Safety summary

What happened

On 24 July 2020, the crew of a Leonardo Helicopters AW139, registered VH-TJO, departed Shellharbour Airport, near Wollongong, New South Wales, with four crew onboard (including a single pilot and aircrew officer). The flight was conducted under the night visual flight rules, with the assistance of night vision goggles, to recover two bushwalkers from the Bungonia National Park, New South Wales.

On arrival at the search and rescue location the helicopter was descended to approximately 240 ft above ground level and reduced speed. The aircraft was then tracked over high ground past the edge of an escarpment, where the terrain dropped away to the valley floor.

During this time an uncommanded, and increasing, rate of descent and lateral drift developed. This was identified by the aircrew officer, with corrective instructions provided to the pilot. During the recovery, the engine power output exceeded airframe limitations, rendering the helicopter temporarily unserviceable.

What the ATSB found

The ATSB identified that the pilot's likely fixation on locating the bushwalkers resulted in them not maintaining an effective scan on the cockpit instruments and outside visual references. This resulted in the loss of hover reference and development of an unintended descent and lateral drift.

In response to the loss of reference, the pilot unsuccessfully attempted to engage the helicopter’s auto hover rather than commence an overshoot. A subsequent focus on selecting the automated mode further delayed the resumption of the scan and recognition of the increasing descent rate.

During the event, air to ground communications between the onboard paramedic and ground party hindered communications between the pilot and aircrew officer.

It was also identified that the external aircraft white lighting was inadequate to clearly illuminate the area below and to the side of the aircraft. This delayed the identification and recovery from the unsafe aircraft state.

Finally, the pilot did not announce losing hover reference, delaying the aircrew officer’s awareness of the developing situation and support to the pilot. As a result, it was estimated the aircraft came within 20 ft of terrain before the descent and drift were arrested.

What has been done as a result

Following this incident, Helicorp Pty Ltd, trading as Toll Helicopters, made several changes to their procedures and equipment aiming to prevent reoccurrence:

• Aircraft external lighting to be upgraded to include a dedicated high-powered search light.
• Sterile cockpit procedures specific to emergency medical services flights, as well as a specific procedure in the event of a loss of hover references have been amended in the company operations manual.
• Additional human factors training with a focus on spatial disorientation, confirmation bias and communication techniques for all flight and medical crew.
• Pre-flight operational risk assessment approval process introduced specifically for all complex night vision imaging system winch activities.

Safety message

Operations at night in low light conditions can be challenging to even the most experienced crews. Low light conditions reduce available visual cues for maintaining aircraft position and undesired aircraft states can develop rapidly. To mitigate these risks, crews conducting night operations in such conditions should maintain adequate references, taking into account equipment limitations such as external lighting, and maintain an effective scan to ensure continual awareness of the position and movement of the helicopter.

This incident also illustrates the importance of an appropriate response if an undesired aircraft state occurs.

The occurrence

At 2000 Eastern Standard Time^[1] on 24 July 2020, a Wollongong‑based emergency helicopter crew commenced their shift at Shellharbour Airport, New South Wales. The on-call crew consisted of the pilot, an aircrew officer (ACO), a paramedic and a doctor.

The first task of the night was to conduct a patient transfer from Bowral to Sydney, in a Leonardo Helicopters AW139, registered VH-TJO. The crew were unable to complete the task due to fog in the vicinity of Bowral so the aircraft returned to base. At approximately 2145, as VH-TJO was being reconfigured post flight, the crew received notification of another task. A pre-flight risk assessment was conducted by the crew and conditions were assessed as suitable for the flight.

This task was to locate, and extract, two bushwalkers from the Bungonia National Park, New South Wales, who were lost and showing signs of dehydration, exhaustion and exposure to the elements. Initial details on the bushwalkers’ conditions were limited, however, when it was suspected one was unresponsive, the helicopter was tasked. The two bushwalkers had separated in an attempt to gain mobile phone reception and raise the alarm, though they remained in the same search area.

The crew had been passed a position of the bushwalkers’ approximate location and were also notified that each of them had a source of white light. The location of the bushwalkers was in the low ground off the edge of an escarpment. The crew conducted a pre‑flight briefing, noting it would be an unlit scene with the moon at less than 20 per cent illumination.

The crew configured the aircraft, with the pilot on night vision goggles^[2] (NVG) in the front right seat and the ACO on NVGs in the rear cabin adjacent to the right door. The paramedic and doctor were also in the rear cabin with the paramedic on NVGs. Lighting in the cockpit and cabin was NVG‑compatible, with two steerable landing lights and a handheld light operated by the ACO that supported the night vision imaging system^[3].

VH-TJO departed the Wollongong base at 2234, transited to the site and arrived over the search area at about 2255 (Figure 1).

Figure 1 - Flight path from Wollongong base to search area and return

Source: Google Earth, annotated by the ATSB

On arrival at the search location the pilot disengaged all the helicopter’s flight director modes (see the section titled VH-TJO) and manually descended the helicopter overhead the escarpment to approximately 240 ft above ground level (AGL). The pilot also reduced the aircraft’s ground speed below 40 kt. They also selected a predominantly northerly approach direction for the initial search, as this provided an assessed headwind component based on the northerly winds experienced during the transit to the location. This approach direction resulted in the helicopter overflying high ground, off the edge of the escarpment and over the valley in the vicinity of the two bushwalkers.

Once below 240 ft, the pilot turned on the right moveable landing light and the crew attempted to identify several features of the area. The crew intended to track the helicopter past a New South Wales National Parks and Wildlife Service helipad then onto the bushwalkers’ location (Figure 2). However, the crew were unable to identify this helipad, but positively identified the area where the rescue services were set up on the ground, as well as Adams Lookout due to vehicle and personnel lights on the ground (Figure 2). This lookout had been mentioned during police communications with the crew in reference to the bushwalkers’ location, which was reported to be near the lookout but in the lower ground off the edge of the escarpment.

Figure 2 - Flight path of helicopter on approach to the incident location

Source: Google Earth, annotated by the ATSB

At 2257 while the aircraft was still over the escarpment, the ground party made an initial radio call to the paramedic in the helicopter (Figure 3). The paramedic responded to the ground party and two-way communication commenced, discussing the bushwalkers. This communication continued throughout the incident.

The helicopter continued forward, at approximately 15 kt ground speed, 84 per cent torque, and with a 9° nose‑up attitude, past the edge of the escarpment. At this stage the pilot was flying with visual reference to the lookout, which was on a spur of high ground to their right. The terrain below the aircraft dropped away into the valley beyond the range of the landing light, however the spur of high ground to the right remained visible. The pilot described the perspective as looking ‘into the black abyss that was … the valley floor.’

At 2258:02 recorded flight data (see the section titled Recorded data) indicated that the nose of the helicopter was raised to approximately 16° nose‑up while engine power was reduced to approximately 78 per cent. The data also recorded a rate of descent increasing past 160 ft/min (Figure 3). The ACO stated that he felt the aircraft had come to a high hover at that point.

Figure 3 - Flight path leading up to incident with time stamps

Source: Google Earth, annotated by the ATSB

At 2258:07 the rate of descent increased above 500 ft/min as the aircraft passed a radio altimeter^[4] (RADALT) height of 304 ft AGL.

At 2258:11 power increased to 91 per cent, however the rate of descent continued to increase, passing 608 ft/min. In addition, a drift to the right commenced.

At 2258:13 both the ACO and the pilot verbalised that they could see a white light source at the bottom of the valley. The light source was in the vicinity of the described location for bushwalker 1.

With the bushwalker sighted, the pilot then looked right in the direction of the lookout and identified that the terrain was no longer visible. The pilot did not verbalise they had lost sight of the lookout.

During that time, the ACO observed the light source of bushwalker 1 disappear behind the nose of the aircraft, however, did not verbalise this to the pilot, or question the apparent movement of the helicopter, due to the ongoing radio communications between the paramedic and the ground party. 

As a result of losing sight of the terrain, the pilot selected the helicopter’s auto-hover function. However, it did not engage, as indicated by the lack of a confirmatory auditory tone. Consequently, the pilot looked inside the cockpit and visually confirmed that the auto hover had not engaged. The pilot then attempted to troubleshoot the failure.

During this time the ACO’s scan moved between the bushwalker’s light and the ridgeline to the right of the aircraft. The aircrew officer identified that the ridgeline was starting to disappear up through their goggles, indicating that the helicopter was descending, and did a quick scan up and down to confirm this.

Air to ground communications continued between the paramedic and the ground party during this time period.

At 2258:15 the ACO called ‘descending, descending’ over the intercom, to which there was no verbal acknowledgement from the pilot. At this point the power was approximately 88 per cent with a rate of descent of 768 ft/min descending through 246 ft AGL.

At 2258:17 the rate of descent reached a maximum of 896 ft/min. Power then increased by 10 per cent and the rate of descent reduced, but the descent and aircraft’s right drift continued.

At 2258:18 the ACO called ‘no further right no further right,’ however the pilot later reported that they only heard part of the transmission. Specifically, the pilot advised only hearing the words ‘right’, which did not align with their situational awareness of the terrain being to the right and so did not make a control input. At that time the rate of descent was approximately 768 ft/min passing through 199 ft AGL.

At 2258:20 Aircrewman called ‘left, left, left, move left.’ The rate of descent was approximately 544 ft/min, passing 159 ft AGL. The pilot responded with a left bank and increased power.

At 2258:23 the rate of descent reached zero and a climb was commenced. The minimum recorded RADALT height was 97 ft AGL. However, due to the positioning of the RADALT antenna towards the nose of the helicopter, and the steep terrain rising behind the tail of the helicopter, this value does not indicate the closest point of terrain to the aircraft. The ACO estimated that the aircraft came within about 20 ft of the terrain to the right of the helicopter.

At 2258:24 the paramedic became aware of the descent and questioned the crew about it.

At 2258:49 the helicopter was established in a steady hover at approximately 285 ft AGL, and the hover mode engaged without issue.

During the recovery the pilot recalled seeing red on the power index, however, they did not recall an exact figure. A red figure on the power index indicated an over torque condition, however there was no visible record of the magnitude of the over torque once the power was reduced. 

The crew conducted three orbits of the area whilst debriefing the incident and decided to end the mission and return to base noting the likely power exceedance. The requirement to return to base was communicated via radio to all relevant authorities involved in the search.

Once back at the base, the aircraft was assessed by maintenance personnel and removed from service due to a torque exceedance.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Night Vision Goggles (NVG): A helmet mounted binocular device that intensifies ambient light, providing flight crew with improved vision at night.
3. Night Vision Imaging System (NVIS): a system of internal and external lighting, combined with night vision goggles, which provides enhanced vision to crew for operation at night. See the section titled Night vision imaging system for further detail.
4. Radio altimeter (also known as a radar altimeter): a device that detects phase shift between a transmitted and a reflected radio signal, to calculate the height of the aircraft from terrain directly below it.

Context

Personnel

Pilot

The pilot had over 20 years of experience flying helicopters, including military aircraft, and held an Airline Transport Pilot (Helicopter) Licence that was issued on 27 August 2017.

The pilot’s logbook showed a total flying experience of 4,676 hours and 322.8 hours using NVGs to the last recorded flight on 24 July 2020. The pilot’s total flying experience on the Leonardo Helicopters AW139 was 735.9 hours. In the previous 90 days, they had flown 45.3 hours on type, and in the previous 30 days the pilot had flown 13.1 hours on type.

The pilot held a valid instrument rating with an expiry date of 28 February 2021. They also held a valid night VFR rating, with an expiry date of 31 July 2021 and a low-level rating, valid until 10 October 2021.

The pilot held a Class 1 aviation medical certificate valid to 19 August 2021 and a Class 2 valid until 2022, with nil restrictions noted.

Aircrew Officer

The Aircrew Officer (ACO) had over 14 years experience crewing helicopters and over 11 years crewing search and rescue (SAR) and emergency medical services (EMS) helicopters. Their total crewing experience was over 2,600 hours.

The ACO was night vision imaging system (NVIS) (see the section titled Night vision imaging system) and winch current, having undergone an NVIS currency check and crewman line check in the previous 12 months.

The operator’s AW139 ACOs all completed a pilot’s ground school course for the aircraft type. The ACO was trained and competent in front seat cockpit duties and rear cabin activities. The ACO was rated as a Level 1 NVG crewmember within the operator’s system. The ACO had over 10 years NVIS experience and was part of the team that first integrated NVIS operations into the New South Wales Ambulance contract with another operator.  

Paramedic and Doctor

The paramedic role included rescue crew officer duties, down‑the‑wire duties and inter-hospital operations. The paramedic and doctor had both undergone the operator‑required Aeromedical Resource Management course, however they were not expected to be involved in the operation of the aircraft.

Aircraft information

General

Leonardo Helicopter’s AW139 is a medium-sized, twin-engine helicopter powered by two Pratt & Whitney PT6C-67C engines. The combined maximum power output of both engines is greater than the main gearbox’s allowable power limit. Therefore, over torque of the transmission can occur when a pilot demands excessive engine power with both engines operative.

VH-TJO

AW 139 serial number 31740 was registered in Australia on 17 August 2017 as VH-TJO, and at the time of the occurrence had flown 1,887.3 hours. The helicopter was certified and maintained for IFR and NVIS operations.

The helicopter was fitted with a 4-axis enhanced flight director (FD) capable of controlling the helicopter’s movement in the pitch, roll, yaw, and vertical axis. The installed version of the FD had additional functions including Hover (HOV) mode and Transition Up (TU) mode.

Auto-hover

HOV mode incorporated two systems to hold the aircraft at a point in space selected by the pilot. The first system controlled the pitch and roll of the aircraft to maintain a zero-ground speed in all directions. The second used the barometric altitude or RADALT information to maintain the altitude or height above ground selected by the pilot.

Aside from the panel-mounted autopilot controller, the pilot could activate both hover systems with the centre of the pitch/roll beep trim selector switch on the cyclic, known as the fifth position of the switch The system could be engaged when the airspeed was below 75 kt, the ground speed below 60 kt and when an operating height was between 15­­–2,000 ft above ground level. Engaging the system instructed the autopilot to make control inputs to bring the aircraft to a hover at the height shown on the RADALT at the time the pilot selected the mode.

The helicopter manufacturer advised that there was no vertical speed limit to engage HOV mode. Though the manufacturer did not intend for HOV mode to be engaged with a high vertical speed, it did not preclude a pilot from doing so. If engaged with a high vertical speed, the system would show as engaged and the autopilot would make adjustments as necessary to attain the height designated by the pilot. If there was a rate of climb or descent present at the time of engagement, this would induce a magnitude of overshoot whilst the system gradually reduced the vertical speed to zero at the selected RADALT height.

Flight crew configuration

Civil Aviation Order 82.6 was in force at the time of this incident and stated that the minimum crew for NVIS operations must not be less than the highest requirement for NVFR, or IFR, specified in either:

• the aircraft’s flight manual
• the operator’s operations manual acceptable to CASA
• Australian civil aviation legislation, including this Order, that applied to the aircraft.

Flight crew configuration for EMS helicopter operations was in accordance with the approved rotorcraft manual.

Supplement 24 of the AW139 rotorcraft manual detailed the minimum flight crew required for night visual flight rules operations as one pilot, unless otherwise required by operating rules.

Supplement 60 of the AW139 rotorcraft flight manual detailed the minimum flight crew required for night vision goggle operations and was to be read in addition to supplement 24 for EMS operations. This supplement allowed for the minimum flight crew to be a single pilot and an additional NVG‑equipped crew member during take-off and landing on unimproved sites to assist with obstacle identification and clearance.

Communications

The communications system onboard the aircraft included five separate radios and the internal communications system (ICS). The ICS consists of five ICS audio control panels. The pilot, ACO and paramedic were all connected to separate ICS panels during the flight. Each ICS panel was set independently of the others, with radio channel selection, channel isolation and volume adjustable at each panel.

During the incident neither the pilot nor ACO had chosen to isolate themselves from the ongoing communication between the paramedic and the ground party on the government radio network (GRN) channel. The pilot stated that they did not isolate the GRN because it was the only radio in use at the time and the ACO stated it was a normal time for the paramedic to be communicating on the GRN and the crew considered the search to be a low workload phase of flight.

When transmitting on any radio, the intercom was muted for that user. In the case of this incident, when the paramedic was transmitting on the GRN, the ACO’s emergency calls over the intercom during the incident would have been muted for the paramedic. It is also possible that the paramedic had prioritised the volume of the GRN over the ICS and other radio channels.

Night vision imaging system

To improve vision during night operations, the helicopter crew utilised a night vision imaging system (NVIS). The operator was experienced in the application of this technology and trained their own crews and offered NVIS training to other operators.

The operator’s NVIS comprised:

• AN/AVS-9 green phosphor Night Vision Goggles (NVG)
• NVG-compatible cockpit and cabin lighting
• ACO‑controlled steerable winch and handheld light
• two pilot‑steerable white landing lights on the underside of the aircraft.

External white lighting

The use of white light was fundamental to the operator’s NVIS usage strategy. VH-TJO was fitted with the standard external AW139 lighting detailed above. The winch light pointed directly downward from the aircraft to illuminate the winch site, with illumination supplemented by the ACO’s handheld light. Low level operations (search and rescue/hover/winching) were conducted by the operator using a combination of references viewed both with and without the NVGs.

The pilot described the landing light as not having a significant range and being ineffective at the height the aircraft was operating at when the incident commenced. 

Several other operators conducting similar night search and rescue, hover and winching operations, had modified their aircraft to include high‑powered search lights and additional external aircraft white lighting.

Meteorological information

Forecast weather conditions

The flight from Wollongong to the search area and return occurred within the Graphical Area Forecast^[5] New South Wales – East (GAF NSW-E). Within the GAF NSW-E there were two subdivisions affecting the flight. The section of the flight to and from Wollongong to the search area was located in subdivision A, and the search portion of the flight was located in subdivision A2. The GAF NSW-E was valid from 2100 to 0300 on 25 July 2020, with forecast conditions including:

• average conditions of greater than 10 km visibility, with broken^[6] stratus cloud 2,000 to 3,000 ft above mean sea level (AMSL) in A2
• 500 m visibility in isolated fog over the land with associated broken stratus 100 – 1,000 ft AMSL.

The Grid Point Wind and Temperature forecasts did not have wind information for 1,000 or 2,000 ft altitudes. The 5,000 ft altitude wind was forecast to be 4 kt from 040°.

Goulburn Airport observations

The Bureau of Meteorology provided the ATSB with METAR^[7] data from Goulburn Airport at the time of the accident. Goulburn Airport was located 26 km to the west of the incident location and was the closest airfield with recorded meteorological observations. For the duration of the flight automatic recordings of weather conditions at Goulburn included wind speeds of less than 2 kt, greater than 10 km visibility and nil cloud detected.

Witnesses

The pilot and crewman of VH-TJO stated that before departure from Wollongong they were given an appreciation of the weather in the search area by the police officers on the ground who reported clear skies with no fog and no cloud. The pilot stated that they encountered those described weather conditions on arrival at the search area. The pilot also noted that it was very dark, with no moon and little cultural lighting in the area.

The pilot described the winds during transit to be approximately 10 – 20 kt from the north and at ground level at Nowra and Wollongong the wind was negligible.

Recorded data

VH-TJO was equipped with a Penny & Giles Aerospace Limited Model D51615-142 solid-state Multi-Purpose Flight Recorder (MPFR). The MPFR recorded up to 600 flight parameters and audio on four separate audio channels. The recorded audio tracks related to pilot, co-pilot and cabin intercommunication system, as well as the cockpit area for the last 120 minutes.

The audio data was not recovered from the MPFR for this incident. However, the recorded flight data information and time stamps from the MPFR have been used for analysis and throughout the report.

The MPFR data was sent to the manufacturer for download and analysis. Leonardo Helicopters produced an analysis report which stated that, while the status of the push buttons to engage HOV mode were not recorded, there was no temporary HOV mode activation before the event. This would have been indicated by the ground speed velocity references being set to zero knots if the HOV mode was successfully engaged.

Leonardo Helicopters also noted that before the event all flight parameters were valid and within the limits for HOV mode engagement. The proper functioning of the system was confirmed when, after the event, the crew were able to successfully activate the HOV mode. It could not be established why the HOV mode did not engage when the pilot first attempted to engage the system.

Also onboard the aircraft was an additional video and audio recording system specifically introduced by the operator as part of the aeromedical fit out for the AW139. It consisted of three cameras, two of which were in the cabin and one fitted to the right-side fuselage below floor level focused downward on the winch site.

The rest of the system consisted of a power control module, an audio mixer and interfaces with the existing aircraft audio panels. Video and audio files were recovered from this system. Audio was recorded from several inputs, however the separate inputs were combined and recorded into one audio file. This file recorded all channels at a nominal volume and was not specific to the settings the crew had on their individual ICS boxes.

Operational information

Operator flight manual

Sterile cockpit procedure

At the time of the incident company procedures for helicopter operations during critical phases of flight included a section for sterile cockpit procedures. Part of these procedures allowed for conversation during sterile cockpit environment when it was specific to the phase of flight concerned.

The Toll fitted audio recording system was used to confirm the focus of the air to ground communications during the incident and confirmed that the paramedic and ground party were focused on locating the bushwalkers, which directly related to the current phase of flight.

Lost visual references procedure

The operator’s procedures included guidance for actions in the event of inadvertent instrument meteorological conditions, loss of visual reference such as brownout or white out and attitude upset situations.

Recovery procedures from loss of visual references are designed to minimise the likelihood of an aircraft striking obstacles. The procedure was to be initiated by any crewmember that lost visual references calling ‘lost reference’ immediately. The pilot flying was then to commence a restricted visibility take-off profile, using the available visual and instrument attitude and rate of movement cues.

In discussing this procedure with the pilot after the incident, the pilot indicated that in this incident their first reaction was to go for the HOV mode. However, they also stated that, in hindsight, they should have conducted an overshoot.

Related Occurrence

AO-2018-039

On the evening of 13 May 2018, the crew of a Leonardo Helicopters AW139, registered VH-YHF, departed Darwin, Northern Territory, to search for an activated emergency position-indicating radio beacon (EPIRB). The crew flew under night visual flight rules with support of an NVIS.

During an approach to a potential EPIRB target, the pilot lost visual references and engaged HOV mode with a high rate of descent. Due to the additional lighting installed on the aircraft, the ACO could see the ground below and provided corrective actions to the pilot. The pilot regained control with a rehearsed emergency recovery drill. During the recovery procedure, the applied engine power exceeded the airframe limitations.

__________

5. Graphical Area Forecast (GAF) provides information on weather, cloud, visibility, icing, turbulence and freezing level in a graphical layout with supporting text. These are produced for 10 areas across Australia, broadly State-based.
6. Broken cloud cover indicates that more than half to almost all of the sky is covered with cloud
7. METAR: A meteorological report for an aerodrome issued at a routine time (half hourly) when conditions are better than specified thresholds.

Safety analysis

The occurrence

During the visual search phase of the flight an unidentified rate of descent and lateral drift commenced. This was likely due to the pilot’s scan focusing largely outside the cockpit in search of the bushwalkers rather than on the cockpit instruments and the ridgeline to the right of the helicopter.

Detection of the uncommanded movement was hampered by limitations with the aircraft’s external lighting. Specifically, at the operating height the external aircraft white lighting was inadequate to illuminate the terrain below the aircraft, resulting in the pilot not identifying the developing rate of descent while searching for the bushwalkers. While the pilot had been using a terrain reference to the right of the aircraft during the initial part of the search, no other terrain was illuminated by the landing lights.

After the pilot and ACO visually identified the bushwalker, the pilot looked back to the three o’clock for the hover reference, but it was no longer in the pilot’s field of view. This was a result of the helicopter’s continued forward movement while the crew were focused on locating the bushwalkers. As the external aircraft lighting did not illuminate the terrain below the aircraft the pilot had no other visual hover references. As a result, the pilot attempted to engage the automated hover mode rather that commence an overshoot. Had the pilot commenced an overshoot when visual references were lost, the severity of this incident would probably have been reduced.

When the auto hover failed to engage the pilot focused their attention on trying to rectify the issue. During this time the rate of descent increased, and drift continued unnoticed until recognised and announced by the ACO.

Communications

The pilot did not announce losing references during this incident. Had this been verbalised to the crew, the ACO would have focused their attention solely on assisting the pilot to maintain aircraft position. This likely would have resulted in the rate of descent being identified earlier and reduced the recovery time. That said, given how close the helicopter came to the terrain during the recovery manoeuvre, the ACO’s detection and response to the situation probably prevented the helicopter colliding with terrain.

Throughout the incident there was continual communications between the onboard paramedic and the ground crew. Despite that, neither the pilot or ACO isolated the air to ground radio channel. This was primarily because all other radios were quiet, and the crew did not feel they were in a high workload phase of flight.

When the ACO identified the light source of bushwalker 1 disappear behind the nose of the aircraft, this was likely their first identification of the helicopter developing the drift and descent which led to the unsafe aircraft state. However, due to the ongoing communications between the paramedic and ground party the ACO did not verbalise this to the pilot and confirm the pilot’s intentions. Had there been no other communications at the time, the ACO would have verbalised the observed movement and it is likely that the pilot would have responded and recovered the descent and drift sooner than otherwise occurred.

The sterile cockpit company procedures at the time did not prevent the paramedic speaking to the ground party during this phase of flight. While it could not be established exactly why the pilot did not clearly hear all communications from the crewman, the continual air to ground communications may have hindered the communication between the pilot and the ACO once the undesired aircraft state had developed, possibly delaying the recovery further.

Findings

From the evidence available, the following findings are made with respect to the near collision with terrain, VH-TJO, that occurred 26 km east of Goulburn Airport on 24 July 2020.

Contributing factors

• It is likely that the pilot's fixation on locating the bushwalkers resulted in them not maintaining an effective scan. This resulted in the loss of hover reference and development of an unintended descent and lateral drift.
• During the incident, air to ground communications between the paramedic and ground party hindered communications between the pilot and aircrew officer. This inhibited the aircrew officer's ability to verify with the pilot whether the observed initial movement was intentional, preventing recovery from the initial drift and descent.
• In response to the loss of hover reference, the pilot unsuccessfully attempted to engage auto hover rather than commence an overshoot. Subsequent focus on selecting the automated mode further delayed the resumption of the scan and recognition of the increasing descent rate.
• The external aircraft white lighting was inadequate to effectively illuminate the area below and to the side of the aircraft. This delayed the identification and recovery from the unsafe aircraft state. (Safety issue)
• The pilot did not announce losing hover reference, delaying the aircrew officer’s awareness of the developing situation and support to the pilot. As a result, it was estimated the aircraft came within 20 ft of terrain before the descent and drift were arrested.

Other findings

• The aircrew officer's detection of the undesired aircraft state and response probably prevented the helicopter colliding with terrain.

Safety issues and actions

External aircraft white lighting

Safety Issue number: AO-2020-038-SI-01

Safety issue description: The external aircraft white lighting was inadequate to illuminate the terrain below and to the side of the aircraft at the required operating height., This delayed the identification and recovery from the unsafe aircraft state resulting in the pilot not identifying the developing rate of descent during the incident, delaying the recovery from the descent.

Additional safety action by Helicorp Pty Ltd

Helicorp Pty Ltd advised they have taken the following proactive safety action in response to this occurrence:

• Sterile cockpit procedures have been amended and specifically introduced into the helicopter emergency medical services volume of the company operations manual. The procedures include a minimum height and speed above which the aircraft needs to be for general discussions between the crew to occur and for when air to ground radio communications are permitted. In addition, prior approval should be sought before the paramedic transmits on role radios. If the PIC approves the transmission, flight crew are to isolate role radios.
• A new procedure has been introduced into the operations manual clarifying that hovering is a visual manoeuvre that requires adequate references to maintain position. It also details the actions required if, upon termination of an approach, adequate hover references are not available.
• Additional human factors training with a focus on spatial disorientation, confirmation bias and communication techniques, including silent cockpit adherence has been introduced for all flight crew and medical crew.
• Pre-flight Operational Risk Assessment process has been amended to include a specific mission oversight approval process for all NVIS complex winch activities.
• Additional NVIS training program was introduced, including initial complex winch training. Additional NVIS winching flights were also added after a subsequent occurrence.
• Additional procedures for the use of auto-hover were introduced.

Glossary

ACO                 Aircrew officer  

AGL                 Above ground level

CASA               Civil Aviation Safety Authority

EMS                 Emergency medical services

EST                  Eastern standard time

FD                   Flight director

GAF                 Graphical area forecast

GRN                Government radio network

HOV                 Hover mode

ICS                  Internal communications system

MPFR              Multi-purpose flight recorder

NVG                 Night vision goggles

NVIS                Night vision imaging system

RADALT           Radio altimeter

SAR                 Search and rescue

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the helicopter crew
• Helicorp Pty Ltd
• Civil Aviation Safety Authority
• Leonardo Helicopters
• video footage of the incident flight from internal cameras
• recorded data from the multi-purpose flight recorder onboard the aircraft
• Bureau of Meteorology

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the helicopter crew
• Helicorp Pty Ltd
• Civil Aviation Safety Authority
• Leonardo Helicopters
• Bureau of Meteorology

Submissions were received from:

• the helicopter pilot
• Helicorp Pty Ltd
• Civil Aviation Safety Authority

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 26 July 2020, a Cessna 402C, registered VH-TSI, collided with terrain during a rejected take-off from an uncommissioned airfield near Papa-Lealea, about 16 NM north-west of Port Moresby, Papua New Guinea. The aircraft was substantially damaged and the pilot (the only occupant) sustained minor injuries.

The Papua New Guinea Accident Investigation Commission (AIC) investigated the accident. During its investigation, the AIC requested assistance from the Australian Transport Safety Bureau (ATSB).

To facilitate this work, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

On 31 December 2020, the AIC released the final investigation report into this accident. Accordingly, the ATSB has concluded its involvement in the investigation.

Any enquires relating to the investigation should be directed to the Papua New Guinea Accident Investigation Commission at www.aic.gov.pg.

Safety summary

What happened

On 31 July 2020, the pilot of a Robinson R44 Raven I helicopter, registered VH-HNF and operated by Riverina Helicopters, was conducting aerial weed spraying at Steam Plains, 69 km south-east of Hay Airport, New South Wales.

During the fifth spray load of the morning, the pilot turned the spray off and conducted a climb to clear a stand of trees. At 1057 Eastern Standard Time, as the helicopter descended to continue spraying, the top of the left skid struck a powerline that crossed the flight path.

The helicopter entered uncontrolled flight and collided with terrain about 120 m beyond where it struck the wire, resulting in fatal injuries to the pilot. The helicopter was substantially damaged.

What the ATSB found

The ATSB found that the pilot knew the wire existed and overflew a small section of the target area earlier that morning but did not conduct an aerial inspection to identify hazards and verify the location of the powerline on the accident flight. Without the aerial hazard check, the pilot was reliant on seeing the wire during the flight but was unable to do so in time to avoid the wirestrike.

The pilot's injuries were consistent with flailing due to the left-side impact, but it could not be determined whether the pilot slipped out of, or was not wearing, the shoulder sash portion of the 3-point harness.

Although the pilot was wearing a helmet, it did not attenuate the impact to survivable levels. Either the impact forces exceeded the helmet design specifications, or the helmet was not fitted, worn or maintained correctly.

The pilot was not effectively managing severe obstructive sleep apnoea, which has been shown can cause impairments in cognitive functions including attention and short-term memory and increased the risk of the pilot suffering the effects of fatigue. It could not be determined whether the pilot was experiencing any impairments associated with the condition. The condition had also not been disclosed to the Civil Aviation Safety Authority, which prevented oversight of any ongoing safety risk associated with the condition.

What has been done as a result

The ATSB has released a safety advisory notice to strongly encourage pilots conducting low-level operations to wear a flight helmet, ensuring that it is:

• fit for purpose
• custom fitted to the pilot’s head
• properly secured by using the chin strap
• maintained in accordance with the manufacturer’s instructions.

Safety message

The risk of wirestrike in low-level operations is well-documented. Uncontrolled flight often follows a wirestrike, which increases the risk of serious and fatal injuries. For pilots conducting low-level operations, pre-flight identification of hazards is essential. As more up-to-date mapping and powerlines data is made available, and more wires carry visible markers, pilots have improved access to tools for planning and strike prevention. The ATSB encourages landowners who engage pilots to conduct aerial application operations to mark powerlines that may pose a hazard.  

However, only by conducting an aerial inspection at a safe height, can the pilot be assured of the location of hazards.

Although planning for hazard avoidance is key, pilot limitations remain, including the ability to see a wire or obstacle, attention, memory and distraction. In these situations, survivability features including 4-point pilot seat restraints and flight helmets, significantly improve survivability of helicopter accidents and should be used. It is also important to remember that a helmet will only meet its design specifications if it is fitted properly, worn correctly and maintained in accordance with manufacturer’s instructions.

Common symptoms of obstructive sleep apnoea (OSA) include snoring, excessive daytime sleepiness and poor concentration. It can also have complex and significant physiological, neurological, cognitive and psychological impacts, and increases the risk of accidents. The Civil Aviation Safety Authority’s Obstructive sleep apnoea and aviation safety fact sheet advises pilots who have symptoms of OSA or suspect they may have it, to see a general practitioner. A diagnosis of OSA must be reviewed by a Designated Aviation Medical Examiner.

Summary video

The occurrence

What happened

On 31 July 2020, the pilot of a Robinson R44 Raven I helicopter, registered VH-HNF and operated by Riverina Helicopters, was preparing to conduct aerial weed spraying along a perimeter fence and adjacent track at Steam Plains Station, 69 km south-east of Hay Airport, New South Wales.

At 0911 Eastern Standard Time,^[1] the pilot ferried the helicopter from the station airstrip to the loading site, where the loading truck was positioned. The Riverina Helicopters’ chief pilot was performing the role of loader for the day, transferring chemical from the truck into the helicopter’s spray tank.

Prior to loading the helicopter with chemical for the first load, the loader briefed with the pilot. The briefing included a review of the day’s task, the map of the property and hazards associated with the operation. The identified hazards included a 19.1 kV single wire earth return powerline, which crossed the perimeter fence line once in the target area. The powerline had been identified as a hazard and highlighted on the pilot’s map during initial planning with the station manager 2 days prior.

After loading at 0931, recorded GPS data indicated the pilot flew the helicopter to the property boundary to spray the track adjacent to the fence line, operating 2.5 to 5 m above the ground, before returning to the loader. The pilot sprayed four loads over a 76-minute period and departed with the fifth load at 1047 (Figure 1).

The GPS data showed that the pilot flew the helicopter to the fence line and began spraying the fifth load. About 370 m before reaching the position where the previously-identified powerline crossed the fence, the pilot turned the spray off and manoeuvred the helicopter to climb over an area of trees 12 to 15 m high. At the end of the treed area, the helicopter descended, likely to recommence spraying. During the descent, the helicopter struck the powerline. The electricity provider reported that the fault to the powerline occurred at 1057. This was consistent with the time of the last recorded GPS position of the helicopter, about 300 m prior to the powerline.

The helicopter subsequently collided with terrain about 120 m beyond the powerline, resulting in fatal injuries to the pilot. The helicopter sustained substantial damage.

Post-accident actions

At 1140, the loader contacted the station manager and reported the helicopter overdue from the last load. Aware that the helicopter was operating in the vicinity of the powerline, the station manager drove to the accident site, advised the loader of the accident, and called emergency services. The station manager advised the emergency services call operator that the powerline was coiled over the fence and the helicopter, and requested the power be switched off as a priority. From a distance, the station manager assessed that the pilot was breathing but unconscious.

The emergency services operator advised Essential Energy and the system controller isolated that section of the electrical network. Field workers were dispatched to check power to the area had been effectively isolated and to ensure it was safe prior to first responders accessing the site.

Police and ambulance crews arrived on the scene and about 1 hour later, the Essential Energy workers arrived and tested the wires to verify they were not live. The pilot was then extricated from the helicopter and airlifted to hospital, where they remained on life support until the morning of 3 August.

Figure 1: VH-HNF flight path for fifth spray load

Source: Google Earth and GPS data, annotated by the ATSB

__________

1.  Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.

Context

Pilot information

Qualifications and experience

The pilot held a Commercial Pilot Licence (Helicopter) and a Private Pilot Licence (Aeroplane) issued under Civil Aviation Safety Regulations Part 61 on 10 February 2015, granted on the basis of Civil Aviation Regulations Part 5 licences issued in 2010. The pilot held the following helicopter ratings: single engine class, aerial application, low level, sling and aerial mustering.

The pilot’s Class 1 Medical Certificate was valid to 27 August 2020. At the pilot’s last medical examination with a Civil Aviation Safety Authority (CASA) Designated Aviation Medical Examiner in August 2019, no issues were raised by the pilot or apparent to the doctor. Following issue of the medical certificate, there was no further communication between CASA and the pilot.   

The pilot was inducted into Riverina Helicopters in July 2015 with about 2,000 hours of aeronautical experience, 1,600 of which was in Robinson R22, and 30 was in R44 helicopters.

The pilot’s Aerial Application Association of Australia (AAAA) Spraysafe accreditation was current and in June 2019, the pilot had successfully completed the association’s Crew resource management, hazards and human factors course. In August 2019, the pilot had completed an annual CASA flight review/proficiency check.

On 27 May 2020, the chief pilot of Riverina Helicopters conducted an (annual) agricultural pilot and air work proficiency check and assessed the pilot ‘competent to carry out Agricultural and Aerial Work operations for Riverina Helicopters’. According to the pilot’s logbook, as of that date the pilot had accrued 3,730.3 hours of aeronautical experience and there were no further entries. 

72-hour history

On 29 July, the pilot had left Griffith at about 0700 and driven the loading truck 1.5 hours to the Steam Plains property. That day, the pilot had been performing the loader duties (not flying) from 1138 to 1715. The pilot and chief pilot had stayed in accommodation at the property for the next 2 nights, going to sleep at about 2130 each night.

On 30 July, the pilot woke up at 0700 and conducted the daily inspection on the helicopter. The pilot started the helicopter at 0917 and commenced spraying operations at 0925 on the neighbouring property, finishing there at 1413. The loader then relocated the vehicle, and the pilot ferried the helicopter to Steam Plains, commencing spraying operations there at 1501. The pilot finished the day’s work and shut down the helicopter at 1743.

On the morning of the accident flight, the chief pilot reported that they had woken up at about 0700 and there had been no hurry in getting started as there was dew and they had to wait for the vegetation to dry before spraying.

Obstructive sleep apnoea

On 23 January 2020, the pilot attended a sleep clinic and completed a sleep study. On referral, the pilot had a STOP-Bang score^[2] hat indicated a high risk of obstructive sleep apnoea (OSA) and an Epworth Sleepiness Scale^[3] score in the higher normal range for daytime sleepiness. At that time, the pilot’s only reported symptom was loud snoring. The resulting polysomnography report identified fragmented sleep with oxygen saturation reducing to a minimum of 81 per cent. The diagnosis was severe OSA, with accompanying moderate oxygen desaturations.

The diagnosis of OSA is made when repetitive pauses in breathing occur during sleep, last at least 10 seconds, and occur due to the airway collapsing. These pauses reduce blood oxygen levels and lead to awakening or shifting into a lighter sleep.

The severity of OSA is based on the number of partial or complete pauses in breathing per hour. Severe OSA is defined as more than 30 events per hour. The pilot recorded 42.5 events per hour on average during the study. In response, the reviewing specialist recommended an urgent trial of a continuous positive airway pressure (CPAP) machine. A CPAP machine provides pressurised air, which opens the airway to ensure adequate delivery of oxygen. However, it does not cure OSA and compliance is a known limitation with CPAP treatment (Caldwell 2006).

CASA’s Obstructive sleep apnoea and aviation safety fact sheet stated that a CPAP should be used at least 5 hours per night for 6 nights per week and ‘must be used during the sleep period just prior to flight’. CASA may issue or reissue medical certification where compliance and effectiveness of CPAP treatment can be used to demonstrate control of OSA.

The ATSB obtained a detailed compliance report of sleep data automatically uploaded from the pilot’s CPAP machine. Between 21 February and 16 July 2020, the pilot had used the CPAP machine for at least 4 hours on 71 per cent of nights. The pilot’s CPAP usage had been frequent in March and April, then decreased. The CPAP had not been used between 8 and 15 July and the last recorded use was 16 July, 15 days prior to the occurrence flight. The pilot had not taken the CPAP machine to the accommodation at Steam Plains.

The effects of sleep apnoea on aviation outlined in the CASA fact sheet included reduced attention and concentration, and degraded cognition.

Fatigue risk

The US Federal Aviation Administration (FAA) pilot safety brochure Fatigue in aviation stated that typically fatigue ‘occurs with someone who does not get sufficient sleep over a prolonged period of time (as with sleep apnoea, jet lag, or shift work) or someone who is involved in ongoing physical or mental activity with insufficient rest’. It further stated:

Any fatigued person will exhibit the same problems: sleepiness, difficulty concentrating, apathy, feeling of isolation, annoyance, increased reaction time to stimulus, slowing of higher-level mental functioning, decreased vigilance, memory problems, task fixation, and increased errors while performing tasks.

Research has also found that sleep deprivation can impair decision making and increase risk-taking behaviour to avoid additional effort (Shingedecker and Holding 1974 as cited in Battelle Memorial Institute 1998; Harrison and Horne 2000; Killgore and others 2006). If a person has 20 or more apnoeas per hour, both health and daytime alertness will suffer (Caldwell 2006). When present, excessive daytime sleepiness is inversely correlated with vigilance, but not all people with OSA display excessive daytime sleepiness (Seda and Han 2020).

Circadian rhythms are the body’s internal clock that regulates the sleep-wake cycle and repeats roughly every 24 hours. An individual’s alertness, sleep tendency and human error have been shown to follow this 24-hour pattern (CASA 2016). According to the International Civil Aviation Organization’s Fatigue management guide for airline operators (ICAO 2015), there are two times of peak sleepiness within 24-hour cycle. The main peak is in the early morning between 0300-0500 known as the window of circadian low, another smaller peak is around 1500-1700 known as the afternoon nap window. During the afternoon nap window, someone who has had restricted or disturbed sleep can find it harder to stay awake.

Other factors that can increase the fatigue risk level include early shift start times (before 0600), when regular breaks have not been taken, and when shifts are longer than 8 hours (CASA 2012). Twenty per cent of accidents where fatigue was attributed were in the 10th or more hour of duty (Goode 2003).

Effects of sleep apnoea

Sleep apnoea can have significant physiological, neurological, cognitive and psychological impacts, and can affect multiple cognitive domains (Seda and Han, 2020). Several studies have shown that OSA has an adverse effect on inductive and deductive reasoning, attention, vigilance, learning, and memory (Lal and others 2012). These impairments are measurable in neurological and cognitive assessments, but they may not be readily evident during flying operations or medical examinations. Deficits in neurocognitive functioning have been shown to occur with a high frequency in OSA sufferers, but the exact prevalence is unknown.

Investigation findings regarding sleep apnoea

A search of the US National Transportation Safety Board database revealed 29 aviation accidents between 1997 and 2019 with ‘sleep apnea’ included in the analysis text, with 9 accidents where it was concluded that OSA had some contribution.

There were 8 accidents in which a pilot had OSA, and the OSA itself or in combination with other diseases and medications contributed to the accident. A further accident involved a fuel truck driver with OSA who fell asleep, and the truck collided with an aircraft.

In one investigation there was no evidence that the pilot suffered sleep apnoea, in another it was unlikely that the pilot’s effectively treated OSA contributed to the accident. For the other 17, the pilot either had, or was at risk of, OSA but it could not be determined whether the pilot was suffering from any effects of OSA and/or whether these contributed to the accident.

The Transportation Safety Board of Canada published a list of all their investigations with fatigue‑related findings from 1990 to 2018. One of 34 aviation occurrences where fatigue was listed as a causal or contributory factor or a source of risk, mentioned OSA. Following diagnosis of OSA and initial effective CPAP treatment, the pilot subsequently rarely used CPAP therapy. The investigation found that although the pilot was therefore at risk of fatigue, there was no indication that fatigue contributed to the occurrence.   

One ATSB investigation report into a fatal accident involving a collision with terrain during landing practice in a solo training flight (AO-2016-112) identified that the pilot had ‘a history of health and chronic pain issues including sleep apnoea’. The investigation found that:

Fatigue and level of experience likely affected the pilot's ability to respond to the demands required to correct the aircraft's departure from controlled flight during the landing attempt and subsequent go‑around.

Post-mortem and toxicology results

The post-mortem report documented multiple impact-related injuries, including spinal fractures, with the cause of death identified as severe traumatic head injury. This was as a result of diffuse cerebral injuries, while only relatively superficial contact injuries to the head were noted. These included bruising consistent with a left-side impact to the head. There was also bruising consistent with the pilot being restrained during the accident by the lap belt, but not from the accompanying shoulder sash.

The only substance identified in toxicological examination was almost certainly administered by emergency/hospital personnel.  

Aircraft information

VH-HNF was a Robinson Helicopter Company R44 Raven I helicopter, powered by a six-cylinder Lycoming O-540-F1B5 engine, manufactured in 2018 and first registered in Australia in April 2018.

The helicopter’s current maintenance release was issued on 21 January 2020 and was valid for 12 months or 100 hours, whichever occurred sooner. A 50-hourly inspection had been conducted on 26 March 2020, at 353.8 hours, and no defects were recorded on the maintenance release. Prior to the commencement of flying on 31 July 2020, the aircraft had accrued 388.5 hours total time in service.

The helicopter was fitted with a Helipod III Agricultural Spray System, which included a single fibreglass belly tank attached to the landing gear and a spray boom and nozzle arrangement located towards the front of the helicopter. Pilot control of the system was via a cyclic-mounted switch. For the system fitted, the maximum chemical tank load was 285 L or 285 kg. With the Helipod system installed, the helicopter was to be operated in the Restricted category and in accordance with a special certificate of airworthiness.

The exact quantity of fuel and chemical on board at the time of the accident was unable to be determined. However, the helicopter would have been within the weight and balance limitations through the range of empty to full fuel and spray tanks.

The R44 helicopter was not fitted with wirestrike protection. The most common aircraft-mounted wirestrike protection systems (WSPS) are passive and comprise deflectors to guide a struck wire to a fixed wire cutter consisting of sharpened blades. They are designed to reduce the likelihood of adverse outcomes resulting from a wirestrike, including entanglement, damage to flight controls, the airframe and injuries to occupants. To be effective, the system relies on the wire entering the cutter with sufficient force and at a suitable angle to cut it.  ATSB research report Wire-strike accidents in general aviation: Data analysis 1994 to 2004 stated that smaller rotary-wing aircraft including Robinson (R22 and R44) helicopters ‘generally have no structural hard points to fit a WSPS and are generally too light and, in many instances, travel too slowly for WSPS to be effective’.

Meteorological information

Witness reports indicated the weather was fine and sunny with calm to mild winds. Bureau of Meteorology observations at 1100, from the nearest recorded weather stations, indicated the temperature was between 10 °C and 12 °C and the wind 0 to 4 kt.

Site and wreckage examination

Powerline

The 19.1 kV single wire earth return powerline spanned 305 m and was supported by two power poles, one located 144 m north-west and the other 161 m south-east of the fence. It crossed the fence line at a gate. Between the poles, the wire drooped parabolically from about 10 m at the pole to 6 m mid span when new but had likely stretched due to its age and was therefore about 5 m above the ground mid span, where it was struck. The wire was pulled off several poles and broken in two places.

The powerline was not marked and was not required to be, according to Australian Standards 3891.1 and 3891.2.^[4] Following a wirestrike of a powerline owned by Essential Energy, field workers assess the risk of another strike. If it is considered likely, at least one aerial marker (Figure 2) is fitted to the wire. It was assessed at the time that a subsequent wirestrike was unlikely to occur due to the remoteness of the location and because the helicopter was spraying weeds along the perimeter fence rather than crop spraying. As a result, no markers were fitted to the wire when it was restrung or subsequently.

Figure 2: Example of a wire aerial marker

Source: Balmoral Engineering

Accident site

The accident site was in flat, open farmland, about 7 km north-east of the loading vehicle. The main fuselage was located about 120 m beyond the powerline, in the direction of travel.

Wire abrasion marks were evident down the front of the forward left strut and along the top of the left skid, ending with a distinct friction mark near the tip of the skid (Figure 3). The powerline remained entangled in the wreckage.

Examination of the ground scars, damage and distribution of the wreckage indicated:

• the main rotor had impacted the tail boom during the accident sequence, resulting in loss of control of the helicopter
• the helicopter collided with the ground on its left side in a nose-down attitude of about 30°
• the main rotor blade and landing gear dug into the ground, resulting in the helicopter bouncing, rotating about 180°, and coming to rest on the right side.

Figure 3: Wire marks on VH-HNF’s left skid

Source: ATSB

The ATSB examined the helicopter and did not identify any evidence of in-flight breakup, birdstrike, or pre-existing defects that may have contributed to the wirestrike. Consistent with normal agricultural operations, the pilot door was not fitted at the time of the accident. Significant structural deformation of the helicopter’s left front quarter and seat was consistent with a heavy impact on that side, to the extent that there was no occupiable space for the front left seat. On the right (pilot’s) side, there was crushing of the seat lower box section (as designed, to absorb vertical impact loads) and some right-side roof deformation, associated with the left-front impact. Although compromised, occupiable space on the right side of the fuselage remained.

There were no issues identified with the flight controls, and examination of the engine found no anomalies that would have affected the engine’s performance. Evidence that the main rotor was being driven under power included that one of the main rotor blades showed significant chordwise bending and, from the other blade, a section of blade tip, measuring 850 mm and weighing 5.3 kg had fractured as a result of ground impact and was thrown approximately 300 m from the accident site.

The loader had recorded uplift of 40 L of Avgas prior to the start of the fifth load. A large quantity of fuel remained in the left fuel tank, and testing indicated no evidence of water or contaminants. There was no post-impact fire.

The chemical holding tank had been compromised and no visible herbicide remained, but a strong odour indicated that a quantity had leaked and soaked into the ground where the aircraft had come to rest. The pilot-controlled spray switch was in the on position.

Operational information

Helicopter operator

Riverina Rotor Work, trading as Riverina Helicopters, was the registered owner and operator of VH-HNF. Riverina Helicopters held a CASA-issued Air Operator’s Certificate to conduct aerial work and aircraft charter operations. Of relevance to this occurrence, the Riverina Helicopters Operations Manual included:

Specialised operations [including aerial spraying]

Protective helmets shall be worn for all specialised operations.

Low level operations

Before descending to conduct low level operations, the pilot in command shall conduct a reconnaissance of the area and identify the hazards noted from the study of the charts and to make a note of other hazards not indicated on the charts.

Agricultural operations – helicopters

The Company shall be responsible for supplying pilots with up-to-date maps and charts of the various treatment areas, clearly displaying all hazards associated with those areas. However, prior to the commencement of operations, the pilot in command shall become familiar with the task by personal inspection and briefing by drawing a ‘field map’ of each area to be treated. Pilots should be aware that any locally supplied information is often incorrect but it does at least provide a guide and can be verified during aerial inspection of the area. A copy of the applicable field map(s) should be taken by the pilot on each sortie…agricultural pilots are required to carry out a preliminary aerial inspection of the area to be treated including the adjacent manoeuvring areas in all directions, paying particular attention to the location of obstructions including those, if any, outside the actual treatment area.

In addition, the operator’s Management System procedure – Conduct an application, included that:

The pilot will conduct a pre-application aerial inspection of the target ensuring that they have confirmed the following with their work order:

iii.   Power Lines, Towers, Aerials, moisture probes & other obstacles are located and identified.

Steam Plains task

The station manager had previously engaged Riverina Helicopters for aerial work in 2010, 2012, 2016 and March 2020. Commencing on 29 July 2020, the station manager had contracted Riverina Helicopters to spray weeds along the fence and adjacent track at Steam Plains and a neighbouring property as a firebreak. The pilot conducted the same task during the 2016 engagement.

Pre-flight planning

On the morning of 29 July (day 1 of the 3-day task), the chief pilot was delayed leaving Griffith in the helicopter due to fog. The pilot drove the loading truck and the station manager reported that it arrived at about 0800. The station manager met the pilot at the truck and gave the pilot a briefing of the task. This briefing included discussing the chemicals that would be used for spraying, the application rate of the chemicals, areas to be sprayed, flight path and hazards. The station manager provided the pilot with maps of Steam Plains and the adjacent property. The maps had been provided to the property owner on purchase in 2008, at which time the property owner had assessed by ground vehicle that the markings on the maps appeared to be correct. 

The spray application path had been drawn on the map in red marker pen by the station manager. Using the map, the station manager briefed the pilot about the location of crops, stock and people working in the area. The pilot used a blue pen to over-mark the powerlines (Figure 4). When the chief pilot arrived later that morning, the pilot passed on the details from the briefing, including the powerlines.

The station manager met with the pilot and chief pilot on the morning of 31 July, at about 0650. They discussed the day’s plan including reviewing the map. Before commencing operations, the pilot and chief pilot briefed on the day’s operation again, including the task, map and powerline location.

Prior to the fifth (accident) load, the pilot fuelled the helicopter and discussed with the chief pilot the shape of the boundary fence to be sprayed on the next sortie and the location of the powerline.

Figure 4: Map of Steam Plains Station showing spray path (red) and powerline (blue)

Source: Station owner, marked by the station manager and pilot, and annotated by the ATSB

Mapped powerline location

Figure 5 shows a comparison between the powerline marked on the pilot’s map and its actual location taken from Essential Energy’s Look-up-and-live app. On the pilot’s map (left image), the powerline is depicted close to the fence corner and beyond the (marked) gate. The powerline’s actual location was exactly overhead the gate and about 300 m further west of the fence corner than depicted on the pilot’s map.

In addition to the commentary in the Riverina Helicopters Operations Manual about the possibility of incorrect locally-supplied information, training also emphasised possible inaccuracies. The instructor who conducted the pilot’s annual flight review and proficiency check in 2019 commented that pilots are trained to expect that planning information may be inaccurate, and reinforced the importance of verifying it by conducting an aerial inspection.

Figure 5: Map location compared with actual powerline location

Source: Helicopter operator, Google earth and Essential Energy, annotated by the ATSB

Spraying procedures

The AAAA Aerial Application Pilots Manual (AAAA 2011:166) advised that:

all application pilots should be trained to carry out an extra “wind and wires” check before commencing each run, to refresh short-term memory and refocus on any wires.

When spraying a crop or paddock, hazards in the whole area are identified before spraying and the hazards then generally remain fixed. However, the operator reported that, to retain identified hazards in working memory when spraying along a fence line on a large property, a pilot may conduct an aerial reconnaissance of a section of the target spray path before spraying that section, then repeat as the helicopter progresses along the fence line. 

In addition, the AAAA Aerial Application Pilots Manual (AAAA 2011:151) stated:

Recollection of precise locations of power lines based on the [application management plan] AMP and a confirming aerial survey is critical to safe application. High situational awareness and an accurate mental map of the treatment area must remain front of mind for the pilot throughout the application…The aerial inspection is the last chance for the pilot to build defences and manage risk.

Aerial inspection and GPS data

Two GPS systems recorded data from the helicopter for the accident flight: Spidertracks and TracMap. Spidertracks data was recorded at 2-minute intervals. The TracMap GPS data associated with the spraying system included speed, altitude and whether the spray system was on or off. Due to buffering from incomplete shutdown associated with the collision, the last TracMap data that was recorded was above the trees with the spray off, before the helicopter descended and about 300 m before it struck the wire.

The TracMap data was compared for the 3 days of the task.

On the first day, the chief pilot reported conducting short inspection flights in the target area ahead, then spraying that section with a good understanding of the hazards present. This was evident in the GPS data for the day, where most tracks were flown twice – once 50 to 100 ft higher with the spray off, then from a lower height with the spray on. Where the intended spray path was along or across a powerline, the helicopter tracked to the wire with the spray off before descending and commencing spraying.

On the day prior to the accident, the pilot was operating on the property neighbouring Steam Plains and the chief pilot was performing loader duties. The GPS data showed that on that day, the helicopter had overflown a powerline several times, including before descending to spray along the wire and perpendicular to it. This was consistent with what the chief pilot observed when the helicopter was operating in sight of the loading truck – short inspection flights conducted before spraying.

On the accident day, the GPS data showed only one small segment of the southern perimeter was flown twice – at the end of the first and start of the second loads. There was no further duplication of any of the tracks and no aerial inspection conducted. The helicopter had not overflown the powerline before the wirestrike.

Previous wirestrike

In 2018, the pilot was operating a helicopter that struck a powerline during spraying operations. The pilot conducted an aerial inspection prior to commencing the task and was aware of the powerline. However, a moisture probe that stood above the crop canopy momentarily distracted the pilot’s awareness of the powerline.

The day after that occurrence, the chief pilot had a debrief with the pilot and recalled discussing the sequence of events leading up to the accident, the wirestrike and the post-accident period. A subsequent follow-up discussion with the pilot included techniques to remain situationally aware and understanding the danger of distraction. Following the accident, the pilot completed an AAAA course in cockpit resource management and wire awareness, and a Robinson Helicopter Safety course.

Survivability aspects

The following section is largely based on a report provided by The Royal Australian Air Force Institute of Aviation Medicine. The report included advice regarding the use of helmets and restraints in helicopter accidents and their role in reducing the risk of fatal injuries in an otherwise survivable accident, as well as analysis specific to this accident. 

Survivability and injuries

The FAA report Analysis of rotorcraft crash dynamics for development of improved crashworthiness design criteria (Coltman and others 1985) defined a survivable accident as one in which the acceleration forces were within the limits of human tolerance and sufficient occupiable space remained for well-restrained occupants. Accidents in which impact injuries of the head or upper torso resulted from striking a surface, and could have been prevented by proper restraint, were deemed potentially survivable.

Injuries from aircraft accidents arise from three distinct sources:

• excessive acceleration forces (internal injuries)
• direct trauma from contact with hard surfaces
• exposure to environmental factors such as fire, smoke, water, and chemicals.

Acceleration forces

Significant research has been conducted into human tolerance of impact forces. Survivable velocity/acceleration envelopes have been determined based on analyses of helicopter accidents, including the injuries sustained by occupants, and the vertical, longitudinal and lateral impact forces (Coltman and others 1989, Coltman and others 1985). A large proportion of the studied US civilian helicopter wirestrike accidents (1974–1978) were classified as non-survivable due to the uncontrolled flight that followed the strike, and 65 per cent of the wirestrike accidents resulted in serious or fatal injuries.

Due to the compound forces on the helicopter (VH-HNF) when it impacted the ground, including a vertical component that resulted in seat crushing (as designed), lateral impact on the left front side and rotational forces, the ATSB was unable to accurately determine the velocities in each plane, to assess whether the acceleration forces were survivable.   

Trauma injuries

In US Army helicopter accidents from 1979 to 1985, trauma injuries from striking the aircraft structure occurred at least five times more frequently than acceleration injuries (Shanahan and Shanahan 1989). The potential for trauma injuries can be reduced by using restraint systems that decrease the area the body can move around in. That is, by reducing the ‘flail zone’ or ‘strike envelope’.

Restraints

The Australian Civil Aviation Safety Order 20.16.3 required at least one pilot crew member to wear a seat belt or safety harness at all times during flight. Civil Aviation Safety Regulation Part 137.225 required fitment of a 4-point harness to fixed-wing aeroplanes operating in the Restricted category – for example, when fitted with ‘role equipment’ such as a spray system – however, this requirement did not apply to helicopters operating in the Restricted category. CASA advised that a proposal to amend Part 137 to include Rotorcraft was expected to commence by the end of 2022. Civil Aviation Safety Regulations Part 90.105 required helicopters to be fitted with a safety harness that ‘must consist of a lap belt and at least 1 shoulder strap’ (3-point harness). Figure 6 illustrates 2-, 3-, 4- and 5-point harnesses.

Figure 6: Aviation restraint types

Source: Aircraft Crash Survival Design Guide, US Army Aeromedical Research Laboratory, annotated by the ATSB

The US Federal Aviation Regulation 137.31 for helicopters conducting aerial application was consistent with Australian regulations in requiring a minimum of a lap belt and shoulder harness for pilots. Some operators have higher standards to reflect their risk associated with their type of operation. For example, the US Department of the Interior, responsible for a large fleet of aircraft conducting land-management-related tasks, required the use of a 4-point restraint (with an inertia reel) for front seat occupants of helicopters. Military standards in the US and Australia mandate the use of a 5-point harness,^[5] due to the risks associated with their requirement to fly at low altitudes, in close proximity to obstacles and hazards.  

Upper torso restraints serve two purposes: to reduce upper body flailing and subsequent contact with aircraft structures and strike hazards, and to distribute acceleration forces across a larger body area to reduce local transmission of force. Although the shoulder sash of a 3-point harness (the design basis for the common seat belt in cars) provides restraint in a forward direction, it provides lateral restraint in only one direction. If the occupant moves in a lateral or diagonal direction away from the shoulder restraint, it is possible to slip out of the shoulder sash.

The limited aviation research for occupants in 3-point restraint systems subjected to oblique impact forces, indicates a risk of head and abdominal injuries from deceleration forces (Snyder and others 1969). Automotive accident research indicates the potential for greater flailing in oblique (60°) impacts compared to completely lateral (90°) impacts due to torso rotation and reduced engagement of the shoulder (Forman and others 2013). Therefore, if deceleration forces have large lateral or oblique components on the opposite side of the 3-point harness, there would likely be reduced protection provided to the upper torso and head in that direction. In a helicopter accident, crash deceleration forces on the occupant may be from multiple directions as the helicopter impacts the ground and rotates.

The front seats of VH-HNF were fitted with 3-point harnesses. The pilot’s shoulder sash was installed to cover the right shoulder. After the initial front-left impact, the helicopter rotated and came to rest on its right side. The pilot was found in the right seat, with the lap belt still attached across the waist, but the pilot’s upper body was outside the right side of the cabin, in front of (unrestrained by) the shoulder sash. The seat and seat belt were intact. This suggests the pilot may not have been wearing the shoulder sash at the time of the accident. Alternatively, the pilot may have slipped out of it during the uncontrolled flight following the wirestrike or during the crash sequence. In the latter case, the pilot would also have had to slip back underneath the sash to end up in front of it. The operator reported that the company pilots always wore the fitted restraint and specifically that they had observed this pilot to always wear the restraint correctly. However, it could not be determined whether the pilot was wearing the shoulder sash at the time of the accident.

A comparison between the flail zone for an occupant wearing a lap belt only (2-point harness) and a 4-point harness is depicted in Figure 7. These images show that the maximum head strike distance is reduced to 50 per cent with the 4-point restraint. Reducing the flail zone significantly reduces injury risk by reducing the number of objects that could cause strike injuries. In particular, this reduces the risk of potentially fatal head injuries, which was the most common cause of death in aircraft accidents (Crowley and others 1992).

Figure 7: Lap belt only (2-point harness) and 4-point harness flail zone

Source: Aircraft Crash Survival Design Guide, US Army Aeromedical Research Laboratory, annotated by the ATSB

Flight helmets

Benefits and requirements

Helicopter accident investigations conducted by the US Army in the 1980s determined that aircrew lives were being lost to head injury in otherwise survivable accidents (where the deceleration forces were within human tolerance). The outcome of this was the introduction and ongoing development of helmet standards. In an analysis of ‘severe accidents’, it was determined that occupants not wearing a helmet were significantly more likely to sustain severe and fatal head injuries (Crowley and others 1992). This finding was also consistent in civilian flying studies (Taneja and Wiegmann 2003). The introduction of protective helmets into military aviation has significantly reduced the incidence of head injury (Lewis 2006).

The Civil Aviation Safety Regulations did not require pilots to wear flight helmets. However, it was often mandated by aircraft operators for pilots engaged in aerial work, and necessary to meet federal- and state-legislated workplace, health and safety requirements. The AAAA code of conduct required a commitment to wear suitable personal protection equipment including a flight helmet. The pilot of VH-HNF was a member of AAAA and the company operations manual required a flight helmet to be worn.   

Standards

Helmets are designed primarily to provide impact protection – attenuating force and distributing it over a larger surface area – and penetration resistance. Helmets primarily consist of a composite shell that encases an ‘impact cap’, made from a layer of rigid foam that crushes on impact, and an inner liner/padding for fitment and additional energy absorption. The helmet should also include support for the retention system (including chin strap), visor(s) and communication equipment, as well as noise attenuation. The helmet must be retained on the head following an impact to protect against injury in subsequent impact/s.

There are specific standards for each of these domains and many commercially available helmets for civilian helicopter operators meet these to varying degrees. There was no Australian Standard for flight helmets, however helmet manufacturers used relevant standards that included the US Department of the Interior (DOI)/US Forest Service (USFS) Aviation Helmet Standard, US Military Standard and the European Standard (EN-966) Helmets for Airborne Sports.

The pilot of VH-HNF wore a MSA LH250 helmet (Figure 8). The manufacturer’s brochure indicated that the helmet was for pilots/flight crew of helicopters, transport and training aircraft without ejection seats. The helmet was reported to meet or exceed: 

• impact resistance to US Air Force (USAF) MIL-DTL-87174A, DOI/USFS Aviation Helmet Standard
• penetration resistance to USAF MIL-DTL-87174A EN-966, DOI/USFS Aviation Helmet Standard
• retention to EN-966:2012 and EN-966:2006, DOI/USFS Aviation Helmet Standard.

The US military standards had different requirements for helmets used in helicopters and aeroplanes. Helicopter and aeroplane helmets were required to be impact tested at five sites (front, rear, left and right sides, crown), but helicopter helmets also required impact testing at two additional sites: the left and right ear cups. The MIL-DTL-87174A standard described helmet performance for use in fixed wing aircraft (aeroplanes) and therefore helmets qualified to that standard may not provide adequate protection for helicopter occupants.  

Figure 8: MSA LH250 helmet

Source: Flight Helmets Australia

To meet the specifications a helmet is designed for, it must be fitted correctly, worn properly and maintained in accordance with the manufacturer’s requirements. The manufacturer of the pilot’s MSA LH250 helmet advised wearers of the following.

- To provide sufficient protection, the helmet must be fitted and adjusted to the head size of its wearer.

- The helmet is made in such a way that any energy received during an impact is absorbed by the destruction of or partial damage to the shell and impact cap; even if this damage is not immediately apparent, replacement of the whole helmet is recommended after a major impact.

- The helmet must be inspected for damage after obvious or suspected impact, or where routine maintenance reveals indications that suggest impact damage may have occurred. Helmet users are responsible for reporting known or suspected damage to helmets and to arrange further assessment, including if the helmet had sustained any impact in a previous accident. If the helmet has sustained a major impact, it should be replaced even if damage is not apparent.

Fitment and maintenance

The pilot purchased the helmet new in 2010. The shell was within its 15-year warranty period at the time of the accident. The pilot had purchased a new chin strap and edge roll (padding) in 2015, and earcup pieces and edge roll in 2017. There was no evidence of the helmet having been serviced by the distributor from which it was purchased.

The LH250 helmet comes in two shell sizes, which can be personalised with pads to fit the wearer’s head. The manufacturer advised that the pads degrade over time and should be replaced to ensure optimum fit. The fit of the helmet was not able to be assessed in this instance. The helmet was fitted with a chin strap and locking buckle, which met US DOI and US Military standards. The chin strap was noted by the ATSB to be worn and frayed (Figure 9). This was indicative of the chin strap being worn securely fastened over a long time.

The pilot had very likely been wearing the same helmet during a helicopter accident in 2018, in which the pilot sustained facial injuries. It could not be determined whether the helmet sustained an impact in that accident, or whether any subsequent inspection or maintenance was conducted, although it was confirmed that the helmet had not been sent to the distributor from which it was purchased. 

Figure 9: Helmet chin strap

Source: ATSB

Effectiveness

The helmet was found at the accident site, on the ground on the left side of the helicopter, the opposite side to the final resting position of the helicopter on its right side and the pilot in the right seat. The helmet sustained extensive structural damage, with significant cracking of the shell on the top and on the left side. The structure around the left ear and visor attachment was crushed and there was a dent in the shell above the left eye. Most of the outer visor and track had broken off from the right side, and there was paint transfer and scrape marks on the top of the helmet.

The chin strap was found undone with dirt lodged in the clasp. The chin strap fastened on the right-hand side of the helmet (Figure 10). The post-mortem report did not identify chin injuries to indicate that the helmet had been forcibly removed with the chin strap properly adjusted and secured. However, any such injuries may have been obscured by facial hair. Post-accident testing of the helmet by the ATSB found it was possible to undo the clasp with a relatively small ‘bump’ applied to the clasp. As the clasp was on the right side, this force needed to be applied opposite the (left) side of the initial impact. Although there was no evidence of damage to the clasp or scuff marks near the latch to indicate contact, the damage to the right side of the helmet was consistent with a secondary impact on that side. There was also no documented history of this latch coming undone in accidents.   

Figure 10: Helmet clasp and buckle

Source: ATSB

Risk of injuries

The ATSB considered whether wearing a helmet may increase the risk of cervical spine injury, given those sustained by the pilot in this accident. The Royal Australian Air Force Institute of Aviation Medicine indicated that there was limited data on this specific risk from helicopter accidents, however the considerable data from motorcycle and all-terrain vehicle accidents demonstrated clear benefits for helmet use in reducing head injury and no difference in regard to neck injuries.

Wirestrikes

Visibility of wires and poles

Powerlines, particularly unmarked wires, may be impossible to see due to the size of the wire, camouflage with the background and limitations of the eye.

Imagery taken from the ATSB’s remotely piloted aircraft (RPA), while following the helicopter’s estimated flight path at about the same time on a subsequent day, found that the wire would have been extremely difficult to see (Figure 11 and Figure 12).

Figure 11: RPA image 50–75 m prior to the powerline showing the accident location, taken at 1028 on 4 August 2020, with powerline highlighted

Source: ATSB

Figure 12: RPA image 50–75 m prior to the powerline showing the accident location, taken at 1028 on 4 August 2020, noting powerline visibility

Source: ATSB

During agricultural operations, pilots must retain the position of a powerline in their memory and are taught to use other visual indications of the presence of a wire, such as a group of trees, power pole, building or feature. The AAAA Aerial Application Pilot’s Manual (AAAA 2011:151) stated:

…the background to the wires – trees, hills etc. – may often provide a poor contrast. Poles may be concealed by intervening obstacles or by being located so far towards the periphery of the pilot’s visual field that they are not noticed.

Figure 13 shows the two closest power poles located either side of the helicopter’s flight path. From ATSB RPA footage taken along the estimated flight path, at times, both poles were obscured by trees and lacked contrast and texture variation from their background (Figure 14 and Figure 15). The two power poles should have been visible within the pilot’s peripheral vision, however it is likely that the pilot’s visual acuity was affected by contrast sensitivity, resulting in the pilot being unable to discriminate the poles from their background. Additionally, based on the powerline’s location on the pilot’s map, the pilot may not have been looking for cues at that time.  

Figure 13: Power poles either side of flight path

Source: lookupandlive app annotated by the ATSB

Figure 14: RPA footage of reconstructed flight path showing location of poles left and right of track from about 160 and 350 m respectively

Source: ATSB

Figure 15: RPA footage of reconstructed flight path showing right pole from about 240 m

Source: ATSB

Similar occurrences

Research conducted for the ATSB publication Wirestrikes involving known wires: A manageable aerial agriculture hazard found that there were 180 wirestrike accidents in the ATSB database for the period between 2001 and 2010. During that period, 55 wirestrikes involved helicopters, 30 of which resulted in an accident and 25 were serious incidents. Of the 55 helicopter wirestrikes, 20 occurred during aerial agricultural operations. Particularly relevant to this accident, the report reminded pilots to:

• have an up-to-date and detailed map with powerlines and other hazards clearly marked
• obtain network maps from the power company if available
• not rely solely on maps and pre-flight briefing
• always conduct an aerial reconnaissance to confirm wire locations and detect other hazards.

For the 10-year period from 2010 to 2020, there were 67 wirestrikes involving helicopters recorded in the ATSB occurrence database, 54 of which were conducting aerial work – 30 of which were during aerial agricultural operations. Of the aerial work occurrences, 23 were classified as accidents and 9 resulted in serious or fatal injuries to the occupants.  

__________

2.  The STOP-Bang questionnaire assesses a candidate’s risk of obstructive sleep apnoea.
3. The Epworth Sleepiness Scale is a self-administered questionnaire with 8 questions. Respondents are asked to rate, on a 4-point scale (0-3), their usual chances of dozing off or falling asleep while engaged in eight different activities
4.  Australian Standards AS 3891.1 Permanent marking of overhead cables and their supporting structures for other than planned low level flying, and AS 3891.2 Marking of overhead cables for planned low level flying operations, addressed the requirements for marking overhead cables, including powerlines.
5.  A 5-point harness is a 4-point harness with an additional crotch strap that prevents ‘submarining’, in which the occupant slides down under the lap belt.

Safety analysis

Introduction

The pilot had been employed by the operator since 2015 and was experienced, trained and qualified to conduct the spraying operation. After being involved in a wirestrike 2 years earlier, the pilot underwent additional training and checking with no issues identified.

The weather on the accident day was sunny with mild temperatures and very light winds. After a delayed start because of dew, the pilot had been flying for less than 2 hours, during which time the helicopter had landed five times to reload with chemical and fuel. The pilot appeared in good health and there was no indication of any performance issues with the helicopter.  

Aerial inspection and hazard identification

Due to a lack of contrast between the wire and the vegetation as the pilot looked down from the helicopter towards the fence line below and with no markers fitted to the wire, it would have been very difficult for the pilot to visually detect the powerline with sufficient time to avoid the wirestrike.

Had the pilot been relying on the powerline’s location depicted on the map, the helicopter would have encountered the wire earlier than expected. Therefore, the remaining defence available to the pilot would have been visual cues along the spray path. In this case, the power poles would likely have been visible, had the pilot been looking for them either side of the flight path. However, as the helicopter approached the wire, the poles would have been difficult to detect in the pilot’s peripheral view, if looking straight ahead.

It was clear that the pilot was aware of the powerline from pre-flight planning, and the chief pilot reported having discussed the powerline with the pilot on multiple occasions, including while loading the helicopter prior to the last take-off. However, despite being aware of the wire, and for reasons that were not determined, the pilot had not completed an aerial hazard inspection of the spray path, other than overflying a small section of the southern perimeter at the start of the second load. Doing so would have provided a clearer mental model of the wire’s exact location and better equipped the pilot to avoid it.

Pilot restraint

The helicopter was fitted with a 3-point harness, consisting of a lap belt and shoulder sash. The pilot’s torso had not been effectively restrained by the shoulder sash as evidenced by:

• the pilot’s head injury and damage to the helmet indicating a left-side impact
• the pilot was found secured in the lap belt but positioned out (and in front) of the shoulder sash
• an absence of bruising caused by the shoulder sash.

Based on the pilot’s final position in front of the shoulder sash, it was possible that the shoulder sash had not been worn at the time of the wirestrike, although the operator had always observed the pilot to wear it correctly. A right-seat shoulder sash is designed to restrict movement in the forward and right diagonal directions. Its effectiveness for restraint is likely to be significantly reduced with movement to the left. With the initial force sending the pilot leftwards, it is possible that the pilot came out of the sash. If so, the resultant flail zone would have been similar to wearing a 2-point harness (lap-belt only). Either way, not being restrained by the shoulder sash significantly increased the risk of strike injuries and injuries due to the pilot not being retained within the occupiable space.

Had the pilot been wearing a 4- or 5-point harness, which provide lateral stability to the upper torso in both directions, the risk of strike injuries, particularly to the head, would have been reduced. Additionally, the risk of deceleration injuries would also have reduced due to the decrease in relative impact forces for an occupant with the upper torso restrained.

Helmet effectiveness

The damage to the helmet and superficial contact injuries including bruising to the pilot’s left cheek, in the absence of skull and facial fractures, indicated that during the initial impact with terrain, the pilot was wearing the helmet and it had protected the head from significant blunt force trauma. Following the initial impact, the helmet completely came off the pilot’s head, increasing the risk of injury from subsequent impacts, and potentially reducing its effectiveness in attenuating the initial impact forces.

The chin strap was found intact and attached to the helmet but undone. It could not be determined whether the chin strap came undone during the accident sequence or was not secured at the time. Although the primary impact was on the left side of the helmet, there was also some damage to the right side of the helmet and visor and the chin strap clasp was on the right side. However, there was no visible damage to, or in the vicinity of, the clasp. Although the ATSB found that the clasp could come undone with a direct ‘bump’ force applied to it, there were no witness marks to indicate the clasp was opened from being caught on something during the impact sequence or directly impacted or bumped. The poor condition of the chin strap may also have resulted in it being uncomfortable to wear secured under the chin. Its poor condition was, however, consistent with the pilot having regularly worn it secured in the past.

It was very likely that the same helmet had been worn in an accident 2 years prior, and the helmet’s effectiveness would have been reduced had it sustained damage during that occurrence. There was no evidence to indicate that was the case, however there was also no evidence that the helmet had been inspected or serviced following that accident. An inspection would have provided an opportunity to identify any damage or items requiring maintenance to ensure that the helmet was continuing to function in accordance with its design specifications.

In any event, the diffuse brain injuries sustained by the pilot indicate the helmet did not attenuate the acceleration forces to the brain to a survivable level. It was not possible to determine if the impact forces exceeded the helmet’s specifications and/or whether the helmet’s effectiveness was compromised by any of the above considerations. However, it is important for pilots to remember that to be fully effective, a helmet must be fitted properly, worn correctly and maintained in accordance with manufacturer instructions.

Obstructive sleep apnoea

Following diagnosis of severe obstructive sleep apnoea (OSA) in February 2020, the pilot had initially managed the condition using a continuous positive airway pressure (CPAP) machine. However, over time, there had been reduced compliance with the treatment, and the CPAP machine had not been used for 2 weeks prior to the accident.

There was no evidence of the pilot having consulted a general practitioner or specialist physician since the diagnosis. This was a missed opportunity for a professional to ensure the CPAP machine’s efficacy in the pilot’s sleep quality. The pilot had also not reported the condition to a Civil Aviation Safety Authority designated aviation medical examiner, which prevented oversight of any ongoing safety risk associated with the condition.

Untreated, the pilot’s condition increased the risk of experiencing the effects of fatigue. However, the pilot had not reported excessive daytime sleepiness at the time of diagnosis. The pilot also had not stayed up late or awoken early and had been operating the helicopter for only about 1.5 hours that morning. Further, the time of day at which the accident occurred, 1057, was not a period of increased risk of fatigue based on the pilot’s reported sleep/wake times.

Even in the absence of fatigue, untreated severe OSA can cause inattention and impaired cognitive function and is linked with several other conditions. However, there is no evidence that cognitive impairment affects everyone with OSA or that the severity of OSA predicts its impact (or associated risks). Therefore, although the pilot was at an increased risk of cognitive impairment due to not using the CPAP to treat the severe OSA in the 2 weeks before the accident, it could not be concluded that the pilot was affected by this at the time of the accident.

Further, the ATSB assessed whether the pilot’s actions may have been indications that the pilot was experiencing the possible effects of OSA. It was possible that cognitive impairment led to the pilot inadvertently omitting the inspection, however, while the pilot had conducted an inspection the previous day, it could not be determined why the pilot did not do so on the accident day. Having briefed about the location of the wire in pre-flight planning and again immediately prior to the accident load, impaired memory and inattention may have affected the pilot’s recollection of the location of the wire and ability to identify it. However, it was equally possible that the pilot recalled the wire hazard but simply did not see the wire or poles. Additionally, numerous wirestrike accidents have occurred in the absence of OSA, in which the pilot was aware of the wire and/or where a hazard inspection was not conducted (ATSB 2006, 2014). 

There is limited evidence of aircraft accidents in Australia and the US in which OSA was a contributing factor. This is at least in part because it is extremely difficult for investigators to assess what a pilot’s cognitive state was at the time of an occurrence.

Findings

From the evidence available, the following findings are made with respect to the wirestrike and collision with terrain involving a Robinson R44 helicopter, registered VH-HNF, at Steam Plains, New South Wales, on 31 July 2020.

Contributing factors

• The pilot did not conduct an aerial inspection to verify the location of hazards including the powerline identified during pre-flight planning. As the wire was very difficult to see, the pilot was unable to see and avoid the wire before the helicopter struck it.
• The pilot's injuries were consistent with flailing due to the left-side impact, but it could not be determined whether the pilot was not wearing, or slipped out of, the shoulder sash portion of the 3-point harness.

Other factors that increased risk

• The pilot was not effectively managing severe obstructive sleep apnoea, which had not been disclosed to the Civil Aviation Safety Authority. This prevented its oversight of any ongoing safety risk associated with the condition.

Other findings

• The pilot’s helmet did not attenuate the impact to survivable levels. Either the impact forces exceeded the helmet design specifications, or the helmet was not fitted, worn or maintained correctly.
• Untreated severe obstructive sleep apnoea can increase the risk of fatigue and impairment of neurological and cognitive functions which can include impaired memory, vigilance and decision-making.

Safety actions

Safety advisory notice to helicopter pilots and operators

The Australian Transport Safety Bureau strongly encourages pilots conducting low-level operations to wear a flight helmet, ensuring that it is:

• fit for purpose
• custom fitted to the pilot’s head
• properly secured by using the chin strap
• maintained in accordance with the manufacturer’s recommendations.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Aerial Application Association of Australia
• Bureau of Meteorology
• Civil Aviation Safety Authority
• New South Wales Police Force
• helicopter maintainer
• helicopter operator and chief pilot of Riverina Helicopters
• recorded data from the GPS units on the helicopter
• Royal Australian Air Force Institute of Aviation Medicine
• Steam Plains Station owner and manager.

References

AAAA (Aerial Application Association of Australia) (2011) Aerial Application Pilots Manual, 3rd edn, Canberra.

ATSB (Australian Transport Safety Bureau) (2014) ‘Avoidable Accidents No. 2, Wirestrikes involving known wires: A manageable aerial agriculture hazard’, Research report AR‑2011‑028, ATSB, Australian Government.

ATSB (Australian Transport Safety Bureau) (2006) ‘Wire-strike accidents in general aviation: Data analysis 1994 to 2004’, Research and Analysis Report B2005/0055, ATSB. Australian Government.

Battelle Memorial Institute (1998) An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, United States Federal Aviation Administration.

Caldwell JL (2006) ‘Physiology of sleep and wakefulness, sleep disorders, and the effects on aircrew’, in Gradwell DP and Rainford DJ (eds) Ernsting’s Aviation Medicine, 5th edn, CRC Press, London, United Kingdom.

CASA (Civil Aviation Safety Authority) (2016) Fatigue – the rules have changed. CASA, Australian Government, accessed 22 August 2021. (also see: Plain English guide for fatigue management rules | Civil Aviation Safety Authority)

CASA (Civil Aviation Safety Authority) (2012) Fatigue Management Strategies for Aviation Workers: A Training & Development Workbook, CASA, Australian Government, accessed 25 September 2021.

CASA (Civil Aviation Safety Authority) (2017) Obstructive sleep apnoea and aviation safety fact sheet, CASA, Australian Government, accessed 22 August 2021.

Coltman JW, Bolukbasi AO, Laananen DH (1985) Analysis of rotorcraft crash dynamics for development of improved crashworthiness design criteria, United States Department of Transportation, Federal Aviation Administration.

Coltman JW, Van Ingen C, Johnson NB and Zimmerman RE (1989) Aircraft crash survival design guide: Volume II – Aircraft design crash impact conditions and human tolerance, United States Army Aviation Applied Technology Directorate.

Crowley JS, Licina JR and Bruckart JE (1992) ‘Flight Helmets: How they work and why you should wear one’, Journal of Air medical Transport, 11(8):19-23.

DOI and USFS (Department of the Interior and United States Forest Service) (2021) Interagency Aviation Life Support Equipment Handbook/Guide, Revision 3.0, United States.

Forman JL, Lopez-Valdes F, Lessley DJ, Riley P, Sochor M, Heltzel S, Ash J, Perz R, Kent RW, Seacrist T, Arbogast KB, Tanji H, Higuchi K (2013) ‘Occupant kinematics and shoulder belt retention in far-side lateral and oblique collisions: a parametric study’, Stapp Car Crash Journal, 57:343-85.

Gibb R, Scharff L and Gray R (2010) Aviation Visual Perception: Research, Misperception and Mishaps (Ashgate Studies in Human Factors for Flight Operations), Ashgate Publishing Group, Routledge, England, United Kingdom.

Goode JH (2003) ‘Are pilots at risk of accidents due to fatigue?’, Journal of Safety Research, 34:309-313.

Harrison Y and Horne JA (2000) ‘The Impact of Sleep Deprivation on Decision Making: A Review’, Journal of Experimental Psychology, 6:236-249.

International Civil Aviation Organisation (2015) Fatigue Management Guide for Airline Operators, 2nd edn, ICAO, accessed 18 November 2021.

Killgore WSS, Balkin TJ and Wesensten NJ (2006) ‘Impaired decision making following 49 h of sleep deprivation’, Journal of Sleep Research, 15:7-13.

Lal C, Strange C and Bachman D (2012) ‘Neurocognitive impairment in obstructive sleep apnea’. Chest, 141(6):1601–1610.

Lewis, ME (2016) ‘Head injury and protection’, in Gradwell DP and Rainford DJ (eds) Ernsting’s Aviation Medicine, 5th edn, CRC Press, London, United Kingdom.

Royal Australian Air Force Institute of Aviation Medicine (unpublished), Support to ATSB AO-2020-040 Accident involving R44 helicopter, vicinity Steam Plains, NSW 31 July 2020, Royal Australian Air Force Institute of Aviation Medicine, Australia.

Seda G, Han TS (2020) ‘Effect of Obstructive Sleep Apnea on Neurocognitive Performance’. Sleep Med Clin. March 15(1):77-85. doi: 10.1016/j.jsmc.2019.10.001. Epub 2019 Nov 26. PMID: 32005352.

Shanahan DF (1993) Basic Principles of Helicopter Crashworthiness, United States Army Aeromedical Research Laboratory (USAARL 93-15), United States.

Shanahan DF and Shanahan M (1989) ‘Injury in U.S. Army helicopter crashes October 1979 –September 1985’, Journal of trauma, 29(4):415–423.

Snyder RG, Snow CC, Young JW, Crosby WM and Price GT (1969) Pathology of trauma attributed to restraint systems in crash impacts, US Federal Aviation Administration Civil Aerospace Medical Institute (DOT/FAA/AM-69/3), United States.

Szczecinski G and Cable G (n.d.), Aviation Medicine for Aircrew, Royal Australian Air Force Institute of Aviation Medicine, Australia.

Taneja N and Wiegmann DA (2003) ‘Analysis of injuries among pilots killed in fatal helicopter accidents’, Aviation Space and Environmental Medicine, 74(4):337–41.

US FAA (Federal Aviation Administration) Pilot safety brochure Fatigue in aviation, FAA, United States, accessed 22 August 2021.

US FAA (Federal Aviation Administration) Sleep apnoea in aviation, FAA, United States, accessed 29 December 2021.

Veillette P (2015) ‘Wire wary: what you don't see can kill, and does’, Business and commercial aviation, October pp.24–28.  

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Riverina Helicopters
• Steam Plains station manager and owner
• the Civil Aviation Safety Authority
• Essential Energy
• the helicopter maintainer
• Royal Australian Air Force Institute of Aviation Medicine.

 Submissions were received from

• Riverina Helicopters
• the Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Glossary

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the afternoon of 23 July 2020, five aircraft were operating in the runway 17 Left (L) circuit at Moorabbin Airport, Victoria. A Piper PA-28 aircraft, VH-TAX (TAX), was lined up in the displaced threshold area of runway 17L. A Sling 2 aircraft, VH-ZSD (ZSD), then on the base leg of the circuit approaching the occupied runway, passed above TAX and conducted a touch and go landing. The runway incursion by ZSD removed the required runway separation between the aircraft.

What the ATSB found

The ATSB found that the student pilot of ZSD sighted TAX but decided to conduct the touch and go landing due to an incorrect belief that the controller had provided a landing clearance. The ATSB identified that the student pilot’s training had not been effective in conveying that a go‑around must be initiated if the runway was occupied.

The investigation also found that the air traffic controller did not identify the developing conflict as ZSD approached runway 17L. Additionally, the controller did not recall the aircraft passing above TAX and conducting a touch and go landing, and remained unaware of the incident until after it was reported over an hour later.

What has been done as a result

Royal Victorian Aero Club, the flight training school operating ZSD, has made changes to its student training program including educational, procedural and recurring activities. The school updated instructor and student educational materials, procedural guidance and examination content.

Safety message

Runway incursions and other runway separation issues are one of the most significant risks to safe aviation operations and a key global safety priority. Airport operators and air navigation service providers are strongly encouraged to identify and mitigate risk areas, especially at locations with inexperienced pilots or unusual airport configurations, such as displaced thresholds. The Airservices‑published safety bulletin Preventing the risk of a runway incursion and the runway safety article Tips for flying at Moorabbin provide relevant guidance.

Pilots are strongly encouraged to identify potential conflicts or runway incursions that may develop during circuits early and to attend carefully to air traffic control communications. It is important that flight training schools reinforce training regarding occupied runways and go‑arounds to students. Air traffic controllers are encouraged to monitor all aircraft and provide clear and unambiguous instructions to their flight crew to avoid runway incursions and related occurrences.

The occurrence

At about 1334 Eastern Standard Time^[1] on 23 July 2020, five aircraft were operating in the runway 17 left (17L) circuit at Moorabbin Airport, Victoria (Figure 1). They included a Sling 2, registered VH-ZSD (ZSD), operated by the Royal Victorian Aero Club (RVAC) with a student pilot on a second, solo flight. The pilot conducted a touch and go landing on runway 17L a few minutes earlier.

Figure 1: Runway 17L circuit traffic situation display screen shortly before the occurrence

Source: Airservices Australia

In addition to the circuit traffic, a Piper PA-28, registered VH-TAX (TAX), operated by Moorabbin Flying Services, with an instructor and student pilot on board, was at the holding point of taxiway G for 17L (Figure 2). The aircraft was in the final stages of preparation for a local training flight.

Figure 2: Overview of Moorabbin Airport showing key locations

The shaded yellow area indicates the tower perspective of the part of the runway when ZSD overflew the lined-up TAX.

Source: Airservices Australia, annotated by ATSB

At 1334:49, the Moorabbin Tower (tower) air traffic controller instructed the pilot of ZSD: ‘Zulu Sierra follow Cessna late downwind'.^[2] The pilot responded: ‘Zulu Sierra Delta’, and shortly after began preparing for a touch and go landing on runway 17L. The pilot of ZSD also mistakenly thought that the controller had issued a landing clearance. There was no further communication with the controller during that circuit.

At 1336:49, the controller instructed the pilot of TAX to line up on runway 17L. One minute later, TAX was still waiting in the lined-up position about 280 m behind the displaced threshold. The pilot of ZSD sighted TAX on the runway during the approach for landing. Just as the instructor was about to contact the tower to ask about the take-off clearance, ZSD passed above TAX and conducted a touch and go landing.^[3]

The instructor was surprised by the unusual event of an aircraft overflying another but did not immediately report the runway incursion, deciding instead to focus on TAX and its flight, and deal with incident-related matters in the post-flight debrief. At 1338:43, the controller (unaware of the incident) issued a take-off clearance and shortly after, TAX departed for the training area.

The pilot of ZSD did not believe any incident had occurred and continued conducting circuits, landing shortly after 1349.

At about 1440, after TAX completed the training flight, the instructor reported the incident to the flight training school’s head of operations and then phoned the tower. The tower supervisor was informed and, in turn, advised the incident controller.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. The Cessna was VH-MJG.
3. The pilot of TAX estimated ZSD passed 50-100 ft above their aircraft (data to verify the vertical separation was not available).

Context

Moorabbin Airport

Moorabbin Airport has five runways (Figure 3) and the vast majority of operations at the airport involve training activities. Runway 17L is 1,335 m in length and has an unusually long (285 m) displaced threshold (Figure 4). The airport operates within Metro Class D airspace and Airservices Australia (Airservices) provides the air traffic services (see Air traffic services section).

Figure 3: Moorabbin Airport

Source: Airservices Australia

Figure 4: Runway 17L section showing the position of TAX behind the displaced threshold

Source: Airservices Australia annotated by ATSB

Air traffic services

Moorabbin Class D airspace

Moorabbin Airport’s Class D terminal airspace is controlled by controllers situated in the Moorabbin control tower. The Class D airspace extended to the north and south-west from ground level to a 3 NM boundary.

Staffing

Airservices determines a minimum number of full time equivalent (FTE) staff (referred to as the mature requirement) to adequately staff a control tower. Moorabbin Tower’s mature requirement at the time of the incident (and for a number of years prior) was 11 FTE, but actual FTE numbers had been higher. The staff in excess of the mature requirement (the surplus) were available to assist in the tower.

In 2019, an informal ‘spotter’ position was created to utilise surplus staff. There was no licensing requirement for a ‘spotter’ nor a job description or procedure for utilising the position, but it was included in the roster. In practice, the ‘spotter’ was an additional resource to assist controllers in performing their duties.

In the months before the incident, however, there were some changes to staffing levels. One change was the removal of the ‘spotter’ position from the roster due to Airservices’ pandemic management plan,^[4] which introduced isolation rosters to mitigate virus spread by physically distancing controllers.

At the time of the incident on 23 July 2020, all three control positions in the tower were staffed. Four controllers were present: the operating Aerodrome Controller West (ADC-W), the outgoing controller handing over the ADC-W position, the Surface Movement Controller-Coordinator (SMC-COORD) and the Aerodrome Controller East (ADC-E). The ADC-E (the controller involved in this incident) controlled the runway and airspace in the eastern part of the airport area using radio frequency 118.1 MHz while the ADC-W performed those functions for the western part on 123.0 MHz.

According to the tower supervisor, a request to Airservices to reinstate the ‘spotter’ position was under consideration at the time with the intention to formally introduce the position when staffing numbers allowed. During the course of this investigation, a proposal to increase the mature requirement to 12.5 FTE was submitted to Airservices in November 2020. A reason given to support the proposal was that traffic levels and complexity at Moorabbin Airport were at a level where there was a risk of missing conflicts. At the time of publication of this report, the request was being considered with a view to allowing the SMC-COORD position to be de-combined during busy periods, but not to provide any additional resource for a formal or informal ‘spotter’ position.

Traffic movements

Under routine conditions, the training environment at Moorabbin Airport includes the workload demands of students learning to fly. In addition to this workload, the controller involved in this incident perceived that there had recently been a 20 to 25 per cent increase in movements at the airport. The tower supervisor also noted the increase in traffic over the previous 5 months and observed that traffic levels were quite saturated with the workload becoming challenging.

These perceptions were supported in part by objective data. Airservices Australia records indicated that monthly traffic movements at Moorabbin Airport had, on average, increased by 8.74 per cent between February and July 2020 (from 19,943 to 21,686 movements). A possible reason for the increase in movements was that pilots who could no longer fly for major airlines (due to the impact of the Coronavirus pandemic) and held an instructor rating, were working at flight training schools and this contributed to increased student flight training activities.

The instructors of both student pilots involved indicated that it had been busier for them over the past 15 months and that they had noticed reduced staffing in the tower. Overall, there appeared to have been an increase in the amount of traffic management work for controllers at Moorabbin Airport.

Traffic during the event

The incident controller assessed that traffic conditions at the time of the event were moderate to high. The airspace contained two aircraft with very similar callsigns, Zulu Sierra Delta (ZSD) and Zulu Sierra Oscar (ZSO). The presence of aircraft with similar callsigns operating in the same area and especially on the same frequency often gives rise to potential and actual flight safety incidents. This hazard is usually referred to as ‘callsign confusion’.

At 1334:49, the controller instructed the pilot of ZSD: ‘Zulu Sierra follow Cessna late downwind', without including ‘Delta’ to avoid potential confusion with ZSO (which was also in the circuit and conducted four landings before the occurrence and two subsequently). Two downwind calls were made by ZSO and November Charlie Echo (NCE), with the first call from ZSO coinciding with the approximate time that take-off clearance for TAX would have been expected for its immediate departure following Mike Juliet Golf (MJG). After the conflict occurred, the controller had a pause in communications (prior to an instruction at 1340:09 'Zulu Sierra Delta follow Cessna late downwind') and only after the conflict, at 1340:30, emphasised the word 'Oscar' in an instruction ('Zulu Sierra Oscar cleared touch and go').^[5]

Traffic control errors

In June 2020, Airservices conducted an operational safety study of Moorabbin Tower incidents from January 2013 to July 2018. The study provided an overview of the nature and frequency of Air Traffic Control (ATC) conflicts. The purpose of the study was to support operational managers in understanding the unit’s safety performance based on results derived from submitted safety occurrence reports.

The study showed that 5 per cent of the total coded occurrences were ATC attributable with six occurrences (3 per cent of the total) resulting in the system entering an undesired state (incorrect presence of at least one aircraft on a runway). The occurrences related to ATC inducing tactical conflicts (occurrences that are pilot attributed) with the tactical planning-related failures being resolved prior to entering the undesired state. The study showed that ATC attributable errors do occur, albeit with a low level of incidence of ATC induced tactical conflicts.

Landing clearances

Airservices provide landing clearance requirements directly relevant to the airspace in which this incident occurred. The Airservices Aeronautical Information Publication En-route (AIP ENR) 1.1 states that a pilot in command must not land unless they receive specific clearance ‘Cleared to land’.

AIP ENR 1.1 provides the following separation standards for Class D controlled airspace:

A landing aircraft will not be permitted to cross the threshold of the runway on its final approach until:

- a preceding departing aircraft using the same runway:

- is airborne and

- has commenced a turn; or

- is beyond the point on the runway at which the landing aircraft could be expected to complete its landing roll and there is sufficient distance to manoeuvre safely in the event of a missed approach;

- is at least 1,000 m from the runway threshold, and has commenced the take-off run, and

- in the opinion of the controller, no collision risk exists

Airservices has also published safety material to avoid runway incursion errors. Relevant publications include the safety bulletin Preventing the risk of a runway incursion and the runway safety article Tips for flying at Moorabbin.

The controller

The controller was working in the ADC-E position at Moorabbin tower. The controller was first rated in August 2003, achieved a rating for all tower positions in March 2007, and was qualified to conduct training and assessment in July 2010. There was also an endorsement to provide relief staffing at Avalon tower when needed. The controller successfully passed a renewal check in April 2020 and had been operating on an approved leave reduction program, of 4 days on, followed by 12 days off duty since early 2020. This level of recency, however, met Airservices’ requirements.

There was no evidence to suggest any likelihood of reduced controller performance due to fatigue, distractions or general health. The weather conditions and visibility were also not considered to have influenced the controller’s actions.

Tools available

In addition to visual observations from the Moorabbin tower and using voice communications, controllers use other tools to assist with performing their duties.

The controller was using a traffic running sheet to record aircraft movement data and to assist in sequencing aircraft. The traffic running sheet provides a back-up memory prompt to the primary function of visual monitoring of traffic. The running sheet that the controller used contained many changes, corrections and annotations, reflecting the level of activity and traffic complexity, which increased the likelihood of making an error (see Appendix – Traffic Running Sheet). The sheet also indicated that the controller remained unaware of the incident between ZSD and TAX.

Moorabbin Tower also utilises a support tool called the Traffic Situation Air Display (Figure 5). This display provides awareness of aircraft higher than about 200 ft, which is higher than ZSD was operating at the time of the incident.

Flight progress strips (FPS)^[6], a tool that has the same functional objective as traffic running sheets, are not used at Moorabbin Airport. According to Airservices, FPS are generally not required for visual flight rules (VFR) flights.

Figure 5: View and perspective from controller position towards runway 17L

Source: Airservices Australia annotated by ATSB

Air traffic communications

Table 1 provides the air traffic communications between the tower and ZSD and TAX in the lead up to the runway incursion. A large number of communications were also made between the controller and various other aircraft. Significant items are highlighted in the table.

Table 1: Communications and events leading up to the time of the incident

Student pilot information

The student pilot commenced training on 9 June 2020, with the first flying lesson on 23 June. Records showed a total flying experience of 18.5 hours to the last recorded flight (the occurrence flight) on 23 July, all on the Sling 2 aircraft type. Of that total experience, 17 hours had been in the previous 30 days. The student was not required to, and did not, hold a flight crew licence.

The pilot was an international student and had completed the General English Language Proficiency (GELP) test on 14 July 2020. On 23 July, the pilot was operating a second session of solo circuits and stated ‘feeling very nervous’ because English was not their first language. The incident occurred during the final leg of the fourth circuit, prior to a full stop landing.

The training school records indicated that the student pilot had completed the required training (as per the lesson entry reports) approved by the school’s instructors. The student was familiar with the runway configurations at Moorabbin, including the unusually long displaced threshold of runway 17L. The training school manual had a requirement about occupied runways and directed that students undertake specific training, including missed approaches/go‑arounds.

If for any reason, it is judged that an approach cannot be continued to a successful landing, a missed approach (go-around) will be conducted.

The operator’s training manual also provided runway descriptions and airport markings (including displaced thresholds). This incident was the first time that the student pilot had experienced another aircraft on the runway when approaching to land. The pilot also expressed a belief that it was permitted to have another aircraft lined up on the runway when landing. The pilot also believed that a landing clearance had been issued, observed that TAX was stationary and thought that it would not take off until the tower issued a take-off clearance.

After the incident, the instructor debriefed the student pilot and explained the requirement to conduct a go around if an aircraft was lined up on the runway. The instructor did not think this had been specifically discussed with the student previously although it may have been covered otherwise in training (during theory classes or briefings). Following that debrief, the pilot reported having a correct understanding of what to do in the event of an occupied runway.

There was no evidence that fatigue risk, distractions or other personal health aspects were likely to have been present. The weather conditions and visibility were also not considered to have influenced the pilot’s actions.

Monitoring regulations

The Civil Aviation Safety Authority (CASA) requirements for instructors monitoring students on their second solo flight are contained within Civil Aviation Safety Regulation (CASR) Part 61.112(3). These requirements state that a flight is suitably supervised if the instructor:

(a) provides guidance to the person in relation to the flight,

(b) during the flight is at the aerodrome from which the flight began and

(c) can be contacted during the flight by radio or other electronic means.

CASR Part 142.340 details the required exposition content for operators conducting integrated and multi-crew flight training. This states that the exposition must contain a description of the procedures by which the operator conducts and manages the activities, including the supervision of instructors and persons participating in activities.

Additionally, the CASR Part 142 Technical Assessor handbook details how the above requirements are to be documented in an organisation’s exposition. Section C3.1.1 (k) of the handbook ‘Procedures for Conduct and Management of Training - Supervision of Student Pilot Solo Flight’ outlined the documented expectations that are to be contained within an exposition with respect to the supervision of student pilots. While not a regulatory requirement, CASA inspectors are advised to check the following.

-The process should include provision for active monitoring of each solo flight by a flight instructor. As well as active monitoring, the supervising instructor should provide flight following, operational control and the rendering of assistance if necessary.

-For solo circuit operations, the applicant should ensure that a competent instructor is assigned to visually monitor circuit operations. The supervising instructor may be provided with two-way radio communication with circuit aircraft for the purpose of exercising operational control over solo flights, if necessary.

-For training area and navigation solo flight operations, an application should ensure that an instructor is assigned to monitor radio frequencies when possible, to provide assistance if necessary, and maintain a search and rescue watch.

Visual monitoring

The instructor usually monitored students by listening to the ATC frequency via radio from the RVAC operations room, as was the case at the time of the incident. There was no CASA requirement to visually monitor operations, and CASA advised that while the instructor needs to be available, it would not be appropriate to intervene in operations at a controlled airport such as Moorabbin. Hence, CASA considers the first knowledge a training school would have of such an incident at a controlled airport is similar to the way this incident unfolded, or the tower would inform the school by telephone.

In any case, from the operations room, the instructor was unable to visually monitor aircraft, as per the suggested guidance in the assessor handbook. The view was also partially obstructed by parked aircraft and the instructor was dividing attention between monitoring the radio and administrative work.

__________

4. Coronavirus disease (COVID-19) was an infectious disease caused by a newly discovered coronavirus. The World Health Organization (WHO) first learned of this new virus on 31 December 2019. International and domestic responses to manage the pandemic included reducing aviation activity internationally and domestically.
5. Pauses can represent confusion (for example about the sequence of events) and words are often emphasised to clearly distinguish similar callsigns. In this case, the controller emphasised the word ‘Oscar’ after the event.
6. Controllers use fight progress strips to maintain situation awareness of ATC operations and traffic. Standard annotations (such as recording the departure runway/location) provide information to assist with the correct execution of the controller’s plan and the early detection of any errors that may occur.

Safety analysis

Introduction

At 1337 on 23 July 2020, the PA-28 aircraft, VH-TAX (TAX), was lined up on the threshold of runway 17L at Moorabbin Airport, awaiting take-off clearance. The Sling 2 aircraft, VH-ZSD (ZSD) was on the base leg of the circuit and its student pilot believed (incorrectly) that a clearance for a touch and go landing had been provided. The student pilot saw the lined-up aircraft but continued the approach, passed above TAX about a minute later and conducted a touch and go landing.

The air traffic controller in the Moorabbin Tower (tower) managing the movements of the two aircraft did not identify the developing conflict as ZSD approached the runway or the aircraft passing above TAX and conducting a touch and go landing, and remained unaware of the incident until advised about an hour later.

Decision to continue the approach and landing

The student pilot’s decision to continue the approach and conduct a touch and go landing on the occupied runway was based on an incorrect belief that a landing clearance had been provided, and a misconception that landing on a runway with another aircraft lined up was permitted. The belief that a clearance had been provided may have been influenced by the following factors:

• callsign confusion
• expectation bias
• cognitive tunnelling
• authority gradient and pilot inexperience.

As discussed, aircraft with similar callsigns operating in the same area and, especially, on the same frequency often gives rise to flight safety incidents. At the time of the incident, ZSD and ZSO were in the circuit at the same time and conducting touch and go landings on runway 17L. It is possible that the downwind calls made by ZSO prior to the event may have been mistakenly heard as a clearance by the student pilot of ZSD.

The student pilot misperceived the tower communications and assumed the expected clearance had been provided by the controller. There may have been an expectation to hear this clearance, where the student pilot filled in the gaps in the communication. Expectation bias can occur when an individual's expectations about an outcome influence perceptions of one's own or others’ behavior.^[7] The student pilot may have been experiencing this bias (expecting the landing clearance to be provided), which could explain why the pilot made the decision to conduct the touch and go, and later recalled hearing a clearance.

There may also have been a degree of cognitive tunnelling for the student pilot. It has long been established that cognitive tunnelling is an inattentional blindness where one becomes overly‑focused on some variable other than the present environment.^[8] It can occur under periods of high stress or workload, which student pilots experience due to high demands on their attentional resources in the training environment.

During this occurrence, the student pilot may have been so focussed on the landing and avoiding a collision with TAX on the runway, that attentional resources were not focussed on tower communications. Hence, the student pilot incorrectly assumed a verbal clearance by the tower had been provided.

Finally, the student pilot’s belief that the controller had provided a landing clearance and deciding to land on an occupied runway may also have been influenced by a steep authority gradient between the student and the controller, as well as the student’s lack of experience.

Authority gradient refers to the established and/or perceived command and decision-making power hierarchy in a team, crew or group situation and how balanced the distribution of this power is experienced within the team, crew or group (Hawkins 1993). A steep gradient occurs when a role appears dominant over another and leads to others being less likely to express concerns, question decisions or even clarify instructions.

As the student pilot was conducting a second solo flight and had English as a second language there may have been a steep authority gradient, which could explain why the student would not have clarified the (assumed) landing instruction.

The evidence shows the student pilot decided to continue the touch and go landing due to an incorrect belief that a clearance had been provided, and a misconception that landing on a runway with an aircraft lined up was permitted. Exact reason(s) for believing a clearance had been provided could not be established, but factors that may have contributed to that belief include callsign confusion, expectation bias, cognitive tunnelling, authority gradient and pilot inexperience, or a combination of these factors.

Occupied runway training

The student pilot of ZSD conducted the touch and go after seeing TAX lined up behind the runway threshold. According to the training instructions and AIP procedures, the approach should not have continued, as the runway was occupied, and a landing clearance had not been received. The instructor did not think this had been specifically discussed with the student previously although it may have been covered otherwise in training. The pilot later stated understanding what to do in future in the event of an occupied runway.

While the training documentation contained occupied runway requirements and Airservices’ safety publications provide further guidance, interview evidence, as well as the student's actions, indicate that learning in this aspect had not been effective.

Unidentified conflict

The controller did not see ZSD approaching to conduct a touch and go landing with TAX lined up and, therefore, took no action to avoid the runway incursion. Normally, pilots report that they are on short final (for example, OXG and NCE in the circuit that day). However, the pilot of ZSD did not contact the tower when approaching for that touch and go landing. Based on the available evidence, the controller’s ability to identify the conflict may have been influenced by the following factors:

• traffic density
• workload and communications
• callsign confusion.

Evidence from the interviews of the controller, the tower supervisor and the involved pilots; as well as the recorded traffic movement data, suggest that traffic movements increased in the months leading up to the time of the event. A controller’s ability to detect a conflict can depend on the traffic load and more controllers miss more potential conflicts when traffic density is high, compared to when it is low.^[9]

The changing traffic movements may also have affected the controller’s workload level. The following research-based observation is relevant to this relationship with workload.

Workload reflects the interaction between a specific individual and the demands imposed by a particular task and represents the cost incurred by the human operator in achieving a particular level of performance. An individual has a finite set of mental resources they can assign to a set of tasks and will seek to perform at an optimum level of workload by balancing the demands of their tasks.^[10]

Both the controller and the supervisor indicated that workload was influenced by traffic movements. Additionally, the number of communications leading up to the event and the many changes to the traffic running sheet suggest high workload. It is probable that an increased level of mental workload because of increased traffic density, resulted in the controller having less opportunity to identify the conflict. Airservices’ safety study data referred to earlier also shows that ATC‑attributable errors have occurred at Moorabbin Airport.

It is also possible that callsign confusion played a part in the controller not identifying the conflict. There was significant communication at the time, both ZSD and ZSO had similar communications with the tower while operating in the same area on the same frequency. At 1334:49, the controller also omitted ‘Delta’ in the instruction ‘Zulu Sierra follow Cessna late downwind' giving potential for confusion between ZSD and ZSO. The first two phonetics of these callsigns (that is, ZS) were the same. Further, they had visually similar shapes that can be easily mixed up as they only differ by their last designator (for example, on a traffic running sheet). The controller’s pauses are indicative of some level of confusion and only emphasising the phonetic ‘Oscar’ after the occurrence, suggests the controller may not have recognised the potential for confusion in time.

Overall, the evidence shows that the controller did not identify the conflict between ZSD and TAX, but the exact reason(s) could not be established. This may have occurred due to the high traffic density and resulting communications workload or the similar aircraft callsigns operating in the same circuit on the same frequency, or a combination of these factors. While it is possible some other factors may have had an influence (for example, runway confusion or not following standard operating procedures), there was no evidence to justify considering such factors.

Other considerations

As the informal ‘spotter’ position was no longer used, the controller was the only person that could have identified the developing conflict because, as explained, the student pilot’s instructor could not have done so. Further, as the instructor in TAX (who had reasons to delay it) did not report the incident immediately, the corrective action taken to address the immediate operational risks by relieving the controller was delayed by more than an hour.

Single person controller operations where a position/sector is operated by one person are unsuitable during busy periods, as they can lead to high task loads, distraction, failure to detect threats and not recognising errors. Monitoring each other’s actions (also known as the ‘four-eye principle’) reduces the likelihood of this error by increasing situation awareness. This was probably the main safety-related reason for rostering an informal ‘spotter’ in Moorabbin Tower.

Airservices’ safety study provides an indicative level of risk that it can use to assess the level of acceptable risk for single person controller operations at Moorabbin, including situations involving student pilot errors or non-compliance with ATC instructions. The ATSB did not find any additional information, such as incident trend data or studies into optimal workload levels (for Moorabbin or similar towers) to make findings with respect to tower staffing levels.

__________

7. Williams and others 2012.
8. Mack and Rock 1998; Most 2010.
9. Metzger and Parasuraman 2001.
10. Orlady and Orlady 1999.

Findings

From the evidence available, the following findings are made with respect to the runway incursion involving The Airplane Factory Sling 2, VH-ZSD at Moorabbin Airport, Victoria, on 23 July 2020.

Contributing factors

• While the Piper PA-28, VH-TAX, was in the lined-up position (behind the displaced threshold) on runway 17L, the Sling 2, VH-ZSD, passed overhead and conducted a touch and go landing.
• The student pilot of ZSD sighted TAX but decided to conduct the touch and go landing due to an incorrect belief that it was permitted to have another aircraft lined up on the runway when landing, and that the controller had provided a landing clearance.
• The student pilot’s training had not been effective in conveying that a go-around must be initiated if the runway, including its displaced threshold, was occupied.
• The air traffic controller did not identify the runway incursion developing, see ZSD pass above TAX or its touch and go landing and remained unaware of the incident until advised about 1 hour later.

Safety actions

Safety action not associated with an identified safety issue

Additional safety action by Royal Victorian Aero Club

The Royal Victorian Aero Club advised the ATSB that it has taken the following actions.

Flight crew and student education

• Briefings for circuits and circuit emergencies have been updated.
• Instructor training now includes being trained on checking essential knowledge for the lesson.
• New manuals have been provided to all instructors and have been signed as acknowledged.
• The pre solo exam and pre area solo exam have been updated to cover the scenario of runway occupied/no clearance provided.

Procedural actions

• The recreational pilot licence training manual has been updated to include essential knowledge to be checked before solo flights.
• Instructors were briefed and have acknowledged the updated manual.

Proactive action

• Solo flights have been reviewed, ensuring that instructors comply with the training manual including supervision requirements and checking essential knowledge.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Pilot and instructor for VH-ZSD
• the instructor of VH-TAX
• Airservices Australia
• The air traffic controller
• The tower supervisor
• Royal Victorian Aero Club
• Moorabbin Flying Services
• Bureau of Meteorology.

References

Hawkins FH 1993, Human Factors in Flight 2^nd ed, Ashgate Aldershot UK.

Mack A & Rock I 1998, Inattentional blindness, MIT Press Cambridge MA.

Metzger U & Parasuraman R 2001, The role of the air traffic controller in future air traffic management: An empirical study of active control versus passive monitoring, Human Factors, vol. 43, pp.519-528.

Most SB 2010, What's "inattentional" about inattentional blindness?, Consciousness and Cognition, vol. 19, pp.1102-1104.

Orlady HW & Orlady LM 1999, Human factors in multi-crew flight operations, Ashgate Publishing Ltd Hants England.

Skybrary, Call-sign Confusion, https://www.skybrary.aero/index.php/Call-sign_Confusion.

Skybrary, Single Person Operations in ATC, https://www.skybrary.aero/index.php/Single_Person_Operations_in_ATC.

Williams JB, Popp, D, Kobak KA & Detke MJ 2012, The power of expectation bias, European Psychiatry, vol. 27, pp.1

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• pilot and instructor for VH-ZSD
• the instructor of VH-TAX
• Airservices Australia
• the air traffic controller
• Royal Victorian Aero Club
• Moorabbin Flying Services
• Civil Aviation Safety Authority

Submissions were received from:

• Airservices Australia
• the air traffic controller
• Civil Aviation Safety Authority

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix – Traffic running sheet

Source: Airservices Australia

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 22 July 2020, a Skippers Aviation Cessna Aircraft Company 441 departed on a charter flight from Broome Airport, Western Australia, for Browns Range Airport, with two pilots and six passengers on board. Shortly after reaching the planned cruising level of flight level 270, a rapid depressurisation of the cabin occurred. The pilots and passengers donned their oxygen masks. The pilots performed an emergency descent and landed at Browns Range without further incident. After landing at Browns Range, they noticed the lower rear corner of the emergency exit door outer skin had separated from the inner skin and was the likely source of the depressurisation.

What the ATSB found

The operator’s aeronautical engineer performed a structural failure investigation, which was reviewed by the ATSB and Textron Aviation (the type certificate holder for the Cessna 441). It was concluded that the emergency exit door progressively disbonded between the inner and outer skin, likely due to the age of the aircraft, facilitated by a combination of corrosion, moisture, and flight cycles. This weakened the structure, which resulted in an accelerated failure of the bondline and rapid depressurisation of the cabin when the aircraft reached flight level 270.

As a result of this incident and the subsequent discovery of two further disbonded doors, all for aircraft operating under a supplementary type certificate life extension program, it was concluded that the existing visual inspection procedures for the emergency exit door bondline were inadequate.

In addition, it was found that the decision to apply the minimum equipment list item for the pressurisation system to depart for the return flight precluded an independent assessment of the condition of the aircraft that would have been required under the special flight permit process.

What has been done as a result

On 6 August 2020, the Civil Aviation Safety Authority issued airworthiness bulletin 52-004 issue 1: Cessna 441 in Flight Depressurisation due to Emergency Exit door bonded skin failure. The bulletin provided an interim detailed visual inspection procedure for the emergency exit door bondline, based on a scheme provided by the operator’s aeronautical engineer.

On 1 January 2021, the operator’s aeronautical engineer submitted an engineering order with supporting documentation to the Civil Aviation Safety Authority for a major modification to their Cessna 441 aircraft. This included the installation of rivets through the bondline and subjected the door to additional inspection requirements.

On 21 January 2021, Textron Aviation released Conquest Service Letter (CQL-99-02) for the Model 441 Conquest/Conquest II maintenance manual. This introduced inspection A522005 - Emergency exit door bond inspection - with an interval of 2,000 hours or 4 years, whichever occurred first. The purpose of the inspection was to verify the integrity of the emergency exit door bondline utilising the method of ultrasonic bond inspection.

The ATSB identified a safety issue for the inspection procedures in the West Star Aviation maintenance manual supplement for the Cessna 441 aircraft life extension program as inadequate for detecting the progressive disbonding of the emergency exit door skin. West Star Aviation considered the proactive safety action taken by Textron Aviation was sufficient to detect defects with the emergency exit door fitted to Cessna 441 aircraft, as this inspection procedure will apply to aircraft on the life extension program. The ATSB has accepted the response from West Star Aviation as closing the safety issue.

The operator enrolled their Broome base pilots in additional human factors training, to capture the elements of communication, decision-making, leadership and threat and error management. In addition, the chief pilot scheduled a revision session in the understanding of the minimum equipment list and its application, for the next visit to Broome.  

Safety message

After landing at Browns Range and discovering the disbonded door skin, the pilots elected to continue with the return flight with the pressurisation system inoperative, which was consistent with the initial advice they received from their company. However, whenever new information about an abnormal situation becomes available, decisions may need to be re-evaluated, as the initial reasoning may no longer be valid. In addition, for the scenario of a structural failure, the special flight permit process should be followed to manage the potential risks associated with a damaged aircraft.

The occurrence

Outbound flight

On 22 July 2020, at about 0904 Western Standard Time,^[1] a Skippers Aviation Cessna Aircraft Company 441 aircraft, registered VH-LBY, departed on a charter flight from Broome Airport, Western Australia, to Browns Range Airport with two pilots and six passengers on board. Browns Range is located about 388 NM (719 km) east of Broome and the flight was planned to be conducted at flight level^[2] (FL) 270 with an estimated flight time of 84 minutes.

The aircraft reached FL 270 at about 0932. At about 0933, when 108 NM (200 km) from Broome and before the cruise configuration was set, both pilots heard a loud noise from the passenger cabin. The PIC initially thought the emergency pressurisation valve (refer to section titled Pressurisation system), located near the emergency exit door on the right side of the cabin, had inadvertently activated.

At about the same time the PIC was checking the warning light for the emergency pressurisation valve, the cabin altitude warning light and aural beeping tone activated. The PIC noted the cabin altitude gauge passing 25,000 ft, while the observation pilot (OP) in the right seat recalled observing about 27,000 ft, indicating a rapid depressurisation of the cabin. The pilots donned their emergency oxygen masks and the PIC initiated an emergency descent. The OP retrieved the emergency checklist and contacted air traffic control (ATC) to request a descent to FL 120. Figure 1 below depicts the incident flight path from Broome to Browns Range and approximate location of the depressurisation.

Figure 1: VH-LBY flight path and location of depressurisation

Source: Google earth, annotated by the ATSB

During the descent, the pilots confirmed the passengers had fitted their masks. When ATC asked if they were ‘ops normal’, the crew reported they were experiencing pressurisation issues, but were ‘ok’. At about 0937, the aircraft reached FL 120. Shortly after, the OP sent a text message to the operator’s senior base pilot (SBP) at Broome advising of the situation and asking if they should return to Broome. The SBP, who was preparing for a flight to Halls Creek, and knew there were no passengers for the return flight on VH-LBY from Browns Range, advised the pilots to continue the flight depressurised, to upload fuel at Halls Creek if required, and to apply the minimum equipment list (MEL).^[3]

At about 0940, the pilots commenced a further descent from FL 120 to 10,000 ft. When at 10,000 ft, the pilots removed their oxygen masks, instructed the passengers to do the same and confirmed they were all responsive and uninjured. The PIC confirmed the aircraft handling was normal, selected the autopilot on, and notified ATC of their intention to return to Broome.

Shortly after the PIC contacted ATC, the OP passed the text message reply from the SBP to the PIC. The PIC initially misunderstood the message and amended their destination intentions to ATC from Broome to Halls Creek, before correcting this to Browns Range. The pilots briefed the passengers and recalculated their fuel requirements for maintaining 10,000 ft, which indicated they would need to divert to Halls Creek on the return flight for fuel.

At about 0942, the operator’s maintenance shift supervisor at Perth received a phone call from the SBP and they discussed the event. During the discussion, they concluded that the problem was likely to be related to an air cycle machine fault (refer to section titled Pressurisation system). Therefore, they agreed that it was acceptable for the aircraft to continue to Browns Range, where the PIC could invoke the MEL item for the pressurisation system, and return to Broome at, or below 10,000 ft without passengers. The shift supervisor reported that they ended the phone call with the expectation that a re-assessment would be made after the aircraft arrived at Browns Range. They then notified the operator’s continuing airworthiness manager and chief pilot of the incident.

At about 0946, the SBP sent another text message to the OP advising the pilots to contact the shift supervisor if assistance was required, that the issue was likely related to the air cycle machine and asked if the emergency pressurisation annunciator light had illuminated. The PIC reported to the OP that they thought the emergency pressurisation annunciator light did come on momentarily. The OP relayed to the SBP that it did activate. The pilots had a further conversation after the OP sent the message to the SBP and concluded that the PIC might have confused the emergency pressurisation annunciator light with the activation of the cabin altitude warning light, and that it probably did not activate.

At about 1046, the aircraft landed at Browns Range Airport without further incident. The passengers disembarked and the PIC applied the MEL item for the pressurisation system. During their walk-around of the aircraft, both pilots noticed the lower aft section of the emergency exit door skin had separated (disbonded). Figure 2 depicts the location of the emergency exit door and Figure 3 depicts the separation of the door outer skin.

Figure 2: VH-LBY and the location of the emergency exit door

Source: Joe Barr, annotated by the ATSB

Figure 3: Separation of the emergency exit door outer skin

Source: Operator, annotated by the ATSB

Return flight

As there was no phone reception at Browns Range (internet access was available at the mine site) and noting the door skin separation was at the trailing edge and not in the airflow, the PIC elected to continue with the return flight via Halls Creek Airport where they expected to meet the SBP and have reception. At about 1117, the aircraft departed Browns Range and arrived at Halls Creek at 1144 without incident. The pilots refuelled the aircraft and waited for the SBP to arrive.

On arrival at Halls Creek, the SBP inspected the emergency exit door and noted there was a 10 mm gap at the bottom of the door and that the door had disbonded, which they had not seen before. They photographed the door and sent them to the maintenance shift supervisor for further discussions.

The shift supervisor subsequently discussed the photographs with the continuing airworthiness manager. They assessed that the door skin was not in the airflow, and therefore, should not result in any further damage for a return flight to Broome unpressurised. Between the personnel at Halls Creek and Perth, there was no discussion of the applicability of the pressurisation system MEL item. This item restricted operations to a maximum altitude of 10,000 ft unpressurised, which was consistent with their plan for the return to Broome for maintenance. At about 1255, the aircraft departed Halls Creek and arrived at Broome at 1419 without further incident.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 270 equates to 27,000 ft.
3.  An approved MEL is a document that allows for the operation of a specific aircraft under specific conditions with a particular item(s) of equipment inoperative at the time of dispatch for the intended flight. Despite the inoperative equipment, the aircraft still complies with its type design standards. This requirement enables the PIC to determine whether a flight may be commenced or continued from any intermediate stop should any instrument, equipment or system become inoperative.

Context

Flight crew information

Pilot in command

The pilot in command (PIC) held a Commercial Pilot Licence (Aeroplane) with an instrument rating for multi-engine aeroplanes and a valid Class 2 Aviation Medical Certificate.^[4] The PIC had accumulated a total of 604.3 flying hours, of which 110.3 hours were on the Cessna 441. The PIC had previously flown the sector from Broome to Browns Range while operating in-command under supervision. However, the coronavirus pandemic resulted in an extended delay between the PIC’s flying under supervision and line check. Therefore, the Broome senior base pilot (SBP) rostered a second pilot with more recent experience of Browns Range to act as an observation pilot (OP) for the flight.

Observation pilot

The OP held a Commercial Pilot Licence (Aeroplane) with an instrument rating for multi-engine aeroplanes and a valid Class 1 Aviation Medical Certificate. The OP had accumulated a total of 1,899.1 flying hours, of which 389.9 hours were on the Cessna 441.

Aircraft information

VH-LBY was a Cessna Aircraft Company 441 (Conquest II) 11-seat pressurised twin-engine turboprop aircraft. It was manufactured in 1978 and first registered in Australia on 13 May 1986. At the time of the incident, the aircraft had accumulated 27,116 flight hours, 23,484 cycles and was about 42 years old. On 29 July 2015, the type certificate for the Cessna 441 was transferred to Textron Aviation Inc.

Pressurisation system

Bleed air from each of the engines was delivered via flow control valves to an air cycle machine, located in front of the forward pressure bulkhead. This provided pressurisation and temperature control for the cabin environment through air ducts and a series of vents. In-flight, the pressurisation source could be selected by the pilot to both, left, right or emergency. Emergency could be selected manually by the pilot (in response to a depressurisation) or activated automatically if the air cycle machine overheated. The associated annunciator light only activated for the air cycle machine overheat condition.

If emergency pressurisation was activated, a control valve provided unregulated airflow from the right engine directly into the cabin via a separate vent to the main system. This will maintain cabin altitude, but also cause the cabin temperature to climb uncontrollably. Activation of the emergency valve was described by the PIC as ‘very loud and sounds similar to the noise we heard…it is located in the forward right of the cabin fuselage…similar location to the emergency exit door…have heard due to age they could inadvertently open’.

The maintenance shift supervisor had a previous experience with an air duct separating from the air cycle machine in another Cessna 441. This resulted in the shift supervisor anticipating a mechanical issue with the pressurisation system rather than a structural issue with the airframe. The shift supervisor further reported that, if airflow from the vents had been verified in-flight, they could have discounted a fault with the air cycle machine and considered other possibilities.

When the SBP asked the pilots at 0946 if the emergency pressurisation activated, the pilots interpreted this query as related to an uncommanded activation associated with the depressurisation. However, the pilots’ response that it activated was interpreted by the SBP that the pilots had manually selected emergency as the pressurisation source at step 3 of the depressurisation checklist and that it had operated as designed.

Supplemental type certificate

Supplementary inspection programs are used to ensure the continuing airworthiness of ageing aircraft. Maintenance becomes more complex as an aircraft increases in age. Additional maintenance is required in areas where experience has shown fatigue or environmental degradation to be greater than predicted (ATSB, 2007).

Cessna, supported by operators and the United States Federal Aviation Administration, had produced a supplemental structural inspection program, published in the model 441 maintenance manual supplemental inspection document (SID). The SID revision number 5-3, dated 15 January 2008, stated the program is valid for:

…model 441 airplanes with less than 22,500 flight hours. Beyond this, continued airworthiness of the airplane can no longer be assured. Retirement of the airframe is recommended when 22,500 flight hours have been accumulated.

In response to the manufacturer’s recommendation to retire the aircraft, the Civil Aviation Safety Authority (CASA) issued a direction to all Australian Cessna 441 pilots and operators, for aircraft that had accumulated 22,500 hours, that commenced on 19 September 2008 and was valid until 18 September 2009.^[5] The direction stated that:

The aircraft may not be flown at any time or for any purpose while this direction is in force unless, being satisfied that it is safe to do so, the Director approves in writing the details of the flight, including the time, route, purpose and risk mitigators.

In response to the recommendation from Cessna and the direction issued by CASA, a Cessna 441 life extension program was developed in Australia and submitted to CASA. This resulted in CASA issuing a supplemental type certificate^[6] (STC SVA 528) on 10 August 2010, with the description:

A life extension program, requiring modification of the airframe and incorporation of a mandatory inspection program, which allows operations beyond Cessna’s current 22,500 hour limitation.

The latest STC was issued to West Star Aviation (STC holder)^[7] on 11 March 2020. The STC permitted the operation of the Cessna 441 until:

• 40,000 hours, or
• 40,000 flight cycles, or
• 25,000 flight cycles after incorporation of this STC, whichever occurs first.

According to STC SVA 528, to be eligible for the life extensions, aircraft incorporating the STC must be inspected in accordance with both the continuous inspection program and the SID, detailed in the maintenance manual supplement (MMS 13757.030-01).

Following the incident, CASA provided data that indicated there were 44 Cessna 441 aircraft in Australia, and that five had exceeded 22,500 hours, and therefore, required STC SVA 528 to continue operating. The incident aircraft was the highest hours Cessna 441 on the Australian register.

Emergency exit door structure

The operator’s contracted aeronautical engineer inspected the door post-incident and provided the following general description of its structure:

• The door skin structure was comprised of an inner layer with a channel around the edge that carried the door seal, and which also acted as a bonded waffle layer; and an outer full skin which was bonded to the inner layer channel at the edge.
• The two skin layers were not mechanically fastened together in a uniform manner. Rivets joined the layers in lateral and vertical channels and surrounded the window [upper half of door] but were not present in the failure location.
• The bond was produced using a film adhesive applied with an unwoven carrier cloth.
• The door skin stresses were almost entirely due to pressurisation forces alone. It did not carry any flight or ground loads.

Emergency exit door inspections

Textron reported that, for aircraft within their recommended life (less than 22,500 hours), there was an inspection for cracks, corrosion, and damage to the emergency exit door, detailed in supplemental inspection 52-20-01. According to the Cessna aircraft maintenance manual, inspection 52‑20-01: Emergency exit door, had an initial compliance of 4,000 hours or 8 years, with a repeat inspection at 2,000 hour or 4-year intervals. The inspection instructions required the emergency exit door to be removed from the airframe to conduct a visual inspection for ‘cracks, deformations, corrosion, and loose or failed fasteners’, with reference to an associated figure (Figure 4). The associated figure included a shaded area, referred to as the ‘critical area to be inspected’, which was located at the join of the lateral and vertical internal door beams.

The MMS made no changes to the Cessna maintenance manual requirements for 52-20-01, nor were there any additional requirements related to the ongoing airworthiness of the emergency exit door. Inspection 52-20-01 was last certified as completed for the incident aircraft on 1 March 2020, with nil defects found. At interview, the maintenance shift supervisor noted that a visual inspection alone might not be adequate to detect the pre-failure condition of the bondline. The shift supervisor stated the ‘current diagram might draw attention to a specific area [shaded area] …very easy to overlook…need a bond check with NDT [non-destructive testing] or a tap test’.

Figure 4: Maintenance manual figure for the inspection of the emergency exit door

Source: Cessna Aircraft Company, annotated by the ATSB

Emergency exit door structural failure investigation

The operator’s aeronautical engineer conducted a structural failure investigation (root cause analysis). A copy of the report was provided to the ATSB, which was shared with Textron. There were no technical objections to the report and the report findings and conclusions included the following:

• The emergency exit door appeared to be the original door fitted to the aircraft during manufacturing.
• The maintenance records did not indicate any previous bonded repairs on the door.
• The depressurisation was the result of a failure of the emergency exit door skin, which appeared to have been caused by propagation of a disbond between the inner and outer skin layers. The final position of the distorted skin corner was about 16 mm proud from the original bond surface.
• Normally, a thin skin disbonding in this manner would provide a warning prior to failing through a pressurisation leak, whistle or failure to maintain cabin altitude. However, in this case, it appeared that the skin had sufficient thickness to continue working until a ‘more serious rapid failure mode’ (‘pop’) occurred.
• A large disbond area resulted from moisture and corrosion, progressing from the inside edge of the door. There were no rivets in the bond in this area to interrupt a progressive disbond (peeling action).
• The basic design, with an overhanging edge and lack of any edge sealing, allowed for eventual bondline contamination, disbonding, and failure. This was exacerbated by corrosion and dents accumulated at the edge.
• While the starting point of the disbond was unknown, initiation (or likelihood) was probably caused by the calendar age of the aircraft. Once a disbond was present, repetitive cycles will tend to grow the disbond.
• Neither the Cessna aircraft maintenance manual nor life extension STC inspection schedules required specific inspection of the skin/bondline area that failed.
• Visual inspection of the affected area required removal of the door from the aircraft and close, detailed inspection of the door perimeter.

Figure 5 depicts the deteriorated bondline and pulled fibres visible under ultraviolet light, indicating final cohesive failure of the normal bond.

Figure 5: Deteriorated and failed bondline of the emergency exit door

Source: Eric Whitney, annotated by the ATSB

The report also highlighted that the door did not carry any flight or ground loads, so failure of the bondline would cause depressurisation, but not a catastrophic airframe loss. The corrosion was not visible on either the inner or outer surfaces of the door. Inspection of the remaining circumference of the door edge revealed the following:

• there were numerous other smaller starting points for bondline failures
• a smaller, similar disbond was found on the lower forward corner and failure at this location was probably also imminent
• lifting of the adhesive carrier cloth was noticed in many places
• a small smudge may have been an indicator of an early local pressurisation leak, however, this would not have been detectable unless the door was removed from the aircraft (Figure 6).

Figure 6: Indication of a local pressurisation leak

Source: Eric Whitney, annotated by the ATSB

Airworthiness bulletin 52-004

Following the incident, the operator’s contracted aeronautical engineer developed an interim inspection procedure that was shared with CASA. On 5 August 2020, CASA held an airworthiness concerns meeting with the information available and elected to publish an airworthiness bulletin. The intent was to have a reporting recommendation to gather more data for potential further fleetwide action, if deemed necessary (and pending completion of the operator’s root cause analysis). The interim inspection procedure required a torch to be used to assist the identification of any separated areas, with a focus on tell-tale pressurisation leaks and defects to the skin edge.

Airworthiness bulletin 52-004 issue 1: Cessna 441 in Flight Depressurisation due to Emergency Exit door bonded skin failure, was released on 6 August 2020. The bulletin’s interim inspection procedure was ‘strongly recommended’ for Cessna 441 aircraft incorporating STC SVA 528, and also ‘recommended’ for all other Cessna 441 aircraft ‘as the root cause is undetermined and failure may be calendar time related, not just hours/cycles’. It was requested that a defect report be submitted to CASA if any anomalies were detected.

A search of the CASA defect reporting system found two notifications for the Cessna 441 emergency exit door after the publication of the airworthiness bulletin. Both aircraft were operating under the STC life extension program. These were:

• On 10 September 2020, a daily visual inspection of a Cessna 441 resulted in concern as to whether the emergency exit door had started to disbond. As it could not be confirmed by visual inspection alone, an ultrasonic non-destructive test was conducted, which confirmed the bondline had started to separate. The aircraft had accumulated 26,628 hours and 21,841 cycles.
• On 11 September 2020, a Cessna 441 was inspected in accordance with the airworthiness bulletin procedure and an area of disbond was found around the lower edge of the door. The aircraft had accumulated 26,993 hours and 23,214 cycles.

Flight crew immediate actions

At interview, the ATSB discussed the pilots’ immediate actions following the depressurisation. Specifically, the request to air traffic control for a descent to FL 120 in lieu of 10,000 ft, the omission of an emergency declaration, and the decision to continue to Browns Range. The OP reported that FL 120 was the first number that came to mind, but in hindsight they should have requested 10,000 ft. The OP also recognised that they did not amend the initial request as there was a lot happening.

The OP could not provide a reason why the descent request was not prefixed with the declaration of an emergency but did recall reporting ‘pressurisation issues’ and that they ‘were ok’ when air traffic control asked them to confirm ‘ops normal’. The PIC was later advised by the operator’s chief pilot that an emergency should have been declared for a rapid depressurisation incident.

Both pilots reported their decision to continue to Browns Range was influenced by the advice provided by their senior base pilot (SBP). The PIC reported that, with the benefit of hindsight, the initial decision to return to Broome was the correct course of action but noted that they had inadvertently provided some misleading information to the SBP. The OP further reported that they should have returned to Broome as they did not know the exact nature of the fault.

The SBP believed the aircraft was much further along track than it was, and that the depressurisation was due to a pipe disconnection. Post-incident, after learning the proximity of the aircraft to Broome, both the SBP and maintenance shift supervisor concurred that a return to Broome would have been more appropriate.

Special flight permit process

At interview, the maintenance shift supervisor recalled being surprised to receive a phone call from the SBP when the aircraft was at Halls Creek, in lieu of Browns Range, to discuss the fault. However, it was considered safe to continue to Broome due to the location of the defect. This decision was reached in consultation with the SBP and continuing airworthiness manager. The shift supervisor asked the SBP if tape was available for the door, which it was not. The shift supervisor reported that if the forward corner of the door had disbonded then they would not have agreed to continued flight due to the potential adverse effect of the airflow on the door. The shift supervisor also reported that they thought about CASA and the special flight permit (SFP) process but believed the SFP process would have provided the same recommendation – to tape it up and return to Broome unpressurised. The shift supervisor reported that, with the benefit of hindsight, they should have followed the CASA SFP process.

In accordance with advisory circular 21-09 v4.0: Special flight permits, regulation 21.197 (Civil Aviation Safety Regulations 1998) allows CASA or an authorised person to issue an SFP for the purpose of flying an aircraft to a base where repairs can be carried out. An SFP provides a qualified exemption to normal airworthiness requirements in order that an unserviceable aircraft may still be operated in an acceptable and safe manner, but not for commercial operations. The risk to safe flight is managed by presenting all the facts, which may include inspection requirements, to an independent authorised person or CASA inspector, who will then decide on the conditions, limitations, and/or directions that must be applied for the proposed flight.

Passenger survey

The ATSB contacted the six passengers on board the aircraft for voluntary participation in a passenger survey. Three passengers returned the survey and provided consistent responses. A summary of the responses provided was as follows:

• A safety briefing for the use of emergency oxygen masks was provided before flight.
• There was no warning of the depressurisation prior to the incident, which was described by two of the passengers as a loud noise (‘bang’). The passenger seated next to the door thought that it was ‘going to get ripped off’.
• The passenger oxygen cup-style masks were a poor fit (‘inadequate seal’) and needed to be held in place for the duration of the descent. One passenger reported that they possibly experienced dizziness, but this could have also been due to the shock. There were no reports of loss of consciousness.
• There was confusion as to what had occurred and what the pilots’ intentions were during the emergency descent until the masks were removed at 10,000 ft and the OP was able to provide an explanation. One passenger thought they were going to conduct an emergency landing.

__________

4.  The PIC’s Class 1 medical expired on 24 June 2020. However, Civil Aviation Safety Authority exemption instrument EX57/20 delayed the required renewal date until no later than 31 March 2021.
5.  The current applicable CASA airworthiness directive is AD/CESSNA 400/119: Airframe Life Limitation 2/2013.
6.  A supplemental type certificate (STC) is one form of approval of the design of a change to a type certificated aircraft, aircraft engine or propeller, when the change is not so extensive as to require a new type certificate (TC). An STC is supplementary to the original TC. It does not change the previously issued TC.
7.  The STC holder must supply instructions for continuing airworthiness to registered operators of aircraft in which the STC modification has been incorporated. They remain responsible for the continued integrity of the change to the type design and must continue to be CASA’s contact point for resolving issues if corrective action is required.

Safety analysis

Introduction

Shortly after reaching the planned cruising level of FL 270, the two pilots and six passengers on board the Cessna 441 aircraft experienced a rapid depressurisation. Oxygen masks were donned, and an emergency descent was conducted. The aircraft landed without further incident at the planned destination of Browns Range, Western Australia.

This analysis will discuss the reason for the emergency exit door failure, the adequacy of the maintenance manual inspection requirements, and the decision to depart from Browns Range for the return flight with the disbonded door skin using the minimum equipment list.

Disbonding of the emergency exit door

A structural failure investigation performed by an aeronautical engineer and reviewed by the ATSB and Textron Aviation, found that the outer emergency exit door skin had separated in-flight as a result of the propagation of a disbond between the inner and outer skin layers. The disbond likely enlarged via a progressive attack of moisture and corrosion progressing from the inside edge of the door to produce a large disbond area, resulting in a rapid depressurisation of the aircraft cabin at FL 270. The door was likely fitted since manufacture of the aircraft.

It was concluded that the initiation of the disbond was likely the result of the aircraft’s age, noting the aircraft was 42 years old and had exceeded the manufacturer’s recommended retirement life of 22,500 hours. The aircraft was operating under a supplementary type certificate for a life extension program and had accumulated 27,116 hours and 23,484 cycles.

Maintenance manual supplement

The structural failure investigation by the operator's contracted aeronautical engineer found that the corrosion was not visible on either the inner or outer surfaces of the door. The detailed visual inspection of the door edge found numerous other smaller starting points for bondline failure, some of which were difficult to see. Examination of the forward lower corner revealed failure at this location was likely imminent.

Although the engineer concluded that the initiation was likely caused by the calendar age of the aircraft, previous inspections of the incident door did not detect the presence of disbonding. The most recent was about 4 months prior to the incident.

The engineer also concluded that neither the Cessna aircraft maintenance manual nor the West Star Aviation maintenance manual supplement required specific inspection of the area that failed. Further, a detailed visual inspection of the affected area and door perimeter required removal of the door from the aircraft. In addition, the maintenance shift supervisor also reported that they did not believe a visual inspection would have necessarily detected the pre‑failure condition.

In response to the Civil Aviation Safety Authority airworthiness bulletin, two additional aircraft were found with disbonding of the emergency exit door. Both were operating under the life extension program. The first required an ultrasonic non‑destructive inspection procedure to confirm, while the second was revealed following the airworthiness bulletin visual inspection procedure.

Given VH-LBY, the two aircraft mentioned above, and the presence of a combination of excessive age, flying hours and cycles, the ATSB concluded that the Cessna 441 aircraft on the supplemental type certificate life extension program were those most susceptible to this failure. However, as none of these occurrences were found through the existing inspection procedures published in the West Star Aviation maintenance manual supplement, the ATSB concluded that the current procedures were inadequate to detect disbonding of the emergency exit door prior to failure. Although there were only a small number of aircraft currently on the life extension program, the remaining 39 Cessna 441 aircraft could potentially transition across in the future.

Decision to return using the minimum equipment list

After landing at Browns Range Airport, the pilots noted the lower aft section of the emergency exit door skin had separated and was the likely source of the depressurisation. As there was no phone coverage at the airport and the disbonded section of the door was not in the airflow, the PIC decided to depart. Although it was noted that there was an option for the pilots to contact their company from the mine site.

Both pilots reported that they expected to have mobile reception and meet their senior base pilot at Halls Creek. They also reported that the pressurisation system item in the minimum equipment list (MEL) was applied, which allowed them to continue flight below 10,000 ft with the system inoperative. The advice to the pilots that they could apply the MEL and return to Broome, was based on the reasoning that there was a fault with the pressurisation system. However, there was no fault with the pressurisation system. The aircraft had depressurised due to a structural failure that required repair.

As new information becomes available, the reasoning behind decisions may need to be re‑evaluated. In this case, the discovery of the disbonded door at Browns Range did not lead the pilots to conclude that the reasoning behind the advice to apply the MEL was no longer valid.  Similarly, when at Halls Creek, and after the operator’s maintenance personnel had been notified, there were no further discussions regarding the MEL.

The required course of action to recover the aircraft to a maintenance facility for repair was the special flight permit process. While this may not have altered the recovery actions, it would have provided an independent assurance that the return flight could be conducted in a safe manner.

Findings

From the evidence available, the following findings are made with respect to the depressurisation event involving a Cessna 441, VH-LBY, near Broome, Western Australia, on 22 July 2020.

Contributing factors

• The aircraft's emergency exit door progressively disbonded between the inner skin and outer skin, likely due to the age of the aircraft, facilitated by a combination of corrosion, moisture, and flight cycles. The weakened structure resulted in an accelerated failure of the bondline and rapid depressurisation of the cabin when the aircraft reached flight level 270.
• The inspection procedures in the West Star Aviation maintenance manual supplement for the Cessna 441 aircraft life extension program were inadequate for detecting the progressive disbonding of the emergency exit door skin. (Safety issue)

Other factor that increased risk

• The minimum equipment list item for the pressurisation system was applied for the return flight after discovery of the disbonded door skin. As a result, the special flight permit process to recover the aircraft for repair was not followed, which removed the opportunity for an independent assessment that the flight could be conducted in a safe manner.

Safety Issues and actions

Maintenance manual supplement 

Safety issue number: AO-2020-036-SI-01 

Safety issue description: The inspection procedures in the West Star Aviation maintenance manual supplement for extended life program Cessna 441 aircraft were inadequate to detect the progressive disbonding of the emergency exit door.

Safety action not associated with an identified safety issue

Additional safety action by Skippers Aviation

Skippers Aviation advised the ATSB they have/will be implementing the following safety actions:

• The importance of adhering to standard operating procedures have been discussed across the Flight Operations Department during their toolbox meetings.
• All Broome base pilots have been enrolled in additional human factors training for the elements of communication, decision-making, leadership, and threat and error management.
• A revision session on the understanding of the minimum equipment list and its application is planned for the pilots in Broome during the chief pilot’s next scheduled visit, at the end of June 2021.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aeronautical engineer for Skippers Aviation
• Broome senior base pilot for Skippers Aviation
• Civil Aviation Safety Authority
• continuing airworthiness manager for Skippers Aviation
• Flight Aware
• maintenance shift supervisor for Skippers Aviation
• passengers
• pilots of the incident flight
• quality and safety manager for Skippers Aviation
• Textron Aviation Inc.

References

Australian Transport Safety Bureau (2007), Aviation Research and Analysis Report: How old is too old? The impact of ageing aircraft on aviation safety, February 2007.

Civil Aviation Safety Authority (2020), Advisory Circular 21-09 v4.0: Special flight permits, November 2020.

Civil Aviation Safety Authority (2016), Civil Aviation Advisory Publication 37-1(5): Minimum equipment lists (MEL), March 2016.

Civil Aviation Safety Authority (2015), Advisory Circular 21-15: Supplemental type certificates, March 2015.

Whitney, EJ (2020), Emergency exit door structural failure investigation – Cabin depressurisation of VH-LBY on 22 July 2020, Report MTR-0400-001 Rev 0.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• aeronautical engineer for Skippers Aviation
• Broome senior base pilot for Skippers Aviation
• chief pilot for Skippers Aviation
• Civil Aviation Safety Authority
• continuing airworthiness manager for Skippers Aviation
• maintenance shift supervisor for Skippers Aviation
• pilots of the incident flight
• quality and safety manager for Skippers Aviation
• Textron Aviation Inc.
• United States National Transportation Safety Board
• West Star Aviation.

Any submissions from those parties will be reviewed and, where considered appropriate, the text of the draft report will be amended accordingly.

Submissions were received from:

• Civil Aviation Safety Authority
• Skippers Aviation
• West Star Aviation.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 21 July 2020, Pacific National freight train 3WB3 was travelling from Port Kembla, New South Wales to Brisbane, Queensland. The train consisted of three locomotives and 34 wagons.

At 1912, train 3WB3 stopped and remained stationary at a signal north of Loftus station. Passenger train C181 was travelling in the opposite direction on the adjacent line towards Kiama and began to pass the stationary freight train at 1918. On passing the third locomotive (NR68), the lead carriage of C181 struck an open air filter hatch on NR68. The driver of C181 heard a loud noise and as a result stopped the train at Loftus station.

Train 3WB3 then departed, with its crew unaware of the collision between the two trains before being directed to stop shortly afterwards. There were no injuries as a result of the collision but the guard’s windscreen and passenger doors on the lead carriage of C181 were damaged. One passenger door was also partially dislodged and pulled outwards from the carriage.

What the ATSB found

Passenger train C181 struck an out of gauge air filter hatch on NR68 that was likely not properly secured during recent maintenance. The checks associated with the maintenance inspections did not require a physical check that the air filter hatch was secured correctly. There were also no other mechanisms to prevent the hatch from opening if the hatch was not properly secured.

What has been done as a result

A modification to fit a secondary latch to the air filter hatches on NR locomotives was released for implementation. The intent of this modification was to prevent hatches on NR locomotives from opening and exceeding the rolling stock outline (out of gauge) if the hatch was incorrectly secured or the lock was to fail.

Safety message

Rail transport operators should review their rolling stock to ensure that appropriate risk controls are in place to prevent hatches from opening while in service and becoming out of gauge.

The investigation

The occurrence

On 21 July 2020, freight train 3WB3 operated by Pacific National was travelling from Port Kembla, New South Wales to Brisbane, Queensland. The train consisted of three locomotives (NR76, LDP004 and NR68) and 34 wagons.

Train 3WB3 departed Port Kembla at around 1727^[1] with two drivers (driver 1 and driver 2). At 1831, the train stopped briefly at Waterfall and the drivers changed positions and continued until stopping at Loftus at 1912. Train 3WB3 stopped about 400 m north of Loftus station at signal SD66UI.

Passenger train C181 consisting of four carriages was travelling towards Kiama in the Down^[2] direction and was not scheduled to stop at Loftus. At 1918, train C181 began to pass train 3WB3 near Loftus. The lead carriage 6984 of C181 struck an open air filter hatch on the third locomotive damaging the front and side of the carriage (Figure 1 and Figure 2). The driver of C181 stopped the train at Loftus station after hearing a loud noise and came to a stand at 1918:48.

Figure 1: Location and collision details

The image shows a simplified diagram for the track configuration at Loftus with the positioning of trains 3WB3 (shown in black) and C181 (shown in orange). The two diagrams A and B show the progression of C181 towards Loftus past the stationary air filter hatch (shown in red).

Source: OTSI

Train 3WB3 proceeded towards Sydney at 1920:14 with its crew unaware of the collision with C181. The driver of C181 reported the collision to network control and C181 remained stationary at Loftus.

At 1926, the crew of 3WB3 were advised by network control to inspect their train at Jannali. Driver 2 inspected one side of the leading portion of the train from the platform at Jannali and did not identify a problem. The train was then authorised to proceed to Como station for an inspection of 

the opposite side of the train. During this inspection, a large opening (missing air filter hatch) was found on the side of the third locomotive.

The collision with the air filter hatch broke the guard side windscreen and the passenger door glass on door 5, and partially dislodged passenger doors 1 and 3 (Figure 2) on carriage 6984 of C181. The air filter hatch broke free from NR68 and fell to the track after the collision with 6984. There were between 30 and 40 passengers on board C181 at the time with no reported injuries.

Figure 2: Collision damage to carriage 6984

The diagram and photos show the location of the damage on carriage 6984. The bottom of passenger doors 1 and 3 were pulled outwards by the air filter hatch.   

Source: Sydney Trains, modified (front of train image brightness adjusted) and annotated by OTSI

Context

Air filter hatch

There was one air filter hatch on each side of the NR locomotive. Each hatch was hinged on the left side and the hinge allowed the hatch to rotate through 180 degrees and lay flat against the side of the locomotive when fully opened. Depending on the direction of travel of the locomotive, either the right-hand or left-hand side (in direction of travel) could open if unsecured.

In this case, NR68 was operating in a trailing direction (drivers cab at the rear) and the air filter hatch on the left-hand side opened as shown below (Figure 3). The air filter hatch when opened protruded 935 mm past the body of the locomotive and exceeded the kinematic outline.^[3]

Figure 3: NR locomotive air filter hatch configuration

The right-hand and left-hand sides of an NR locomotive are shown. The left-hand side of the locomotive is shown with the air filter hatch open and protruding past the body of the locomotive (rolling stock outline).

Source: OTSI

The air filter hatch was fitted with two T-handle screw latches to secure the hatch (Figure 4).

• The T-handle wound a screw that operated a latch that could rotate through about 95 degrees between two end stops. On contacting an end stop, the latch would slide forward or backwards in relation to the screw rotation.
• To secure (clockwise rotation) - the latch would rotate to a horizontal position and clamp (may require a number of revolutions) against a bracket on the locomotive.
• To open (anti-clockwise rotation) - once the clamping force was lost against the bracket, the latch could rotate upwards to a vertical position allowing the hatch to open.
• The T-handle could be folded flat against the hatch when the latch was in the locked or un-locked position.

Figure 4: Air filter hatch latch

The image on the left shows the T-handle with the handle folded flat. The image on the right shows the latch in the locked position. Clockwise rotation of the T-handle would cause the latch to slide forward on the lower end stop. In response to anti-clockwise rotation of the handle the latch would rotate vertically and slide backwards on the upper end stop.

Source: OTSI

Rolling stock outlines

Trains are designed and assessed to ensure that the vehicle operates within the specified gauge. Australian Standard for Rolling Stock Outlines^[4] contained requirements to maintain acceptable clearances between rolling stock, structures and passing trains. The following was specified in relation to hatches:

4.8 Hatches

External hatches should be designed such that when open they do not protrude from the kinematic envelope [outline]. If this cannot be achieved the hatch design should include one or more of these features:

(a) Top hung (hinged at the top of the hatch).

(b) Redundancy in fastening systems.

(c) Secondary latch to open (latch shall be designed with two positions, one fully latched and a secondary latched position).

(d) Swing stop (chain or strap).

(e) Visible lock indicators.

(f) Designed to be frangible or tear-away.

This standard was not mandatory for rail transport operators but provided industry recommended practices to prevent hatches exceeding the specified gauge or kinematic outline.

Maintenance activities

Maintenance records indicated that the air filters on NR68 were replaced on 1 June 2020 requiring the air filter hatch to be opened and closed.

The following maintenance was completed on NR68 in close proximity to the air filters after they had been replaced (Table 1). United Group Limited (UGL) was the maintenance provider for Pacific National.

Table 1: Maintenance history

Journey of NR68

On 19 July 2020, NR68 operated as the lead locomotive on train 1MW2 from Melbourne, Victoria and arrived in Port Kembla on 20 July. While in Port Kembla yard on 21 July, the three locomotives were turned around and NR68 became the trailing locomotive for 3WB3. Closed-circuit television (CCTV) footage from Port Kembla yard showed the air filter hatch on NR68 in a closed position before the train departed as 3WB3.

Driver 1 reported inspecting the rear locomotive (NR68) prior to departure from Port Kembla and advised the air filter hatch was closed. A roll-by inspection^[5] was also performed of both sides as 3WB3 departed Port Kembla at 1727 and no issues were reported.

Platform footage from Helensburgh showed NR68 pass through at 1820 with the air filter hatch fully open and laying flat against the body of the locomotive. On passing Loftus platform at 1912, the air filter hatch on NR68 appeared to be in a closed or partially closed position. The train then came to a stop north of the station and the position of the hatch could not be observed.

The crew of 3WB3 reported passing four trains travelling in the Down direction prior to Loftus without incident.

Safety analysis

Post collision the air filter hatch was found to be missing one (lower) of the two latches, probably the result of the collision although the missing latch was not recovered. The remaining latch (upper) was inspected and functioned as expected. Both hinges failed during the collision sequence as the hatch detached from NR68.

The unsecured air filter hatch on NR68 probably opened after passing Loftus or was drawn outwards by the air pressure associated with the passing of C181 when it was struck.

It is likely that the air filter hatch on the left-hand side of NR68 was opened during one of the recent maintenance activities, although there was no specific requirement for the hatch to be opened. The most recent maintenance activity on NR68 was completed on 17 July 2020, NR68 then operated in a leading direction between Melbourne and Port Kembla on 19 July. If the hatch had been opened and not secured correctly on 17 July, the hatch would probably be less likely to open in transit as the hatch needed to open against the direction of travel.

The design of the air filter hatch and locks meant that the hatch could appear visibly closed and locked without it being secured correctly. The inspections following maintenance and the roll-by inspections prior to departure, would be unlikely to detect an unsecured hatch unless the hatch was obviously open.

The locking and hinge arrangement of the air filter hatch allowed the hatch to exceed the kinematic outline and presented a risk to people, structures and passing trains if the locks failed or the hatch was incorrectly secured. While the hatch was not required to be designed in accordance with AS 7507:2017, the inclusion of some of these features specified in the standard would likely have prevented this occurrence.

Findings

From the evidence available, the following findings are made with respect to the collision between out of gauge freight train 3WB3 and passenger train C181 on 21 July 2020.  

Contributing factors

• The air filter hatch was likely not properly secured on NR68 during one of the recent maintenance activities allowing the hatch to open during the journey of 3WB3 which was struck by C181.
• The maintenance inspections did not require a physical check that the air filter hatch was secured correctly. Additionally, there were no other mechanisms to prevent the air filter hatch opening if it was not properly secured.

Safety actions

Safety action by Pacific National and United Group Limited

Pacific National advised that the following safety actions were taken by Pacific National and its maintenance provider United Group Limited (UGL):

• Completed an inspection of the air filter hatches across the fleet of NR locomotives to check the integrity of the locks and hinges.
• Assessed the design of hatches that could open and exceed the rolling stock outline for NR locomotives if the hatch was incorrectly secured or the lock was to fail. This identified a separate hatch (CA10 communications cabinet located at platform level on the left-hand side behind the driver’s cab) that could exceed the rolling stock outline.
• Completed an inspection of the CA10 hatches across the fleet of NR locomotives to check the integrity of the locks and hinges.
• Issued a bulletin to maintenance staff in November 2020, detailing the correct procedure for securing hatches.
• Developed a design change to install a secondary latch to the air filter and CA10 hatches under Field Modification Instruction (FMI-1752 – Secondary Latch Install on NR Locos).

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• NSW Trains
• Pacific National
• Sydney Trains.

References

Rail Industry Safety and Standards Board (2017). AS 7507:2017 - Rolling Stock Outlines.

Rail Industry Safety and Standards Board (2021). Glossary of Terms. Accessed at: https://www.rissb.com.au/glossary/

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• NSW Trains
• Office of the National Rail Safety Regulator
• Pacific National
• Sydney Trains
• Transport for NSW.

Submissions were received from:

• Pacific National.

The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1.  Times shown in 24-hour format as Australian Eastern Standard Time (AEST).
2.  The Down direction refers to the direction of travel for trains heading away from Sydney. The Up direction refers to trains heading towards Sydney.
3.  Kinematic outline - A two-dimensional cross-section of the shape of a vehicle that consists of the static outline plus the maximum permitted allowance for vertical bounce upwards plus lateral and roll movements in response to a steady-state cant deficiency force at maximum permitted cant deficiency (or the maximum permitted installed cant) and dynamic movements in response to track irregularity.
4.  Rail Industry Safety and Standards Board (2017). AS 7507:2017 - Rolling Stock Outlines
5.  Roll-by inspections are a visual inspection of moving rail traffic to identify equipment, loading security or other defects or failure

The occurrence

On 14 July 2020, at about 0700 Western Standard Time,^[1] a SPENO rail grinder track machine crew prepared for planned work on the Up Main line near Midland, Western Australia. At about 0830, the rail grinder crew received authority from the network control officer (NCO) to occupy the Up Main line between Midland and Forrestfield. The rail grinder departed Midland in the wrong running direction on the Up Main line, then travelled over the Robinson Road level crossing to begin work on the ARC Infrastructure network metro line. The rail grinding work was within the activation zone for the Robinson Road level crossing, which resulted in the flashing lights activating and the booms lowering to protect the crossing.

Due to the extended operation of the level crossing, road traffic began to build-up along Robinson Road. Some motorists ignored the warning signals and drove around the boom gates and across the level crossing without knowing if safe to do so.

At about 0930, an employee (RG1) associated with the rail grinder, travelling to the Midland Yard, noticed that road traffic was queued and that some motorists were driving around the boom gates. The RG1 stopped motorists from crossing until it could be confirmed that no trains were approaching.

The RG1 called the rail grinder crew and advised them that the presence of the rail grinder working had triggered the level crossing and traffic had queued and some illegally crossed. A second employee (RG2) attended the level crossing to assist with traffic management.

The RG2 contacted the protection officer on the rail grinder to determine train running information. They confirmed that, based on information obtained from the NCO the night before, there were no approaching trains.

The RG1 and RG2, with technical assistance via phone from the protection officer, latched the boom gates in the up position and began to allow road traffic over the level crossing. The NCO was unaware of this altered working condition at the Robinson Road level crossing.

At about 1034, the rail grinder completed work, outside of the level crossing activation zone, and travelled toward Midland in the right running direction on the Up Main line. The RG1 and RG2 restored the level crossing to normal operation and unlatched the boom gates. Once the rail grinder entered the activation zone, the level crossing activated and the booms lowered into place. Once the rail grinder cleared the level crossing, it restored to normal with the booms raising to the normal parked position. On observing this, the RG1 and RG2 departed in preparation for the next level crossing. Unbeknown to the RG1 and RG2, the raised boom gates had relatched into the locked (up) position.

The rail grinder and its crew proceeded to the next work location during the allocated time between trains and in accordance with their authority. A short time later, the rail grinder was moved clear of the Up Main line to allow train 2430 to pass.

Freight train 2430, travelling towards Perth on the Up Main line, passed through the Robinson Road level crossing. At that time, the train crew noticed that the boom gates had not lowered, however, the flashing lights operated. The crew reported their observations to the NCO. The NCO reported the fault to an on-call signal electrician. During this conversation, it was noted that the rail grinder had been working in the area and may be involved. The RG1 heard this call and went back to the crossing, where they identified that the boom gate locking mechanism had been locked into the latched-up position. They subsequently locked the boom gate into the unlatched (normal) position. Shortly after, the signal electrician attended the crossing and did not identify any faults.

Investigation activities

During the investigation, the ATSB:

• interviewed members of the rail grinder work team
• analysed the rail grinder scope of work
• conducted analysis of data from event recorders and signalling infrastructure equipment
• analysed the reasons for the level crossing activation and degraded level of protection
• analysed the actions of the work crew
• conducted preliminary analysis of training and human factor aspects
• conducted an initial review of the rules and procedures for level crossing boom management and design
• conducted a document review of local agreements and regulatory requirements
• liaised with key stakeholders.

ATSB observations

From the investigation, the ATSB determined:

• Following completion of rail grinding work near the Robinson Road active level crossing, the boom gate locking mechanisms were left in a position that resulted in providing partial protection as train 2430 approached and passed through the crossing.
• The proximity of the rail grinder work to the level crossing meant that the crossing protections were continuously activated, which resulted in road users driving around the boom gates. Consequently, the gates were latched and locked in the up position.
• The project planning and approval process for the rail grinding work did not identify the possibility of interference with the level crossing operation and the road network. This led to inadequate traffic management being placed at the level crossing resulting in traffic queues and an ad hoc response latching the boom gates.

Reasons for the discontinuation

The ATSB gives priority to transport safety investigations that have the potential to deliver the greatest public benefit through systemic improvements to transport safety.

Given the ATSB’s constrained resources, the ATSB considered it was unlikely that further investigation would identify systemic safety issues or identify opportunities for the enhancement of transport safety. Consequently, the ATSB has discontinued this investigation.

The ATSB has briefed ARC Infrastructure and SPENO about its observations from this investigation and potential learnings. However, it considered that broader communication of this information would not be of significant benefit to other parties.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

__________

1.  Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.

Safety summary

What happened

On 9 July 2020, at about 0005 Eastern Standard Time, a Beechcraft 200 aircraft, registered VH‑FDO and operated by the Royal Flying Doctor Service, Queensland Section, was on approach to Cairns Airport, Queensland. On board the aeromedical flight were the pilot in command under supervision, supervisory pilot, flight nurse and two patients.

The Cairns runway 15 threshold was temporarily displaced due to runway works. During the approach, the flight crew sighted an airport safety officer’s car with its headlights directed at what appeared to be a row of lights across the runway, illuminating the displaced threshold. The aircraft passed above the row of lights and touched down beyond it. However, the aircraft had landed short of the actual displaced threshold and struck an unseen temporary runway end light. 

What the ATSB found

The ATSB found that the airport safety officer's car headlights were directed at reflective witches’ hats that marked the works limit line, which was in front of the displaced threshold. To the flight crew, this appeared as a row of lights across the runway. As a result, the flight crew misidentified the aerodrome works limit line as the displaced runway threshold lights. The actual displaced threshold lights were also indistinguishable from the taxiway lights that remained illuminated during the approach. This resulted in a runway undershoot as the aircraft landed short of the displaced threshold.

The works and airport safety officers laid out the aerodrome works lighting but did not ensure it was arranged such that the location of the displaced threshold was unambiguous to the flight crew. The requirement that lighting was not confusing to pilots was stipulated in the Civil Aviation Safety Regulations Part 139 (Aerodromes) Manual of Standards. However, the Cairns Airport procedures for temporary runway works lighting and markings were inconsistent and did not ensure they were laid out in accordance with the required standards.

What has been done as a result

After the incident, the following safety actions were taken by Cairns Airport for the remaining runway works:

• no vehicle headlights were to be directed towards the active runway
• the works limit line was marked by a single amber light on the side of the runway
• taxiway lights were only illuminated after an aircraft had landed
• witches’ hats with reflective tape were not to be used
• the notice to airmen was amended to advise that taxiways were not available, and of temporary blue taxiway edge lighting
• green temporary displaced threshold lights were replaced with solar lighting that did not require electricians to wire.

Safety message

Aerodrome works can pose a hazard to aircraft, particularly where there are unusable portions of a runway and a displaced runway threshold. Aerodrome works markings and lighting must be unambiguous and laid out in accordance with relevant standards, to minimise the likelihood of confusion for flight crew and the potential for a runway undershoot or excursion.

The occurrence

Tasked flight

On 8 July 2020, at about 1900 Eastern Standard Time,^[1] a Beechcraft 200 aircraft, registered VH‑FDO and operated by the Royal Flying Doctor Service (RFDS) Queensland Section, departed Cairns Airport, Queensland. The pilot in the left seat was in command under supervision (ICUS) of the supervisory pilot in the right seat. A flight nurse was also on board for the aeromedical flight, which collected one patient at each of Northern Peninsula and Kowanyama Airports, before returning to Cairns.

Cairns Airport was undergoing runway works, with the runway 15 threshold temporarily displaced 1,856 m. While the runway was closed at night during the works, a portion of the runway was available to the RFDS with prior notice. As such, when the aircraft departed Kowanyama at 2310, the pilot ICUS contacted air traffic control (ATC) to advise of their estimated arrival time in Cairns. The Cairns Tower controller subsequently radioed the duty airport safety officer (ASO) to let them know the aircraft was expected to arrive at 0013 (on 9 July).

When the controller switched on the runway and taxiway lights in anticipation of the arrival, the duty ASO reported driving in a southerly direction to make sure the green displaced threshold lights were visible. The duty ASO then drove to taxiway B3 and stopped at the holding point, angled about 45° down the runway, with the safety car headlights pointing at the works limit line (refer to section titled Works limit lights and markers and Figure 4). Closed-circuit television footage of the incident showed that the headlights were on high beam, however, the ASO thought they were on low beam at the time.

Arrival at Cairns

At about 0003, while on descent, the pilot ICUS contacted the Cairns Approach controller and advised that they had received the current automatic terminal information service.^[2] This included that the landing distance available was 1,300 m and the instrument landing system (ILS)^[3] was not available. The Approach controller responded that they should expect the area navigation Z (RNAV-Z) approach to runway 15 with displaced threshold as per the notice to airmen (NOTAM).^[4]

Two and a half minutes later, the controller cleared the flight crew to conduct the RNAV-Z approach. The flight crew then briefed for that approach, noting that there would be no precision approach path indicator^[5] or ILS guidance.

The RNAV-Z approach was programmed in the aircraft’s flight director to fly a 3° profile to the minimum descent altitude,^[6] which was 860 ft. Continuing the 3° profile would take the aircraft to the actual runway threshold, therefore, the flight crew planned to fly a short level segment until the aircraft intercepted a visually assessed position from which a 3° approach to the displaced threshold could be made.

When about 8 NM (15 km) prior to the runway threshold, the pilot ICUS extended the landing gear and selected the landing lights on. The Approach controller instructed the pilot to contact Cairns Tower, and at 0010:15, as the aircraft descended through about 1,900 ft, the Tower controller cleared the flight crew to land. At that time, the aircraft became clear of cloud and the pilot ICUS recalled seeing a large spotlight where the workers were operating at the closed end of the runway. When the aircraft descended to 860 ft, the flight crew had the runway in sight. The flight crew could also see the safety car with its headlights on, which appeared to be directed at a row of lights across the runway, depicting what they believed to be the displaced threshold.

At the time, the duty ASO observed that the reflective band on the witches’ hats were lit up ‘incredibly brightly’ with ‘a bright white light extending across the runway’.

The pilot ICUS reported selecting the autopilot off, flying a short level segment, and a 3° approach profile to what they assessed was the displaced threshold. The flight crew recalled that the aircraft passed over the displaced threshold at about 50 ft and touched down about two runway edge lights (120 m) beyond that, in accordance with normal procedures. However, at about 0018, the ASO observed the aircraft touch down short of the displaced threshold. The Airservices Australia radar data also showed that the aircraft landed at about the position of the temporary runway end lights, which were 60 m prior to the displaced threshold. The ASO reported not taking any further action that night, as there were no abnormal communications between the flight crew and the Tower controller. The flight crew taxied to the hangar and shut down the aircraft. 

Post-flight inspections

Later that morning, at about 0500, an ASO reported that one of the temporary runway end lights was broken. The metal base had been pushed about 30 cm across the runway and the red light was shattered. No aircraft other than VH-FDO had landed the previous night.

The aircraft operator’s senior base pilot was advised of the broken light by Cairns Airport personnel. The senior base pilot phoned the flight crew and asked whether the aircraft had struck anything the previous night, but neither was aware that it had. The supervisory pilot subsequently found a corresponding scuff mark on the right main landing gear tyre of VH-FDO. After some investigation, it was established that the flight crew had misidentified the works limit line as the displaced runway threshold and landed short of the displaced threshold. The aircraft tyre had struck the temporary runway end light, which was taped to be unidirectional to aircraft using runway 33 and was therefore not visible to flight crew when they landed on runway 15 (Figure 1).

Figure 1: Example of temporary runway end light – taped to be unidirectional

Source: Cairns Airport

___________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Automatic terminal information service: The provision of current, routine information to arriving and departing aircraft by means of continuous and repetitive broadcasts during the hours when the unit responsible for the service is in operation.
3. Instrument landing system: A precision instrument approach system which normally consists of the following electronic components: VH localiser, UHF glideslope, VHF marker beacons.
4. NOTAM: A notice distributed by means of telecommunication containing information concerning the establishment, condition or change in any aeronautical facility, service, procedure or hazard, the timely knowledge of which is essential to personnel concerned with flight operations.
5. Precision approach path indicator consists of four lights perpendicular to the runway abeam the touchdown point, which transition between red and white depending on the aircraft’s approach slope.
6. Minimum descent altitude: A specified altitude in a 2D instrument approach operation or circling approach operation below which descent must not be made without the required visual reference.

Context

Personnel information

Pilot in command under supervision

The pilot ICUS held a Commercial Pilot Licence (Aeroplane), an instrument rating and a Class 1 Aviation Medical Certificate. The pilot had been an RFDS pilot for 12 months and had accrued 1,864 hours of aeronautical experience, of which 515 hours were in the Beechcraft 200- and 300-series (King Air) aircraft, and 55.4 hours at night. At the time of the incident, the pilot had been awake for 9 hours and on duty for 6 hours, with a self-assessed fatigue level^[7] of ‘3: okay, somewhat fresh’.

Supervisory pilot

The supervisory pilot had been an RFDS pilot for over 17 years and had accrued nearly 13,000 hours total flight time, of which 6,224 hours were in the King Air aircraft and about 3,000 hours were at night. This experience included routinely operating into remote airstrips, with the use of improvised runway lighting. At the time of the incident, the supervisory pilot had been awake for about 7 hours and on duty for 6 hours, with a self-assessed fatigue level of ‘2: very lively, responsive, but not at peak’.

Aerodrome information

Cairns Airport runway works

The first two stages of Cairns Airport runway works had been completed, which involved removing and re-laying the asphalt runway surface. Stage three commenced on the night of 8 July 2020 and involved grooving the newly laid surface. For the duration of the works, the runway was closed at night other than for nominated aircraft. For those aircraft, a portion of the runway was available, with a temporarily displaced threshold. 

In preparation for commencement of the works that night, there were three ASOs, including one as the designated works safety officer (WSO) and one as the duty ASO. They were tasked with laying out the required aerodrome works lighting and blanking out runway and taxiway lighting on the unusable portions of the aerodrome. The portable lighting they laid out was:

• five green lights either side of the runway to mark the displaced threshold
• runway end lights across the width of the runway that appeared red for aircraft landing on runway 33, but were taped with black tape so that they were not visible to pilots of aircraft arriving on runway 15
• reflective witches’ hats (Figure 2) placed on the works limit line, with an orange flare torch placed between each pair of hats.

The WSO and ASOs commenced this task at about 2110. When completed, the WSO advised the Cairns Tower air traffic controller that the threshold was displaced as per the NOTAM (refer to section titled Pre-flight planning).

Figure 2: Witches’ hats used to mark the works limit line

Source: Cairns Airport 

Regulations regarding aerodrome lighting

Regulations pertaining to aerodromes were specified in the Civil Aviation Safety Authority’s (CASA) Civil Aviation Safety Regulations 1998, Part 139 (Aerodromes) and the associated Manual of Standards (MOS). Much of that information was also published in the Airservices Australia Aeronautical Information Publication, Part 3 – Aerodromes. The following was specified in the MOS with regard to runway lighting and markings.

General guidance

It is important for pilot recognition and interpretation of aerodrome lighting systems, that standard configurations and colours be used. The pilot always views the aerodrome lighting systems in perspective, never in plan, and has to interpret the guidance provided, while travelling at high speed, often with only a limited segment of the lighting visible. As time will be limited to see and react to visual aids, particularly in the lower visibilities, simplicity of pattern, in addition to standardisation, is extremely important.

Displaced threshold lighting

Applicable to the Cairns runway width, five green lights either side of the runway depicted a temporarily displaced threshold.

Runway edge lighting

Due to the works in progress, runway 15 was a non-precision approach runway. As such, it was required to have runway edge lights along both sides of the full length of the runway available for use. At least six red runway end lights were required to be positioned across the runway, between these runway edge lights. The 60 m of the runway that was available for aircraft use prior to the displaced threshold was required to have runway edge lights showing red in the direction of approach. The ground crew had covered all edge lights prior to the displaced threshold.

Taxiway centreline lighting

The green taxiway centreline lights in the vicinity of the displaced threshold were required to not cause confusion with the green displaced runway threshold lights.

Extinguish closed portions

When all or part of a runway or taxiway is closed, all the associated aerodrome lighting must be extinguished. Additionally, the lighting was required to be electrically isolated or disabled, to prevent inadvertent activation of the lights. However, it was acceptable to cover lights with an opaque cover for short time periods provided the cover was firmly attached to the ground and could not be dislodged, and it did not pose a hazard to aircraft operations.

Works limit lights and markers

The works limit line, also known as the equipment limit line (ELL) delineates a safety barrier for workers. Portable amber, yellow or orange works limit lights were to be used to indicate the limits of the works area to the works personnel.

Daytime works limit markers were fluorescent orange PVC cones or witches’ hats (Figure 3). These were to depict aerodrome works to the works personnel and not to convey information to pilots regarding the movement area.

Figure 3: Works limit marker

Source: CASA

Civil Aviation Safety Authority guidance

The stated purpose of CASA’s Advisory Circular 139-20(0) – Safe planning and conduct of aerodrome works was ‘…to discuss the areas of safety concern and offer suggestions on how to minimise the hazard which may be created by aerodrome works’. The circular also noted that it was the aerodrome operator’s responsibility to ensure aerodrome safety during aerodrome works. Of particular relevance to this incident, the circular included the following regarding the extinguishing of unnecessary lighting and the use of vehicle headlights:

10.6 Extinguish Unnecessary Lights – Aerodrome lighting must show only the usable aerodrome facilities. Where because of aerodrome works, a portion of the runway or taxiway is not usable, the lights on those portions of runway or taxiway must be extinguished so as not to create confusion. One method of extinguishing a light is to place masking tape over the light, another is the use of a bucket to cover the light.

11.3 If there are aircraft operations at night, the lights from vehicles engaged in night work must not cause confusion to pilots. Vehicle light fittings should be checked to ensure that the lights are not directed unduly upwards. Drivers must be told that as a matter of course, high beam is not to be used.

Method of working plan

The MOS required a method of working plan (MOWP) for the works to be conducted at Cairns Airport. The Cairns Airport MOWP included that, for stage three of the works, the runway would be closed nightly until 1 August 2020 for specified hours. The closure would be advised by NOTAM and applied to all aircraft operations except for RFDS King Air and other nominated aircraft. For these aircraft, the runway could be used with 30 minutes prior notice. The MOWP also included template text for the NOTAMs.

The MOWP stipulated that the designated WSO’s responsibilities included ensuring:

• the safety of aircraft operations
• unserviceability markers and lighting were placed in accordance with the MOS.

The MOWP also stated that:

• works personnel were to remain behind the works area limit line marked by a row of orange witches’ hats
• drivers must use low beam only on vehicle headlights.

The RFDS operational procedures supplement to the MOWP documented the arrangement between Cairns Airport, RFDS and Cairns ATC, to allow for medical flights to continue during the scheduled runway works. Much of the information detailed in the supplement was provided to the flight crew in a notice to aircrew (NOTAC) (refer to section titled Pre-flight planning).

Runway works drawing

The drawing of the overlay for the runway 15 displaced threshold operations, an extract of which is depicted in Figure 4, was an annex to the MOWP. The drawing indicated that the displaced threshold was 1,856 m beyond the permanent runway 15 threshold, and the temporary runway end was 60 m prior to the displaced threshold. The works limit line was 200 m prior to the runway end and there was 260 m between the works limit line and the displaced threshold. The legend for the drawing described the following:

• equipment (works) limit line was orange witches’ hats during daylight hours and flashing amber lights at night
• runway end lighting was at least six lights spaced evenly between the rows of runway edge lights
• displaced threshold lighting was five green lights either side of the runway, 2.5 m apart, with the innermost lights on each side omnidirectional and in line with the runway edge lights.

Figure 4: Extract of drawing depicting the displaced threshold and associated lighting

Source: Cairns Airport, annotated by the ATSB

Laying out the lights

Airport safety officers

Of the three ASOs assigned for the works on the incident night, one was designated the WSO and another the duty ASO. While the WSO was responsible for aerodrome safety according to the MOWP, the three ASOs worked together to set up the runway lighting. The duty ASO was the most experienced, having worked at Cairns Airport for 34 years.

When the WSO collected the witches’ hats from their storeroom, there were no MOS-compliant orange witches’ hats available, only traffic cones with reflective bands (Figure 2). These were branded with ‘ELL’, which indicated to the WSO that they were appropriate for use. The WSO reported that an orange flare torch was placed between each pair of witches’ hats on the works limit line.

Blacking out lights

Inset lights, recessed into the aerodrome surface, were blacked out with 400 x 400 mm carpet tiles and raised lights were covered with a vinyl sock. The ASO reported that they laid carpet tiles over the runway end lights, lead-on and lead-out lights for taxiways B2 and B3, holding point lights, and taxiway A2. They placed a vinyl sock over each of the runway edge lights between the displaced and permanent runway 15 threshold, and on the blue lights on the aircraft turning areas on the runway.

Taxiways A3, B3, A4 and B4 remained lit from the holding point, and taxiway A4 and ‘some of’ A3 (green) lead-in lights and temporary blue taxiway edge lighting parallel to the runway between A3 and A4 remained illuminated. In accordance with the NOTAM, the high intensity approach and runway lights, and the precision approach path indicator were not available and were therefore not selected on by the Cairns Tower air traffic controller. There was no reference to the closed taxiways in the NOTAM.

During stage two of the works, as the runway asphalt was progressively taken up and new surface laid, electricians isolated light circuits, removed and re-laid the cables, thereby extinguishing taxiway lights. This was not done for stage three. On the incident night, an electrician assisted with laying out the temporary displaced threshold lights and runway end lights. After the incident night, these were replaced with solar lights that did not require wiring.

Works safety officer tasks

The first task for the WSO each night was to attend the works contractors’ ‘toolbox’ meeting as the representative for Cairns Airport. The WSO reported that, on the incident night, the contractors’ toolbox meeting was scheduled to start at the time the WSO arrived at work. After attending the meeting, the WSO recalled then being pushed for time to get the runway set up. The WSO split the tasks to be completed with the two ASOs, so that one person did either side of the runway, and the third did the threshold and runway end lights. Despite the rush, the WSO and ASOs thought the displaced threshold and lighting was set up correctly. Subsequent to the incident night, the rostering was amended to allow more time between the start of shift and commencement of runway works for the WSO to set up and check the works lighting.

The WSO reported that their normal plan each night was to enter the runway to cover and lay out the lights at the commencement of the works hours. The WSO was responsible for ensuring the runway was set up according to the MOWP, drawing, associated emails, and the MOS, which were accessible on an iPad.

Once complete, the WSO advised the Cairns Tower controller, and the other ASOs resumed their normal duties. When the works contractors started work, the WSO was then responsible for monitoring the worksite, and escorting workers on and off the site. 

Works checklist

Cairns Airport issued a works safety officer tasking list when stage one of the works commenced. The checklist detailed the items to be completed by the WSOs and ASOs at the start and end of each shift. The items were based on the car number and assigned role, however, car 18/34 was referenced, which was not in use for stage three. The WSO reported that they had used a checklist when they first started the works, but not for stage three. The WSO checklist tasks for the start of shift that also applied to stage three included:

• attend the works toolbox meeting
• set up the works limit line
• request ATC deselect the lighting as required
• deploy the displaced threshold – carpet squares on inset lighting, cover runway lighting and tape lights as required
• confirm with ATC that the displaced threshold has been established and request selection of the runway lighting to confirm the visual aids are correct.

According to the checklists, the duty ASO was to conduct a runway inspection with the aerodrome ground lighting energised, prior to any RFDS movement and prior to the runway being opened after the works. The ASO was also required to check the NOTAMs for accuracy. There was no reference to covering taxiway lighting in the checklist.

Closed-circuit television footage

Closed-circuit television footage taken of the incident flight, showed that the taxiway lights were illuminated, including the A3 and B3 taxiways. The safety car headlights were on high beam and directed at the witches’ hats (designating the works limit line), and the runway edge lights between the witches’ hats and displaced threshold were not visible.

Lighting on a subsequent night

Several nights after the incident, the flight crew again flew into Cairns, using the runway 15 displaced threshold. The flight crew reported that, compared to the incident night, the displaced threshold was distinct and that, due to the absence of extraneous lighting, there was no confusion. Differences to the runway lighting arrangement included:

• the reflective witches’ hats were absent and a single amber light to the side of the runway marked the works limit line
• no safety car headlights were directed at the runway
• taxiway lights were deselected until the aircraft landed such that the only green lights leading to/from and perpendicular to the runway were the displaced threshold lights
• there was no runway lighting prior to the displaced threshold (Figure 5).

Figure 5: Runway lighting for the runway 15 displaced threshold several nights after the incident

Source: Flight crew

Operational information

Pre-flight planning

The flight crew signed on at about 1800, were tasked for the flight and conducted the pre-flight planning. The pilot ICUS performed aircraft weight and balance, and fuel calculations, and discussed the implications of the NOTAMs and forecast weather with the supervisory pilot. The aircraft operator provided the NOTAMs to flight crew, transcribed as NOTACs.

Regarding stage three of the runway works, the NOTAC detailed the work periods when the displaced thresholds would be in place and that initially, the runway 15 threshold would be displaced 1,856 m, followed by displacement of the runway 33 threshold. While the runway 15 threshold was displaced, aircraft would be required to enter and exit the runway via taxiway A4 and backtrack the runway as required.

The NOTAC referenced the MOWP drawing (refer to the extract in Figure 4), detailed the runway lengths, and take-off and landing distances available. The NOTAC also stated that the localiser, glide path, precision approach path indicator and high intensity approach and runway lighting were not available. It stated that the temporary threshold would be lit by five green lights each side of the runway.

The flight crew received and reviewed the NOTAC and MOWP 2 days prior to the incident. Then, during the pre-flight briefing, they noted that it was the first night the runway threshold would be displaced for stage three works. They also identified that the ILS would not be available and that they expected to conduct the RNAV-Z approach to Cairns.

Flight crew interpretation of aerodrome works lighting

During the approach to Cairns, both flight crew assessed that the lit witches’ hats looked like a row of lights indicating the displaced threshold, although both thought it odd that the safety car’s headlights were directed at the threshold. The flight crew also reported that the actual displaced threshold green lights placed either side of the runway merged with the green taxiway centreline lights. This resulted in multiple rows of green taxiway lights extending from both sides of the runway.

The pilot ICUS recalled aiming to land two runway edge lights beyond what they assessed was the displaced threshold. Therefore, the pilot ICUS thought that the runway edge lighting must have been on from between the works limit line and displaced threshold. However, closed-circuit television footage correlated with the ASO reports that those runway edge lights had been covered and were not visible. The lights the flight crew referenced as cues were therefore not runway edge lighting, but may have instead been temporary taxiway edge lighting on the western side of the runway.

Earlier that night, the flight crew had landed at Kowanyama and Bamaga Airports, which had lighting that created rectangular runways. The lit witches’ hats, which they thought were lights across the runway, made the Cairns runway also look rectangular.

Aircraft landing lights

The aircraft had two landing lights and a third designated as a taxi light, all attached to the nose landing gear leg. It was standard practice to select all three lights on for landing (and take-off). The landing lights were high intensity discharge lights, which the pilot ICUS reported were only ‘useful’ from about 500 ft above the runway elevation. The aircraft fleet’s landing lights were gradually being replaced with LED lights, but VH-FDO’s had not yet been replaced.

Similar occurrences

A search of the ATSB’s occurrence database for the 10 years prior to the incident identified 10 runway undershoot events involving a displaced threshold, all of which occurred during daylight hours. Nine of these were during runway works and one was with a permanently displaced threshold. None resulted in injuries.

______________

7. The ATSB and RFDS Queensland Section use the Samn-Perelli fatigue scale from 1 (Fully alert. Wide awake. Extremely peppy) to 7 (Completely exhausted. Unable to function effectively. Ready to drop).

Safety analysis

Introduction

Runway 15 at Cairns Airport, Queensland had a displaced threshold due to runway works. During landing on that runway at night, the aircraft touched down prior to the displaced threshold.

This analysis details the flight crew’s interpretation of the aerodrome works lighting and the airport safety officers’ actions in laying out the lighting. Although the works safety officer reported that the tasks to lay out the lighting were rushed, they were of the view that the aerodrome works lighting had been set up correctly. Additionally, Cairns Airport’s planning and procedures for establishing the aerodrome works lighting will be considered.

Displaced threshold misidentification

It was the first night the flight crew had operated into Cairns with the temporarily displaced runway 15 threshold in place, and they had briefed for, and set up the approach accordingly. While on approach, the flight crew sighted the airport safety officer’s car headlights directed at what appeared to be a row of lights.

The pilot in command under supervision and the supervisory pilot, who was highly experienced at operating at night, both misidentified the row of lights as the displaced threshold. Like the two previous runways they had landed on that night, the runway lighting appeared to form a perfect rectangle. Additionally, the five green displaced threshold lights placed either side of the runway, were indistinguishable from the green taxiway centreline lights and did not alter the flight crew’s misperception of the threshold.

Although the pilot in command under supervision reported aiming to land the aircraft two runway edge lights beyond the displaced threshold, those lights were extinguished, and it could not be determined what the pilot had referenced as runway edge lights. Nevertheless, due to the misidentification, a runway undershoot occurred. The radar data showed that the aircraft landed short of the displaced threshold, near the temporary runway end lights and beyond the works limit line. As a result, the aircraft’s right main landing gear tyre contacted a temporary runway end light, which was blacked out and not visible to the flight crew.

Lighting requirements

The works safety officer was responsible for ensuring the aerodrome works lighting was in accordance with the Manual of Standards Part 139 – Aerodromes (MOS) and that it was unambiguous to pilots. The works safety officer was assisted by two other experienced airport safety officers in laying out the aerodrome works lighting. However, they did not identify that the witches’ hats with reflective bands were contrary to the MOS and the method of working plan (MOWP) diagram.

Further, the use of the safety car headlights on high beam, as shown in the closed-circuit television footage, was contrary to the MOWP. The duty airport safety officer believed that it was the aircraft’s landing lights (rather than the safety car headlights) that illuminated the reflective bands. However, the aircraft’s lights were not effective from the height at which the flight crew had misidentified the works limit line as the displaced threshold.   

Additionally, the MOS required that lights on unusable portions of the aerodrome were extinguished so as not to create confusion to pilots. In the two previous works stages, electricians had isolated and removed taxiway (and other) lights. However, this was not done for the third stage of works and the unusable taxiway lights were not blanked out. The lights remained illuminated on taxiways that were not available for use by the flight crew. Leaving the green taxiway centreline lighting illuminated perpendicular to the runway increased the likelihood of confusion with the green displaced threshold lighting. 

Therefore, the combination of the safety car headlights lighting up the reflective witches’ hats and the lit taxiways did not ensure that the displaced runway threshold was unambiguous to the flight crew.

Cairns Airport procedures

The MOWP stated that the works limit line was to be designated by orange witches’ hats, which was not in accordance with the MOS for night-time works. In contrast, the MOWP diagram specified the use of amber flashing lights to designate the works limit line at night and witches’ hats only for daytime works, which was in accordance with the MOS. The MOS also specified that red runway edge lights were required in the usable runway (60 m) prior to the displaced threshold, however, these were not included in the MOWP diagram or laid out.

Additionally, during previous works stages, the green taxiway lights were isolated and removed by electricians. Electricians would not be doing this for stage three, therefore the taxiway lights had to be extinguished to avoid potential confusion with the green displaced threshold lights. However, deselecting or covering the taxiway lights was not included in the MOWP.

Lastly, Cairns Airport had provided checklists to the works and airport safety officers detailing the tasks to be completed, but ground crew had not used the checklist for stage three. The checklist referenced tasks by car number, which required amendment to reflect the roles for stage three and did not include covering or extinguishing taxiway lighting. Use of an appropriate checklist would have assisted the airport safety officers with setting up the runway correctly, particularly as they were unaware prior to the incident that the lighting was ambiguous.

Therefore, it is important that procedures are in place to ensure runway works lighting and markings are in accordance with the standards. As it was, the Cairns Airport procedures were inconsistent, and did not assure the works lighting met the requirements, including that the lighting was unambiguous to pilots.

Findings

From the evidence available, the following findings are made with respect to the runway undershoot involving Beechcraft 200, VH-FDO, at Cairns Airport, Queensland, on 9 July 2020.

Contributing factors

• The flight crew misidentified the aerodrome works limit line for the displaced runway threshold lights, resulting in a runway undershoot and collision with an unseen portable runway end light.
• The works and airport safety officers did not ensure the aerodrome works lighting was arranged such that the location of the displaced threshold was unambiguous to the flight crew.
• Cairns Airport procedures for temporary runway works lighting and markings were inconsistent and did not ensure lighting was not confusing to pilots.

Safety actions

Additional safety action by Cairns Airport

Following the incident, and for the duration of the remaining runway works, Cairns Airport took the below safety actions.

• No vehicle headlights were to be directed at the active runway during any aircraft operations on, or on approach to, the runway.
• The works limit line was marked by an amber solar-powered light only.
• Witches’ hats with reflective tape were not to be used.
• Air traffic control was requested to only activate taxiway lights once an arriving aircraft had landed and to deactivate the taxiway lighting after an aircraft had departed.
• Green temporary displaced threshold lights were replaced with solar lighting that did not require electricians to wire.
• The notice to airmen was amended to advise that taxiways were not available, and of temporary blue taxiway edge lighting on taxiway A between A3 and A4.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• flight crew
• operator
• Cairns Airport managers and airport safety officers
• Airservices Australia
• the Civil Aviation Safety Authority.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew
• the operator
• Cairns Airport managers and airport safety officers
• Airservices Australia
• the Civil Aviation Safety Authority.

Any submissions from those parties will be reviewed and, where considered appropriate, the text of the draft report will be amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

In the early afternoon of 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA), was conducting test flights following aircraft maintenance. After completing a successful autonomous test flight, the pilot toggled the automatic mode switch to disengage the aircraft’s automatic mode for taxi back to the hangar.

The pilot then increased the throttle to provide the aircraft with sufficient momentum to taxi. As the aircraft turned towards the pilot, they determined that the aircraft was not responding to commands to reduce the engine thrust. The pilot considered attempting to arrest the aircraft by hand but determined it was moving too quickly and instead toggled the automatic mode switch to regain control of the aircraft and turn it away from bystanders.

The pilot then directed the aircraft across the airfield and it came to rest against the perimeter fence, resulting in minor damage to the aircraft’s skin.

What the ATSB found

The ATSB determined that, following the autonomous flight, the pilot did not correctly disengage the aircraft’s automatic mode. Subsequently, when they increased the throttle to provide the aircraft with momentum to taxi back to the hangar the ’abort landing’ function activated, increasing the throttle to maximum and overriding the pilot’s commands to decrease throttle. The pilot was able to deactivate the ’abort landing’ function by toggling the automatic mode switch.

It was determined that the pilot did not identify visual, audible and tactile cues that indicated the aircraft had not exited the automatic mode prior to increasing the throttle for taxi. The most likely reason for this was that they were experiencing a level of fatigue known to impact performance.

Additionally, the pilot’s controller utilised switches with 3‑positions for 2‑position (on – off) roles, increasing the likelihood of incorrect or incomplete selection. The controller also lacked the means to enable the pilot to immediately shut down the aircraft’s engine.

What has been done as a result

In response to this incident the operator implemented several changes to their systems and procedures. They advised that 3‑position switches on the aircraft controllers, which were being used for 2‑position roles, have been replaced with 2‑position switches. A formalised taxi-in procedure has been introduced that requires personnel to shutdown aircraft on the runway and push them to the hangar by hand. A gated switch was installed on the remote controller that was capable of overriding all other controls, placing the flight controller into manual mode and commanding the throttle to shut down the turbine engine.

For subsequent operations the flight test timeline was increased from 7 to 10 days with no increase in workload. The additional time was to allow for aircraft setup and testing prior to operations commencing and to ensure that all crew members were provided with adequate rest and recovery time during both setup and operations.

Safety message

This incident has 3 key learnings for RPA operators:

• Fatigue is a risk, particularly in high tempo commercial operations. Even when fatigue management is not mandated, operators should ensure that their fatigue management processes are robust and effective.
• All controls for RPA’s should be as simple and reliable as possible. If a control leaves room for human error, then it will increase the risk of this error occurring even if procedural controls are in place. Consideration should also be given to a system that allows the remote pilot to shut down the aircraft immediately in the event of an unexpected state or failure.
• Operators should be prepared for the RPA to do something unexpected and know and frequently practice emergency procedures.

The occurrence

On the weekend of 13‑14 June 2020 a team of remote pilots and maintainers from Remote Piloted Systems (the operator), RF Designs (the maintainer) and a client company arrived at Bruhl Airfield, 2 km south-west of Tara, Queensland (Figure 1). Over the weekend they set up and prepared for a week of test flying of two autonomous test bed aircraft, the RF Designs Albatross and the RF Designs Mephisto (Mephisto). The aircraft were assembled, following disassembly for transport, and systems tested prior to operations commencing on the Monday morning. This work was overseen by the operator’s chief remote pilot (CRP) and a senior manager of the maintainer.

Figure 1: Location of Bruhl Airfield

Source: Google Earth annotated by the ATSB

Throughout the following week the team conducted multiple test and evaluation flights for the client each day. These usually involved multiple aircraft and multiple pilots through the launch (take-off), mission, and recovery (landing) phases.

On the morning of Friday 19 June, the final operational flights were carried out for the client company. Following this, the client’s personnel commenced packing up and preparing to depart the site. With all relevant permissions and approvals in place, the operator’s CRP took the opportunity to conduct post maintenance test flights on Mephisto HP001, to ensure that it was airworthy and prepared for future operations. During the week, HP001 had undergone maintenance which included the aircraft’s flight controller being removed and reinstalled following its use in another Mephisto aircraft.

The flight plan for the test consisted of two flights, testing all three of the aircraft’s modes (see the section titled Aircraft operations), and the flight controller setup and tuning. The first flight was to involve a launch in manual mode, followed by a circuit and recovery in fly by wire (FBW) mode. If the results of this flight were acceptable the aircraft was to be repositioned to the western end of the runway for the second flight. There it would be transitioned to autonomous mode and conduct a fully autonomous launch, circuit, and recovery.

At 1242 Eastern Standard Time,^[1] HP001 was launched, with both flights completed without incident. Figure 2 shows the Global Positioning System (GPS) tracks of the aircraft during the first and second flights with the track colour indicating the aircraft’s mode. Figure 3 shows the transition between the flights and the completion of the second flight, the initial taxi, loss of control and the recovery.

Figure 2: Mephisto test flights 19 June 2020

Source: Google Earth and operator annotated by the ATSB

Following the autonomous recovery at the conclusion of the second test flight, the pilot attempted to transition the aircraft out of the autonomous mode and back into manual mode for taxi to the hangar. The pilot toggled the automatic mode switch and increased the throttle setting to provide thrust to taxi the aircraft. Once the aircraft had sufficient momentum to allow for the taxi the pilot attempted to reduce the throttle setting. However, the aircraft did not respond to the pilot’s commands and the turbine engine continued to accelerate.

The aircraft was now in relatively close proximity to the pilot and moving towards other personnel who had been observing from nearby. The pilot considered arresting the aircraft by hand but, due to the aircraft’s speed and momentum, they determined that was not practical. The pilot re‑toggled the automatic mode switch, allowing them to regain control. With the aircraft back under control, the pilot directed the aircraft across the runway to the southern side of the airfield away from the hangar and personnel. The aircraft was arrested, at low speed, by the airfield boundary fence.

The aircraft was then attended by the pilot and several other personnel who conducted a normal shutdown before pushing it back to the hangar for inspection. The inspection determined that the aircraft only had minor damage to the skin due to the impact with the fence.

Figure 3: Mephisto test flight 2 - occurrence flight

Source: Google Earth and operator annotated by the ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours

Context

Aircraft information

The RF Designs Mephisto remotely piloted aircraft (RPA) (Figure 4) is a high-performance autonomous testbed aircraft. First flown in 2019, it is based on the CARF-Models Mephisto large model aircraft and modified by RF Designs at their facility in Brisbane. These modifications included a flight controller, additional fuel tank, additional shielded wiring, and some larger and more robust control components, all allowing for autonomous test operations.

Figure 4: RF Designs Mephisto

Source: RF Designs

The aircraft, which can be disassembled for transport, is a composite construction of carbon fibre and fibreglass, 3.1 m long, with a wingspan of 2.6 m. It has a maximum take-off weight of 35 kg, retractable undercarriage and flaps and is powered by a Kingtech K260G2 turbine. Delivering 26 kg of thrust, the turbine can propel the aircraft to a maximum speed of 85 m/s (165 kt) and an altitude of more than 5,000 feet.^[2]

The client owned a fleet of 6 of the aircraft that were operated and maintained by Remote Piloted Systems and RF Designs respectively. Of the fleet, 5 were operationally capable (Figure 5), and 1 (HP001) was used for testing and training.

For the week of 15‑19 June the operator brought 4 of the fleet to conduct operations for the client, 3 operational Mephistos and the test and training aircraft for backup and spare parts.

Figure 5: Operational Mephisto fleet

Source: RF Designs

Aircraft operations

The Mephisto could be operated in three different modes, manual, fly by wire (FBW) or automatic.

In manual mode the remote pilot in command (RPIC) had full control over all aircraft functionality with no interaction from the flight controller’s stabilisation programming. This required that the aircraft be manually trimmed and stabilised by the RPIC. In FBW mode the RPIC commanded the aircraft directly, however, the flight controller’s stabilisation programming interpreted and implemented these commands to ensure stable flight. This meant that if the pilot removed control input, then the aircraft would continue in straight and level flight.

Finally, in automatic mode a flight plan consisting of a series of waypoints was programmed into the flight controller using the ground control station (GCS). When the RPIC activated the automatic mode and the flight plan, the flight controller commanded the aircraft through the programmed waypoints with full control over aircraft systems. When the automatic mode was disengaged the aircraft’s systems return to the settings commanded by the RPIC’s controller.

The crew of the Mephisto consisted of two remote pilots - the launch and recovery pilot (LRP) and the GCS operator. The pilot who was actively flying the aircraft was designated the RPIC. For the autonomous flights the RPIC was the GCS operator as they were monitoring the flight and had the ability to intervene and take control of the aircraft if required.

The LRP primarily conducted launches and recoveries and operated the aircraft in manual or FBW mode within visual line of sight. This usually involved flying the aircraft to or from a holding point where it was transitioned to or from the command of the GCS operator for automated flight.

The GCS operator monitored aircraft systems during all flights, conducted flights beyond visual line of sight (BVLOS) and monitored automatic flights. Due to the difference in their roles the LRP and GCS operator were located at different points on the field (Figure 3). The LRP was on the flight line next to the runway providing them the best view of the aircraft for launch and recovery. The GCS operator worked from inside a hangar which provided a more stable environment for the equipment used to monitor and control the aircraft while away from the launch and recovery location. Due to their physical separation, the pilots communicated via radio.

Due to the risk to the aircraft of an inadvertent mode change when transitioning from the GCS operator to the LRP following a flight, a specific process was used for the handover. This process started after launch once the LRP handed over control to the GCS operator. At this point, the LRP would place the automatic mode switch (see the section titled Remote controller) on their controller in ’auto on’ and set the flaps to fully retracted.

At the time of the occurrence, following the automated test flight, the GCS operator had handed control back to the LRP for taxi. The pilot advised that prior to the hand over their controller had been set up with the automatic mode switch selected to ’auto on’ and the flap control in the fully retracted position.

Flight controller

Each Mephisto aircraft was fitted with a Pixhawk 2 flight controller, which was programmed with ARDUpilot software to enable flight in all modes. The flight controller recorded a range of parameters which could be downloaded and used for simulation, recreation, and analysis.

The flight controller received a constant stream of data from a range of inputs including control inputs from either the LRP remote controller or GCS, GPS information, airspeed and engine fuel flow. It then controlled the aircraft via a series of servos that manipulated the aircraft flight control surfaces and turbine engine controls.

Abort landing command

The ’abort landing’ command within the flight controllers programming allowed the GCS operator or LRP to abort an autonomous landing via the remote controller or GCS. The LRP controller triggered the command when 3 criteria were met.

- The aircraft was in the autonomous mode.
- The aircraft was in the landing stage.
- The throttle on the LRP controller was increased above 90 %.

When these criteria were met the aircraft overrode control inputs, increased turbine power to the take-off throttle setting (100 %), pitched up and maintained the current heading until a target altitude was reached.

Remote controller

To control the Mephisto the LRP used a TARANIS X9D Plus hand-held controller, manufactured by FrSKY. The TARANIS X9D Plus (Figure 6) was a programmable, 24 channel, 2.4 GHz transmitter that could be used to control a range of remote devices, including RPA. The controller had 8 programmable control switches, (6 3-position and 2 2-position) that the user could assign to modes or operational settings.

For this operation, to ensure redundancy, the 2 position switches activated the ’return to launch’^[3](RTL) function. This meant that 3 position switches were used to control the aircraft’s modes. To reduce risk of the automatic mode being inadvertently deactivated the modes were switched separately. One switch controlled the automatic mode (on and off) and the other selected manual or FBW. The control hierarchy placed the automatic mode switch above the manual or FBW switch so an inadvertent movement of the manual or FBW switch would not disengage the automatic mode.

Figure 6 shows the location of these switches. The operation of any of these switches required a defined movement and the pilot described that changing between positions made an audible ’click’.

The automatic mode switch was configured with 2 ’auto on’ and 1 ’auto off’ position, which was the top position. This configuration had recently been updated from 1 ’auto on’ and 2 ’auto off’ positions. This change was due to a risk to the aircraft associated with inadvertent deactivation of the automatic mode during flight, particularly when the aircraft was BVLOS. To ensure that the switch was in the correct position it was normal for pilots to drive the switch to an end point of the control to ensure that the desired mode had been selected.

The LRP controller was not fitted with the ability to activate the aircraft’s flight termination system (FTS) (see the following section titled Flight termination systems and active failsafe) or operate as a ’kill switch’, cutting power the aircraft’s engine. In the event that the LRP required the FTS to be activated they would request the GCS operator activate it.

Figure 6: TARANIS X9D Plus with key controls identified

Source: FrSKY annotated by the ATSB

Flight termination systems and active failsafe

Under the Civil Aviation Safety Authority (CASA) permission for the operation (see the section titled Operational information) the aircraft was required to be fitted with a primary active failsafe system and primary and secondary flight termination systems. The primary active failsafe system was designed to ensure that the aircraft did not depart the operational area in the event of a communications loss with the controller. It was designed to return the aircraft to either the launch point or some other holding point within the operational area that allowed the RPIC to conduct necessary checks and perform relevant actions to re-establish communications. If necessary, the system could be activated by the LRP, GCS operator or automatically if the aircraft exited the operational area. The aircraft’s RTL function met this requirement.

The FTS was a secondary level of control that was activated if the primary active failsafe failed or was unable to return the aircraft to a stable location. The system worked by bringing the aircraft to the ground as quickly and as safely as possible, with the main aim of protecting personnel and property. In the case of the Mephisto, the FTS was set to place the aircraft flight control surfaces in a configuration to induce a spin and cut fuel to the engine. This arrested as much forward momentum as possible prior to impact with terrain. The FTS was activated by either the GCS on a dedicated control link or automatically if the aircraft departed a contingency area around the operational area.

CASA specifically stated that the FTS was not intended for use on the ground. However, the system’s process meant that, in the event of an issue on the ground, it would provide a way to rapidly arrest momentum of the aircraft and put it into a known state.

At the time of the incident the aircraft in question was fitted with both the primary active failsafe and FTS. However, due to the rapid development of the aircraft the flight manual had not been updated and contained information that the flight termination system had not been fitted and remained in development.

Operational information

The operator, maintainer and client company had been conducting BVLOS, autonomous and multi-aircraft test flights from Bruhl airfield since November 2019. They had been using a range of smaller, primarily electrically driven aircraft types and recently began using the Mephisto, to allow for higher performance operations and testing.

Bruhl airfield, located approximately 265 km west-north-west of Brisbane Airport (Figure 1), was chosen for 3 reasons. Firstly, it was familiar to several of the crew members. Secondly, it was remote and the surrounding area desolate. This meant that the operational area had a low the risk to persons and property in the event of an aircraft malfunction. Finally, it was accessible by road for the operator, maintainer, and client company from Brisbane.

Operational permissions

Permission for autonomous, BVLOS, multi-aircraft operations at Bruhl airfield operations was granted by the CASA in November 2019. The operator was authorised for flight BVLOS above 400 ft within defined areas and in compliance with certain conditions until 30 November 2020 or revoked. These conditions included:

• the fitment of a ’primary failsafe mode’ which could command a return to launch, ensuring that, during this process, the aircraft did not increase height or depart from the operational area
• fitment of both primary and secondary flight termination systems, with the secondary being able to command immediate flight termination in the event of the loss of communications with the primary.

Operational schedule

Operational test flights for the client’s systems were carried out throughout the week, finishing prior to the incident flight at approximately midday. Through the week these operations started at around 0900 and continued throughout the day, with a break for lunch.

Following each flight there was the requirement to download and analyse the aircraft flight data, liaise with the client company, conduct any required maintenance, and prepare aircraft and flight plans for following flights. These tasks were usually carried out by the incident pilot in their role as the operators CRP.

There was no formalised procedure for taxiing the aircraft back to the hangar. However, the pilot reported that there was a standard process that Mephisto pilots followed to provide the aircraft with enough momentum for the taxi. This process, as outlined below, was for a Mephisto aircraft having completed an autonomous recovery and positioned on the runway.

1. LRP to take control of the aircraft.
2. automatic mode to be deactivated with the aircraft in either FBW or manual
3. remote controller throttle advanced to 100 %
4. pilot to wait for the throttle to spool up to the desired level (approximately 30 %), due to throttle lag this could take approximately 6-7 seconds
5. pilot to throttle back on the controller to desired level
6. pilot to taxi the aircraft back to the hangar under its own power.

Crew information

A team of five pilots, all cross trained on the GCS and as LRP for the Mephisto aircraft, were available to conduct the week of flight activity. In addition, at the time of the incident, multiple training pilots were observing the test flight in preparation for CASA flight testing during the following operational period.

For the incident flight the aircraft crew consisted of the LRP, who was also the operator’s CRP, and a GCS operator. Both the LRP and GCS operator held current remote pilot licenses (RePLs) with appropriate category and type endorsements for operation of the Mephisto.

Fatigue

The International Civil Aviation Organization (2016) defined fatigue as:

A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety related operational duties.

Fatigue is a known contributor to a range of adverse effects on human performance. These can include, slower reaction times, decreased vigilance, shortened attention span, reduced short term memory capacity, and reduced decision making capability.

The pilot reported that at the time of the incident they, and others undertaking the operation, were experiencing a heightened level of fatigue due to the tempo of the operation.

Three people on site were designated to monitor fatigue of the operational crew, the incident pilot (as the operators CRP), a senior manager of the maintainer’s company, and a representative from the client company. The pilot reported that following an out‑landing incident earlier in the week, the client’s fatigue management personnel reported that they believed that there was a heightened level of fatigue among the operational personnel. This increased awareness of the fatigue levels prompted increased monitoring of the crew. However, no further action was deemed to be necessary.

Fatigue guidance

At the time of the incident, there was no regulation that applied to fatigue management for operators of RPA. However, in the company operations manual, the operator had used guidance from CASA's sample operations manual, which identified the following 3 areas of fatigue management to be followed:

• the chief pilot must consider and minimise the potential for fatigue to effect operations
• pilots were not to conduct RPAS operations if they believed that they were suffering from fatigue that was likely to impair their performance
• pilots must immediately report fatigue related concerns to the chief pilot who would take appropriate action to remedy the situation.

To comply with this, the chief pilot was required to consider several factors relating to each mission, including:

• travel time to the operation
• complexity and duration of the operation
• the time of day that the operation was to take place
• environmental conditions.

Fatiguing conditions

Through a review of the operation and the pilot’s history the ATSB identified 3 factors that could have contributed to a significantly heightened fatigue level. These were environmental conditions, operational requirements, and disrupted sleep.

Environmentally, while the incident occurred during winter, the LRP were operating outside on the flight line, in sunny and warm conditions. While there was no concern about the effect of the temperature, the pilots did identify a risk of dehydration, which can be a contributor to fatigue. These factors were being managed through breaks through the day and access to shade, fluids and food.

Operationally there were 2 periods that would have affected the pilots fatigue levels. Firstly, in the week leading up to the operation the pilot had been undertaking a range of maintenance testing and other preparatory activities. This involved multiple round trips to and from Brisbane to the airfield for test flights, a trip of approximately 3 hours each way. In addition to the flights and aircraft preparation this also involved data download, analysis and associated aircraft tuning both at the airfield and in Brisbane.

These activities were not only fatiguing themselves but limited the pilot’s opportunity for rest in preparation for the operational week, which they were aware was going to have an increased operational tempo. The pilot was aware of the heightened risk of fatigue due to these factors and sought to mitigate them over the weekend prior to the operation by taking more of an oversight role of preparations and leaving individual tasks to crew members.

The pilot reported that during the operational week they had 12 to 14 hours of duty each day. This involved carrying out aircraft test flights for the client company, overseeing LRP and GCS operations for the operational and test aircraft. In their role as CRP, the incident pilot, was also monitoring the crew for signs of fatigue, overseeing maintenance, preparing aircraft, and planning and reviewing data for the operations undertaken each day. The maintenance and preparatory tasks were undertaken in the morning prior to commencement of the days flying operations and, in the evening, following the completion of operations until going to sleep. This meant that, with the exception of mealtimes, there was limited to no time where the operations were not the focus. While the incident occurred in the middle of the day it was at the end of the final test flight of the week’s operations.

The pilot reported that sleep opportunity was in line with their regular habits, getting approximately 7 hours each night. However, during these operations they were staying at the airfield and rooming with another person. The pilot reported that this probably resulted in disrupted sleep. All other members of the crew were roomed off site in individual accommodation, which both promoted sleep opportunity and removed them from the operational environment.

Fatigue review

Unlike crewed aircraft operations, this operation did not need to comply with Civil Aviation Order (CAO) 48.1 Instrument 2019. Despite that, the ATSB reviewed the pilot flight and duty times against the instrument and appendices 1 (basic limits), 4 (any operations) and 5A (daylight aerial work operations and flight training associated with aerial work) to gain an appreciation of what level of fatigue was considered likely to affect performance.

Based on this review it was determined the pilot had exceeded the cumulative duty period limits, had not had sufficient off duty time and did not have adequate sleeping facilities as per the instrument requirements. As such, if the pilot had been seeking to fly a crewed aircraft subject to CAO 48.1 requirements, they would have been considered unfit to fly.

Recorded data

As discussed in the Flight controller section, the Pixhawk 2 flight controller can record and store a range of timestamped flight data and status messages.

The data for the two test flights, was downloaded by the operator and the data and relevant software for interpreting it were provided to the ATSB. Figure 7 shows data from these flights with throttle, flap and altitude traces. Additionally, the active aircraft mode is shown and some of the recorded aircraft status messages.

Figure 7: Flight data showing 19 June test flights

Source: ATSB utilising data provided by the operator

Figure 8 shows data from the second flight with the transition into automatic mode and the aircraft then launching conducting a circuit and being recovered. Following the landing there were a number of mode changes and an aircraft status message that corresponded with the ‘abort landing’ function being activated, the pilot toggling the mode switch to disengage this function and directing the aircraft away from personnel on the flight line.

Figure 8: Flight Data - Mephisto test flight 2 - 19 June

Source: ATSB utilising data provided by the operator

Figure 9 shows greater detail of the incident over the period of 20 seconds from 12:47:00 to 12:47:20, during which the aircraft was under the control of the LRP. This time covers the aircraft on the ground preparing to taxi, the throttle being advanced, and the ’abort landing’ function being activated, as identified by aircraft status message 2. It shows the mode selections by the pilot as they disengaged the abort landing function and toggled into manual mode as the aircraft was directed towards the airfield fence.

The chart shows that the aircraft remained in automatic mode and the flaps remained extended until approximately 12:47:04 when the throttle trace showed an increase to 100 %. At this time the aircraft status message appeared, giving the indication that the ’abort landing’ function has been activated and the flaps retracted while the throttle remained at 100 % as the aircraft followed the ’abort landing’ process.

The data showed the pilot toggling the automatic mode switch to off, and back on, to overwrite the ’abort landing’ function. It shows the throttle trace as the pilot directed the aircraft away from the flight line and across the runway towards the fence, and finally the re-engagement of the manual mode for the aircraft to be shutdown.

Figure 9: Flight Data - Incident - 19 June

Source: ATSB utilising data provided by the operator

__________

2. The aircraft’s maximum altitude was not confirmed – 5,000 ft is the maximum altitude allowed under the operational permissions obtained from the Civil Aviation Safety Authority.
3. When activated the return to launch function automatically flew the aircraft back to the launch point or another designated point and, depending on programming, either held in place (allowing the RPIC to regain control) or conducted an automated recovery.

Safety analysis

Introduction

At 1247 on 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA) completed an automated test flight and attempted to transition the aircraft out of automatic mode to taxi it back to the hangar.

The pilot was unaware they had not deactivated the aircraft’s automatic mode prior to increasing the throttle to provide sufficient momentum for the taxi. This action activated the aircraft’s ‘abort landing’ function and prevented the engine from throttling down as the pilot was commanding.

The following analysis will look at the factors that resulted in the incomplete deactivation of the automatic mode, the pilot not realising the aircraft remained in the automatic mode and the delay in regaining control of the aircraft.

Deactivation of automatic mode

Following the landing, the pilot attempted to deactivate the aircraft’s automatic mode using the automatic mode switch. The switch had 3 positions with 2 positions set for automatic mode on and 1 for automatic mode off. The pilot recalled that they had moved the switch as indicated by the click and movement that was felt. However, they did not recall whether it was moved 2 positions or 1. The data showed no deactivation of the autonomous mode, indicating a single position change.

This meant the aircraft was in a state different to what was intended leading to the activation of the ’abort landing’ function when the pilot advance the throttle, and the subsequent loss of control.

The LRP remote controller (TRANSIS X9D Plus) had only two 2-position switches available, which for redundancy were both being used for return to launch functionality. This meant that the automatic mode selection was relegated to a 3-position switch. The technique of driving the switch to an end point that the Mephisto pilots used went some way towards mitigation of an error. However, the use of a 3-position switch increased the likelihood of a mis-selection and an undesired state.

This potential had been identified by the operator with the change of layout for the 3 positions from off-off-on to off-on-on. It was believed that this was a way to limit the risk of an aircraft accidentally being forced into manual or fly by wire mode while flying beyond visual line of sight. However, it did not overcome the issue of an incomplete or incorrect mode selection.

Aircraft state awareness

There were 3 cues to alert the pilot that the aircraft remained in the automatic mode. Firstly, the aircraft’s flaps had not retracted when they attempted to disengage the automatic mode, despite being set to fully retracted on the controller. Secondly, the pilot should have felt and heard two distinct ’clicks’ as the control moved through the second ’auto on’ position and into the desired ’auto off’ position.

The pilot commented that they did not remember seeing the flaps retract and recalled feeling and hearing 1 click but could not recall the second. The ATSB considered a number of reasons why the pilot may not have detected or reacted to these cues. These included: deliberate pilot action, distraction, expectation bias, and fatigue. Based on the available evidence, it was considered that the heightened level of fatigue was the most likely explanation. This is discussed further below.

Delayed control recovery

In the event of a RPA loss of control on the ground, where the engine was still functioning at a high-power setting, removing engine power is the quickest and easiest way to arrest momentum and bring the aircraft back under control. The flight termination system (FTS), as required under the CASA permission for the operation and fitted to the aircraft, provided the ability override the aircraft’s automatic mode, immediately cut fuel to the turbine and drive the aircraft controls into a configuration to induce a spin.

While this system was designed to operate in the air, its functionality, specifically cutting fuel to the turbine, would have allowed the aircraft’s momentum to be arrested more quickly. However, this system could not be activated from the launch and recovery pilot’s (LRP) controller and relied on communications with the ground control station operator to activate it. The aircraft’s data showed that there were only seconds for the pilot to react and take appropriate action. While calling for the activation of FTS would have stopped the aircraft it would not have been practical in the time available.

Had the LRP’s controller been fitted with a switch that could activate the FTS, there would have been no requirement for the extra control inputs to deactivate the ‘abort landing’ function and regain control of the aircraft.

Fatigue

For this operation the potential effects of fatigue on crew members had been identified and a range of fatigue management and mitigation strategies were in place. However, these strategies did not specifically account for the added work created by the incident pilot’s additional role as the operator’s chief remote pilot (CRP).

For example, in addition to flight operations and testing, they were liaising with the client company, monitoring other team members for signs of fatigue and staying at the field in shared accommodations. Additionally, while the crew was being monitored for fatigue, the 3 personnel assigned to monitor the fatigue - the CRP, the maintainers senior manager and the clients fatigue monitoring personnel did not have anyone assigned to monitor their fatigue levels. Fatigue monitoring is only effective if all personnel are being monitored.

Considering their workload and reduced rest opportunity, the ATSB assessed that it was likely that the pilot was experiencing a level of fatigue that affected performance. Heightened fatigue levels are known to cause a reduction in ability to react to external stimuli and effect a person’s attention and decision-making capacity.

The level of fatigue felt by the pilot at the time of the incident likely had an effect on them missing the visual (flaps not retracting), tactile (not feeling one click rather than two) and audible cues (hearing one click not two) that indicated the aircraft had not exited the automatic mode.

Findings

From the evidence available, the following findings are made with respect to the loss of control during taxi involving RF Designs Mephisto, HP001 at Bruhl Airfield on 19 June 2020.

Contributing factors

• When the throttle was advanced for taxi, the automatic mode, which had not been correctly deactivated, entered an ’abort landing’ state. This overrode the pilot’s commands to decrease throttle and the turbine thrust continued to increase, resulting in a loss of control.
• The use of a 3-position switch (with 2 positive and 1 negative position), for a 2‑position role, increased the likelihood that a pilot would inadvertently not deactivate the automatic mode prior to manoeuvring the aircraft.
• The controller did not have a ’kill switch’ to override the aircraft’s automatic mode and shutdown the turbine in the event of an issue. As a result, the pilot was forced to toggle the aircraft’s mode switches and direct it away from personnel rather than being able to override it.
• The pilot was experiencing a level of fatigue known to impact performance. This likely led to a lack of reaction to multiple cues that the aircraft had not exited the automatic mode.

Safety action

Safety action not associated with an identified safety issue

Safety action by Remote Piloted Systems (the operator).

In response to this incident the operator introduced the following changes to the Launch and Recovery pilot’s controller switch layout and allocations, procedures for taxiing the Mephisto aircraft and operational planning to reduce risks identified:

• 3‑position mode switches were replaced with 2‑position mode selection switches to eliminate issues with incomplete deactivation of the automatic mode.
• All launch and recovery pilot controllers had a ’kill switch’ added that overwrites the aircraft’s mode to manual and drives the throttle immediately to zero thrust. This switch is gated to enable easy to operation, when necessary, but is also difficult to inadvertently activate.
• Taxi procedure has been changed/formalised to require that all aircraft are shutdown on the runway and pushed back to the hangar by hand rather than under their own power.
• The operational timeline has been extended from 7 to 10 days, with additional time to setup and prepare the aircraft and a break before operations commenced.

Safety action by RF Designs (the maintainer).

Since this event the RF Designs has introduced the following two safety improvements:

• The aircraft flight manual has been updated to clarify the presence of the flight termination system, removing the phrase ’not currently fitted, in development’.
• Specific fatigue management requirements, including references to CAO-48.1, have been added to the RPA operations manual.

The ATSB welcomes the prompt safety action taken by the operator and maintainer to address the deficiencies identified in this incident.

Glossary

BVLOS             Beyond Visual Line of Sight

CASA               Civil Aviation Safety Authority

CRP                 Chief Remote Pilot

FBW                Fly by Wire

FTS                  Flight Termination System

GCS                 Ground Control Station

GPS                 Global Positioning System

LRP                 Launch and Recovery Pilot

RePL                Remote Pilot License

RPA                 Remotely Piloted Aircraft

RPIC                Remote Pilot in Command

RTL                  Return to Launch

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilot flying
• aircraft manufacturer and maintainer
• Civil Aviation Safety Authority
• Operators manual for the FRSky TARANIS X9D Plus
• recorded data from the aircraft
• ARDUpilot documentation.

References

ICAO. (2016). Doc 9966: Manual for the Oversight of Fatigue Management Approaches 2nd Edition. Quebec, Canada: International Civil Aviation Organisation.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the operator and pilot flying
• the maintenance organisation
• CASA

No submissions were received.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

The occurrence[1]

Aeromedical tasking and flight preparation

In June 2020, the ATSB commenced a transport safety investigation into a main rotor blade strike involving a Leonardo Helicopters AW139, registered VH-EGK and operated by Queensland Government Air, about 16 km west‑south‑west of Caboolture airfield, Queensland.

On 20 June 2020, at about 1709 local time, the aircrew (comprising the pilot, aircrew officer (ACO) and rescue crew officer (RCO)) and medical crew (flight doctor and paramedic) were tasked with retrieving a patient from a property near Caboolture and transporting them to the Royal Brisbane Hospital. In preparation for the flight, the pilot completed an operational pre‑flight risk assessment, which indicated ‘normal operations’, permitting acceptance of the task without further discussions with the operator’s duty management pilots. The remaining crew refuelled the helicopter and configured the cabin for a night winch rescue.

Transit to the site

At about 1746, the helicopter departed Archerfield Airport. The flight was operated under the instrument flight rules,[2] with the aircrew using night vision goggles.[3]

On approach to the rescue site, the ACO contacted the ground paramedic to confirm the patient’s status and ascertain whether any areas nearby could be used for a landing, to avoid the requirement to winch. The ground paramedic advised that a suitable landing site was not available, but there was a possible suitable winching position about 20 m behind the ambulance. The ACO requested the ground paramedic keep the ambulance lights and roof top emergency beacon on, to assist in identification of the winch location. 

Arrival on site and insertion winches

The helicopter arrived in the vicinity of the site at about 1800 in dark conditions, approximately 30 minutes after last light.[4] The pilot and ACO identified the site, completed the pre-landing checklist, and put the ‘Trakkabeam’[5] on. The aircrew discussed the site characteristics and planned the approach. 

Recorded flight data showed that several orbits of the rescue site were conducted. During the final orbit, the pilot briefed the crew on the site. At about 1813, the pilot commenced a descent to the site and completed power checks and briefed the escape route. At about 1818, the pilot manoeuvred the helicopter to a low reference datum[6] of about 200 ft above ground level and 50 m north of the insertion winch location. From this position, the aircrew conducted the reconnaissance brief. They checked the power setting, radio altitude reading, security of harnesses, and if they had ‘good references’. The pilot then handed the conning[7] over to the ACO. 

Between about 1821 and 1826, the crew completed 2 insertion winches to lower the RCO, flight paramedic and stretcher, from a height between 65–100 ft. The helicopter then departed the site to the east and orbited for about 20 minutes while the patient was prepared for extraction. During this time, the pilot and ACO commented on the rain passing through the area and prepared for the extraction winches. 

The extraction winch and collision with terrain

The patient was moved from the side of the hill to a position in an open area considered suitable for winching. At about 1841, the RCO radioed the ACO to report that they were ready for the winch. The pilot verbalised to the ACO ‘same brief as before’, which was acknowledged by the ACO. The pilot and ACO both reported there was no re-identification, verbalisation or re-briefing of the critical hazards (outlying trees) associated with the revised extraction winch position. They then completed their final checks. At about 1846, the helicopter was established in a hover about 80 ft directly above the patient. At interview, the pilot approximated the helicopter’s main rotor was rotating about 1 m from the surrounding tree line.

The flight paramedic and the patient on a stretcher were winched into the helicopter. As the winch was lowered to collect the RCO, the ACO directed the pilot to move forward and right, twice. As the RCO was about to be winched, they verbalised for the ACO to hold them on the ground as they had momentarily lost their night vision goggles mount. At about 1851, the ACO confirmed to the pilot that they were holding a good position. The recorded data showed that, over the last minute, the helicopter’s height ranged between about 50–65 ft above the ground (861–876 ft above mean sea level) and the heading changed between about 111–120°.

Shortly after, the doctor called out ‘trees, trees’, at which point the helicopter’s main rotor blades contacted a tree. Immediately following the main rotor strike, the ground paramedic reported seeing a branch fall through the trees, with an estimated diameter of 10 cm and length of about 1‍–‍1.5 m.

Recovery and return to Archerfield

In response, the pilot immediately manoeuvred the helicopter away from the tree line. The RCO was subsequently raised off the ground, contacted the trees and went into a spin. Shortly after, the RCO was safely secured inside the aircraft. The pilot reported that feedback through the flight controls remained normal, with no abnormal vibrations. However, as a precaution, the pilot elected to return to the helicopter’s base at Archerfield Airport. 

Helicopter damage assessment

An engineering inspection of the main rotor blades identified damage to one of the 5 tip caps, which was missing about 50 g of honeycomb and skin material (Figure 1). Two other main rotor blades had minor abrasions to the paint layer. No other significant damage was observed.

The helicopter manufacturer considered a loss of 40–50 g on a main rotor blade tip was generally not enough to generate a perceivable vibration in the aircrew or passenger compartments. 

Figure 1: Damage to the main rotor blade tip

Source: ATSB

Environmental information

Meteorological conditions

The Bureau of Meteorology graphical area forecast applicable for the flight and occurrence location indicated the conditions were:

• visibility was greater than 10 km, with broken[8] stratus cloud between 2,000–3,000 ft above mean sea level, and from 1900 local time, broken cumulus and stratocumulus cloud between 3,000–6,000 ft 
• visibility reducing to 3,000 m in isolated showers of rain, with broken stratus cloud between 1,000–3,000 ft and broken cumulus cloud between 3,000–8,000ft.

Significant rainfall had been recorded in the vicinity of the site over the preceding days. Immediately prior to the occurrence, the Bureau of Meteorology weather radar indicated light rain in proximity. The pilot reported there was more weather to the west of their site and that it was clear to the east. The cloud base had reduced as they were operating, and they had passing showers, with some rain on the windscreen. Recorded audio from the helicopter captured the aircrew discussing rain while orbiting to the east before returning for the extraction winch. Mobile phone footage taken from the ground showed moderate rain during the extraction sequence. 

Lighting conditions

It was reported that there was limited ambient lighting generated from surrounding residential and farming properties. The astronomical conditions indicated very low celestial illumination in the vicinity of the site, with 1.7% moon illumination. Despite this, both the pilot and ACO reported they had good visibility, and they did not notice any scintillation[9] of their night vision goggles due to the low light. 

Investigation activities

During the investigation, the ATSB:

• interviewed the aircrew, medical crew and relevant safety personnel
• examined data from the helicopter’s multi-purpose flight recorder and mobile phone footage of the winching operation
• reviewed the environmental conditions
• reviewed the operator’s standard operating procedures
• consulted the helicopter manufacturer
• considered similar occurrences.

ATSB observations

Helicopter drift and visual cueing environment

Unbeknown to the pilot, the helicopter drifted during the night extraction of the RCO, resulting in the main rotor blades impacting a tree. Further, the aircrew were potentially operating in a degraded visual cueing environment due to the meteorological and lighting conditions at the time. 

Pre-flight operational risk assessment 

The operator’s pre-flight operational risk assessment tool was not accurately completed, resulting in a low-risk score that did not reflect the accurate flight conditions. Further, the tool did not consider the relative humidity when evaluating the environmental conditions, nor did it include a risk level that equated to a mandatory no-go decision.

Obstacle clearance limits

During the extraction, the helicopter was hovered closer to the surrounding tree line. It was noted that there were no minimum obstacle clearance limits prescribed by the operator, particularly for when operating in confined areas.

In-flight risk assessment

The aircrew did not fully complete the reconnaissance brief for the insertion winch sequence and therefore had not identified the closest obstacles or external hover references. 

Actions following a suspected or actual obstacle collision

As no apparent issues were identified with the helicopter following the main rotor blade strike, it was returned to the operator's base. This involved flying over a populated area, although the damage severity was unknown. The operator did not have a published procedure regarding the actions required by aircrew following a suspected or actual collision with an obstacle such as conducting a precautionary out-landing. 

Operator safety action

In response to this occurrence, the operator has implemented a range of safety actions, such as:

• Introduced additional requirements to strengthen the operational risk assessment process. Such as, the inclusion of relative humidity (temperature dewpoint spread) in the pre-flight risk assessment operational tool, the requirement to consult with a management pilot when the risk was assessed as ‘orange – extreme caution’ or above, increased coordination with the tasking agency regarding the acceptance of the rescue task, and the recording and auditing of risk assessment scores. Similarly, an instruction was issued to aircrew emphasising that the risks associated with winching operations should be assessed at tasking, dispatch, arrival on site, and throughout the operation.
• Released a standards directive and updated the aircrew operations manual with additional obstacle clearance requirements. This included mandatory minimum distances from obstacles when operating in, or within the vicinity of a confined area, or manoeuvring near obstacles.
• Released a standards directive and updated the aircrew operations manual requiring the pilot in command to land as soon as possible when either ‘suspecting or observing’ helicopter damage. 

Safety message

The flight planning and task preparation stage provides an important opportunity to assess the operational environment prior to task acceptance and departure. Risk management strategies such as a pre-flight risk assessment tool can help pilots apply a systematic process to decision‑making and assist with mitigating other hazards that could adversely affect the safety of flight. 

However, as a pre-flight risk assessment tool cannot anticipate all hazards and corresponding risks that may emerge during the flight, aircrew should continually reassess the operational risk to determine if the applied risk controls are appropriate or require adjustment to ensure flight safety is maintained. In-flight briefings are an effective mechanism for achieving this. Likewise, such briefings aid an aircrew’s shared understanding of how the tasking is to be completed. This understanding is then reinforced through positive communications between the aircrew throughout the tasking.

Finally, this occurrence illustrates the importance of an appropriate response if a helicopter is suspected of colliding with terrain, regardless of the presumed severity. Unknown damage to a helicopter’s main or tail rotor system could quickly develop into a much more serious situation, particularly when operating over a densely populated area.

Reasons for the discontinuation

Based on a review of the available evidence, the ATSB considered it was unlikely that additional investigation would identify further important safety lessons. Queensland Government Air has been briefed about the ATSB’s observations and potential learnings. While the broader communication of this information is useful to other similar operators, in this case, appropriate safety action has been taken by Queensland Government Air. 

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation. Consequently, the ATSB has discontinued this investigation.