Safety summary

What happened

On 28 September 2019, an Airbus Zephyr 8 (Zephyr) unmanned aerial vehicle (UAV) was launched from Wyndham Airport, Western Australia. The UAV was being operated by Airbus and the purpose of the flight was to conduct beyond visual line of site, high-altitude aerial work.

While climbing through 8,000 ft above mean sea level, the UAV experienced a series of uncommanded turns. The UAV self-recovered from the first two uncommanded turns however, the third upset resulted in the aircraft entering an uncontrolled spiral descent. Despite attempts to return to controlled flight, the UAV sustained an in-flight break-up.

What the ATSB found

The investigation found that the UAV entered an area of unstable atmospheric conditions that were beyond the aircraft’s ability to remain in controlled flight. Once the UAV departed controlled flight, it exceeded its structural limitations, resulting in an in-flight break‑up.

Airbus operated the UAV within the Civil Aviation Safety Authority’s authorisation and their own established procedures. As a result, the operation of the Zephyr aircraft was conducted with minimal risk to the public and environment.

What has been done as a result

Airbus conducted an investigation of this occurrence, which resulted in several safety recommendations being directed to the design and operational departments of the Zephyr program. Implementation of these recommendations will likely contribute to continued safe development of the Zephyr UAV.

Safety message

The number of UAVs and remotely piloted aircraft (RPA) in Australia, and worldwide, is increasing rapidly. Through reporting and investigation of UAV and RPA accidents and incidents, the ATSB is able to monitor trends and identify areas for safety improvement. This information is used to enhance the safety of all aircraft, and the public in general, enabling this sector of the aviation industry to continue to grow and develop.

The investigation

The occurrence

On 28 September 2019, at 2143 Western Standard Time^[1] an Airbus Zephyr 8 unmanned aerial vehicle (UAV), serial number Z8B-03,^[2] was launched from Wyndham Airport, Western Australia. The UAV was being operated by Airbus and the purpose of the flight was to conduct beyond visual line of site, high-altitude aerial work. The launch was described by the crew as ‘ideal’ and a systems check, conducted at about 1,200 ft above mean sea level, did not identify any issues. The UAV continued to climb, in a south-easterly direction, toward its typical operational altitude of 60,000-74,000 ft.

At about 2240, while climbing through 5,200 ft, the UAV experienced an uncommanded roll of about 15˚ to the right. This was likely induced by isolated thermal turbulence as the aircraft passed over a dry salt lake. The UAV’s track changed approximately 180˚, before self-recovering. At this point, the crew elected to continue the climb, to the north, toward anticipated smoother conditions. Power was increased to counter the corresponding headwinds, however, the UAV’s ground speed reduced to around 1 kt.

As the climb continued, the UAV entered an area of increasingly unstable atmospheric conditions. At about 2307, while passing through 8,700 ft, the UAV experienced another uncommanded roll of 14˚ to the right, followed by 17˚ to the left. The aircraft again self‑recovered, however, the turbulent conditions persisted. The UAV descended about 1,000 ft over the next 7 minutes, while the crew increased power and tried to direct the aircraft to calmer conditions.

The UAV sustained a third uncommanded roll to the right, at about 2315, from which it was slow to recover. During the attempted recovery, the UAV exceeded its maximum airspeed (Vne).^[3] The aircraft, with full left rudder applied, did not self-recover and the roll angle subsequently increased beyond limits. The UAV then entered an uncontrolled spiral descent.

At about 2316, the UAV’s airspeed increased further beyond Vne, which shortly thereafter, resulted in an in‑flight break-up, with both wings fracturing at about mid-span (Figure 1). Coincident with the break-up, the crew noted that vision from the wingtip camera^[4] was lost. Shortly thereafter, both separated wing sections were observed in vision from the forward-looking camera mounted on the aircraft’s fuselage.

Figure 1: Typical zephyr - showing wing fracture locations

Source: Airbus, annotated by ATSB

The loss of the outboard section of both wings meant the UAV was no longer able to maintain itself in the flight envelope and it entered into the ‘soft termination’ phase.^[5] The intent of soft termination was to have the UAV descend within the predicted ‘cut-down’ vector.^[6] The soft termination phase also disabled the aircraft’s battery charging system to reduce the risk of a post‑accident fire.

The crew initiated the post-crash management plan and monitored the telemetry from the UAV until it was lost behind terrain, at 872 ft, about 5 minutes later. The accident site was located about 5.5 km east of Wyndham Airport and within the predicted cut-down zone (Figure 2).

Figure 2: Flight path

Source: Airbus, Google Earth – annotated by ATSB

The distribution of the wreckage was consistent with an in-flight break-up. The rudder was not located despite an extensive search. The recovered components were taken to a hangar at Wyndham Airport for examination. Examination of the wreckage identified that the wings failed about mid-span, due to overstress (Figure 3 and Figure 4). The aircraft batteries were tested and were all found to be within operational voltages.

Figure 3: Right wing outboard section

Source: Airbus

Figure 4: Left wing outboard sections

Source: Airbus

Context

Aircraft information

The Airbus Zephyr unmanned aerial vehicle was an ultra-light weight, high-altitude pseudo‑satellite, developed by Airbus Defence and Space.^[7] The Zephyr was solar-electric and designed to operate in the stratosphere,^[8] above the weather and conventional air traffic (refer to section titled Meteorological information). Flight testing begun in 2008, with multiple successful missions launched from Arizona, in the United States, and Dubai, in the United Arab Emirates. These missions provided valuable operational experience and flight data, for the research and development phase. In August 2018, a Zephyr completed a 25‑day flight. The ultimate goal for the program was to operate for over 100 days without landing.

The Zephyr (Figure 5) has a polyhedral wingspan of 25 m,^[9] weighed about 65 kg and could accommodate various payloads, for communication and surveillance roles. The carbon-fibre wing structure contained an array of solar panels which powered the two motors, aircraft systems and recharged the aircraft’s batteries. Control was provided via the rudder, elevators and differential power from the motors.^[10] The Zephyr was launched by hand^[11] and climbed at a low airspeed with a climb rate of about 5,000 ft/hr. Due to the Zephyr’s light weight and low airspeed it was susceptible to turbulent atmospheric conditions.

The Zephyr UAV design was similar to a glider where, ascending during daylight under power, to a maximum altitude of about 74,000 ft, was similar to a glider being towed to altitude. The UAV then slowly descended overnight (to about 60,000 ft) in a glide, reducing reliance on the aircraft batteries until the latter part of the night.

Figure 5: Airbus Zephyr

Source: Airbus

Design standard

At the time of publication of this report, there were no design standards for unmanned aircraft systems (UAS). In the absence of a defined certification process, Airbus developed their own design standard, which was approved through the Ministry of Defence, United Kingdom.

The Joint Authorities for Rulemaking on Unmanned Systems (JARUS) consisted of a group of experts from various national aviation authorities and international safety organisations. Their objective was to provide guidance material to facilitate each national authority to develop their own specific technical, safety and operational requirements for the certification and safe integration of UAS requirements, while avoiding duplicated effort.

The Civil Aviation Safety Authority (CASA) utilised the JARUS specific operations risk assessment (SORA) to identify and set minimum operational organisational and technical requirements to achieve an acceptable level of safety for operations in Australia.

Operational information

The Zephyr program commenced operations from Wyndham Airport, 2,200 km north-east of Perth, Western Australia, in late 2018. Wyndham was chosen due to its remoteness, providing good separation from standard flight routes and areas of high population.

CASA issued Airbus with an authorisation to operate beyond visual line of sight (BVLOS), and at night, from the surface to 90,000 ft, over the defined movement area and not within 3 NM of any other aerodrome. Some of the authorisation’s requirements were:

• a current ‘notice to airmen’ (NOTAM)^[12] was required for all operations over 400 ft above ground level and BVLOS
• Airbus was to coordinate air traffic from the ground to 18,000 ft (FL180)^[13]
• Airservices Australia was to coordinate traffic between FL180 and FL550.

The operational base at Wyndham Airport consisted of two ground control stations (GCS).^[14] The GCS contained the necessary equipment to support flight operations. In addition, the Zephyr could be monitored and controlled from the main base in Farnborough, United Kingdom, or any other GCS however, only the Wyndham GCS was authorised by CASA for Australian operations.

Crew information

The core crew, for the launch and initial climb, consisted of a remote pilot, remote pilot in command, mission planner and flight test engineer. In addition, there were several subject matter experts, observing and providing guidance as required. All crewmembers were appropriately qualified for this mission. Further, all self-reported to being healthy and not suffering from a level of fatigue that may affect their ability to carry out their roles.

Meteorological information

Wyndham’s climate includes a wet season, from late November to March, and a dry season typically from April to early November. ^[15] The wet season is associated with convective atmospheric conditions that are not compatible with Zephyr operations.

Weather forecast

Knowledge of the effects that atmospherics conditions had on the UAV were developed over several years of operation in the northern hemisphere. Wyndham weather information was obtained via various global weather forecasting organisations, the Bureau of Meteorology (Australia) and locally launched radiosondes.^[16] The crew reported that, due to the remote, and mostly rural, location of Wyndham, the weather forecasting data was lower in resolution than was required for their operations. Therefore, the locally launched radiosondes, combined with their knowledge base from the northern hemisphere-operations, were utilised for forecast modelling during mission planning.

Forecast weather for the occurrence flight identified:

• a broad scale upper trough to the west, slowly progressing east
• no cloud expected above inversion layer, located at approximately 11,000 ft
• a mixing layer (rising and descending air) just below the inversion layer
• no storm activity
• likely areas of turbulence, both terrain-induced and atmospheric.

Mission planning

Due to the UAV’s susceptibility to turbulence, the climb and descent phases were considered critical as they took up to 10 hours to transit the troposphere.^[17] As a result, the climb and descent phases were carefully planned to avoid areas of convective activity. A launch would not go ahead when a mixing layer greater than 1,500 ft was identified. Experience had shown mixing layers typically reduced or dissipated in the evening. In addition, the possibility of aircraft drift had to be considered, to ensure the UAV remained within the defined operational area.

Weather forecasting data was analysed at each ‘launch decision point’ throughout the day, analysis continued for the duration of the climb and in preparation for descent. General considerations included:

• evaluation of upper air wind strength
• notable cloud activity and level
• the risk of icing
• topography assessment of mountain or gravity wave severity
• evaluation of humidity and likely thermal activity
• forecast rain or thunderstorms
• launch requirements of surface temperature less than 40˚C and winds of 2-5 kt.

This flight was originally planned to launch on 27 September 2019. The crew conducted the mission planning as per their procedures, however, the surface winds were not suitable for launch. The flight was subsequently put on hold, pending assessment of weather conditions the following morning.

On the morning of 28 September 2019, some of the crew met at 1100 for a briefing and review of the latest weather information. Over the course of the day, the crew noted that the conditions improved as the day progressed into evening, as was anticipated. In addition, the crew reported that while likely areas of turbulence had been identified, ‘it was not expected to be unmanageable’. When the surface conditions were identified as 29˚C with winds of 2-4 kt, from the south‑east, the decision was made to launch.

Other occurrence

In March 2019, another Zephyr 8 was involved in an accident, after launching from Wyndham Airport, WA. The resulting collision with terrain was also within the safe, predicted cut-down vector and there were no injuries to people or damage to local infrastructure. Following this occurrence, Airbus developed several safety recommendations. These included:

• enhanced pre-mission forecasting based on a better understanding of the effects of weather on the Zephyr
• expanded mission planning to determine optimum flight route, designed to avoid weather conditions known to affect the Zephyr
• crew to include additional subject matter experts, in operational and observer roles, to provide knowledge and guidance, as required
• refining procedures to ensure that no one person was making critical decisions, while also ensuring every member of the crew had the opportunity to provide input
• refining post-crash management procedures.

The ATSB spoke with eight members of the crew following the September 2019 occurrence, which was the first flight after the March accident. The crew referred, with positive comments, to the enhanced procedures being utilised during the mission planning, flight operations and post‑crash management.

Analysis

Designed for high‑altitude flight, the Zephyr unmanned aerial vehicle (UAV) was extremely sensitive to atmospheric instability during the climb and descent phases. At the time of the occurrence, the Zephyr program was in its early operation phase. As such, information regarding the UAV’s structural limitations and methods to forecast turbulence were still evolving.

About one hour after launch, the UAV encountered atmospheric conditions that resulted in a departure from the planned flight. The UAV self-recovered from several turbulence‑induced upsets, and the crew increased power and tried to command the aircraft into calmer conditions. Due to the UAV’s low air speed, local winds reduced the groundspeed to around 1 kt, reducing its ability to move out of the unstable conditions in a timely manner. The UAV was unable to self‑recover from the final uncommanded turn and entered into an uncontrolled spiral descent. During this descent, a combination of high bank angles and airspeed exceeded its structural limitations and resulted in an in-flight break-up.

Multiple successful missions, over several years, in the dry desert-like locations in the northern hemisphere, had provided valuable data to assist in identifying the optimum weather conditions for the sensitive climb and descent phases. This was only the second launch from Wyndham and, as such, the unique local terrain and weather conditions were not fully understood. The first, failed launch from Wyndham resulted in the implementation of enhanced planning procedures, which were utilised for this mission, with positive reports from the crew. While this mission also resulted in a loss of the UAV, both launches resulted in a greater understanding of local meteorological conditions.

The two launches from Wyndham, while unsuccessful, have shown that the cut-down vector, soft‑termination and post‑crash management procedures were effective. These steps reduced the likelihood that the Zephyr UAV would present a fire risk following the collision with terrain, and that it came to rest at the predicted location, minimising risk to the public and environment.

Findings

From the evidence available, the following findings are made with respect to the in-flight break-up involving an Airbus Zephyr 8 unmanned aerial vehicle, near Wyndham Airport, Western Australia on 28 September 2019.

Contributing factors

• The Airbus Zephyr 8 entered an area of unstable atmospheric conditions that exceeded the aircraft's ability to remain in the flight envelope, resulting in an in-flight break up.

Other findings

• Operational and post-crash management procedures were effective in minimising risk to the public and environment.

Safety issues and actions

Safety action by Airbus

As a result of this occurrence, Airbus conducted an investigation which resulted in several safety recommendations. These included the development of tools capable of forecasting local weather phenomena to the higher accuracy and resolution required for the Zephyr Program. These tools are intended to assist the flight crew with mission planning and in-flight decision-making. In addition, enhanced procedures were developed to assist the flight crew in efficiently managing abnormal situations.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Airbus
• flight crew.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Airbus
• flight crew
• Civil Aviation Safety Authority.

Submissions were received from:

• Airbus
• Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. The term UAV refers to serial number Z8B-03 for the remainder of the report, except where otherwise noted.
3. Vne – velocity never exceed – indicated airspeed that, if exceeded, may result in structural damage to an aircraft. The Zephyr UAVs Vne was significantly slower than conventional aircraft.
4. The wingtip camera was located on the left and oriented to view the aircraft.
5. Soft termination can also be commanded by the crew.
6. The cut-down vector is determined using aircraft telemetry to predict the aircraft’s likely point of collision with terrain.
7. QinetiQ initially designed the Zephyr in 2003, before Airbus Defence and Space gained control of the program in 2013.
8. The stratosphere is located above the troposphere, about 18-25 km above the earth’s surface. In this zone, air temperature increases with altitude, avoiding convection and resulting in stabilised atmospheric conditions
9. The wings consisted of a mid-span 15˚ dihedral (upward) and wing tip anhedral (downward).
10. There is no aileron flight control system on the Zephyr.
11. Zephyr is typically hand-launched by four to five ground crew, fast-walking/jogging into an ideal 2-3 kt headwind.
12. A notice to airmen (NOTAM) advises personnel concerned with flight operations of information concerning the establishment, condition or change in any aeronautical facility, service, procedure, or hazard, the timely knowledge of which is essential to safe flight.
13. Flight level (FL): An aircraft’s height above mean sea level when the pressure at sea level is 1013.2 hPa, called pressure altitude. FL 220 equates to 22,000 ft pressure altitude.
14. Typically, when two Zephyrs were in operation; each GCS would control an individual aircraft. On this flight, the second GCS acted as a back-up facility.
15. The wet season is usually preceded by a ‘build-up’, generally from October to late November, where temperature and humidity ‘build’, before monsoonal rain sets in, resulting in a period of unstable weather conditions.
16. A radiosonde is a small telemetry instrument, which measures various atmospheric parameters as it is carried into the atmosphere by a weather balloon, transmitting the data to a ground receiver.
17. The troposphere, the atmospheric layer between the earth’s surface and the stratosphere, is where almost all weather phenomena takes place.

Safety summary

What happened

On the evening of 25 September 2019, the flight crew of a GIE Avions de Transport Régional ATR72 aircraft, registered VH-VPJ and operated by Virgin Australia Airlines, received a clearance to line‑up on runway 35 from intersection ‘Golf’ at Canberra Airport, Australian Capital Territory. While taxiing to the runway, the flight crew inadvertently lined-up on runway 30. Almost immediately after commencing the take-off roll, and at about the same time air traffic control instructed them to ‘stop’, the flight crew rejected the take‑off. The aircraft was re‑positioned for a departure from runway 35. 

What the ATSB found

The ATSB found that the flight crew elected to depart from intersection ‘Golf’ for runway 35. Due to the close proximity of the aircraft’s parking bay to the ‘Golf’ runway holding point, the selection of this intersection reduced the distance, and therefore the amount of time available for the flight crew to complete their pre-departure checks. After passing through the holding point, the captain taxied the aircraft onto runway 30, following the lead-on lights for that runway, while the first officer’s attention was focussed on completing procedures and checklists. This likely resulted in the flight crew having reduced awareness of the runway environment and aircraft orientation.

The lead-on lights to runway 30 were active with the taxiway lighting and the lead-on lights to runway 35 were activated when the holding point stop bar at intersection ‘Golf’ was turned off by air traffic control. Therefore, both runway lead-on lights were active. This increased the risk of an aircraft being manoeuvred onto the incorrect runway, particularly at night and/or in low visibility conditions. In this case, the captain, who recalled being focused on the lead-on lights, followed the first set of lights that led to runway 30.

The ATSB also established that Virgin Australia Airlines’ ATR72 Before take-off procedure did not specify when ‘ready [for take-off]’ was to be communicated to air traffic control. This increased the risk of procedures and checklists being completed while the aircraft was taxiing onto the runway, at a time when monitoring was critical. Virgin Australia Airlines’ procedures applicable to all the aircraft in their fleet did not include a runway verification check using external cues, including runway markings, signs and/or lights.

What has been done as a result

After the incident, Virgin Australia Airlines discontinued the use of intersection ‘Golf’ for departure at Canberra Airport during the day and night. Subsequent action included a proposal to amend the ATR72 Before take-off procedure to ensure it was completed at a time when the flight crew’s attention was not diverted to other tasks. However, ATR72 operations ceased before this was implemented. In addition, Virgin Australia Airlines have developed a runway verification procedure to be included in their Flight Crew Operating Manual for the Boeing 737, their current fleet.

Safety message

The design of airport runways and taxiways vary from relatively simple to more complex layouts. This can be exacerbated by reduced visual cues, such as night-time or poor weather, which can easily increase confusion. It is important for all flight crew to familiarise themselves with these layouts, particularly any unique designs, and ensure effective flight crew co-ordination is employed to minimise the risk of a runway incursion.

Operators should ensure the design of their operating procedures minimises the risk of human error. Clearly delineating procedural steps may reduce the likelihood of flight crews’ heads down activities at critical moments throughout the flight.

The occurrence

What happened

On the night of 25 September 2019, at about 1840 Eastern Standard Time (EST),^[1] the flight crew of a GIE Avions de Transport Régional ATR72-212A (ATR72) aircraft, registered VH‑VPJ and operated by Virgin Australia Airlines, were preparing for a scheduled passenger service from Canberra, Australian Capital Territory, to Sydney, New South Wales. The flight was planned to depart at 1900 and the captain recalled they were running ahead of schedule.

As part of their pre-flight planning, the flight crew elected to depart from intersection ‘Golf’ (G) for runway 35 (refer to section titled Canberra Airport information). The flight crew reported they based this decision on the aircraft’s performance, taking into account the weight and environmental conditions at the time, and the proximity of intersection G to their parking bay.

At about 1855, after the flight crew completed their pre-flight briefing, they requested a pushback clearance from air traffic control (ATC), which was approved. Several minutes later, the flight crew requested a taxi clearance to the holding point at intersection G, which was also approved. At around the same time, the flight crew of two other aircraft also requested clearances for pushback and taxi.

At about 1858, the captain commenced taxiing the aircraft. While taxiing to intersection G, the flight crew completed their departure review, which included checking the departure runway and intersection, take-off performance speeds and the flap setting. Before departure, there was no mention of the departure’s complexity or its designation as a hotspot. Just prior to reaching the holding point, the first officer (FO) advised ATC that they were ‘ready’ [to take-off] and then commenced the Before take-off procedure (refer to section titled Take-off performance).

At about 1859, ATC instructed the flight crew to line-up on runway 35 and about a minute later, they were cleared for take-off, with both instructions read back correctly by the FO. After the stop bar was deactivated by ATC, the aircraft crossed the holding point and the captain commenced turning through the intersection, inadvertently aligning with the centreline of runway 30.

During the turn, the FO was completing the final Before take-off checks and therefore, only looked up after the aircraft was lined-up on the runway. The captain recalled focusing on taxiing the aircraft to follow the lead-on lights (refer to section titled Airport lighting) and trying not to go too far into the intersection. Both flight crew recalled ‘the picture didn’t look right’ when they were lined-up on what they thought was the departure runway (runway 35). They also reported the runway (runway 30) appeared shorter than expected and that there was no centreline lighting (Figure 1). Neither of the flight crew could recall if they cross-checked the aircraft’s heading or position by available means as per the operator’s Before take-off procedure when they were in the lined-up position.

Figure 1: Night comparison of runway 30 and runway 35 from intersection Golf

Note: The vehicle lights were turned on in the runway 35 photograph (right).

Source: Canberra Airport, annotated by the ATSB

Air traffic control reported noticing the aircraft moving on runway 30 and immediately instructed the flight crew to ‘stop stop’ as they ‘seemed to be taking off on [runway] 30’. About 6 seconds later, the FO advised ATC they were ‘stopping’. The flight crew reported that take-off power^[2] had not been applied, nor the take-off roll commenced, and no braking was required. However, recorded flight data showed an immediate increase in torque for both engines from 4-6 per cent during taxi to 17.7 per cent, as well as a decrease in brake pressure to 16 pounds per square inch (psi) after the turn onto runway 30 (Figure 2). About 4 seconds later, the engine torque reached 28.1 per cent, indicating the power levers had been advanced to commence the take-off. At about this time, ATC instructed the flight crew to stop, after which, the data showed a decrease in the power lever positions to flight idle and an increase in brake pressure to 1,686 psi.

The flight data was consistent with airport closed-circuit television footage. This footage showed the aircraft cross the holding point and line-up on runway 30, followed by a brief pause, then a short acceleration before a sudden braking. The aircraft then remained stationary on the runway for a few seconds before it was taxied forward along the runway and vacated at the next exit.

Air traffic control provided further instructions to the flight crew to taxi off runway 30 and reposition for a departure from intersection ‘November’ for runway 35. The flight continued to Sydney without further incident.

Figure 2: Flight data showing the aircraft’s turn onto runway 30 with key events

Note: The green line from taxiway golf onto runway 30 indicates the aircraft track.

Source: Virgin Australia Airlines, annotated by the ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) +10 hours.
2. For the ATR72, the normal maximum take-off torque is 90 per cent.

Context

Personnel information

Captain

The captain held an Air Transport Pilot (Aeroplane) Licence, multi-engine command instrument rating and a Class 1 Aviation Medical Certificate. At the time of the incident, the captain had a total of 6,500 hours of aeronautical experience, of which 2,375 hours were on the ATR72.

The captain was based in Brisbane and scheduled to travel on the 2130 service from Sydney to Brisbane on arrival in Sydney. However, during the turn‑around in Canberra, the captain contacted the airline’s crewing department to reschedule the commute to an earlier flight that departed Sydney at 2000, 10 minutes after the incident flight’s scheduled arrival time in Sydney.

First officer

The FO held a Commercial Pilot (Aeroplane) Licence, multi-engine instrument rating and a Class 1 Aviation Medical Certificate. At the time of the incident, the FO had a total of 6,700 hours of aeronautical experience, of which 6,100 hours were on the ATR72.

Experience in Canberra

Both the captain and the FO reported regularly operating from Canberra Airport over a number of years during both the day and night and being familiar with the airport’s layout. However, they could not recall previously using intersection G for departure at night but had used it for departure at least once during the day.

Fatigue considerations

A review of the sleep and roster information obtained found there was a low likelihood the flight crew were experiencing a level of fatigue known to have an adverse effect on performance.

Canberra Airport information

Canberra Airport has two runways, 17/35,^[3] with a length of 3,283 m and width of 45 m; and 12/30, with a length of 1,679 m and width of 30 m. At the time of departure, both runway 30 and 35 were active.

The intersection departures available for runway 35 were from taxiways ‘Golf’ (G), ‘Mike’, ‘Papa’, and ‘November’ (Figure 3). Taxiway G leads to the intersection of the two runways 17/35 and 12/30 and is listed as a runway incursion hotspot due to this complex layout (refer to section titled Runway incursions). There are few airports in Australia where a taxiway led to the intersection of two runways.

Figure 3: Canberra Airport chart

Source: Virgin Australia Airlines, annotated by the ATSB

Airport signs

Canberra Airport had runway and taxiway signs as per the Civil Aviation Safety Authority’s Part 139 Manual of Standards for Aerodromes and International Civil Aviation Organization’s Annex 14: Aerodromes. However, these documents do not include standards for signs at taxiways that lead to the intersection of two runways. Intersection G had a red runway sign for 12/30 on the left and a runway sign for 17/35 on the right of the taxiway when viewed from the cockpit (Figure 4). Adjacent to the holding point lights on the left side of the taxiway was the yellow runway distance remaining board for runway 35.

Figure 4: View of intersection G at Canberra Airport

Source: Canberra Airport, annotated by the ATSB

In comparison, the United States Federal Aviation Administration Aeronautic Information Manual stated that if a sign was located on a taxiway that intersects the intersection of two runways, the designation for both runways should be shown on the sign along with arrows showing the approximate runway alignment of each runway. In addition to showing the approximate runway alignment, the arrow indicates the direction to the threshold of the runway whose designation is immediately next to the arrow (Figure 5).

Figure 5: Federal Aviation Administration standards for signs at holding points with two runways

Source: Federal Aviation Administration

While intersection G was a complex layout, the runway signs were consistent with the applicable standards. Although other signs could be used at taxiways that lead to the intersection of two runways, such as those shown above, there were no other incidents reported for Canberra Airport where an aircraft had been inadvertently taxied onto the wrong runway from intersection G.

Airport lighting

The lighting system at Canberra Airport included runway lighting and taxiway lighting (Figure 6). Runway lighting consisted of white lights on the edges of the runway, and green and red lights positioned at the ends of the runway landing and departure thresholds respectively. Taxiway lighting consisted of green centreline lighting. There were also red stop bar lights at all the holding points for both runways. Only runway 17/35 had white centreline lighting.

Stop bars are installed at runway entry points to prevent an aircraft inadvertently entering the runway without a clearance. The lead-on lights for runway 35 from intersection G were linked with the stop bar so that when the stop bar was deactivated by ATC, the green centreline lighting beyond the stop bar activated. The lead-on lights for runway 30 were on the same circuit as the taxiway lighting, and therefore already active irrespective of the state of the stop bar. Therefore, it was possible for the lead-on lights to both runway 30 and 35 to be illuminated at the same time.

Figure 6: Canberra Airport lighting

Source: Canberra Airport, annotated by the ATSB

Operational information

Aircraft performance

From intersection G, there was 1,810 m of take-off run available^[4] and 1,870 m of take-off distance available^[5] for departure from runway 35. For runway 30 there was 1,030 m of take-off distance available. Factoring the aircraft’s weight and environmental conditions, about 1,700 m was required for the take-off. The accelerate stop distance^[6] required for either runway was about 1,650 m.

Given the shorter length of runway available for take-off from intersection G, the aircraft’s limitations for using this intersection was a maximum take-off weight of 20,541 kg and maximum air temperature of 31 °C. At the time of the incident, the aircraft’s actual take-off weight was 20,000 kg and the ambient air temperature was recorded as 11 °C.

As part of an internal review following the incident, Virgin Australia Airlines examined the ATR72 specific departure data from Canberra Airport for the 9 months prior to the incident. The data showed that 4 per cent of all ATR72 departures were from intersection G during both the day and night. Less than 1 per cent of all departures were from intersection G at night.

Simulator session

To assess the outcome of a take-off from runway 30, Virgin Australia Airlines conducted a simulator session. The same data as the incident flight was loaded into the simulator and the flight crew briefed an intersection G departure from runway 35. When the flight crew reached the intersection of runway 30 and 35, they were instructed to keep turning until they were lined-up on runway 30. Since the aircraft was lined-up near the intersection of the runways, the course deviation bar was observed to be centred.

The flight crew conducted the take-off, applying full torque of 90 per cent. The aircraft reached a height of 50 ft at the upwind threshold and continued without any terrain warnings. The scenario was repeated with an engine failure after take-off, which resulted in the flight crew receiving a terrain warning. Based on the results from these sessions, it was assessed that the take-off could have been successful if the departure was continued from runway 30. However, a runway overrun would have likely occurred if these was an engine failure at around their selected V1^[7] speed, or if there was any mishandling of the take-off. The operator’s flight technical specialists reviewed the flight data and conditions on runway 30 on the night of the incident and estimated around 980 m was required for the aircraft to become safely airborne using a minimum rotate/unstick airspeed.

Operator procedures

Take-off performance

At the time of the incident, Virgin Australia Airlines did not publish ATR specific performance charts for departure using runway 12/30. Therefore, the flight crew were restricted to using runway 17/35 only.

Before take-off procedure and checklist

In preparation for departure, the flight crew were required to complete the Before take-off procedure and checklist specified in Virgin Australia Airlines’ ATR72 Standard Operating Procedures. This procedure was to be completed after the cabin was secure and the departure review had been conducted. The procedure did not include a step for when ‘ready’ [for take-off] should normally be reported to ATC, and the flight crew recalled they would often report ‘ready’ [for take-off] prior to commencing the Before take-off procedure. By comparison, calling ‘ready’ was placed at the end of Virgin Australia Airlines’ Boeing 737 Before take-off procedure.

The ATR72 procedure referred to flight crew member 1 (CM1) as the pilot in the left seat (the captain) and flight crew member 2 (CM2) as the pilot in the right seat (the FO). Each flight crew member was assigned specific tasks to complete, which were applicable to all flights. Table 1 lists the tasks to be completed as part of the Before take-off procedure. Of note, the second to last item was required to be performed prior to entering the runway for take-off and the last item was to be completed on the runway. On the evening of the incident, the flight crew allowed themselves less than 90 seconds to complete this procedure while taxiing to the intersection. In comparsion, taxiing to the other intersections closer to the runway end would have taken several minutes, allowing more time to complete this procedure.

Table 1: Virgin Australia Airlines ATR72 Before take-off procedure

Note: This table combined the Before take-off procedure and checklist provided by Virgin Australia Airlines.

The Before take-off procedure also specified that flight crew were required to verify the aircraft had lined-up on the correct runway using internal cues within the cockpit such as those provided by the horizontal situation indicator.^[8] Specifically, the procedure stated:

Use all available information such as heading and [flight management system] course indication [primary flight display],^[9] lateral profile [multi-function display]^[10] and departure runway [multi‑function control and display unit]^[11] to ensure the aircraft is at the assigned runway and correct intersection for take-off.

Virgin Australia Airlines’ procedures applicable to all fleet did not include the use of external cues to verify the aircraft’s position prior to entering the runway and/or commencing the take-off roll at all times. The only reference to checking the take-off runway was during low visibility operations. External cues include runway markings, lights, and signs. An informal review of other operators’ procedures found they included a runway verification check, which was conducted prior to take‑off. This procedure required the flight crew to confirm the runway entry point prior to entry, and the departure runway prior to commencing take-off, with reference to both internal and external cues. This procedure would be conducted by both flight crew, and it required them to verbalise the identification and verification.

Runway incursion prevention

Virgin Australia Airlines’ Operations Manual: Operating Policies and Procedures applicable to all aircraft in their fleet described strategies to assist flight crew to manage the risk of runway incursions. These strategies included:

To avoid a runway incursion, flight crew must maintain a high level of situational awareness and vigilance during taxi, both before take-off and after landing. The following will assist flight crew in achieving this:

1. The Pilot Flying (PF) should brief the anticipated taxi route during the departure or approach briefing, as applicable, when:

a. Complex taxi routing is expected; or

b. Advice including NOTAMs affect taxiway routing or runways; or

c. Active runways will be crossed; or

d. Runway incursion 'hotspots' are identified on airport charts.

Ensure the aircraft location and that of other proximate traffic is known at all times by use of airport signage and reference to the airport diagram chart. Navigation displays should be used to aid orientation whenever practicable. During complex taxiing the [pilot monitoring] may assist awareness by verbal confirmation of taxiway passage or clearances.

Administrative tasks and checklists should be accomplished at the appropriate time, with due consideration to active runway or ‘hotspots’ on the taxi route.

Prior to crossing a runway or entering a runway for take-off the flight crew must:

a.) Verify the correct runway.

b.) Confirm that there is no conflicting traffic on the runway or on approach. Use of Traffic Collision Avoidance System may assist in the display of traffic but does not preclude visual verification.

Runway incursions

The International Civil Aviation Organization (2007) define runway incursions as:

Any occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle or person on the protected area of a surface designated for the landing and take-off of aircraft.

Incident reports show runway incursions are often clustered at particular runway holding points and/or intersections. These are known as ‘hotspots’. Specifically, a runway incursion hotspot is defined as ‘a location on an aerodrome movement area with a history or potential risk of collision or runway incursion, and where heightened attention by pilots/drivers is necessary’ (International Civil Aviation Organization 2007). These hotspots are included on charts provided by Airservices Australia and Jeppesen. Virgin Australia Airlines provided their flight crew with Jeppesen charts for their flight planning.

According to Airservices Australia’s Pilot’s Guide to Runway Safety (2016) a reason why runway incursions occur was due to runway confusion, which is when pilots enter, take-off, or land on the incorrect runway. The risk increases at airports with multiple runways, complex layouts or during night operations. One countermeasure to avoid runway confusion was to visually identify the correct runway before you enter or land on it using available cues such as signage, orientation, and runway markings.

An ATSB research report Factors influencing misaligned take-offs at night reviewed Australian and international occurrences where aircraft lined up on runway edge lighting or departed from closed/incorrect runways or taxiways. Common themes identified in these occurrences were flight crew divided attention/distraction/eyes inside (including due to workload and lack of familiarity with runway or airport) and confusing runway/taxiway entry/lighting.

The Pilot’s guide to runway safety also provided the following considerations to avoid runway incursions (not limited to):

• plan the taxi using available airport charts
• minimise heads down activity while the aircraft is moving
• resist the pressure to take short cuts.

Similar occurrences

A review of the ATSB’s occurrence database did not find any other incidents where an aircraft entered runway 30 instead of 35 at Canberra Airport while taxiing from intersection G in the previous 5 years. The following incidents were identified where aircraft had been lined-up on the incorrect runway or intersection:

ATSB investigation AO-2017-008

On 21 January 2017, the flight crew of an Airbus A320 aircraft, registered VH-VNC, prepared to conduct a regular passenger service from Cairns to Brisbane, Queensland.

At about 1511, ATC cleared the flight crew to taxi to holding point ‘B5’, which was the clearance they had expected and briefed. The aircraft was then taxied behind another aircraft along taxiway B. However, as that aircraft entered the runway from taxiway ‘B4’, the FO of VH-VNC inadvertently also taxied to holding point B4. At about 1515, the captain advised ATC that they were ready for take-off. Air traffic control cleared the flight crew to line up on the runway. The FO taxied the aircraft onto the runway and the flight crew completed the pre-take-off checks.

About 1 minute later, ATC cleared the flight crew to take-off. Immediately after, the captain read back the take-off clearance and ATC advised the flight crew that they were lined up at the B4 (not B5) intersection. The take-off clearance was cancelled. The aircraft subsequently took off from the B5 intersection and the flight continued without incident. Intersection B4 was 403 m shorter than B5.

The investigation noted that the pre-take-off checklist required the flight crew to verbally confirm that they were on the correct runway. However, reference to an intersection was not part of the verbal check/response. The FO commented that confirming the intersection as well as the runway during the pre-take-off checks may prevent a similar incident occurring.

ATSB investigation AO-2007-064

On 25 November 2007, a Gulfstream Aerospace Corporation G-IV aircraft, registered HB-IKR, was being operated on a charter flight from Brisbane, Queensland to Sydney, New South Wales. At about 2225, the pilot in command of the aircraft commenced a take-off run on taxiway Alpha, adjacent to the active runway 01. Air traffic control instructed the pilot to cancel the take-off clearance. The flight crew stopped the take-off and ATC instructed them to taxi to the end of the runway for a take-off using the full runway length.

The investigation identified various factors that contributed to the attempted take-off on the taxiway, including the take-off being conducted at an intersection departure from taxiway A7, which did not have normal runway threshold markings. Further, there was increased workload for the captain and possible self-imposed time pressure.

__________

3. Runway numbering: represent the magnetic heading closest to the runway orientation (e.g. runway 35 is orientated 348º magnetic).
4. Take-off run available: the length of runway declared available and suitable for the ground run of an aircraft taking off.
5. Take-off distance available: the length of the take-off run available plus the length of the clearway at the end of the runway.
6. Accelerate stop distance required (all engines operating): The sum of the distances required to accelerate from the brakes release point to V1 (decision speed for critical engine failure) with all engines operating and then to decelerate to come to a full stop plus the distance travelled at V1 in 2 seconds.
7. V1: the critical engine failure speed or decision speed required for take-off. Engine failure below V1 should result in a rejected take off; above this speed the take-off should be continued.
8. Horizontal situation indicator: A direction indicator that includes a magnetic compass, which provides the location of the aircraft in relation to a chosen course or radial.
9. Primary flight display: presents information about primary flight instruments, navigation instruments, and the status of the flight in one integrated display.
10. Multi-function display: used for traffic, route selection, and weather and terrain avoidance.
11. Multi-function control and display unit: used to input and modify flight plans.

Safety analysis

Introduction

On the evening of 25 September 2019, the flight crew of a GIE Avions de Transport Régional ATR72 aircraft, registered VH‑VPJ and operated by Virgin Australia Airlines, received a clearance to line-up on runway 35 from intersection ‘Golf’ (G) at Canberra Airport, Australian Capital Territory. The aircraft was inadvertently taxied onto runway 30 and the take-off roll was commenced. The flight crew rejected the take-off about the same time as air traffic control (ATC) issued them an instruction to ‘stop’.

This analysis will discuss the flight crew’s actions and responsibilities prior to take-off, and the runway lighting characteristics. It will further discuss Virgin Australia Airlines’ Before take-off procedures and the cues used to verify an aircraft’s position in relation to the runway environment.

Line-up on incorrect runway

Shortly after the flight crew were cleared for take-off on runway 35 at night by ATC, the captain inadvertently taxied the aircraft onto runway 30. After lining-up on runway 30, the engine power increased and brake pressure decreased, which was consistent with commencing the take-off roll. The recorded flight data was consistent with the airport closed-circuit television footage of the aircraft’s movements on the taxiway and runway 30.

While the flight crew did not recall commencing the take-off roll, they did notice there were differences in the runway environment to what they were expecting and discussed it with each other. Specifically, there was no centreline lighting and the runway appeared shorter than expected. The abrupt rejection of the take-off at about the same time ATC issued the ‘stop’ instruction was consistent with the flight crews’ reported awareness of a problem with the runway environment.

Time pressure before take-off

The flight crew elected to depart from intersection G for runway 35 primarily due to its proximity to their parking bay and this departure was within the performance limits. Although there were no delays on the night of the incident and the flight was reported to be running early, it was possible that the flight crew were also attempting to depart ahead of the other two aircraft, particularly given the captain’s rescheduled flight to Brisbane. However, neither flight crew recalled these factors influenced their decision to use intersection G for departure.

By selecting intersection G, the flight crew only allowed themselves around 90 seconds to complete their preparatory tasks before arrival at the holding point. These tasks included the departure review and Before take-off procedure. If they had selected another taxiway entry to runway 35, they would have had several additional minutes before arrival at the respective holding point in which to complete their checks.

This self-imposed time pressure led to the First Officer (FO) calling ‘ready’ as the aircraft taxied to the holding point for intersection G and prior to completing the Before take-off procedure. This procedure should have been completed before entering the runway, with the exception of the last item in the procedure to confirm that they were lined-up on the runway’s centreline. This resulted in the FO’s attention being diverted to the procedure when entering the runway environment.

Reduced awareness of the runway environment

On the night of the incident, the flight crew elected to depart from intersection G for runway 35. Although they operated routinely to Canberra Airport, they both reported they could not recall having departed from this intersection at night. After pushback and while taxiing towards intersection G, the flight crew briefed the departure, but did not specifically include the layout of the intersection in their brief.

As they approached intersection G, the FO reported focusing on the Before take-off procedure and was therefore not monitoring the external environment. The captain reported being focussed on the lead-on lights. However, the Before take-off procedure was a challenge and response procedure, and therefore would have required some of the captain’s attention. This likely resulted in the captain taxiing the aircraft through the intersection with divided attention while the FO’s attention was focussed inside the cockpit. Barshi and others (2009) reported that during busy periods, it is easy for attention to be absorbed in one task, which can divert attention from other important tasks, such as monitoring.

Neither flight crew could recall if they checked the aircraft’s heading after line-up. As they subsequently commenced the take-off roll, they had not identified they were lined-up on the incorrect runway. This indicated the flight crew had a reduced awareness of their position within runway environment.

Lead-on lights from intersection ‘Golf’

Taxiway G led to the intersection of runway 12/30 and runway 17/35. This intersection was identified as a hotspot, which could potentially be confusing to flight crew, particularly at night. When ATC issued the line-up clearance to the flight crew from this intersection, the stop bar was selected off by ATC and the lead-on lights for runway 35 illuminated. The lead-on lights for runway 30 were already illuminated with the taxiway lighting, which resulted in the lead-on lights for both runways illuminated at the same time. As the lead-on lights for runway 30 were the first set encountered when entering the intersection, these lights likely drew the captain’s attention, resulting in the aircraft being manoeuvred to follow them.

A risk when operating at an airport with a complex layout at night and/or low visibility conditions is runway confusion, where pilots enter, take-off, or land on the incorrect runway (Airservices Australia 2016). This can occur when features of the taxiway or runway, such as lighting are misidentified. While there were no other known incidents at Canberra Airport, the simultaneous activation of the lead‑on lights at intersection G increased the risk of an aircraft being manoeuvred onto the incorrect runway.

ATR72 before take-off procedure

The flight crew called ‘ready’ prior to commencing the Before take-off procedure on the night of the incident, which they reported they had done frequently. However, the Virgin Australia Airlines ATR72 Standard Operating Procedure did not specify a particular time when the flight crew were to make this call to ATC. By comparison, calling ‘ready’ was specified as the final item in the operator’s Boeing 737 Before take-off procedure, meaning that there were no further tasks to be completed until the flight crew received their take-off clearance from ATC.

Degani and Weiner (1993) as well as Barshi and others (2016) research into checklist design concluded that checklists should be designed in such a way that their execution will not be integrated with other tasks. They suggested countermeasures could include carefully examining the content and timing of procedures and checklists, such as specifying the tasks that must be completed at specific points in each phase of flight. Specifically, the timing of the procedure and checklist should minimise the risk of interruptions, distractions, and concurrent tasks. Similarly, Virgin Australia Airlines and Airservices Australia provide general guidance to consider the timing of tasks, such as avoiding heads down activity while the aircraft is moving.

For the incident flight, the timing of the ‘ready’ call resulted in the aircraft crossing the holding point and entering the runway with the FO focussed on checklist items. Consequently, the FO was unable to monitor the environment as the aircraft entered the runway to line-up.

Therefore, the omission of a step in the ATR72 Before take-off procedure for the ‘ready’ call, increased the risk of flight crews actioning this procedure while entering the runway. In turn, diverting their attention to checklist items at a time when monitoring and verifying the runway environment was critical.

Runway verification cues procedure

Virgin Australia Airlines’ ATR72 Standard Operating Procedure and fleet-wide policy and procedures draw reference to the importance of verifying the aircraft is on the correct runway. However, the only cues listed in the ATR72 Before take-off procedure to achieve this related to internal cues such as the cockpit instruments, including the horizontal situation indicator. The only other reference to external runway verification cues was in specific reference to low visibility operations.

The external cues available to the flight crew at the intersection G holding point prior to runway entry included the airport chart and runway marker boards. The cues to indicate they were on runway 30, in addition to the aircraft instruments, were the absence of centreline lighting, the presence of the apron lighting and the proximity of the runway end lights.

Other operators, particularly those operating into airports with complex layouts, include a runway verification procedure. This procedure would require the flight crew to verbalise their identification and verification of the runway entry point prior to entry, and the departure runway prior to commencing take-off using available internal and external cues. Making use of all available external cues at an airport, including signs, lighting, and markings will improve awareness of the environment and reduce the risk of runway incursions (Federal Aviation Administration 2016).

To avoid a runway incursion or overrun event, operators and flight crew need to ensure the aircraft enters the correct runway from the correct holding point and is then lined-up on the correct runway for take-off. The inclusion of a published procedure could promote a habit of directing attention to both internal and external cues, to verify the aircraft’s position in the runway environment.

Detection of incorrect runway

When the flight crew lined-up and commenced the take-off roll on runway 30, ATC immediately issued a stop instruction. At around the same time, the flight crew rejected the take-off and commenced braking. The ATSB’s calculations based on the runway length and the aircraft’s performance data showed that there was insufficient distance available on runway 30 for the aircraft to take-off. Virgin Australia Airlines conducted simulator sessions that demonstrated a successful take-off was possible if there were no abnormal conditions.

Therefore, had neither the flight crew nor ATC detected the aircraft was lined-up on the incorrect runway, it was possible that the take-off would have been achieved. However, if an engine failure occurred near V1, or if the take-off was mishandled, there was a risk of a runway overrun due to the shorter runway length.

Findings

From the evidence available, the following findings are made with respect to the take-off being commenced on the wrong runway involving GIE Avions de Transport Régional, ATR72, VH‑VPJ, Canberra Airport, Australian Capital Territory, on 25 September 2019.

Contributing factors

• At night, the flight crew inadvertently lined-up and commenced the take-off roll on runway 30, rather than the assigned runway 35. The flight crew and air traffic control noticed the error about the same time and the take-off was rejected.
• The runway intersection selected reduced the taxi time, resulting in the flight crew announcing they were 'ready' before completing the 'before take-off' procedure.
• While taxiing onto the runway, the captain was focused on following the runway lead-on lights while the first officer was completing the Before take-off procedure and checklist. This likely resulted in them having a reduced awareness of the runway environment and aircraft orientation.
• When the runway holding point stop bar at intersection Golf was turned off, the lead-on lights to both runway 30 and 35 were illuminated. This increased the risk of an aircraft being manoeuvred onto the incorrect runway, particularly at night and/or in low visibility conditions.
• The Virgin Australia Airlines Before take-off procedure did not include a step to report ‘ready’ to air traffic control. This increased the risk of flight crews completing this procedure while entering the runway, diverting their attention to checklist items at a time when monitoring and verifying was critical (Safety issue).
• Virgin Australia Airlines did not require flight crew to confirm and verbalise external cues such as runway signs, markings, and lights to verify an aircraft’s position was correct prior to entering and lining up on the runway (Safety issue).

Other findings

• The immediate response of air traffic control and the flight crew with rejecting the take-off, reduced the risk of a runway overrun.

Safety issues and actions

Timing of 'before take-off' procedure

Safety issue number: AO-2019-055-SI-01

Safety issue description: Virgin Australia Airlines did not require ATR flight crews to complete the Before take-off procedure prior to reporting ‘ready’ to air traffic control. This increased the risk of flight crews completing this procedure while entering the runway, diverting their attention to checklist items at a time when monitoring and verifying was critical.

Runway verification cues

Safety issue number: AO-2019-055-SI-02

Safety issue description: Virgin Australia Airlines did not require flight crew to confirm and verbalise external cues such as runway signs, markings, and lights to verify an aircraft’s position was correct prior to entering and lining up on the runway.

Safety action not associated with an identified safety issue

Discontinuation of departures from intersection G

After the incident, Virgin Australia Airlines issued a flight notice to all flight crew advising departures using intersection G at Canberra Airport would be discontinued. All performance platforms on the ATR72 were updated and the Canberra ‘TWY G’ intersection departure was removed.

Proposed changes to the ‘Before take-off’ procedure

Virgin Australia Airlines approved changes to the ATR72 standard operating procedure to include an additional statement highlighting the checklist must be completed before entering the runway. However, ATR72 operations ceased prior to the implementation of this change.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew
• Virgin Australia Airlines
• Airservices Australia
• Canberra Airport.

References

Airservices Australia 2016, A pilot’s guide to runway safety. Airservices Australia.

Barshi, I, Loukopoulos, LD & Dismukes, RK 2009. The multitasking myth: Handling complexity in real-world operations. Ashgate Publishing Aldershot.

Barshi, I, Mauro, R, Degani, A. & Loukopoulou, L 2016, Designing flightdeck procedures, National Aeronautics and Space Administration Technical Memorandum NASA/TM—2016–219421

Civil Aviation Safety Authority 2017, Manual of Standards Part 139 - Aerodromes. Canberra: CASA.

Degani A & Wiener EL 1993, ‘Cockpit checklists: Concepts, design, and use’, Human Factors, vol. 35(2), pp.345–59.

Federal Aviation Administration 2016, Pilot’s handbook of aeronautical knowledge FAA-H-8083-25B. US Department of Transportation, Federal Aviation Administration, Flight Standards Service.

Federal Aviation Administration 2020, Aeronautical Information Manual. US Department of Transportation, Federal Aviation Administration.

International Civil Aviation Organization 2007, Manual for the prevention of runway incursions (Doc 9870), Montreal: ICAO.

International Civil Aviation Organization 2018, Aerodromes - Volume 1: Aerodrome design and operations (8th edition), International Civil Aviation Organization.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties: the captain, first officer, the tower controller, Airservices Australia, Virgin Australia Airlines, Canberra Airport, and Civil Aviation Safety Authority.

Submissions were received from Virgin Australia Airlines, Canberra Airport, and the first officer. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Overview of the investigation

The occurrence

On 19 September 2019, the ATSB commenced a transport safety investigation into an unstable approach involving a Vietnam Airlines Boeing 787 aircraft landing in Melbourne, Victoria. During the approach to Melbourne Airport, the aircraft was not appropriately configured for landing or slowed to the approach reference speed, which resulted in an unstable approach. After 2 advisory calls from the Melbourne tower air traffic controller, concurrent with an aircraft-generated configuration alert indicating that the landing gear was not extended, the captain initiated a go‑around.

The incident

On 19 September 2019, at about 0725 Eastern Standard Time,^[1] the crew of a Vietnam Airlines Boeing 787-9 aircraft, registered VN-A870, operating a scheduled passenger service from Ho Chi Minh City, Vietnam, were on descent into Melbourne, Australia. The captain was the pilot flying (PF) and the first officer was the pilot monitoring (PM).^[2]Visual meteorological conditions were present at Melbourne Airport for the arrival.

The crew had planned to track via the ARBEY 4A standard terminal arrival route (STAR)^[3] prior to conducting the runway 34 RNAV-Z^[4] approach. The aircraft was descended in accordance with instructions from air traffic control.

At 0757:15, while the aircraft was maintaining 6,000 ft, the Melbourne approach controller requested that the crew cancel all speed restrictions and hold their speed for as long as possible. The PM responded that they were maintaining 240 kt and the approach controller replied ‘just the best you can do, thank you’.

At 0758:03, the approach controller provided the crew with their clearance to descend via the STAR to 2,500 ft and that they were cleared for the RNAV-Z approach to runway 34. From 0758:28 to 0801:02, the crew incrementally reduced the aircraft’s speed from 240 kt to 185 kt and selected 2 stages of flaps (flaps-1 then flaps-5).

During the STAR, a tailwind, in combination with the instruction from air traffic control to hold their speed for as long as possible resulted in an average groundspeed of about 280 kt, requiring the crew to use the speedbrake to decelerate and descend.

At 0802:13, after the aircraft had commenced the turn to intercept the approach, the approach controller instructed the crew to contact the Melbourne tower controller. After initial frequency congestion, the PM contacted the tower controller and confirmed they were cleared for the approach.

At 0804:18, the aircraft passed the final approach fix, 4 NM (7 km) from the runway, at 1,493 ft, about 157 ft below the intended glidepath. The aircraft configuration remained at flaps-5 with the landing gear up. The airspeed was about 186 kt, which was 26 kt above the maximum procedure approach speed of 160 kt and about 36 kt above their calculated flaps-30 approach reference speed of 150 kt. The autopilot captured the glidepath at 0804:25, just beyond the final approach fix, at an altitude of 1,493 ft, which was about 1,059 ft above field elevation (AFE).^[5] At 0804:30, the tower controller cleared them to land.

At about 0804:45, the Essendon Fields Airport tower controllers, located about 8 km south-east of Melbourne Airport, visually identified that the landing gear was retracted. The aircraft was descending through 1,305 ft (871 ft AFE) at an airspeed of 181 kt and about 3.0 NM (6 km) from the runway 34 threshold. At about that time, the PM reportedly prompted the PF to continue the configuration for landing.

The Essendon tower controller advised the Melbourne tower controller via an internal coordination hotline ‘Vietnam 781 check wheels’. At 0804:56, the Melbourne tower controller relayed this to the crew as ‘Vietnam 781 check wheels’, at which time the aircraft was at 960 ft radio altitude (RA).^[6] However, the PM misheard the advisory call as a ‘check wind’ request from the tower and replied ‘Vietnam 781, wind three-six-zero [360] twenty-five [25] knots’. The Melbourne tower controller immediately recognised the advisory call was misunderstood and provided a second call to the crew ‘Vietnam 781 check your wheels, they were observed up’.

At 0805:06, as the aircraft descended through 1,014 ft (780 ft RA and 580 ft AFE) at 183 kt with flaps-5 and the landing gear up, the crew received a master warning alert with an associated ‘CONFIG GEAR’ message.^[7]In response, the PM moved the landing gear handle to the down position, while the PF announced ‘go-around’ and selected the autothrottle take-off go‑around^[8] button. The PF disconnected the autopilot and the PM reported to tower ‘Vietnam 781 go-around’. The aircraft’s lowest recorded altitude was 862 ft (600 ft RA and 428 ft AFE) at about 1.5 NM (3 km) from the runway 34 threshold. Following the go-around, a second approach was conducted without further incident.

Investigation activities

During the investigation, the ATSB:

• interviewed the crew and air traffic controllers involved
• reviewed air traffic control audio recordings and aircraft recorded flight data
• reviewed the operator’s Standard Operating Procedures and crew fatigue information
• reviewed ATSB occurrence data of similar events.

ATSB observation

Stable approach criteria

The Vietnam Airlines standard operating procedures required the correct flight path, approach speed and aircraft configuration to be met, and all briefings and checklists completed by 1,000 ft above ground level for an approach to be considered stable. The procedures also stated that a go‑around must be initiated immediately if the approach became unstable below this height. The ATSB found that the aircraft was not correctly configured and the aircraft’s deviations from the operator’s stabilised approach criteria were not effectively managed, which resulted in an unstable approach.

Non-standard phraseology

The International Civil Aviation Organization Manual of Radiotelephony (ICAO Doc 9432) recommended that landing gear checks by air traffic control use the phraseology ‘check gear down and locked’, which was consistent with the Airservices Australia aeronautical information publication for a civil aircraft. However, the publication provided alternative phraseology to be used when controlling military aircraft of ‘check wheels’.

Fatigue

Considering the crew’s local home time in Ho Chi Minh City, and the approach into Melbourne was conducted during their window of circadian low, this increased the risk of fatigue for the crew. In addition, information provided to the ATSB from the crew indicated that, at the time of the incident, the captain had been awake for around 15 hours and the first officer for around 21 hours. The extended time of wakefulness also increased the risk of fatigue affecting the pilots.

Safety message

Unstable approaches are known to be a hazard to aircraft operations. According to the International Air Transport Association, between 2012–2016, there was an average of 6 accidents per year, which were preceded by an unstable approach.^[9] The Flight Safety Foundation approach-and-landing accident reduction task force identified several factors that contributed to unstable approaches, which included:^[10]

• crew fatigue
• crew or air traffic control-induced circumstances resulting in insufficient time to plan, prepare and conduct a safe approach, which includes accepting requests from controllers to fly higher/faster or to fly shorter routings than desired not recognising deviations
• not adhering to parameter-deviation limits
• belief that the aircraft will be stabilised at the minimum stabilisation height or shortly thereafter
• confidence by the PM that the PF will achieve a timely stabilisation.

In March 2019, the United States National Transportation Safety Board published Safety Alert 077 Stabilized approaches lead to safe landings. This reiterated that, failing to maintain a stabilised approach could lead to a landing with too much speed or too far down the runway, and ultimately to a runway excursion, loss of control or collision with terrain. The alert went on to urge pilots of all types and classes of aircraft to comply with standard operating procedures and industry best practice for stabilised approach criteria and go-arounds.

Reasons for the discontinuation

Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues or important safety lessons. Consequently, the ATSB has discontinued this investigation.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

The ATSB has communicated with Vietnam Airlines and Airservices Australia about some its observations and potential learnings. However, it considered that broader communication of this information would not be of significant benefit to other parties.

_______

1. Australian eastern standard time (EST): coordinated universal time (UTC) + 10 hours. 
2. Pilot flying (PF) and pilot monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances such as planning for upcoming stages of the flight. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.  
3. All time reference in this report are in local time (Central Standard Time).</Standard terminal arrival route (STAR): A designated instrument flight rules arrival route linking a significant point, normally on an air traffic services route, with a point from which a published instrument approach procedure can be commenced. 
4. Area navigation (RNAV) approach: A method of navigation, which permits aircraft operation on any desired flight path within the coverage of the ground or space-based navigation aids, or within the limits of the capability of self-contained aids, or a combination of these. 
5. The aerodrome elevation was 434 ft and the threshold elevation for runway 34 was 330 ft. 
6. Radio altitude (RA) is the height above terrain measured by the aircraft, which is equivalent to height above ground level (AGL). 
7. The master warning for CONFIG GEAR activates if any thrust lever is at idle, radio altitude less than 800 ft, and the landing gear is not down and locked. 
8. Take-off/go-around: is an autopilot/autothrottle setting activating take-off or go-around thrust. Depending upon aircraft type, it may be activated by depressing a switch or by manually moving the thrust levers to the appropriate position 
9. IATA (2017). Unstable Approaches – Risk, Mitigation Policies, Procedures and Best Practices (3rd ed.). Retrieved from https://www.iata.org/contentassets/7a5cd514de9c4c63ba0a7ac21547477a/iata-guidance-unstable-approaches.pdf. 
10. Flight Safety Foundation (2020). FSF ALAR Briefing Note 7.1 – Stabilized Approach. Retrieved from https://flightsafety.org/wp-content/uploads/2016/09/alar_bn7-1stablizedappr.pdf

Safety summary

What happened

At about 0640 Eastern Standard Time on 20 September 2019, a Mooney M20J aircraft, registered VH-DJU, departed Murwillumbah, New South Wales for a private flight under visual flight rules to Taree, New South Wales. On board were the pilot and one passenger.

At 0717, when DJU was 45 NM north of Coffs Harbour, the pilot contacted air traffic control and requested a clearance to transit the Class C controlled airspace at 6,500 ft. Air traffic control advised that a clearance was not available at that altitude and that, due to cloud conditions, a visual transit of the airspace would only be possible at an altitude not above 1,000 ft. The pilot then advised that the flight would descend to ‘not above 1,000 ft’.

The aircraft continued on a direct track to Taree and at 0724 the pilot reported that the aircraft was operating outside controlled airspace in clear conditions at 4,100 ft and would remain on that track. The aircraft was then climbed to 4,500 ft and at 0732, commenced a descent in the vicinity of high terrain.

The aircraft did not arrive at Taree as expected so a search was initiated. The aircraft was found to have collided with terrain about 26 km west of Coffs Harbour Airport. The two persons on board were fatally injured and the aircraft was destroyed.

What the ATSB found

The ATSB found that the pilot was not provided clearance to transit Class C airspace due to the trainee controller’s conservative assessment that workload would not allow it although there was no conflicting traffic, meteorological factor or limiting air traffic control instructions or procedures. The trainee’s supervisor accepted the assessment as an alternate transit option was provided to the pilot. Additionally, the information subsequently provided by air traffic control likely resulted in the pilot deciding to descend the aircraft from 6,500 ft instead of other available safe options. This descent exposed the flight to increased risk.

The ATSB also found that the pilot was not carrying suitable navigation equipment and had most likely not obtained the required weather forecasts. These factors reduced the pilot's ability to manage the flight path changes and identify the high terrain. This led to the aircraft being descended toward the high terrain in visibility conditions below that required for visual flight, resulting in controlled flight into terrain.

The pilot had also not completed the required flight reviews or proficiency checks. This resulted in the pilot not possessing the required licence to undertake the flight and likely led to a deterioration in the knowledge and skills required for effective flight management and decision‑making.

What has been done as a result

Following the occurrence, Airservices Australia (Airservices) provided additional training for air traffic controllers focussing on clearance issues, workload assessments, and coordination with other traffic units where decisions affect the other unit. An information and education package was developed for controllers regarding the provision of advice and information to pilots not subject to a clearance.

Performance checks and unit reviews were also undertaken to provide assurance that airways clearances were consistently issued in accordance with documented procedures. Airservices also included additional content in on‑the‑job instructor professional development sessions to ensure trainees’ capability is commensurate with actual workload to optimise performance.

Safety message

The safety risks of visual pilots flying into non-visual conditions are well documented. This continues to be a recurring factor in aircraft accidents and has been the focus of numerous previous ATSB reports and publications.

This accident also emphasises the importance of pilot and flight preparation. Ensuring that all required training is completed assists a pilot to both develop and maintain the necessary skills to manage challenges that may be encountered during a flight, such as inclement weather or inadvertent entry into non-visual conditions. Further, confirming that appropriate operational information is obtained and readily available ensures that a pilot is well prepared to anticipate in‑flight complications and successfully manage unforeseen challenges.

The accident also illustrates the significant influence that air traffic control can have on the conduct of a flight.

The occurrence

At about 0640 Eastern Standard Time^[1] on 20 September 2019, a Mooney M20J aircraft, registered VH-DJU, departed Murwillumbah, New South Wales for a private flight under visual flight rules (VFR)^[2]to Taree, New South Wales. On board were the pilot and one passenger.

After departing Murwillumbah, the aircraft climbed to 6,500 ft above mean sea level (AMSL) on a direct track to Taree (Figure 1).

At 0717 when the aircraft was 45 NM north of Coffs Harbour Airport, the pilot contacted Brisbane Centre air traffic control (ATC) and requested a clearance to transit Class C controlled airspace (see the section titled Airspace and airways clearances) on a continuation of the direct track to Taree at an altitude of 6,500 ft. The air traffic controller advised the pilot that a clearance to enter controlled airspace was not available at 6,500 ft and provided the option to request clearance through the underlying Coffs Harbour Class D controlled airspace.

Figure 1: Aircraft track (yellow) on 20 September 2019

Source: Google Earth, annotated by ATSB

The pilot subsequently contacted the Class D controller in the Coffs Harbour air traffic control tower and requested a clearance. In response, the tower controller contacted the Brisbane Centre Class C controller to discuss and coordinate the aircraft’s transit. Following that discussion, at about 0721, the tower controller advised the pilot that due to the extensive cloud cover, ‘the only way’ to transit that airspace under the VFR would be at an altitude not above 1,000 ft. The pilot responded that the aircraft would descend to ‘not above 1,000 ft’.

Recorded air traffic surveillance data indicated that at about this time, the pilot manoeuvred the aircraft slightly further laterally away from the Class C airspace however, during the descent, it briefly entered that airspace without a clearance.

The aircraft then continued on a direct track outside controlled airspace (OCTA) towards Taree and at 0724, the pilot advised the tower controller the flight was ‘currently 4100 in clear and we’re OCTA’. In the context of the preceding discussion regarding the extent of the cloud, the ATSB assessed the pilots reference to ‘in clear’ was an indication that the aircraft was operating in clear weather conditions at an altitude of 4,100 ft at that time. The pilot also advised that the flight would continue on that track and that a clearance request would be made upon reaching the airspace boundary (the aircraft’s track intersected further Class D controlled airspace to the south of Coffs Harbour). The tower controller acknowledged this and asked that the pilot report entering controlled airspace.

A review of recorded air traffic control surveillance data showed that after the pilot reported that the flight was operating in clear conditions, the aircraft was climbed to about 4,500 ft in Class G uncontrolled airspace and continued on a direct track until 0732. At that time, the aircraft commenced a descent, which continued until the last recorded position about 1 minute later. The aircraft was last recorded descending through an altitude of 3,564 ft at a ground speed of 165 kt. No further position or radio broadcasts were received from the aircraft.

In response to the aircraft not arriving at Taree as expected, a search was initiated. Although the search was initially hampered by rain and low cloud in the vicinity of the aircraft’s last known position, the aircraft was located, having impacted terrain at an elevation of 2,920 ft. The wreckage was positioned in line with the last recorded track and about 2.8 km south of the last recorded position. The two persons on board were fatally injured and the aircraft was destroyed (Figure 2).

Figure 2: Accident site

Source: ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.

Context

Pilot information and training

The pilot obtained a Civil Aviation Regulation 1988 Regulation 5 (CAR 5) Private Pilot Licence (Aeroplane) in 1982. For that licence, the pilot held endorsements for single engine aircraft below 5,700 kg maximum take-off weight, manual propeller pitch control, retractable undercarriage, tail wheel undercarriage and operation in controlled airspace. The pilot had never held an instrument rating.

The pilot was reported to have kept an up to date logbook but it was not found at the accident site or located during the investigation. An earlier logbook provided to the ATSB, contained two entries, including one relating to the conduct of a flight review in January 2010. The pilot had declared a total aeronautical experience of 1,006 hours at their last medical examination in November 2017.

Licencing and flight reviews under CASR Part 61

In September 2014, the Civil Aviation Safety Authority (CASA) introduced new flight crew licencing regulations, Civil Aviation Safety Regulation 1998 (CASR) Part 61. As part of the transition to the new licencing system, pilots could continue to exercise the privileges of their CAR 5 licence until 31 August 2018. Between September 2014 and 31 August 2018, pilots were required to make an application for a new Part 61 licence in conjunction with their next required flight review or proficiency check.

From 1 September 2018, CASA ceased recognising CAR 5 licences and a pilot was required to hold a CASR Part 61 licence in order to conduct a flight.

Prior to conducting a VFR private flight, CASR Part 61 required an aeroplane flight review (AFR), or other specified proficiency check, to have been undertaken within the previous 2 years.

The CASA Flight reviews information sheet provided the following guidance on the purpose and benefits of flight reviews:

A flight review is an opportunity to receive training that refreshes your flying skills and operational knowledge. Pilots undertake flight reviews to ensure they continue to be competent flying particular types of aircraft or exercising the privileges of an operational rating.

After gaining a qualification, it is normal for some skills to deteriorate over time. A flight review ensures your piloting skills remain - or are brought back up - to standard.

During an AFR, a pilot is required to demonstrate competency as outlined in the Part 61 manual of standards. The AFR also serves as an opportunity for a pilot to receive training to attain the required standards.

The manual of standards included the following competencies which were relevant to the management of hazards associated with the accident flight:

2.2 3 (d) perform diversion procedure

2.5 5 (a) perform basic flight manoeuvres using full instrument panel

2.7 7 (a) recognise and manage threats and errors during pre-flight planning and in-flight;

(b) maintain effective lookout and situational awareness;

(c) assess situations and make appropriate decisions;

(d) set priorities and manage tasks;

(e) maintain effective communication with stakeholders;

(f) communicate effectively using aeronautical radio.

4 (c) obtaining, interpreting and applying meteorological and aeronautical information;

(d) navigation and flight planning for day VFR operations;

(j) hazard identification and risk management;

(m) hazardous weather;

Prior to the introduction of CASR Part 61, flight reviews were only required to be recorded in a pilot’s logbook. After the introduction of CASR Part 61, flight reviews and proficiency checks were required to be recorded in a pilot’s licence, logbook and with CASA. As the pilot’s current logbook was not recovered during the investigation, the date of any flight review after January 2010 and before September 2014 could not be determined.

However, CASA did not hold any record of an application for a flight review or equivalent proficiency check after September 2014. The ATSB contacted flying training organisations at Murwillumbah Airfield and Gold Coast Airport, where the pilot’s previous aircraft was maintained, and the pilot was reported to have regularly visited. None of these organisations held training records for the pilot.

Based on the available information, the ATSB concluded that the pilot had not met the CASR Part 61 flight review requirements and, as such, did not hold the required licence to undertake the flight.

Fatigue

The ATSB collected information about the pilot’s 72 hours of activity prior to the accident. A review of that evidence identified that it was unlikely that the pilot was experiencing a level of fatigue known to affect performance.

Medical and pathological information

The pilot held a Class 2 medical certificate valid until November 2019.

Two prescription medications belonging to the pilot were found in the wreckage and the pilot’s toxicology report confirmed the presence of both medications. The use of one of those medications was not recorded in the pilot’s medical file held with CASA. It is unlikely that this medication adversely affected the pilot’s performance during the accident flight.

CASR Part 67 describes the requirements for aviation medical certification. One of the criteria for exercising the privilege of a Class 2 medical certificate is that the use of ‘any over‑the‑counter or prescribed medication or drug… that causes the person to experience any side effects likely to affect the person to an extent that is safety‑relevant’ is prohibited.

Further, medical certificate applicants are required to answer ‘every question asked by the examiner that the examiner considers necessary to help…CASA decide whether the applicant meets the relevant medical standard’. They are obliged to notify CASA of changes in medical conditions that impair their ability to ‘do an act authorised by the license’.

The following extracts from CASA-developed brochures are particularly relevant to pilot medical examinations.

Designated aviation medical examiners (DAMEs) and pilots together should foster a culture where it is likely that pilots will feel comfortable disclosing medical problems, even if they may impact on their ability to maintain an aviation medical.

Your DAME…will expect you to answer both written and verbal questions, honestly and fully...

Under the clinical practice guidelines for DAMEs, certain risk assessment protocols allowed them to take into account the pilot’s need for medication use when assessing if the applicant met the relevant medical standard. A CASA brochure states ‘only 0.29 percent of all initial and renewal medical certificates were refused by CASA during 2016-2017’.

Aircraft information

The Mooney M20J is a four seat, piston-engine aircraft with a two-blade variable-pitch propeller and retractable tricycle landing gear. VH-DJU (serial number 24-1075, Figure 3) was manufactured in 1981 and first registered in Australia in 2005.^[3]

Figure 3: The aircraft, VH-DJU

Source: Previous aircraft owner

The pilot purchased the aircraft on 6 July 2019, about 3 months prior to the accident, and had flown about 31 hours in the aircraft. The most recent entry on the maintenance release was 11 days prior to the accident (9 September 2019) and showed that the aircraft had accumulated 3,295 hours total time‑in‑service.

At the last scheduled maintenance inspection, in December 2018, the required inspections and test of the pitot-static system^[4] to maintain the aircraft’s approval for instrument flight rules (IFR)^[5]operation were not undertaken. However, as a condition of purchasing the aircraft, the pilot of the accident flight required that the test and inspections be carried out. In April 2019, this was carried out and at the time of the accident the aircraft was equipped and approved for IFR operation (Figure 4).

Figure 4: Composite image of the instrument panel

Source: Supplied

The aircraft was equipped with an autopilot capable of maintaining a selected heading and navigation track. The autopilot did not have an altitude hold function or ability to manipulate the vertical flight profile.

Two smartphones and a tablet computer were recovered from the wreckage. Neither smartphone contained an electronic flight bag or other aviation application. The tablet computer was found packed in an overnight bag indicating that it was not used during the flight.

Date-expired air navigation charts for the area encompassing the flight were found stowed in a flight bag indicating that they were not being used at the time of the accident. No paper flight plan or other flight planning notes were located in the wreckage.

Global Navigation Satellite System units

Passengers who had flown with the pilot reported that the pilot routinely used a Garmin Aera 500 Global Navigation Satellite System (GNSS)^[6] unit carried in their lap. The aircraft was also equipped with a Garmin GTN650 GNSS unit.

Aera 500

The Aera 500 unit carried by the pilot was not approved as a sole means of navigation. However, the unit did present useful information relating to the progress of the flight. This included topographical and airspace information. The unit had a terrain function that required a valid 3D GNSS position solution and a valid terrain and obstacle database to operate properly. Terrain information was advisory only and could include:

• display of altitudes of terrain and obstructions relative to the aircraft’s altitude
• pop-up terrain alert messages issued when flight conditions meet parameters set within the terrain system software algorithms
• forward looking terrain avoidance alerts

The ATSB recovered data from this unit indicating that it was in use at the time of the accident. However, it could not be established which mode was selected at the time of the accident or whether the terrain function was operable and the status of any user and system inhibitions.

GTN650

The GTN650 unit fitted to the aircraft operated as both a radio communications unit and an IFR‑approved GNSS unit. The unit was capable of operating in different modes, which could display a significant amount of information relating to progress of the flight. This included the selected track, any deviation from this track, topographical, and airspace information.

Like the Aera 500, the GTN650 had a terrain function. The unit provided similar advisory information and alerts as the Aera 500 unit with similar limitations. The previous owner of the aircraft, a flying instructor, advised the ATSB that at the time of the pilot’s purchase of the aircraft, the pilot declined familiarisation training with the GTN650 unit as the Aera 500 would be used. It could not be determined if the pilot subsequently undertook user training for the GTN650 unit.

The ATSB was not able to recover any data from the GTN650 unit to determine if it was used during the accident flight.

Terrain in the accident vicinity

At the time of the request to transit Class C airspace, the aircraft was about 10 NM north of Grafton (Figure 5). The area to the north of and surrounding Grafton was low-lying coastal terrain with elevations generally below 1,000 ft AMSL. However, the line of hills associated with the Coast Range, between the aircraft’s position and a track toward the coast and Coffs Harbour, rose to elevations in excess of 1,000 ft AMSL.

Figure 5: World Aeronautical Chart extract showing terrain in the vicinity of the aircraft’s track

Source: ATSB

Along a direct track toward Taree, the aircraft’s path passed over a region where the Great Dividing Range extended near to the coast at Coffs Harbour. This area included the mountain range encompassing Dorrigo National Park. The topography within this region was substantially more rugged and elevated than the terrain further north, rising in excess of 3,000 ft AMSL.

The terrain over which the aircraft was flying at the time of the descent from 4,500 ft was within this mountain range. The highest obstacle near the aircraft’s track were two towers on Mount Moombil at 3,950 ft, 400 m east of the track. Immediately south of Mount Moombil was a broad valley, which rose on the southern side to a ridge. The highest point of the ridge was 3,018 ft.

Meteorology

Airservices Australia (Airservices) did not hold any National Aeronautical Information Processing System (NAIPS)^[7] login records for the pilot for that, or any past, flights. A review of the pilot’s 

personal electronic devices identified that there were no aviation flight planning or aviation weather applications and no weather documentation relevant to the accident flight was found in the wreckage.

The ATSB obtained relevant weather information from the Bureau of Meteorology (BoM).

BoM information

Graphical area forecast

The graphical area forecast for the accident region forecast the following cloud conditions for the time of the accident (all heights AMSL):

• broken^[8] stratus between 1,000‑2,000 ft
• broken stratocumulus between 2,000‑4,000 ft
• scattered cumulus between 4,000‑9,000 ft

Satellite images

Satellite images (Figure 6) for the area just prior to the accident time showed generally clear conditions between Murwillumbah and Grafton. South of Grafton and throughout the area encompassing the high terrain west of Coffs Harbour, the images showed extensive cloud coverage. Further along the intended route towards Taree, the cloud coverage reduced near the coast, but persisted inland.

Figure 6: Meteorological satellite image extract for 0730 on 20 September 2019

Source: Bureau of Meteorology, annotated by ATSB

Analysis

The BoM provided the following analysis of meteorological conditions for the Coffs Harbour region on the morning of the accident:

On the 19th of September 2019, the analysed mean sea level pressure (MSLP) chart for 1800 UTC (4 am AEST 20th September) showed a strong, slow-moving high-pressure system over the Tasman Sea extending a ridge over eastern New South Wales. A coastal trough situated north of Coffs Harbour, whilst an approaching cold front was moving east through Central Australia at approximately 30 knots.

At the time of the incident the region was covered in widespread broken low cloud. With bases generally between 2000 - 3000ft above mean sea level, this most likely resulted in cloud on ground around Mount Moombil. Recent rainfall over the area with persistent onshore flow likely increased the low-level moisture within the air mass, creating saturated conditions.

The top of the broken low cloud layer was approximately 3,000 (±1,000) ft AGL [above ground level] with a second cloud layer, few to scattered in its extent and at approximately 8,000 (±1,000) ft AGL.

Automatic terminal information service

At the time of the accident, the Coffs Harbour automatic terminal information service detailed the following weather information:

• wind: Variable at 5 kt
• visibility: Greater than 10 km
• cloud coverage: Few at 1,500 ft and broken at 2,500 ft^[9]
• temperature: 17° C

Witness

A witness located about 10 km south‑east of the accident site stated that cloud was ‘down to the ground’ at the base of the mountain from 0700 until 0830 on the morning.

Visual meteorological conditions

Visual meteorological conditions (VMC) are the minimum meteorological conditions in which flight is permitted under the VFR – that is, conditions in which pilots have sufficient visibility to fly the aircraft while maintaining visual separation from terrain and other aircraft. Additionally, when operating VFR at or below 2,000 ft above the ground or water, the pilot must be able to navigate by visual reference to the ground or water.

The VMC requirements for aeroplanes vary for different classes of airspace (Table 1).

Table 1: Visual meteorological conditions

Source: Aeronautical Information Publication ENR 1.2

Airspace and airways clearances

Coffs Harbour airspace

Coffs Harbour Airport is situated within Class D terminal airspace (Figure 7). This airspace was controlled by an air traffic controller situated within the Coffs Harbour control tower. The Class D airspace extended to the north and south‑west at ground level to a 7 NM boundary. West of the airport, the airspace extended about 6 NM and further west of this boundary, the controlled airspace base was the overlying Class E airspace at 8,500 ft.^[10] To the north and south‑west, the airspace fanned out at increasing distances from Coffs Harbour. The base of the airspace also progressively stepped up at increasing distances to a maximum altitude of 4,500 ft at about 22 NM.

Figure 7: Visual terminal chart extract of Coffs Harbour airspace showing key events

Source: Airservices Australia, annotated by ATSB.

Overlying the Class D airspace was Class C en route airspace, which continued up from 4,500 ft to overlying Class A airspace at flight level (FL) 180.^[11] The Class C airspace was controlled by an air traffic control position situated in Brisbane. At the time of the accident, this position was occupied by a trainee controller (trainee) in the first week of on-the-job training and under the supervision of an on-the-job training instructor (OJTI). The trainee and OJTI were managing both the sector of Class C and uncontrolled Class G airspace overlying and surrounding Coffs Harbour (Grafton) combined with a second sector of Class C and Class G airspace (Newell) extending to the west over the New England region.

The base of the Class C airspace also fanned out and progressively stepped up at further distances from Coffs Harbour Airport. At a distance of about 30 NM, where the pilot of DJU requested to enter the airspace, the base of the Class C airspace was 5,500 ft. Outside of these boundaries was Class G uncontrolled airspace that extended up to the base of overlying Class A airspace at FL 180.

Within Class C airspace, aircraft were identified and controlled using automatic dependent surveillance broadcast (ADS-B) or radar surveillance data. IFR aircraft were positively separated from both IFR and VFR aircraft. VFR aircraft were provided traffic information about other VFR aircraft. The controllers had access to relevant weather forecasts and observations, but as they were physically located in Brisbane, they could not see the actual weather conditions.

In addition, Class C controllers provided pertinent operational information to IFR aircraft as well as to VFR aircraft upon request within the Class G airspace.

Within Class D airspace aircraft were not identified and controlled using surveillance data, and separation between aircraft was provided as follows:

• IFR flights were separated from other IFR and special VFR flights,^[12]
• IFR flights were provided traffic information for VFR flights,
• VFR flights were provided traffic information on other VFR flights, and
• special VFR flights were separated from other special VFR flights in conditions less than VMC.

The Class D controller at Coffs Harbour Airport had access to weather forecasts, observations and could observe the prevailing weather conditions for the airspace. In addition, the control tower was fitted with a tower situation awareness display (TSAD). This displayed ADS-B and radar aircraft position information to enhance controller awareness but was not used for traffic management or separation.

Flight notification

The pilot was not required to and did not submit a flight plan prior to departure.

As the pilot intended to operate in the Class C airspace, notification of the flight was to be provided to ATC as per Airservices’ Aeronautical Information Publication (AIP) requirements. The pilot provided this notification when the aircraft was 10 NM north of Grafton (about 4 minutes prior to reaching the airspace boundary), with detail of the intended track and a clearance request to transit the Class C airspace.

Traffic

At the time of the Class C clearance request, there was no other traffic below 10,000 ft in the Coffs Harbour airspace, nor were there any impending arrivals or departures during the time the aircraft would have transited the airspace. Within the remaining airspace being managed by the trainee and OJTI, there were five other aircraft being provided an air traffic service.

Additionally, in the minute prior to receiving the request from VH-DJU, the trainee had completed handling a flight following request from a VFR aircraft.

Class C clearance request

The pilot requested a clearance to proceed from a position 10 NM north of Grafton (14 NM from the airspace boundary) direct to Taree at an altitude of 6,500 ft. This track passed within the Class C airspace for a distance of about 7 NM (2 minutes and 50 seconds at the aircraft’s speed).

On receiving the clearance request, the trainee assessed that workload and priorities would not permit a clearance at the requested level, and that the transit would be better facilitated through the underlying Class D airspace. The trainee then advised the pilot accordingly, providing the option to request clearance for the Class D airspace. The trainee or OJTI did not contact the Class D controller prior to initially proposing the pilot contact that controller. The OJTI felt that it was more effective for the pilot to contact the Class D controller directly rather than coordinating the request.

Workload assessment

The Airservices investigation report into the accident identified the following:

Sampling of Grafton sector controller performance assessment reports and daily training records included debriefing and coaching comments emphasising to trainees and controllers to be cautious with issuing clearances below A080 through the [Coffs Harbour] airspace. These comments are intended to highlight the known complications of transiting aircraft with processing IFR departures and arrivals. Techniques including the use of alternative clearances for departing and overflying aircraft are also emphasised during training and checking together with options for transiting aircraft to climb/descend to transit the airspace to manage the traffic scenarios. Assessing the options available with regard to the traffic picture is also emphasised during training and checking.

While acknowledging the complexities during training and checking is appropriate, this may unduly influence decision-making particularly in trainees and inexperienced controllers as they gain confidence and familiarity with new airspace volumes. In these cases, perceived workload may be prioritised ahead of an appropriate assessment of the current and projected traffic disposition.

The OJTI assessed that the workload at the time of the clearance request was low, but the trainee being new to the role may have perceived the workload as higher. The OJTI also stated that while the trainee’s decision was conservative, it was appropriate. The OJTI felt no intervention was required as the pilot had been provided a suitable option. The OJTI further stated that 6,500 ft was a level that created separation difficulties with Coffs Harbour arrivals and departures and given the limited size of the airspace this can very quickly create a significant workload issue.

Class C airspace infringement

After being advised that a Class C clearance was not available, the aircraft entered the Class C controlled airspace without clearance. After entering the controlled airspace, the pilot descended the aircraft before exiting the airspace about 1 minute later (see the section titled Class D clearance request and communications below). 

The trainee did not attempt to contact the pilot of the aircraft during the airspace infringement. The OJTI noted that this airspace infringement did not cause any separation or traffic management concerns.

Class D clearance request and communications

The direct track to Taree from the pilot’s position did not intersect the northern sections of the Class D airspace and therefore a clearance was not required on the direct track at or below 4,500 ft. However, the track did intersect the southern section of the airspace beyond Coffs Harbour.

The pilot requested a clearance with the Class D controller for a transit at 6,500 ft on a direct track to Taree. This flight path would have transited the Class C airspace and the Class D controller, queried whether the pilot wanted to remain at 6,500 ft. The pilot stated being ‘happy to remain at 6,500 ft’ and the controller, unaware of the previous Class C clearance request, instructed the pilot to contact the Class C controller for a clearance through that airspace.

The Class D controller then contacted the trainee to advise that the pilot would be calling them to request the clearance through the Class C airspace and that they wanted to transit at 6.500 ft. The Class D controller informed the trainee that a VFR transit would be difficult. During this discussion between the controllers, the pilot again contacted the Class C controller for the clearance.

The trainee advised the pilot that the Class D controller had been in contact and instructed the pilot to again contact that controller.

At 0721, the pilot again contacted the Class D controller. The Class D controller advised that a clearance through the Class D airspace would only be available ‘about not above 1,000 ft’ and the pilot responded that the flight would descend to that level. The Class D controller asked the pilot to report entering the airspace at the 7 NM boundary. While a change in track was required to enter the airspace at the 7 NM boundary, no tracking instruction or guidance was provided to the pilot. The pilot did not voice any concerns about the advice provided by the Class D controller.

At 0724, about 10 minutes prior to the accident, the pilot contacted the Class D controller and advised that the flight was operating outside controlled airspace, in clear conditions at 4,100 ft AMSL, would remain on that track and request a clearance upon reaching the airspace boundary. No clearance was issued by the tower controller, but the controller acknowledged the request and instructed the pilot to report entering controlled airspace. No further broadcasts were heard from the aircraft.

Seventeen minutes later, at around the time the controller expected the pilot to enter controlled airspace (and about 7 minutes after the accident had occurred), the Class D controller tried contacting the pilot twice without receiving a response.

Uncertainty phase not declared

Aircraft to the west of Coffs Harbour were known to disappear from the TSAD (as DJU did about 1 minute prior to the accident) due to the effect of the surrounding terrain. It was also common for VFR aircraft to be uncontactable by Coffs Harbour ATC when operating in Class G airspace in that area. The controller reported that, as the pilot had advised that the flight was operating in clear conditions at 4,100 ft, they held no concern for the progress of the flight. Consequently, no uncertainty phase was declared with respect to the flight.^[13]

Fatigue

The ATSB found no indicators that increased the risk of the controllers experiencing a level of fatigue known to affect performance.

Future Coffs Harbour airspace reclassification

Prior to the accident, Airservices commenced the Airspace Modernisation Program. This program will reclassify the Class C airspace above Coffs Harbour to Class E. At the time of writing, the timeframe for the completion of this program was not available.

Undertaking a VFR transit of the Class E airspace will not require a clearance.

Recorded flight data

The aircraft was not required to be and was not fitted with flight data recorders.

Airservices provided ADS-B and radar surveillance data relating to the flight. The data captured the flight from soon after departure at Murwillumbah until about 2.8 km north of the accident site (Figure 8).

Figure 8: Recorded flight path near accident site (towers on Mt Moombil not depicted)

Source: Google Earth annotated by ATSB

From 0722 until 0724, the aircraft descended from its cruising altitude of 6,500 ft to 4,100 ft. At this time, the pilot reported operating in clear conditions. About 2 minutes later, the aircraft climbed to 4,500 ft.

The aircraft remained at 4,500 ft until 0732 when a descent commenced and continued until the last recorded position at 0733:50. The descent rate averaged about 850 ft per minute with a groundspeed between 165 kt and 175 kt. The observed wind was almost directly across the descent track at 10-20 kt. According to the aircraft’s previous owner, this descent profile was consistent with maintaining a cruise engine power setting.

During this descent, the aircraft passed a saddle about 400 m west of the summit of Mount Moombil. On top of the summit were two towers, 538 ft high. The aircraft passed about 386 ft below the top of these towers and continued descending across a broad valley. Throughout the descent, no significant variations in either aircraft track, speed or descent rate were recorded.

Data recovered from the pilot’s Aera 500 GNSS unit was similar to the surveillance data until 3 minutes prior to accident (about 1 minute before the final descent) when the recorded data ended. The ATSB’s examination of the unit determined that the data loss was most probably the result of power supply interruption during the accident sequence, before that data was recorded to the non-volatile memory.

Accident site and wreckage

The accident site was located at an elevation of 2,920 ft in heavily wooded, steep terrain within Dorrigo National Park (Figure 9).

Figure 9: Aircraft wreckage

Source: ATSB

The path made by the aircraft through the vegetation continued for about 65 m from the first identified aircraft component to the ground impact point (Figure 10). Tree-impact marks and the impact crater showed that the aircraft entered the vegetation in a wings-level attitude on a continuation of the previously recorded descent angle of about 2°.

Examination of the wreckage found that the aircraft entered the vegetation at relatively high speed with the flaps and landing gear retracted. No pre-impact faults were identified, but the examination was limited by the extensive damage. The serviceability of the flight instruments and associated systems could also not be verified. Both fuel tanks ruptured, and an odour of fuel was present. The engine separated from the fuselage and the engine controls were severely disrupted during the accident sequence, which prevented determination of their positions. Damage to the propeller indicated that it was being driven by the engine at the time of the accident. The accident was not survivable.

Figure 10: Final descent path of the aircraft

Source: ATSB

Similar occurrences

The safety risks of visual pilots flying into non-visual conditions are well documented and continue to represent a significant factor in aircraft accidents and fatalities.

Many similar occurrences have been summarised in the ATSB research reports General Aviation Pilot Behaviours in the Face of Adverse Weather and Accidents involving Visual Flight Rules pilots in Instrument Meteorological Conditions as well as in ATSB accident reports, including AO‑2017‑061 and AO‑2017‑069.

A large amount of reference material is available to pilots for guidance on avoiding VFR flight into adverse weather as well as recovering a flight should inadvertent IMC entry occur, including by seeking the assistance of ATC. The United States Aircraft Owners and Pilots Association Air Safety Institute website VFR into IMC provides an online course, videos and reference materials to assist pilots in avoiding and managing these scenarios. The following articles also provide valuable guidance on the subject.

• AVweb, Surviving VFR into IMC.
• Plane & Pilot, Surviving inadvertent IMC.

__________

3. Prior to being registered in Australia, the aircraft was operated in South Africa.
4. The pitot-static system is a system of air pressure-sensitive sensors and instruments that are used to determine an aircraft's airspeed, altitude, and vertical speed.
5. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft to operate in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules. Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.
6. Global Navigation Satellite System: A satellite based radio navigation system that uses signals from orbiting satellites to determine precise position and time.
7. The National Aeronautical Information Processing System (NAIPS) is a computerised, aeronautical information system. It processes and stores meteorological and NOTAM information as well as enables the provision of briefing products and services to pilots.
8. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘few’ indicates that up to a quarter of the sky is covered, ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky, ‘broken’ indicates that more than half to almost all the sky is covered, and ‘overcast’ indicates that all the sky is covered.
9. Cloud heights are above ground level.
10. For VH-DJU, a clearance was not required to transit the Class E airspace.
11. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 180 equates to about 18,000 ft.
12. By day, when VMC does not exist, air traffic control may authorise, at pilot request, a ‘special VFR’ flight for the purpose of entering or leaving the controlled airspace.
13. Uncertainty Phase: A situation where uncertainty exists as to the safety of an aircraft and its occupants.

Safety analysis

Introduction

On the morning of 20 September 2019, while en route from Murwillumbah to Taree, New South Wales, a Mooney M20J, registered VH-DJU (DJU) descended into an area of low visibility and high terrain near the town of Dorrigo. During this descent, the aircraft collided with steep, forested terrain within Dorrigo National Park.

A review of the pilot’s medical records, post‑mortem toxicology results and recorded data indicated that it was very unlikely that the pilot became incapacitated during the flight. While examination of the wreckage was limited by extensive damage, no defects or anomalies were identified that contributed to the accident. As such, this analysis focuses on the examination of the operational factors that led to the aircraft’s collision with terrain while being operated under the visual flight rules (VFR).

Class C clearance request

At 0717, about 4 minutes prior to reaching the Class C airspace north of Coffs Harbour, the pilot notified the controller (in Brisbane) of their intended track and requested clearance to transit the airspace. The intended transit would be short (7 NM, less than 3 minutes) and there was no other aircraft in the Class C or D airspace overlying Coffs Harbour, or any impending departures or arrivals there.

The aircraft was cruising at 6,500 ft and the pilot reported being ‘happy’ at that altitude, indicative of the visibility and conditions at the time. Based on the Bureau of Meteorology (BoM) analysis of the cloud conditions, the ATSB assessed that a VFR transit of the airspace at or above 6,500 ft was possible.

At the time the transit clearance request was made, the trainee controller (trainee) controlling the Class C airspace was managing five aircraft across two airspace sectors and had just completed handling another request. The trainee assessed that the workload would not allow the clearance requested for DJU and advised the pilot that it was not available and to contact the Coffs Harbour control tower to transit via the underlying Class D airspace.

The supervising on-the-job training instructor (OJTI) felt that the trainee’s perception of workload was higher than it actually was, but it was a conservative assessment and appropriate given the trainee’s experience (within the first week of on-the-job training). In any case, the OJTI was satisfied with the trainee’s handling of the request as the decision to not provide a clearance was not considered unsafe and the pilot had been provided with an appropriate alternative.

The trainee and the OJTI also reported considering that the requested 6,500 ft transit may create separation difficulties with aircraft departing Coffs Harbour Airport under instrument flight rules. However, at the time there was no traffic expected to or from the airport. Additionally, a review of the available evidence indicated that there were no meteorological factors, traffic control instructions or procedures that prevented the pilot of DJU being provided with a clearance.

When DJU subsequently infringed Class C airspace as it descended, the trainee took no action and the OJTI felt the infringement did not present any traffic management issues. This indicates that the clearance requested could have been accommodated without any significant increase in controller workload.

Acceptance of the ATC option to seek a clearance through Class D airspace resulted in the pilot deviating from their intended plan and commenced a sequence of events that ultimately culminated in the accident. However, it is also important to recognise that the pilot had other available safe courses of action that were not utilised (discussed further below) and the ultimate outcome could not have been anticipated.

Decision to descend

When communicating with the Coffs Harbour tower controller to transit the Class D airspace, the pilot reported being ‘happy at 6,500 ft’. An assessment of the BoM cloud conditions analysis indicated that visual meteorological conditions (VMC) allowed the flight to progress at and above that altitude or below about 2,000 ft, but extensive cloud cover probably prevented VMC flight between those two levels. The analysis also indicated that it was possible to proceed in VMC around the Class C controlled airspace at or above 6,500 ft. Conditions also permitted a diversion or descent to the north of Grafton to proceed coastal beneath the cloud layers south to Taree.

In response to the pilot’s request, the Class D controller advised that ‘…the only way you could transit this airspace VFR would be around… not above one thousand [feet]’. The pilot responded that the flight would descend to ‘not above 1,000 ft’ and commenced a descent from 6,500 ft.

The controller had also requested that the pilot report at the 7 NM airspace boundary to receive a clearance but had not provided any tracking information. Given the aircraft’s position at the time, the pilot would have had to change track to reach that boundary.

At altitudes less than 1,000 ft along a track between the aircraft’s position and Coffs Harbour Airport and more significantly, along a continuation of the direct track to Taree, terrain clearance was not possible. However, the pilot did not voice any concerns with the advice provided and the flight descended on the direct track to Taree.

While it was the pilot’s decision to descend from 6,500 ft and continue along the direct track instead of other available safe options, this decision was likely influenced by the information provided by the controller. The descent took the aircraft toward both significant cloud and high terrain, increasing risk to the flight.

Pre-flight preparation

Although out-of-date, the aeronautical charts carried by the pilot showed the high terrain west of Coffs Harbour. However, the pilot was not using the charts at the time of the accident. Additionally, an electronic flight bag program was not used to provide topographical information. The pilot was heavily reliant on the global navigation satellite system units for situational awareness, but the limitations of these units may have prevented them from displaying adequate terrain information.

There was no evidence that the pilot obtained weather information prior to departure or during the flight, nor was any weather information found in the wreckage. As the weather encountered during the flight was similar to forecast, this information would have provided the pilot with advance notice of the likely conditions and supported more effective decision-making.

In summary, the pilot probably did not have an adequate understanding of the weather conditions or awareness of the topography west of Coffs Harbour. These factors reduced the pilot's ability to manage the flight path changes and identify the high terrain into which the aircraft was descending.

Flight into unsuitable conditions

The BoM analysis indicated that conditions across the mountain range west of Coffs Harbour at the time of the accident were below the minimum stipulated for VMC. This is consistent with the account of a witness located 10 km south‑east of the accident site.

About 8 minutes after reporting that the aircraft was operating in clear conditions, surveillance data showed that the aircraft commenced a descent. Given the weather conditions in this area, it is possible that the pilot initiated this descent to remain clear of cloud (to comply with the VFR) as it is a pilot’s responsibility to ensure VFR flights operate in accordance with VMC.

During the descent, the aircraft passed about 400 m to the west of and about 386 ft below the top of two towers at the summit of Mount Moombil. At or after that time, no significant change in flight path was recorded, which suggests that the aircraft had encountered poor visibility and/or these towers were not sighted.

The aircraft’s path through the vegetation to the final impact point was a continuation of the previous descent angle and track. This indicates that the flight was under control until the collision and that the pilot was unable to identify the high terrain in the aircraft’s path in sufficient time to take avoiding action.

Flight reviews

An aeroplane flight review (AFR) is required every 2 years for a pilot to exercise the privileges of a flight crew licence. A current logbook was not located during the investigation, a previous logbook contained the only recorded flight review undertaken by the pilot, in January 2010. As the pilot had not undertaken an AFR since the introduction of CASR Part 61 in September 2014, by September 2018, the pilot’s CAR 5 licence was no longer valid, and the pilot was not licensed in accordance with Part 61.

As some piloting skills deteriorate over time, flight reviews serve as valuable opportunities for pilots to ensure that these skills remain at, or return to, the required standard. Furthermore, a number of the competencies required to be demonstrated during a flight review were relevant to the challenges faced by the pilot during the accident flight. Any deterioration in these skills would have diminished the pilot’s ability to effectively manage these challenges. Therefore, undertaking the required regular training would very likely have assisted the pilot in the management of the flight. However, insufficient data was available to identify whether the uncompleted flight reviews contributed to the accident.

Mandatory medical disclosure

Toxicological examination identified that one of the medications that the pilot was using was not recorded in the pilot’s medical file held by CASA. However, the ATSB found no evidence that the pilot’s actions and decision making was impacted by this medication or a medical condition.

Nevertheless, it is important to declare all medications to address risks that could affect performance. While it is acknowledged that some pilots may be concerned about not meeting medical certificate requirements if they declare using medications or have a medical condition, pathways exist for managing certain medical conditions while maintaining a medical certificate.

Findings

Contributing factors

From the evidence available, the following findings are made with respect to the collision with terrain involving Mooney M20J, VH-DJU, which occurred 26 km west of Coffs Harbour Airport, New South Wales on 20 September 2019.

• The pilot was not provided with a clearance to transit Class C airspace despite no limiting meteorological factors. Instead, the Class C controller provided the option to seek a clearance at a lower altitude with an increased risk of encountering poor weather.
• The limited information provided by the Class D controller to enter that airspace probably led to the pilot’s decision to descend into a hazardous area instead of other available safe options.
• The pilot was not carrying appropriate navigation equipment and had most probably not obtained weather forecasts. This reduced the pilot's ability to manage the flight path changes and identify the high terrain.
• The aircraft was descended into an area of high terrain in conditions below that required for visual flight, leading to controlled flight into terrain.

Other factors that increased risk

• The pilot had not undertaken required recurrent flight reviews or proficiency checks to maintain currency or obtain the licence required to undertake the flight. This probably led to a deterioration in the knowledge and skills required for safe flight management and decision making.
• Although there is no evidence that it contributed to this occurrence, the pilot was taking an undisclosed medication. The disclosure and recording requirements for a pilot’s medical certificate aim to address the risks associated with medications or conditions that could affect performance.

Safety action

Safety action not associated with an identified safety issue

Additional safety action Airservices Australia

Following the occurrence, Airservices Australia implemented the following proactive safety actions:

• Classroom briefings and simulator exercises were completed by all New England controllers focussing on clearance issue techniques and workload assessment, as well as coordination with other units, where decisions taken will affect the other unit.
• Performance checks and unit reviews were undertaken to provide assurance that airways clearances were consistently issued in accordance with documented procedures.
• An information and education package was developed for controllers regarding the provision of advice and information to pilots not subject to a clearance.
• Inclusion of additional content to the on-the-job-instructor professional development sessions on ensuring the trainee’s capability is commensurate with actual workload to optimise performance.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 6 September 2019, at 1430 Eastern Standard Time,^[1] the pilot of a Bell Helicopter Company UH-1H helicopter registered VH‑UVC (UVC) departed Archerfield Airport, Queensland, on a private flight with four passengers for Bankstown, New South Wales.

Following a refuelling stop at Coffs Harbour, New South Wales, the pilot made contact with Williamtown air traffic control (ATC), while north-east of Broughton Island and requested clearance to track south via the visual flight rules (VFR) coastal route. The initial radio calls between the pilot and Williamtown ATC, occurred about 6 minutes prior to the published time of last light. The radio calls indicated that the helicopter was being affected by turbulence and as a result the pilot was having difficulty maintaining a constant altitude. In response, the controller issued a clearance for the aircraft to operate between 2,400 and 3,500 ft.

Once past Anna Bay, and about 11 minutes past published last light, UVC was observed on Williamtown ATC radar to make a left turn to the south, depart the coastal route and head offshore, on a direct track to Bankstown Airport. The turn likely resulted in the pilot losing visual cues and encountering dark night conditions.

The helicopter continued to track offshore to the south-west for about 90 seconds, maintaining between about 2,500 and 3,200 ft before commencing a rapidly descending, left spiral turn. It disappeared from Williamtown radar coverage about 12 minutes after published last light. Attempts by the controller to contact the pilot were unsuccessful and authorities were subsequently advised of a missing helicopter.

On 25 September 2019, wreckage from the destroyed helicopter was located in about 30 m of water, 5 km south‑west of Anna Bay. Two of the five persons on board the helicopter were confirmed to have received fatal injuries. The bodies of the pilot and two of the passengers were not found but they were presumed to have similarly not survived the accident.

What the ATSB found

The ATSB found that the pilot continued to fly after last light without the appropriate training and qualifications, and then into dark night conditions that provided no visual cues. That significantly reduced the pilot's ability to maintain control of the helicopter, which was not equipped for night flight.

Once visual references were lost, the pilot likely became spatially disorientated and lost control of the helicopter, resulting in a collision with water.

Further, the pilot did not disclose on-going medical treatment for significant health issues to the Civil Aviation Safety Authority. That prevented specialist consideration and management of the on‑going flight safety risk the medical conditions and prescribed medications posed.

Safety message

Various ATSB research and investigation reports refer to the dangers of flying after last light without the appropriate qualifications and experience. The ATSB report, Avoidable Accidents No. 7, highlights the risks of visual flight at night. Risks include, reduced visual cues, increased likelihood of perceptual illusions, and spatial disorientation.

A VFR flight in dark night conditions should only be conducted by a pilot with instrument flying proficiency as there is a significant risk of losing control if attempting to fly visually in such conditions. If day VFR‑rated pilots find themselves in a situation where last light is likely to occur before the planned destination is reached, a diversion or precautionary landing is probably the safest option. Air traffic control assistance with available landing options is also available.

This accident also highlights the importance of aviation medical certificate holders reporting relevant conditions and medications to their Designated Aviation Medical Examiner. A full understanding by the Civil Aviation Safety Authority’s aviation medical specialists of a pilot’s medical conditions, and use of medications, enables management of the risk for both the individual and flight safety overall.

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) +10 hours.

The occurrence

On 6 September 2019, at 1430 Eastern Standard Time,^[2] the pilot of a Bell Helicopter Company UH-1H helicopter registered VH‑UVC (UVC) departed Archerfield Airport, Queensland, with four passengers on board. The pilot was conducting a private flight for the purpose of repositioning the helicopter to Bankstown Airport, New South Wales (NSW).

Witnesses at Archerfield advised that the intent was for UVC to be self-sufficient in terms of fuel requirements during the transit to Bankstown. Pre-flight preparation included the loading and filling of a plastic 400 litre fuel storage tank and a 205 litre drum. A portable, battery‑operated transfer pump and hose was to be used to transfer fuel from the on-board storage into the helicopter’s fuel tanks, when on the ground. Basic maintenance was also completed in preparation for the flight.

At about 1600, the pilot landed at Coffs Harbour, NSW to refuel the helicopter. A nearby helicopter operator who witnessed UVC land, reported that fuel was transferred from the 400 litre tank until it was empty, and then from the 205 litre drum. The refuelling operation drained the available battery power and the pilot sought assistance from the operator, who supplied a battery power pack to complete the refuelling. Shortly after, the operator noted that fuel was overflowing from the helicopter’s fuel tank filling port and called out that the tank was full. The partially‑emptied drum was then reloaded into UVC, and the battery pack returned to the operator.

During the refuelling stop, one of the passengers called a Bankstown operator to advise that they were in the process of refuelling. Arrangements had been made with the operator to provide hangar space for UVC. The operator was awaiting their arrival to assist moving the helicopter into the hangar. Following refuelling, the pilot departed Coffs Harbour at about 1648.

At 1652 the passenger advised the Bankstown operator via text message that they were on their way to Bankstown. The operator was aware of the time it would take to fly to Bankstown and that an arrival after last light was now likely. The operator contacted the passenger via a text message and queried whether they were ‘night VFR’ - a reference to whether the flight could continue at night under the visual flight rules (VFR). ^[3] The response from the passenger was that the pilot ‘is’ night VFR rated.

At 1755, the pilot made contact with Williamtown Tower, requesting clearance to track south via the VFR coastal route (Figure 1). The pilot also requested a climb to a higher altitude, to take advantage of more favourable winds. In response, the Williamtown Tower controller advised them to contact Williamtown Approach (Approach) for clearance.

At 1757, the pilot of UVC contacted Approach and requested a clearance. At 1758, the Approach controller identified UVC’s position as 7.4 km to the north-east of Broughton Island (Figure 1), and advised the pilot they could operate at whatever altitude was required provided it was not below 2,400 ft.^[4] The pilot responded with a request to operate between 3,000 and 3,500 ft. UVC was cleared to track coastal southbound at a block altitude between 3,000 and 3,500 ft.

At 1759, following an inquiry from the Approach controller, the pilot advised that Bankstown was the intended destination. At 1800, the pilot was advised that if any further track or altitude changes were required, to inform Air Traffic Control (ATC) accordingly. While no response was required, the pilot did not acknowledge the transmission.

Published last light for Anna Bay, NSW was 1801. At this time the controller again contacted UVC to offer alternative tracking if required. The pilot responded requesting to remain on the eastern side of the R578A Williamtown restricted area. The controller clarified this request and in response, the pilot advised that if the track was not available, they would continue on the VFR coastal route. The pilot was then cleared to track as required for Bankstown Airport. The track clearance was acknowledged by the pilot at 1802.

Figure 1: Williamtown airspace map with VH-UVC’s position at various times

Source: Airservices Australia, annotated by the ATSB

A final text message from the passenger was received by the Bankstown operator at 1804 advising that UVC was approaching Williamtown.

At 1805, the Approach controller contacted the pilot to confirm that operations were normal, having observed that UVC’s altitude had dropped to 2,700 ft. The pilot acknowledged the loss of altitude, commenting on a wind gust affecting the helicopter. The controller responded by providing clearance for the pilot to operate between 2,400 and 3,500 ft. This was acknowledged by the pilot who also commented on the turbulent conditions that were being experienced. The controller acknowledged the conditions and made a further offer of assistance should it be required.

UVC was then observed on Williamtown ATC radar to make a left turn to the south, depart the VFR coastal route and head offshore. Automatic Dependent Surveillance - Broadcast (ADS-B)^[5] data supplied by Aireon, indicated that the helicopter’s position at the beginning of the turn, at 1811:23, was 2.3 km west-south-west of Anna Bay^[6] (Figure 2).

The turn offshore was witnessed by two recreational fishers who were located on Stockton Beach, about 2 km to the west of Birubi Point, Anna Bay. They described seeing a helicopter track overhead in a westerly direction, then turn out to sea, heading in a south-westerly direction. They reported that the helicopter sounded loud, and its lights were observed until it disappeared from sight, following a turn to the east.

The helicopter continued to track offshore to the south-west for about 90 seconds, maintaining an altitude of between 2,568 and 3,168 ft, before commencing a rapidly descending left turn. ADS-B data showed that the aircraft commenced this descent from 2,968 ft at 1812:55 which was about 12 minutes after published last light. At 1813:12, a short, loud but indistinct transmission, that may have originated from UVC was recorded by Williamtown ATC. The last Aireon ADS-B data point identified the aircraft passing an altitude of 93 ft at 1813:18. UVC disappeared from the Williamtown ATC radar display at 1813:26.

Figure 2: Flight path of VH-UVC following the VFR coastal route passing Anna Bay and the turn offshore

Source: Google and ADS-B data (Aireon), annotated by the ATSB

Two attempts by the Approach controller to contact the pilot at 1813:17 and 1813:27 were unsuccessful. The controller then broadcast advice to the pilot that surveillance identification had been lost and to immediately check altitude. Further advice of the area’s QNH^[7], the lowest safe altitude in the area, and an instruction to climb immediately, were broadcast. The controller followed that transmission with several more unsuccessful attempts to contact the pilot. There was no response and at 1815 the Approach controller contacted the Australian Maritime Safety Authority’s, Joint Rescue Coordination Centre and notified them of the missing helicopter.

The initial search for UVC, using a fixed wing aircraft and several rotary wing aircraft, was hampered by poor weather and sea conditions. The search was concentrated in the vicinity of reported oil slicks and floating wreckage several kilometres to the south west of Birubi Point. The search was suspended after several days when the likelihood of locating survivors had passed.

An extended sea and aerial search for the helicopter was continued by the NSW police and later, with assistance from the Royal Australian Navy. Wreckage from the destroyed helicopter was located on 25 September 2019, 5.3 km to the south west of Anna Bay, in about 30 m of water.

Two of the five persons on board the helicopter were confirmed to have received fatal injuries. The bodies of the pilot and two of the occupants were not found but they were presumed to have similarly not survived the accident.

2.  
   2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) +10 hours.
   3. Visual flight rules (VFR) are a set of regulations which allow a pilot to only operate an aircraft in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
   4. The lowest altitude that could be assigned for night operations due to terrain clearance requirements.
   5. ADS-B is a system in which equipment on board an aircraft automatically broadcasts the precise location of the aircraft. The data can be used by other aircraft and air traffic control to identify the aircraft’s position and altitude without the need for radar.
   6. All distances with respect to Anna Bay are referenced from the intersection of Morna Point and Gan Roads, Anna Bay New South Wales.
   7. QNH: altimeter barometric pressure subscale setting used to indicate an aircraft’s height above mean sea level.

Context

Pilot information

The pilot held Private and Commercial Pilot licences (Helicopter) and was qualified to fly by day under the Visual Flight Rules (VFR). The pilot also held a single-engine helicopter class rating and a gas turbine engine design feature endorsement. The pilot last conducted a single-engine helicopter flight review on 25 October 2018 that was valid until 31 October 2020. A Class 1 Aviation Medical Certificate issued by the Civil Aviation Safety Authority (CASA), valid until 26 April 2020, was also held.

The pilot’s logbook indicated a total of 1,440.5 hours total flying experience, of this about 103 hours were on the UH-1H. In the previous 90 days, 9 hours were accrued with 1.8 hours on the UH‑1H. A review of flying‑related documents showed that the pilot:

• commenced flying on 9 September 2011
• completed his Private Pilot Licence (Helicopter) on 10 April 2013
• completed his low level (Helicopter) flying training on 13 June 2013
• completed his Commercial Pilot Licence (Helicopter) on 26 June 2015.

The pilot completed their endorsement on the UH-1H on 26 October 2018 and was appropriately qualified to operate VH-UVC (UVC). The pilot was not qualified or trained to fly at night. At the time of gaining their Private and Commercial Pilot Licences (Helicopter) there was no requirement for night or instrument flight training. An examination of the pilot’s logbook found no evidence of night flying or instrument flying experience.

Pilot’s medical history

The pilot was being treated for significant health issues and sought regular medical support from a non‑aviation medical specialist from January‑March 2019. Following a break in treatment, the pilot again visited the specialist on 3 September 2019. While being treated, the following medications were prescribed:

• valdoxan
• olanzapine
• naltrexone
• diazepam

Valdoxan and olanzapine have the potential for producing a sedating side-effect, requiring management of the dosage amount. During medical reviews with their specialist, the pilot did not report feelings of sedation in the morning or during the day. The diazepam was prescribed three days before the accident, with a planned review at a subsequent appointment.

A witness reported that in the week of the accident the pilot disclosed that they had slept for a full day, waking briefly in the evening, then slept through to the following morning. No explanation was offered as to what prompted this. The pilot’s treating specialist last saw the pilot on 3 September 2019 and was unaware of the reported sleep episode. The specialist’s opinion was sought on possible reasons, and the ATSB’s assessment of their comments was that it was unlikely to have been the result of any of the prescribed medicines taken at their specified dosages.

As the pilot’s body was not recovered following the accident, the ATSB was unable to gain any further medical information from a post-mortem examination or toxicological assessment.

72-hour history

The ATSB was unable to gather sufficient information to complete a 72-hour history, primarily due to the pilot living alone. However, in the 24-hour period prior to the accident, the pilot:

• exchanged text messages with a family member around midnight
• accessed the National Aeronautical Information Processing System to gain location briefings that included weather related information at 0200
• briefly met up with a family member around 0745 on the morning of the accident.

With the limited information available, it was not possible to determine, whether at the time of the accident, the pilot was operating with a level of fatigue known to affect performance. However, from the available history, the pilot had about five hours of sleep opportunity the night before the accident.

Aviation medical certificates

A current medical certificate is required to exercise the privileges of a pilot licence. A Class 1 medical certificate is required to exercise the privileges of a commercial pilot licence and a Class 2 medical certificate is required for a private pilot licence.

When applying to renew a medical certificate, pilots are required to update their medical history by providing details of medications they have taken or have been prescribed. Additionally, pilots are required to provide information relating to any medical procedures, medical issues or symptoms that required the input of a medical specialist.

On completion of an examination by a Designated Aviation Medical Examiner (DAME) a report is submitted to the CASA to assess whether a medical certificate can be issued or whether further information or tests are required.

In the course of renewing their medical certificates, the accident pilot did not disclose medical conditions under treatment, or the medications that had been prescribed. 

For the awareness of flight crews, CASA publicises a limited list of approved medications,^[8] along with a list of medications that are considered hazardous to aviation. Medications that assist sleep are considered as hazardous. Medications that are considered as hazardous can only be used with the express clearance of the CASA or a DAME.

The ATSB sought advice regarding the medications that had been prescribed to the pilot of UVC from a subject matter expert (SME) in aviation medicine. The SME advised the ATSB that diazepam, olanzapine and naltrexone:

Were absolutely incompatible with flying with respect to CASA guidelines, as were the conditions for which they had been prescribed.

and for valdoxan:

(restrictions) would be imposed for conditions requiring valdoxan, but only after 1-3 months grounding and then with a written clearance from a [treating specialist], DAME and treating GP. CASA would require on‑going medical audit and only a restricted medical certificate would be issued.

The SME further advised that, based on the pilot’s medical history and occurrence information, medical incapacitation from a heart attack, seizure, other underlying condition or known medications were unlikely to have contributed to the accident.

Aircraft information

General information

UVC was a Bell Helicopter Company UH-1H, S/No 5144, manufactured in the United States of America in 1966. The UH-1H is a medium size, single engine utility helicopter with a two‑bladed main rotor system. Standard configuration included dual controls, seating capacity for 13 persons, including two crew members, and skid type undercarriage. UVC was placed on the Australian Civil Aircraft Register on 2 October 2018 and was issued with Special Certificate of Airworthiness No. 13L1817 in the Limited^[9] category on 17 October 2018.

The Special Certificate of Airworthiness specified that the aircraft was to be operated:

• in accordance with the operating limitations contained within the approved Army Model UH-1H Helicopter Operator’s Manual
• by day under the Visual Flight Rules unless the aircraft was appropriately equipped for night or instrument flight.

Aircraft records

UVC’s Log Book Statement^[10] specified that maintenance releases were to be issued for periods of 150 hours time-in-service or 12 months, whichever occurred earlier. Maintenance reference data for UVC was the UH-1 series, military services Inspection Planning Guide from the Interagency Committee for Aviation Policy (ICAP^[11]).

The maintenance release, current at the time of the accident, was issued on 16 October 2018 for day VFR operations at an aircraft time in service of 6,693.0 hours.

The current maintenance release with flight hour information for UVC was not recovered from the helicopter following the accident. An estimate of the aircraft time in service was derived from the pilot’s logbook to determine UVC’s operating time since the issue of the maintenance release. It was estimated that prior to departure from Archerfield, UVC’s total time in service was about 6790.0 hours.

At 6,743.0 airframe hours a 50-hour inspection was required, involving:

• visual inspections
• mounting hardware torque checks
• rotor drive train oil system maintenance.

Additionally, a voltage regulator inspection was required to be performed by 16 April 2019.

Maintenance history

Following arrival in Australia, the helicopter was assembled and refurbished. The refurbishment included maintenance actions for the initial issue of the certificate of airworthiness, systems checks and post-maintenance testing. Maintenance records indicated that on completion of the refurbishment, flight testing that included dynamic balancing of the main rotor system and confirmation of correct flight control stick forces was conducted. Additional and on-going maintenance requirements were annotated on the maintenance release.

Prior to departure from Archerfield, a 10-hour/14-day inspection was performed, and a clearing endorsement was entered on part 1 of the maintenance release. An image of the maintenance release showing the clearing endorsement was provided to the ATSB.

The image also showed that the 50-hour inspection due at 6,743.0 hours, and the voltage regulator inspection due on 16 April 2019, had not been endorsed on the maintenance release as having been completed. An image of part 2 of the maintenance release, where maintenance can be certified, was not provided. The aircraft logbook did not contain details of maintenance activity beyond UVC’s refurbishment and maintenance release issue on 16 October 2018.

The ATSB was unable to verify if the required maintenance had been performed as the aircraft’s maintenance release was not recovered from the wreckage.

Aircraft systems

Flight control system

UVC was equipped with a hydraulically‑assisted flight control system which could be operated by either the pilot or co-pilot. The system included the cyclic and collective control systems, allowing operator inputs to the main rotor system, and tail rotor pedals for control of the tail rotor.

With hydraulic assistance power removed, the pilot would experience higher than normal forces to move the cockpit controls, and moderate feedback would be felt when the controls were moved. However, full main and tail rotor system control would still be available and control movements would result in a normal helicopter response.

Figure 3: Layout of Bell Helicopter Company UH-1H with major components labelled

Source: Bell Helicopter Company, annotated by the ATSB

Hydraulic system

The hydraulic system consists of a single hydraulic pump supplying pressure to the hydraulic servo cylinders connected to mechanical linkages in the helicopter’s flight control system. When the cockpit controls are moved, pressurised hydraulic fluid enters the cylinders reducing the force for control movement.

In the event of a hydraulic system malfunction, feedback forces from the main rotor are prevented by irreversible (check) valves in the hydraulic servo cylinders. This allows the pilot to continue making the required control system inputs. In the event of a hydraulic power failure, the pilot should land a soon as practicable in an area that will permit a run-on landing.^[12]

Aircraft modifications

UVC was a standard UH-1H helicopter with no recorded airframe modifications, however a tablet device (Figure 4) was mounted on the pilot’s side instrument panel. From reference to an image of UVC’s cockpit and the UH-1H Operator’s Manual it was determined that the pilot’s side, attitude indicator and directional gyro may have been removed to accommodate the device or were obscured once the device was installed. A second attitude indicator was mounted in the left side instrument panel.

To accommodate the tablet installation, the pilot’s airspeed and turn and slip indicators were relocated to new positions below the tablet device. While the UH-1H Operator’s Manual did not specify the instruments that were required for VFR flight, relocation of instruments was permitted.

Figure 4: VH-UVC instrument panel

Source: Niza Villanueva, annotated by the ATSB

UH-1H helicopter limitations

The Operator’s Manual for Army Model UH-1H helicopters, specified that intentional flight into severe or extreme turbulence or into thunderstorms was prohibited. Other limitations for UVC were a gross weight limitation of 4,309 kg, and a never exceed limit of 112 kt indicated airspeed. This limiting airspeed varied slightly with aircraft gross weight and atmospheric conditions.

Wreckage information

Search for helicopter and wreckage field

A Royal Australian Navy vessel tasked to assist the search, located the helicopter wreckage field about 3.5 km offshore, in about 30 metres of water. NSW police divers located parts from the helicopter and provided the ATSB with a series of location coordinates from a GPS‑enabled dive camera. The positions of the helicopter parts were mapped to show their relative positions on the ocean floor (Figure 5).

Figure 5: Map showing relative positions of helicopter wreckage on the ocean floor relative to UVC’s flight path

Source: Google using Aireon data for UVC flight path and NSW police supplied positions of wreckage items, annotated by the ATSB.

The heaviest items, including the main rotor system and the engine, were located within 10 metres of each other. Other debris and parts of the cabin were also nearby. The tailboom was located about 51 metres to the south-east of the engine’s position.

Helicopter wreckage

The engine, main rotor system and tailboom were identified in underwater imagery recorded by the Royal Australian Navy during the search for the helicopter. The imagery showed that the tailboom was missing the vertical fin, tail rotor gearbox, tail rotor, and the synchronised elevators (Figure 3).

Imagery of the main rotor system showed both main rotor blades attached to the rotor head and the transmission mast connected to the upper reduction gearbox section of the transmission assembly. The lower section of the transmission assembly that included the mount casing and tail rotor drive section was not identified.

One of the main rotor blades appeared to be largely straight with damage to the outboard section. In contrast, the opposite blade was significantly damaged. The blade tip section was missing and there was evidence of blade deformation in bending. The ‘D’ section leading edge main spar, was visible and portions of the blade aerofoil section between the blade leading and trailing edges were missing. It is likely that both blades were rotating when they struck the water.

The swashplate, main rotor system (Figure 3) and pitch control mechanism were also present. Additionally:

• the transmission and main rotor blade system had detached from the fuselage during the accident sequence
• there was no evidence of a flight control system fault
• significant disruption of other sections of the helicopter was evident
• the damage was consistent with a high-speed impact with water.

The engine was located on the ocean floor in the vicinity of the main rotor system and the cockpit and cabin remains (Figure 5). The engine was intact, with the exception of the exhaust pipe. It was not possible to determine the integrity of the engine, or its serviceability from available imagery, however no obvious defects were identified.

Figure 6: Engine from VH-UVC located within the wreckage field

Source: NSW police, annotated by the ATSB.

Other helicopter parts that were identified included:

• remains of the cockpit area
• both cockpit seats
• fragments of cabin structure
• sections of the undercarriage
• items of portable refuelling equipment.

Other pieces of the helicopter were present however identification was limited by the clarity of the water and some items had become partially buried by sand. On Monday 16 September 2019 a member of the public provided NSW police with a small honeycomb panel. It had washed ashore between Kingsley Beach and Little Kingsley Beach, located about 2 km to the south-east of Anna Bay.

Two other pieces were found and reported to NSW police on 18 September 2019. They were also of honeycomb construction (Figure 7) and were found at separate locations on Stockton Beach, NSW. The construction and paint colour of the panels were similar to structural panels used in UVC, however no features specifically linking the items to UVC were identified.

A portion of helicopter main rotor blade washed ashore at Blinky Beach on Lord Howe Island, NSW and was reported to police on Friday 17 January 2020. The blade was constructed from an aluminium composite material, measured 800 mm by 340 mm and was painted matt black. It bore a sticker that read ‘bh Fort Worth Texas’, which identified the section as belonging to a Bell Helicopter.

Figure 7: Items of honeycomb construction found on Stockton Beach, probably from UVC

Source: NSW police

Tailboom assessment

UVC’s tailboom was retrieved by NSW police divers and made available to the ATSB for examination. The tailboom (Figure 8), without the vertical fin, synchronised elevators, tail rotor gearbox and tail rotor assembly (Figure 3), had separated at the fuselage rear bulkhead due to overstress failure of the rear fuselage structure.

Figure 8: VH-UVC tailboom following recovery from the ocean floor

Source: NSW police, annotated by the ATSB

Internally, the remains of the synchronised elevator control system and the tail rotor pitch control systems were present. Failures of the control tubes and cables were attributed to overstress. Examination of the tailboom did not identify any pre-existing defects likely to have influenced the accident sequence.

The tail rotor drive train from the rear fuselage tailboom junction to the 42° gearbox was also present. Compression damage to the tailboom driveshaft cover was consistent with water impact. Drive shaft coupling imprints were noted on the cover (Figure 9). The imprints were consistent with the driveshaft not rotating at the time of impact. However, rotational damage signatures were also present at either end of the recovered tail rotor drive train. Additionally, multiple contact marks were evident on the side of the boom in the vicinity of the synchronised elevator attachment points. Those marks were consistent with repeated movements of the elevators.

Figure 9: Tailboom driveshaft cover with inset showing driveshaft coupling imprints

Source: ATSB

Recorded data

Overview

The aircraft was fitted with a Mode S transponder that broadcast ADS-B data. This information included the position and altitude of the aircraft and was received by Airservices Australia as well as other third‑party ADS‑B receivers (Aireon and Flightradar24).

Two mobile devices with the OzRunways electronic flight bag application installed were on board. The application provided the option for live flight tracking by transmitting the device’s position and altitude. ADS-B and OzRunways data was obtained and analysed by the ATSB.

Both the Aireon and OzRunways data was compared and found to be consistent, however the Aireon data has been used in this report as it provided higher fidelity for altitude information over the final flight segment. The data was transmitted at five second intervals and a track line was produced by joining each data point with a straight line. Variations between these data points were not captured.

VH-UVC flight path

From Broughton Island UVC tracked past Yacaaba Head, Fingal Bay then Morna Point (Figure 10). Once past Anna Bay, the pilot commenced a left turn away from the coast, aligning with a direct track to Bankstown (Figure 11 and 12). The turn and subsequent track were inside the Williamtown military control zone area boundary. The helicopter tracked offshore to the south‑west for about 90 seconds before commencing a rapidly‑descending, left turn followed by a collision with the ocean surface.

Figure 10: Townships along the VFR coastal route once UVC passed Broughton Island

Source: Google using ADS-B data (Aireon), annotated by the ATSB

Figure 11: Overhead view of UVC flight path showing turn to seaward and spiral descent

Source: Google and ADS-B data (Aireon), annotated by the ATSB

Figure 12: Side view of UVC flight path showing turn to seaward and spiral descent

Image description: The flight path is provided for illustrative purposes. The altitudes as presented originate from raw data and have not been corrected for atmospheric conditions.

Source: Google and ADS-B data (Aireon), annotated by the ATSB

The variation in UVC’s flight parameters over the final 30 minute period is presented in a graphical format (Figure 13) with key events presented in an overhead view (Figure 14). The rate of change of altitude and track, before and after last light, where the pilot appeared to be attempting to maintaining a constant altitude, were averaged and compared. For the period after last light and prior to the turn away from the coast:

• the average variations in altitude increased by a factor of 2 compared to daylight operation.
• excluding what appeared to be a deliberate turn by the pilot at about 1809, the average variations in track increased by a factor of 3 compared to daylight operation.

Figure 13: UVC flight parameter variation over the final 30 minutes

Source: ADS-B data (Aireon) with ATSB analysis

Figure 14: UVC flight path from Broughton Island

Source: Google and ADS-B data (Aireon), annotated by the ATSB

Once past Anna Bay, UVC’s flight path from the turn to seaward to the spiral descending turn was further examined. The flight path is presented in a graphical format in (Figure 15) with key aspects noted below:

• at 1811:23, UVC commenced a left turn which continued until 1811:56, aligning with the direct track to Bankstown Airport
• from 1811:27 to about 1812:24, the altitude increased by about 550 ft
• a right turn commenced at 1811:56, continuing until 1812:15. Ground speed decreased during this time period
• a turn to the left commenced between 1812:15 and 1812:20
• from 1812:20 to 1812:24 the track changed to the left by about 21⁰
• from 1812:24 to 1812:50 there were ground speed and altitude changes, with a continuing left turn
• from 1812:50 to 1812:55 the turn rate and altitude increased
• from 1812:55 there was a rapid loss of altitude and rapid changes in track and ground speed, consistent with a loss of control. The average rate of descent after the loss of control was calculated to be about 7,500 feet per minute, peaking at 11,636 feet per minute at 1813:18
• Based on wind speeds recorded at WLM it is estimated that in the last 14 seconds of the descent, UVC’s V_NE^[13] limit was exceeded by up to 45 kt.

Figure 15: UVC flight parameter variation over the final 150 seconds of flight

Source: ADS-B data (Aireon) with ATSB analysis

Air traffic services

The pilot submitted a flight plan for the Archerfield to Coffs Harbour leg. A flight plan was not submitted for the Coffs Harbour to Bankstown leg, however, there was also no requirement for one.

The pilot’s first contact with Williamtown Air Traffic Control (WLM ATC) was a request for an airways clearance at 1755. When issuing the requested clearance, the controller asked whether UVC had a CAR174B exemption^[14], which would allow UVC to operate at a lower minimum altitude at night. On receiving no acknowledgement, the Approach (APP) controller advised the pilot that 2,400 ft was the lowest altitude that could be offered. There was no indication provided to the controller in the radio exchange that the pilot was not qualified to continue the flight after last light.

At 1800:27 and 1800:56 WLM ATC offered the pilot of UVC alternate tracking and at 1801:41 cleared the pilot to manoeuvre as required for tracking to Bankstown. At 1805:41, the APP controller issued a safety alert advising the pilot to ‘check altitude’ when UVC dropped to 2,700 ft, which was below the clearance altitude of 3,000 ft. The pilot reported turbulent conditions and in response the controller re‑cleared the pilot to operate from the lowest safe altitude of 2,400 ft to 3,500 ft. At 1806:09 the controller requested the pilot to advise if anything further was needed.

The turn offshore at 1811:23 was observed on WLM radar. An indistinct transmission, which was assumed by ATC to be from UVC, was heard at 1813:12, about 17 seconds after the loss of control had likely occurred (Figure 15). UVC was observed on radar in a rapid descent from about 2,900 ft, disappearing from WLM radar coverage at 1813:26. By 1813:27, the APP controller had alerted the Tower controller of the unfolding situation, and made two standard radio calls seeking a response from UVC.

A detailed alert to UVC specifying that identification had been lost, and a low altitude warning to check altitude, was made at 1813:32 by the APP controller. The alert also included the area barometric pressure, the lowest safe altitude, and an instruction to initiate an immediate climb. There was no response from UVC and a further five radio calls were made to contact the pilot by WLM ATC controllers.

At 1824:13, in response to a request from the APP controller, the pilot from one of the WLM departing aircraft called UVC on the 121.5 emergency frequency and reported that no response was received.

The ATSB engaged the services of an ATC subject matter expert (SME) to review the controller’s interaction with the pilot of UVC. The SME concluded that:

The actions of WLM ATC throughout the flight of UVC were in accordance with the published rules and procedures for an aircraft operating Night VFR. In addition, WLM ATC offered alternative and flexible clearances to meet the needs of the pilot in command.

Operational information

Flight endurance

CASA regulatory requirements specify that pilots of helicopters conducting private flights under the VFR are to carry a fixed fuel reserve of 20 minutes flight time. The pilot in command is required to ensure that this fuel reserve remains unused on landing unless an emergency is declared. Pilots are also required to refer to operational information such as current weather reports and forecasts for the route to be flown and to plan the flight using that information.

The witness at Coffs Harbour noted that prior to departure, the helicopter’s fuel tank had been filled to overflowing and a quantity of fuel remained in the 205 litre drum. The UH-1H operations manual stated that the useable fuel quantity was 781.6 litres or 1,362 lbs of fuel. UVC’s fixed fuel reserve requirement was calculated to be 195 lbs of fuel.

The distance from Coffs Harbour to Bankstown via a coastal route to Anna Bay and then direct track to Bankstown, was calculated to be about 250 nautical miles. A flight in nil wind conditions, allowing for climb and descent, at an indicated airspeed of 95 kt would have required about 1,570 lbs of fuel. The fuel quantity required for UVC to transit from Coffs Harbour to Bankstown using forecast winds was calculated to be about 1,265 lbs.

Provided the forecast conditions had continued, the pilot of UVC would have required an intermediate refuelling stop or to declare a fuel emergency prior to arrival at Bankstown. Any holding or diversion would likely have required a landing before Bankstown to prevent airborne fuel exhaustion.

Pilot access to weather information

The pilot accessed the National Aeronautical Information Processing System (NAIPS) using the OzRunways electronic flight bag application at 0200 and 0202 on 6 September 2019. Requests were made for location briefings and NOTAM^[15] information for Archerfield, Coffs Harbour and Sydney.

A forecast for the intended route was not requested, nor were Head Office NOTAMs or SIGMETs.^[16] The pilot did not access further weather information through NAIPS. However, it could not be established whether the pilot, or one of the passengers, sourced further updates enroute via other means.

Night VFR (Helicopter) qualification and training

For VFR flights conducted at night, a Night Visual Flight Rules (NVFR) rating and helicopter NVFR endorsement are required. Training for the rating and endorsement covers theory and practise in the areas of basic instrument flight, navigation aid training and procedures in the event of abnormal situations. In addition, human factors and non-technical skills awareness and application, specific to the night flying environment are covered.

A minimum of 10 hours night flying experience is necessary, of which at least five hours are required to be in a helicopter or approved flight simulation training device. These night hours must include dual flight, solo night circuits, and cross-country flights. Three hours of dual instrument time in a helicopter or approved flight simulation training device is also required.

CASA regulatory requirements specify that a pilot who does not hold a NVFR rating, or instrument rating, is not permitted to depart on a flight before first light or after last light, and is also not permitted to depart unless the estimated time of arrival at the destination is at least ten minutes before last light.

Decision making

Flight under the VFR requires minimum conditions of visibility and distance from cloud. Variation from the expected weather conditions enroute may not enable a pilot to reach the planned destination under this ruleset. That, in turn, will require a timely decision to land or divert when things are not going to plan. However, the human tendency to continue with a course of action is documented in various research studies.

The American Psychological Association defines plan-continuation bias as:

‘The tendency of people to continue with an original course of action that is no longer viable’. An example would be an airline pilot who unexpectedly encounters bad weather at the scheduled destination but decides to land anyway rather than divert to another location. Plan-continuation bias tends to be particularly strong towards the end of the activity and has been theorized to result from the interaction of such factors as cognitive load, task demands, and social influences.

Errors associated with plan-continuation have been recognised in the analysis of a number of aircraft accidents previously (NTSB, 1994; Batt and O’Hare, 2005; Dismukes, Berman and Loukopoulos, 2007).

In the ATSB research investigation report B2005/0127, addressing general aviation pilot behaviours in the face of adverse weather, Batt and O’Hare (2005) identified that the halfway point of a flight may feel like a psychological ‘turning point’ for pilots.

The focus of the pilot’s thoughts and attention will shift gradually from the point of departure to the planned destination…as the flight progressed, the chances of a VFR into IMC encounter increased until they reached a maximum of 27.6% during the final 20% of the flight distance. This pattern suggests that an increasing tendency on the part of pilots to ‘press on’ as they near their goal.

Options available to day VFR pilot’s experiencing reduced visual cues include contacting air traffic control for assistance or conducting a precautionary landing. The ATSB’s ‘Don’t push it, LAND It’ safety messaging, jointly developed and supported by the Civil Aviation Safety Authority and the Australian Helicopter Industry Association, encourages helicopter pilots to exercise this option.

Weight and Balance

Weight and balance information was derived from maintenance records, witness statements and images provided to the ATSB. Additionally, estimated and known weights of the pilot, passengers, baggage, equipment and fuel on board were used to calculate UVC’s weight and centre of gravity. It was estimated that the weight of UVC on departure from Coffs Harbour was 3,808 kg, which was below the Operator’s Manual gross weight limit of 4,309 kg.

The occupant seating positions were established from information provided by witness and from on-board images that occupants exchanged with ground-based parties following their departure from Coffs Harbour. UVC’s longitudinal and lateral balance was found to be within limits from Coffs Harbour to Anna Bay.

Helicopter – basic operational equipment for flight under the night VFR

In addition to the equipment requirements for day VFR operations, Civil Aviation Order, CAO 20.18 specifies that a helicopter may only be operated under the night VFR, if it is equipped with instruments that include an attitude indicator and a heading indicator (directional gyroscope).

Further, for night VFR flights conducted over land or water where the helicopter’s attitude cannot be maintained by the use of external visual surface cues from lights on the ground or celestial illumination, a helicopter is to be:

• equipped with an approved automatic pilot or automatic stabilisation system, or
• operated by a qualified two pilot crew, each with access to the flight controls.

Helicopter emergency procedures

The Operator’s Manual for Army Model UH-1H helicopters provides guidance for pilots in the event of system malfunctions or loss of function. In the event of a partial power loss, or if the engine is no longer operating (Figure 16), an auto rotational descent^[17] and landing is required.  

Likewise, the pilot would initiate an auto rotational descent in response to:

• a drive train or tail rotor failure
• an engine to transmission main drive shaft failure
• a transmission free wheel unit disengagement.

Figure 16: Airflow through the main rotor system during an auto rotational descent

Image description: During an autorotation, the upward flow of relative wind permits the main rotor blades to rotate at their normal speed.

Source: FAA Helicopter Flying Handbook

The descent is typically conducted at a specified forward airspeed for the helicopter type and characterised as a controlled descent. For the UH-1H helicopter a typical auto rotational rate of descent is about:

• 1,600 feet per minute with an indicated airspeed of 52 kt for minimum rate of descent, or
• 2,060 feet per minute with an indicated airspeed of 82 kt for maximum glide distance.

A loss of tail rotor control or drive to the tail rotor, is manageable provided adequate airspeed is maintained, as directional stability will be provided by the helicopter’s vertical fin. The UH-1H helicopter requires airspeeds above 30-40 kt to maintain directional control with a loss of tail rotor drive. Other tail rotor malfunctions, including stuck pedals (fixed tail rotor pitch settings), require 40‑70 kt airspeed be maintained.

When performing an auto rotational descent to a suitable landing site, a pilot has a choice in the angle of descent, varying from vertical to maximum horizontal range. Pilots are trained to perform auto rotational descents and auto rotational capability is a certification requirement for helicopters.

Meteorological information

Forecast weather

Graphical Area Forecast (GAF)

The flight from Coffs Harbour to Bankstown occurred within the Graphical Area Forecast^[18] New South Wales – East that was valid from 1500 to 2100. Forecast conditions included:

• average conditions of greater than 10 km visibility with areas of scattered^[19] cumulus and stratocumulus cloud at altitudes between 4,000 and 8,000 ft
• widespread blowing dust reducing visibility to 5,000 m
• scattered showers of rain reducing visibility to 4,000 m with associated scattered cumulus and stratocumulus cloud from 3,000 to 5,000 ft and broken cumulus and stratocumulus cloud from 5,000 to above 10,000 ft
• isolated smoke over the land reducing visibility to 4,000 m and isolated heavy smoke over the land north of Taree reducing visibility to 2,000 m
• isolated thunderstorms over the sea reducing visibility to 3,000m with associated isolated cumulonimbus clouds from 3,000 to above 10,000 ft
• moderate mountain wave activity forecast above 4,000 ft
• severe turbulence forecast below 10,000 ft with moderate turbulence north of Taree

The GAF also noted that moderate turbulence^[20] is implied in cumulus, stratocumulus and altocumulus cloud and severe turbulence^[21] is implied in cumulonimbus cloud.

Significant Meteorological Information Advisory (SIGMET)

The Bureau of Meteorology (BoM) issued a Significant Meteorological Information Advisory at 1436 for severe turbulence below 10,000 ft valid from 1500 to 1900. The area affected by the SIGMET covered the entire flight from Archerfield to Bankstown.

Grid Point Wind and Temperature

The Grid Point Wind and Temperature forecast valid at the time of the flight indicated the average wind south of Coffs Harbour was 25 kt from the north‑north‑west at 2,000 ft.

Mean Sea Level Pressure chart

The Mean Sea Level Pressure chart showed a trough and frontal system approaching the Williamtown area on the afternoon of the flight. These systems were moving west to east and had an associated tight pressure gradient.^[22]

Williamtown TAF

The BoM provided an aerodrome forecast (TAF)^[23] for Williamtown Airfield, located about 21 km to the west of the accident location. Due to the weather front passing through the area, the TAF was amended several times. An updated TAF for Williamtown was issued at 1534 and was valid from 1600 on the 6 September 2019 to 1600 the following day. The forecast conditions were:

• wind 20 kt, gusting 35 kt from 320° with CAVOK^[24] conditions
• from 1600, moderate to severe turbulence below 5000 ft until 1800
• from 1800:
  • wind 27 kt, gusting 48 kt from 290°, visibility 9,000 m in blowing dust with light showers of rain, cloud scattered 4,000 ft and broken cloud^[25] at 12,000 ft
  • a 40 per cent probability of visibility reducing to 4,000 m in blowing dust until midnight
  • severe turbulence below 5,000 ft.

Williamtown Aerodrome warning

On the afternoon of the flight there were two aerodrome weather warnings in place for Williamtown. The weather warnings were valid from 1800 to 2200. The first warning released at 1306 was for wind gusts in excess of 41 kts. A later warning released at 1345 added visibility reduction in blowing dust to the wind gust warning.

Actual weather

The BoM provided a summary of the conditions in the area at the time of the accident and stated that broad scale severe turbulence was likely to have been present. A tight pressure gradient near the frontal system generated strong and gusty west to north-westerly winds. Generally, significant west to north-westerly wind crossing the mountains to the west of the Newcastle area would have caused mechanical turbulence in the area, particularly downwind of the ranges. Strong north westerly winds were observed following the passage of the trough (ahead of the front).

The Bureau of Meteorology (BoM) provided the ATSB with the SPECI^[26] and METAR^[27] data from Williamtown at the time of the accident (Table 1).

Table 1: Williamtown observations

Although SPECI and METAR reports indicated visibility in the area was unlimited, comments between Williamtown Approach and Tower controllers at 1753 made reference to visibility to be about 6‑7 km with dust. Also of note are the overcast cloud conditions from 1810.

The BoM also provided the ATSB with one-minute interval data recorded by the Williamtown Automatic Weather Station. The one-minute cloud data from Williamtown showed that the cloud cover started to build from 1728, was likely overcast by 1751 and considered as overcast by 1802.

Visibility at Williamtown reduced markedly from 35.7 km at 1742 to 8.34 km by 1811. SPECI reports are only issued when weather conditions fluctuate about or below specified criteria. Visibility reductions only trigger a SPECI when the visibility is below an aerodrome’s highest alternate minimum visibility or 5,000 m, whichever is greater. As such, the one-minute visibility data indicating 8.34 km was not low enough to trigger a SPECI.

Last light

For aviation purposes, night is defined as the period of darkness between the end of evening civil twilight (last light) and the beginning of the following morning civil twilight (first light). At last light, in ideal conditions, there will be enough light from the sun for large objects to be seen, but no detail.

Published last light^[28] for the Anna Bay area, on the day of the accident was 1801, however the presence of cloud cover, dust and masking terrain to the west would have resulted in last light occurring earlier.

Additionally, although the moon was high on the horizon, with the lunar disc 52 per cent illuminated, any celestial lighting was likely obscured by the overcast conditions.

Data from a privately‑owned weather station located about 4 km to the north‑east of the accident site was provided to the ATSB. The data, which included ambient lighting levels, showed that by 1750, the ambient light had degraded to 19 lux^[29], reducing to 4 lux by 1800. By 1820, the available light had reduced to zero. By comparison, at 1700 the lux level was 2,055 while in full daylight, the lux levels were about 10,750.

Once UVC passed Broughton Island various townships were present along the VFR coastal route that may have provided sources of lighting for the pilot’s reference (Figure 10).

Spatial disorientation

Spatial orientation defines the natural human ability to maintain body orientation and/or posture in relation to the surrounding environment (physical space) at rest and during motion. The FAA’s Medical Facts for Pilots provides the following:

Humans are designed to maintain spatial orientation on the ground. The three-dimensional environment of flight is unfamiliar to the human body, creating sensory conflicts and illusions that make spatial orientation difficult, and sometimes impossible to achieve. Statistics show that between 5 to 10 % of all general aviation accidents can be attributed to spatial disorientation, 90 % of which are fatal.

Spatial disorientation is defined by Benson (1999) as where ‘the pilot fails to sense correctly, the position, motion or attitude of the aircraft or of him/herself’ with respect to the ground. For pilots flying under the VFR, seeing the horizon is crucial for orientation of both the pilot’s sense of pitch and bank of the aircraft (Gibb et al, 2010). In conditions of low visibility where the horizon may not be visible to the pilot, they can become rapidly disorientated.

Spatial disorientation is also often simply described as an inability to determine ‘which way is up’, although the effects of disorientation can be considerably more subtle. It occurs when the brain receives conflicting or ambiguous information from the sensory systems. It is likely to happen in conditions in which visual cues are poor or absent, such as in adverse weather or at night. Spatial disorientation presents a danger to pilots, as the resulting confusion can often lead to incorrect control inputs and resultant loss of aircraft control.

Pilots obtain information about their orientation from:

• The visual system (eyes), which can obtain information from a range of cues outside the aircraft and relevant flight instruments inside the aircraft
• The vestibular system, which consists of the balance organs located in the inner  The semicircular canals provide information about angular or rotational accelerations in the vertical (yaw), horizontal (pitch) and longitudinal (roll) axes, and the otolith organs provide information about linear accelerations
• The somatosensory system, which includes a range of receptors in the muscles, tendons, joints and skin that sense gravity and other pressures on the Such perceptions are often known as the ‘seat of the pants’ aspect of flying.

The visual system generally provides about 80 per cent of a person’s raw orientation information, with the remainder provided by the vestibular and somatosensory systems, both of which are prone to misinterpretation and illusions during flight (Newman 2007). Although the visual system can overcome these limitations, the risk of spatial disorientation is significantly increased if the relevant visual cues are absent, ambiguous or not attended to.

Benson (1999) outlined that spatial disorientation would typically occur within 60 seconds of all visual cues being removed, while another United States study showed a loss of control by non‑instrument rated pilots would occur, on average, about 180 seconds after the loss of all visual cues (Bryan, Stonecipher, & Aron, 1954).

A range of factors can influence the extent to which a pilot may experience or be able to recover from spatial disorientation. Common factors include limited or ambiguous visual cues outside the cockpit, not directing sufficient attention to the flight instruments due to workload or distraction, and not being proficient in instrument flying skills.

The risk of experiencing spatial disorientation can be managed effectively in the absence of external visual cues by reference to suitable aircraft instrumentation. However, controlled flight by sole reference to cockpit instruments is a separate, and complex, learned skill from those skills associated with flight in visual conditions.

Newman (2007) reported that spatial disorientation is affected by

• pilot factors such as fatigue, medication and workload
• aircraft factors that include single pilot operations, the presence or otherwise of an autopilot or stability augmentation system, and serviceable cockpit instrumentation
• operational factors, that include pressing on into instrument meteorological conditions^[30] without an instrument rating
• environmental factors that are related to time of day (flight after last light) and ambient weather conditions.

A further consideration is the likelihood that the lack of training and qualifications makes the day VFR‑rated pilot susceptible to spatial disorientation following the loss of visual cues when flying in dark night conditions.

Newman (2007) also commented on the inherent instability of a helicopter increasing pilot workload and the likelihood for spatial disorientation. The Flight Safety Australia (2015) article, Workload and Helicopters includes the following about piloting a helicopter.

Piloting a helicopter is a complex, continuous, multi-task operation…This means helicopter pilots face a high workload in day-to-day flying…Workload also varies temporarily, according to weather (IMC, wind/turbulence) and environment (terrain, obstacles, wires).

Compared to fixed wing aircraft, helicopters are dynamically unstable and require constant pilot input to maintain controlled flight (Fay, 1976; Prouty, 2004). Depending on design, they can be fitted with stability control systems or an autopilot to assist the pilot and reduce workload.

Vestibular system illusion

A false sensation of rotation is an illusion generated by the vestibular system involving the semicircular canals, that can lead to spatial disorientation and result in loss of control. It is commonly referred to as the ‘graveyard spiral’. The FAA’s Medical Facts for Pilots describes how under conditions of unreliable or unavailable visual references, the false sensation of rotation is:

…associated with a return to level flight following an intentional or unintentional prolonged bank turn. For example, a pilot who enters a banking turn to the left will initially have a sensation of a turn in the same direction. If the left turn continues (~20 seconds or more), the pilot will experience the sensation that the airplane is no longer turning to the left. At this point, if the pilot attempts to level the wings this action will produce a sensation that the airplane is turning and banking in the opposite direction (to the right).

If the pilot believes the illusion of a right turn (which can be very compelling), he/she will re-enter the original left turn in an attempt to counteract the sensation of a right turn. Unfortunately, while this is happening, the airplane is still turning to the left and losing altitude. Pulling the control yoke/stick and applying power while turning would not be a good idea–because it would only make the left turn tighter. If the pilot fails to recognize the illusion and does not level the wings, the airplane will continue turning left and losing altitude until it impacts the ground.

With appropriate training and experience, pilots who become disorientated when flying in compromised visual conditions are able to recognise illusions and utilise cockpit instruments to restore their orientation.

Related Occurrences

Between 2010 and 2019 the ATSB investigated 11 fatal accidents, involving aircraft flown after last light in dark night conditions, that resulted in a collision with water or terrain. Loss of control was a factor in five of them, with spatial disorientation found to have contributed to three of the five. Of the 11 accidents, five involved pilots who were qualified to fly an aircraft at night. Six of the accidents involved helicopters, two of which were flown by pilots who were qualified to fly at night. The remaining four accidents involved non-night qualified, day VFR‑rated pilots. Four related occurrences are presented below.

ATSB investigation AO-2011-087

On the evening of 27 July 2011, the owner-pilot of a Robinson Helicopter Co. R22 helicopter, registered VH-YOL was conducting a local flight from Big Rock Dam to Brooking Springs homestead near Fitzroy Crossing, Western Australia. The pilot was reported missing, and the wreckage of the helicopter was located the following day, 14 km north-west of Fitzroy Crossing township. The helicopter was seriously damaged, and the pilot sustained fatal injuries. The ATSB found that the pilot was operating at night without the appropriate training or qualifications in a helicopter that was not suitably equipped.

ATSB investigation AO-2011-100

On 15 August 2011, the pilot of a Piper PA‑28‑180 Cherokee aircraft, registered VH-POJ, was conducting a private flight transporting two passengers from Essendon to Nhill, Victoria under the VFR. The flight was arranged by the charity Angel Flight to return the passengers to their home location after medical treatment in Melbourne. Global Positioning System data recovered from the aircraft indicated that when about 52 km from Nhill, the aircraft conducted a series of manoeuvres followed by a descending right turn. The aircraft subsequently impacted the ground at 1820 Eastern Standard Time, fatally injuring the pilot and one of the passengers. The second passenger later died in hospital as a result of complications from injuries sustained in the accident.

The ATSB found that the pilot landed at Bendigo and accessed a weather forecast before continuing towards Nhill. After recommencing the flight, the pilot probably encountered reduced visibility conditions approaching Nhill due to low cloud, rain and diminishing daylight, leading to disorientation, loss of control and impact with terrain. 

ATSB investigation AO-2011-102

On 18 August 2011, an Aérospatiale AS355F2 (Twin Squirrel) helicopter, registered VH-NTV, was being operated under the VFR in an area east of Lake Eyre, South Australia. At about 1900 Central Standard Time, the pilot departed an island in the Cooper Creek inlet with two film crew on board for a 30-minute flight to a station for a planned overnight stay. It was after last light and, although there was no low cloud or rain, it was a dark night.

The helicopter levelled at 1,500 ft above mean sea level, and shortly after entered a gentle right turn and then began descending. The turn tightened and the descent rate increased until, 38 seconds after the descent began, the helicopter impacted terrain at high speed with a bank angle of about 90°. The pilot and the two passengers were fatally injured, and the helicopter was destroyed.

The ATSB found that the pilot probably selected an incorrect destination on one or both of the helicopter’s global positioning system (GPS) units prior to departure. The ATSB concluded that, after initiating the right turn at 1,500 ft, the pilot probably became spatially disoriented. Factors contributing to the disorientation included:

• dark night conditions
• high pilot workload associated with establishing the helicopter in cruise flight and probably attempting to correct the fly-to point in a GPS unit
• the pilot’s limited recent night flying and instrument flying experience
• the helicopter not being equipped with an autopilot.

ATSB Investigation AO-2016-031

On 7 April 2016, the pilots of two Robinson R22 helicopters flew from Mossman, Queensland, to various fishing locations to the north with a passenger in each helicopter. Late in the afternoon, on the return flight to Mossman the pilots encountered weather and winds that slowed their progress and required them to refuel at Cooktown. The pilots departed Cooktown at last light and as the flight progressed, the light available from the sun continued to decrease and there was no moon. There were also patches of cloud and rain in the general area.

Shortly after passing Cape Tribulation, in dark night conditions one of the helicopters registered VH-YLY, collided with the sea. The passenger was injured in the accident but was able to reach the shore and notify emergency services. A search was initiated and the missing helicopter was located about 400 m offshore in about 10 m of water. The pilot was not located. The ATSB found that the pilot of VH-YLY, who was only qualified to operate in day VFR conditions, departed on a night flight and continued towards the destination in deteriorating visibility until inadvertently allowing the helicopter to descend into water.

8. available at www.casa.gov.au – aviation medicine – medication.
9. Operational category assigned to ex-military (warbird), historical or replica aircraft under Part 132 of the Australian Civil Aviation Safety Regulations
10. Log Book Statement - a document contained within an aircraft’s permanent records that identifies relevant aircraft details and documents the aircraft’s maintenance program and maintenance release inspection information
11. ICAP: Interagency Committee for Aviation Policy established by the General Services Agency, United States of America, for the effective acquisition, management and disposal of federally owned aircraft
12. A manoeuvre that is used to transition from forward flight to a landing on the surface where a hover landing is not possible or appropriate.
13. VNE: Never-exceed speed.
14. An exemption to Civil Aviation Regulation CAR174B that places minimum safe altitude restrictions upon an aircraft operating under the night VFR.
15. Notice to Airmen (NOTAM): NOTAMs provide information that is of direct, and often immediate, operational significance.
16. Significant meteorological information (SIGMET): a weather advisory service that provides the location, extent, expected movement and change in intensity of potentially hazardous (significant) or extreme meteorological conditions that are dangerous to most aircraft, such as thunderstorms or severe turbulence.
17. An auto-rotational descent is a power off manoeuvre in which the engine is disengaged from the main rotor system and the rotor blades are driven solely by the upward flow of air through the main rotor.
18. Graphical Area Forecast (GAF) provides information on weather, cloud, visibility, icing, turbulence and freezing level in a graphical layout with supporting text. These are produced for 10 areas across Australia, broadly State-based.
19. Scattered cloud is defined as cloud totalling 3 to 4 OKTAS, meaning 3 to 4 eights of the sky obscured by cloud.a>
20. Moderate turbulence. There may be moderate changes in aircraft attitude and/or altitude, but the aircraft remains under positive control at all times – usually, small variations in air speed – changes in accelerometer readings of 0.5g to 1.0g at the aircraft’s centre of gravity – difficulty in walking – occupants feel a strain against seat belts – loose objects move about.
21. Severe turbulence. Abrupt changes in aircraft attitude and/or altitude – aircraft may be out of control for short periods – usually, large variations in air speed – changes in accelerometer readings greater than 1.0g at the aircraft’s centre of gravity – occupants are forced violently against seat belts – loose objects are tossed about.
22. The pressure gradient is indicated by the proximity of isobars (lines of constant pressure) on a surface weather map. When the lines are close together a large (tight) pressure gradient exists, which can indicate relatively higher wind speeds.
23. Aerodrome Forecast (TAF): a statement of meteorological conditions expected for a specific period of time in the airspace within a radius of 5 NM (9 km) of the aerodrome reference point. The heights referenced in TAFs are heights above the aerodrome reference point (ground).
24. Ceiling and visibility okay (CAVOK): visibility, cloud and present weather are better than prescribed conditions. For an aerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft, no cumulonimbus cloud and no other significant weather.
25. Broken cloud is defined as cloud totalling 5 to 7 OKTAS meaning 5 to 7 eights of the sky obscured by cloud.
26. SPECI: An aerodrome weather report issued whenever weather conditions fluctuate below specified criteria.
27. METAR: A routine aerodrome weather report issued routinely on the half-hour.
28. Last light computations do not include the nature of the terrain surrounding a location, or the presence of other than a cloudless sky and unlimited visibility at that location.
29. Lux: Unit of illuminance that is used as a measure of the intensity, as perceived by the human eye, of light that hits or passes through a surface
30. Instrument meteorological conditions (IMC): weather conditions that require pilots to fly primarily by reference to instruments, and therefore under Instrument Flight Rules (IFR), rather than by outside visual reference. Typically, this means flying in cloud or limited visibility

Safety analysis

Introduction

While on a positioning flight to Bankstown, New South Wales, Bell Helicopter Company UH-1H registered VH‑UVC entered a descending turn, about 12 minutes after last light, resulting in a collision with water near Anna Bay, New South Wales.

The pilot was not qualified, and the helicopter was not equipped, to operate at night. At the time of the accident, dark night conditions and moderate to severe turbulence were likely present. No evidence was found of a mechanical defect with the helicopter that may have contributed to the accident.

The following analysis will discuss the continuation of the flight after last light, and the reasons for the subsequent loss of control. The analysis also considers the pilot’s medical history.

Flight after last light

Due to the departure time from Archerfield Airport, and the need to refuel enroute, there was insufficient time to reach Bankstown before published last light. Considering the prevailing weather conditions, last light probably passed prior to the published end of evening civil twilight, as the helicopter approached Broughton Island.

Recognising that the pilot could have identified prior to departing Coffs Harbour that the flight could not be completed in daylight, given the inherent utility of a helicopter, there were also opportunities to land at a beach, or other suitable areas, prior to reaching Broughton Island. After this point, the pilot would have required suitable ground lighting to avoid obstacles during landing. An option available to the pilot at this point was to contact Williamtown air traffic control for assistance and a possible landing at Williamtown Airfield.

The pilot’s decision to continue the flight at night may have been influenced by self-induced pressure to complete the flight for business and personal reasons. It is also possible that plan‑continuation bias influenced the pilot’s decision. As the flight passed the halfway point and progressed closer to the destination the pilot may have become increasingly committed to continuing with the original plan. Consequently, deciding to turn back or divert may have become increasingly difficult.

Loss of visual cues

As the flight progressed after last light visual cues may have been available to the pilot from ground‑based lighting close to the aircraft’s track and there may have been a horizon or silhouette of terrain to the west.

However, about 10 minutes after published last light UVC commenced a left turn, departed the coastal route, and tracked offshore. The position of the helicopter at this point was about 2 km to the west of Anna Bay. As the helicopter tracked over a featureless sea with overcast conditions blocking out celestial lighting, the pilot likely lost any remaining visual cues and encountered dark night conditions.

Loss of control

Flight profile

The aircraft’s flight path after last light showed increasing variations in track and altitude. Considering that turbulent conditions were likely present for the whole flight from Coffs Harbour it is likely that the reduced visual cues encountered by the pilot affected their ability to control the helicopter.

UVC’s track following the turn offshore was aligned with a direct track to Bankstown and was inside the Williamtown military control zone, which shared a lateral boundary with the R578A restricted area. As such, it is likely that the pilot was attempting to track directly to Bankstown, rather than follow the R578A restricted area boundary as previously requested.

From 1812:55 UVC entered a descending and tightening left spiral turn. Information derived from ADS-B data indicated that between UVC’s last two recorded positions the helicopter’s descent rate was in excess of 11,500 feet per minute and the aircraft’s airspeed was in excess of 150 kt. The magnitude of those parameters significantly exceeded the operational limitations published in the Operator’s Manual and, together with the characteristic spiralling turn, supported a loss of control of the helicopter at that point.

Helicopter systems assessment

Compression damage to the tailboom driveshaft cover was consistent with the upper surface of the tailboom impacting the ocean surface. Further, witness marks on the driveshaft cover indicated that the tail rotor drive train was stationary at the time of impact. However, there was also physical damage consistent with rotation and continuity of the tail rotor drive train. As such, it was considered likely that the tailboom detached from the helicopter prior to impact, decoupling the tail rotor drive and allowing the boom to rotate to an inverted position prior to impact.

Considering that the loss of control commenced about 1.2 km from the wreckage field and the tailboom was found only about 51 meters away from the main wreckage of the helicopter, it is likely the tailboom separation from the helicopter occurred very close to the helicopter’s impact point and did not contribute to the loss of control.

The vertical fin and synchronised elevators detached from the tailboom and were not identified in underwater wreckage imagery provided to the ATSB. From the available information, it was not possible to determine when these components separated from the tailboom. However, as there was no evidence of pre-existing defects, it is considered more likely that they separated in the final moments due to the forces associated with contacting the water or as a result of dynamic loading effects associated with flight in turbulent conditions at very high airspeed.

The ATSB considered whether a system failure or malfunction influenced the development of the accident. Due to the location and condition of the wreckage the ATSB was unable to examine the helicopter’s powerplant, rotor and flight control systems. As a result, the helicopter’s flight path after 1812:55 was analysed in order to determine if it was consistent with a system fault.

The three possible faults considered were a loss of drive to the main rotor, loss of thrust from the tail rotor or loss of hydraulic power. The Operator’s Manual advised that in the event of a loss of drive to the main rotor system an autorotational descent is required. A loss of tail rotor thrust or failure of the hydraulic system requires the pilot to maintain an airspeed above 30‑70 kt and to position the aircraft for a run on landing at a suitable flat location.

The left turn initiated at 1812:55 was inconsistent with a track to a suitable landing site due to the proximity of Stockton beach to the right of the helicopter’s track and a mayday call was not made, as would be expected in this situation. In addition, the helicopter’s airspeed prior to 1812:55 was above that required to counter both a loss of tail rotor drive and hydraulic failure.

The airspeed and descent rate were also inconsistent with an autorotational descent or approach to a suitable landing site. It is therefore considered likely that the aircraft control and propulsion systems were serviceable and did not compromise the operation of the helicopter.

Spatial disorientation

When the pilot turned offshore near Anna Bay it is likely that the absence of celestial lighting and ground references resulted in dark night conditions being encountered. In addition, moderate to severe turbulence was likely present. The lack of external visual cues would have required the pilot to reference the aircraft’s flight instruments to maintain control of the helicopter.

The primary instrument for maintaining control, or to recover from an unusual attitude, is the attitude indicator. In UVC the pilot’s attitude indicator was not available to the pilot due to the location of a tablet on the instrument panel. The tablet was not located in the wreckage, as a result the screen brightness settings and their potential influence on the pilot’s night vision could not be determined.

A second attitude indicator was located on the left side instrument panel however, it would have been difficult for a pilot with no instrument training to effectively use that instrument given its cross‑cockpit position.

The pilot was not trained or experienced in maintaining control of the helicopter with sole reference to the flight instruments. Research has shown that pilots not proficient in maintaining control of an aircraft with sole reference to the flight instruments will become spatially disorientated and lose control of the aircraft within 1 to 3 minutes after visual cues are lost.

The helicopter’s inherent instability coupled with the turbulence conditions and lack of an auto pilot probably made it more difficult to control UVC and may have increased the pilot’s susceptibility to spatial disorientation. In addition, the pilot’s reduced sleep opportunity the night before the accident, the elapsed flight time since departure from Archerfield and the workload associated with the turbulent conditions may have increased their level of fatigue, increasing the likelihood of disorientation.

The helicopter’s spiralling descent flight profile after 1812:55 was consistent with spatial disorientation influenced by limitations of the vestibular system and absence of visual cues. The absence of external visual references also prevented the pilot from regaining control of UVC before it collided with the water.

Reporting of medication and medical conditions to the Civil Aviation Safety Authority

To assess and manage flight safety risk, the Civil Aviation Safety Authority (CASA) uses Designated Aviation Medical Examiners (DAMEs) as a point of contact for pilots renewing their medical certificates. The renewal process relies on self-reporting by the pilot of any medical conditions or treatments. Specifically, pilots are required to advise their DAME, and ultimately CASA, of any medications, medical procedures, medical conditions or symptoms that required the assessment a medical specialist.

The pilot, who was under the care of a non‑aviation medical specialist in the month prior to their most recent medical certificate renewal process, did not disclose to their DAME the medical conditions that were being treated nor details of the medications that were prescribed.

The pilot’s treating specialist reported that the sedating characteristics of the prescribed medications were known, and the dosages were carefully monitored, albeit based on pilot self‑reports. The specialist further reported that the dosage was appropriate for the pilot and did not impact on the pilot’s decision-making ability or physical functioning.

While the specialist’s clinical assessment was not in question, the input of CASA aviation medicine specialists was necessary to determine whether the pilot remained eligible to be issued with an aviation medical certificate.

Pathways exist for managing certain medical conditions that do not preclude a pilot from maintaining an aviation medical certificate. However, disclosure of medical information is essential to enable CASA to manage any on-going flight safety risk for both the individual and flight safety overall.

Findings

From the evidence available, the following findings are made with respect to the collision with water involving Bell UH-1H helicopter, VH-UVC, 5 km south-west of Anna Bay, New South Wales, on 6 September 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The pilot continued to fly after last light without the appropriate training and qualifications, and then into dark night conditions that provided no visual references. That significantly reduced the pilot's ability to maintain control of the helicopter, which was not equipped for night flight.
• The pilot likely became spatially disorientated, resulting in a loss of control and collision with water.

Other factors that increased risk

• The pilot did not disclose on-going treatment for significant health issues to the Civil Aviation Safety Authority. That prevented specialist consideration and management of the on‑going flight safety risk the medical conditions and prescribed medications posed.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Aireon
• Airservices Australia
• Bureau of Meteorology
• Civil Aviation Safety Authority
• FlightRadar24
• maintenance organisation for VH-UVC
• medical and air traffic control specialists
• New South Wales police service
• OzRunways
• a number of witnesses

References

ATSB (2013), Avoidable Accidents No. 7. Visual flight at night accidents: What you can’t see can still hurt you, ATSB, Canberra, Australia.

Batt, R, and O’Hare, D (2005), General Aviation Pilot Behaviours in the Face of Adverse weather, Australian Transport Safety Bureau, Aviation Research Investigation Report B2005/0127.

Benson, A (1999) Spatial disorientation – general aspects. In J Ernsting, AN Nicholson, DJ Rainford (Eds.) Aviation medicine. Butterworths & Co. Ltd, London:

Bryan L, Stonecipher J, and Aron K (1954) 180-degree turn experiment, 54(11):1-52, University of Illinois Bulletin.

Dismukes, RK, Berman BA and Loukopoulos LD (2007), The limits of expertise: Rethinking pilot error and the causes of airline accidents, Ashgate Publishing Limited, Hampshire, England

Fay, J (1976), The Helicopter. History, Piloting and How it Flies, David and Charles, London.

Federal Aviation Administration (2019), Helicopter Flying Handbook, U.S. Department of Transportation, FAA-H-8083-21B

Federal Aviation Administration, Medical facts for pilots, AM-400-03/1, Civil Aerospace Medical Institute

Flight Safety Australia (2015), Workload and helicopters, Civil Aviation Safety Authority, Australia,  

Newman DG (2007), An overview of spatial disorientation as a factor in aviation accidents and incidents, Australian Transport Safety Bureau, Aviation Research and Analysis Report B2007/0063.

NTSB (1994), A review of flight crew involved, major accidents of U.S. air carriers, 1978 through 1990, NTSB/SS-94/01, Washington, D.C. 20594

Prouty RW (2004), Helicopter Aerodynamics, Eagle Eye Solutions, Lebanon, USA.

Flight Safety Foundation (1997), ‘Inadequate visual references in flight pose threat of spatial disorientation’, Human Factors & Aviation Medicine, 44(6).

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• medical specialists
• Bureau of Meteorology
• Civil Aviation Safety Authority
• maintenance organisation for VH-UVC
• Williamtown air traffic controllers
• air traffic control specialist.

Submissions were received from:

• Bureau of Meteorology
• a medical specialist

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 20 August 2019 a Regional Express, Saab Aircraft Company 340B, registration VH-ZLX, departed Adelaide, for a regular public transport flight to Port Lincoln, South Australia. During the post flight walk around, the first officer noted that the left main outboard landing gear tyre was deflated and that a piece of the wheel was missing.

Ground support personnel at Adelaide Airport subsequently located the missing section of wheel on the runway strip.

What the ATSB found

An area of fatigue cracking had initiated in the bead seat region of the wheel and progressed 86 mm around the circumference prior to final overstress fracture. Information obtained from the manufacturer and a previous ATSB investigation indicated that fatigue cracking of the bead seat area in this wheel type was a known issue with previously updated maintenance schedules and practices.

It was considered likely that the fatigue crack was present at the most recent maintenance visit, however, it had not been detected. Insufficient guidance in the operator’s maintenance procedures meant that inspections required by the component maintenance manual that might have identified the developing fatigue crack were not carried out.

What's been done as a result

The operator advised that, as a result of this incident, they have implemented new measures to prevent a recurrence. These include:

• Updating wheel maintenance procedures to ensure that non normal inspections are identified and carried out.
• Making the component maintenance manual for tyres more readily available to personnel by adding it to their engineering website.
• Providing additional advisory material to maintenance personnel on the requirements of completing unserviceable tags to ensure that other maintenance personnel performing subsequent work fully understand the defect.
• Providing additional training to personnel on wheel maintenance techniques.

Safety message

When situations or issues arise that do not fit into standard operating procedures, maintenance personnel should always be prepared to consult or request further guidance. This guidance can come from internal support materials, such as procedures, or external materials such as maintenance manuals or the manufacturer.

The occurrence

What happened

At approximately 1935 Central Standard Time^[1] on 20 August 2019, a Regional Express, Saab Aircraft Company 340B, registration VH-ZLX (ZLX), departed Adelaide, South Australia for a regular public transport flight to Port Lincoln, South Australia. This was the last flight of the day for the aircraft and there were two flight crew, one cabin crew and 14 passengers on board. Following the landing in Port Lincoln, the first officer conducted an external inspection of the aircraft and noticed that the left main outboard landing gear tyre was deflated.

The crew reported no issues with aircraft handling during the take-off, landing or taxi phases of the flight. Additionally, none of the crew or passengers advised of any vibration or unusual noises during the flight.

On closer inspection of the wheel, the first officer noted that a piece of the wheel rim was missing (Figure 1). Ground staff were notified and the Port Lincoln aerodrome reporting officer (ARO) was contacted to conduct a runway inspection. The ARO’s inspection did not reveal any foreign object debris or damage to the runway.

The following morning, the operator dispatched engineers to replace the wheel and brake assembly. They informed the flight crew that the missing piece of wheel had been located on the runway strip at Adelaide Airport.

Context

Incident wheel history

The incident wheel was manufactured in 1995 and acquired by the operator in 2007. Since then, it had undergone 42 tyre changes, and 8 overhauls, the most recent of which was in October 2018. In the 10 months between this overhaul and the occurrence, it had accumulated 943 flight cycles on five different Saab 340B aircraft (Table 1).

The wheel’s removal from the first three aircraft was for routine tyre changes, with the tyres being worn to limit (WTL). Following its removal, the wheel was transported to the operator’s maintenance facility, inspected in accordance with the operator’s process, signed off as serviceable and returned to storage before transport and fitment to the next aircraft.

The removal from the fourth aircraft was due to a flat tyre. During a routine post flight inspection on 16 July 2019 the wheel was identified to be audibly leaking, maintenance personnel were notified and reported that when they arrived, the tyre was flat. As a result, both wheels in the set^[2] were removed from the aircraft. The operator reported that prior to the occurrence flight the tyre pressure had been checked with a pressure gauge and was at the appropriate operating pressure before departure.

Table 1: Incident wheel maintenance history since previous overhaul

Source: Operator

Following removal of the wheel in July 2019, an ‘unserviceable’ tag was attached, and the wheel was returned to the operator’s maintenance facility. A standard tyre change form with the word ‘Repair’ hand‑annotated at the top of the form was used to document the maintenance. The form indicated that the following items were completed.

• ‘General wheel check and inspection admin’
• valve subassembly reinstallation and the wheel inflation
• the post-inflation leak test^[3], which found no evident leak.

Other items listed on the form, including visual inspection and non-destructive testing, were not performed as they were marked as ‘N/A’.

Following the leak check, the wheel was inflated to the recommended storage pressure and stored at the operator’s maintenance facility for approximately 1 month. On the day of the occurrence, the wheel was fitted to ZLX, and the aircraft conducted three flight cycles^[4] before the rim section separated at Adelaide Airport.

Wheel examination

Following the incident, the wheel and tyre assembly, including the recovered segment, were provided to the ATSB for inspection.

Initial inspections revealed that a section of the rim, comprising approximately one-half of the wheel’s circumference, had broken away with the fracture extending through the bead seat. The tyre had been damaged in the area of the fracture, with exposed steel reinforcing and some fractured wires. The tyre had folded over the fractured section of the rim and was caught on the edge of the rim (Figure 1).

Figure 1: Wheel in as-received condition

Source: ATSB

The tyre was removed, and the wheel disassembled to allow access to both sides of the fracture surface. The fracture followed a radial path through the wheel rim bead seat area (Figure 2).

Figure 2: Cross-section diagram of the wheel hub showing the location of the fracture

Source: Manufacturer, annotated by the ATSB

Beach‑marks consistent with fatigue crack progression were evident across both faces of the fracture surface (Figure 3 and 4). These markings extended radially from the internal bead seat radius surface towards the centre of the exposed fracture face. The beach-marks extended circumferentially around the rim for approximately 86 mm. While several potential fatigue initiation points were examined on both faces of the fracture, the exact origin could not be determined. The outer surfaces of the fracture, beyond the area of fatigue, were dull grey in colour and rough/fibrous in appearance. These features were consistent with a ductile overstress failure in a heat-treated aluminium alloy.

Figure 3: Excised portion of wheel rim with fatigue area highlighted

Source: ATSB

Figure 4: Magnified view of fatigue area showing crack progression along the bead seat and evidence of tyre contamination on the fracture surface

Source: ATSB

There was also black discolouration on the fracture surface. This was determined to be rubber debris from the tyre when it had been caught over the rim.

Scanning electron microscopy of the fracture surface revealed a relatively smooth fracture with evidence of non-uniform stepwise crack formation (Figure 5). This was further indication of a fatigue crack propagation through the material. Due to the non-uniform nature of the steps, it could not be determined how many cycles of fatigue had occurred before the overstress fracture.

Figure 5: Area of fatigue surface showing step-wise crack formation

Source: ATSB

The examinations did not locate any corrosion or pre-existing manufacturing defects. Externally, there was no significant surface or mechanical damage to the fractured rim.

Wheel design

The wheel, serial number AUG 95-1523, was a part number (P/N) 5010488 main wheel assembly manufactured by the Aircraft Braking Systems Corporation (ABSC), now Meggitt Aircraft Braking Systems (MABS) in August 1995. The wheels were for use on a range of fixed and rotary wing aircraft including the Saab 340B.

Following a number of in‑service failures, in August 1994 ABSC identified an issue with the design of these wheels. These failures were attributed to fatigue crack development in the bead seat region of the wheel.

In order to ensure that cracks were detected prior to wheel failure, the manufacturer issued a service bulletin SF340-32-24, ‘SAAB 340 Main Wheel Sub Assembly 5009327 and 5009327-1’, which revised the required inspection and maintenance procedures for this wheel-type. The changes included non-destructive inspection, either eddy current or ultrasonic, at a series of locations around the wheel at each tyre change.

The inspection schedule for these wheels was introduced by service letter (SL) SL-GS-36.^[5] The SL indicated that overhauls should be performed at maximum intervals of five tyre changes, or 1,500 flight cycles, whichever occurred first, nominally introducing an interval of approximately 300 flight cycles between each eddy current inspection. That interval was consistent with the maintenance history of the failed wheel.

In December 1995, the manufacturer released an updated design (P/N 5010488-1) that included additional reinforcement in the bead seat region. Figure 6 and 7 show the differences between the two designs. The new design could not be retrofitted to existing wheels. The manufacturer’s advice to operators in the service bulletin that introduced the new design (Saab 340-32-41) was that the older wheels (serial number OCT95-1606 and earlier) could be used until stock depletion, provided the necessary maintenance and inspection standards detailed in SL‑GS‑36 were maintained.

Figure 6: Diagrams showing the difference in the original and revised wheel designs

Source: Manufacturer modified by the ATSB

Figure 7: Example of the difference between the old and new wheel designs

Source: ATSB

The manufacturer advised that they were not aware of any in service failures in the last 10 years and could not determine how many of the older wheel designs remained active, as they were not alerted to removal of wheels from service. The ATSB also reviewed defect reporting service (or equivalent) databases of the Civil Aviation Safety Authority, the United States Federal Aviation Administration and Transport Canada (Canadian Regulatory Authority) for reports of wheel failures. The jurisdiction of these agencies covers the majority of the aircraft with this wheel type. That review identified four reported wheel failures in the last 20 years and none in the last 10 years.

A search of the operator’s engineering database showed 38 wheels of the older design remained active in their fleet. In the 10 years prior to this occurrence, the operator has experienced one other in-service failure on their aircraft (see the section titled Previous occurrence) and 69 wheels of this type have been removed from service. It could not be determined if the removal of these wheels from service was due to the presence of fatigue cracks, as this level of detail was not recorded in the engineering database.

Component maintenance procedures

The component maintenance manual (CMM) outlined a range of different maintenance tasks that were to be carried out on this type of wheel (both the original and updated designs). It stated that, with the exception of the overhaul requirements already outlined, wheels were an ‘on condition’^[6] part.

Three key procedures given in the CMM were for tyre change, overhaul and special cases.

Tyre change

The tyre change procedure was carried out when a tyre was worn to its tread limit. This involved recording the details about the wheel, dismantling the removable flange, removing the worn tyre, conducting a detailed visual inspection of the whole wheel assembly and non-destructive (eddy current or ultrasonic) inspection of specific areas.

Overhaul

At an overhaul, wheels had to undergo a full tyre change inspection plus eddy current, ultrasonic or fluorescent penetrant inspection of the whole wheel.

Special cases

‘Special cases’ inspections were required when the tyre had been operated with a flat or damaged tyre, or when the mating wheel^[7] has been operated with a flat tyre.

In the case of a wheel operated with a flat tyre, the CMM required that the wheel undergo a careful visual inspection for damage, and a roundness check to ensure that the wheel was still circular. If the wheel was out of a specific tolerance, then it was to be replaced. There was no requirement for the wheel to undergo any non-destructive inspection in this process.

Operator’s maintenance process

The operator provided maintenance personnel with two different forms for carrying out the routine maintenance on wheels of this type, one for overhaul and another for tyre changes. The two forms specified the required tasks (as detailed in the CMM), and a location for each task to be signed off.

At the time of the occurrence, neither of these forms required personnel to confirm the reason for the tyre removal or if any additional maintenance actions, such as those outlined in the ‘special cases’ section, were required. There was no form for the special cases procedures.

A review of maintenance documentation indicated that non‑destructive inspections were carried out during the last overhaul of the occurrence wheel and during each subsequent tyre change conducted prior to the wheel failure. No cracking was identified during any of those inspections.

Previous occurrence

ATSB Investigation AO-2009-006

On 6 February 2009, a Regional Express Saab340B aircraft, registered VH-KDQ, landed at Sydney Airport following a regular public transport flight from Orange, New South Wales. During the post-flight inspection, the crew noted that that the aircraft’s left main outboard landing gear wheel was deflated and had sustained damage. Closer inspection by maintenance personnel revealed that a section of the wheel had fractured but remained attached to the wheel assembly.

The ATSB’s examination of the wheel found that it had failed due to a fatigue crack that had developed within the bead seat after initiating in the transition radius.

The failed wheel was a part 5010488 main wheel assembly manufactured by ABSC, serial number SEP92-0621 and, as discussed in the Wheel Design section, was more susceptible to this type of failure. The investigation reviewed the safety actions that had previously been put in place by both the manufacturer and the operator, finding them to be satisfactory.

Safety analysis

Component failure

Failure of the left main outboard landing gear wheel from Saab 340B aircraft, VH-ZLX, was a result of the fracture and separation of a section of the inner wheel rim adjacent to the tyre bead seat. The cracking and fracture was typical of a progressive fatigue cracking mechanism, which had initiated on the internal bead seat transition radius. In conventional pneumatically pressured wheel designs, the internal bead seat radius is typically a region of high bending stresses. As such, it is pre-disposed to the initiation and growth of fatigue cracking. Operational stresses arising from tyre flexure during taxi and landing can further contribute to this failure mechanism.

The bead seat radius fatigue cracking was a known issue with wheels of the original ABSC P/N 5010488. To improve the reliability of these wheel assemblies, the wheel manufacturer introduced updated inspection methods and tyre change or cycle limits between overhauls. To further address the issue, a revised wheel design (P/N 5010488-1) with features that strengthened the bead seat region of the wheel aimed at preventing fatigue failures was introduced. The failed wheel from VH-ZLX was of the original design.

Wheel inspection and crack development

Each time the non-destructive testing was conducted at a tyre change, no cracks were identified, and the wheel remained in service. Two scenarios were identified that could have accounted for the presence of the fatigue crack that initiated the failure:

• the initiation and growth of the crack occurred rapidly, with the crack developing in the time since the last non-destructive inspection was carried out, or
• a crack had initiated at the time of the last non-destructive inspection and was not detected.

The ATSB was not able to determine the crack growth rate that occurred in the wheel rim from the fracture surfaces. While rapid crack development could not be conclusively ruled out, for the following reasons the ATSB considered it probable that a crack had been present at the time of the last non‑destructive inspection but had not been detected:

• The relatively large size of the fatigue area (86mm), compared to the relatively low number of flight cycles that had occurred (97) since the last eddy current inspection.
• The nominal interval between eddy current inspections was 300 flight cycles, however, this failure occurred well before the next inspection was due. The very small number of reported failures in this wheel type in last 10 years indicated that the inspection interval generally appears adequate to capture cracks before they progressed to failure in service.
• While it was possible that the wheel was operated for a short time with lower than recommended tyre pressure which could have influenced the crack growth rate, it was considered unlikely that it increased the growth rate enough to cause failure at one third of the nominal inspection interval.

Available forms

When the wheel was presented to the wheel bay following its removal from VH-ZXK, the personnel involved utilised the standard tyre change form to complete the inspection, noting on the form that this was not a standard tyre change, rather a ‘Repair’. Utilising the tyre change form, personnel signed for the ‘general wheel check and inspection admin’ task. This task did not include a visual inspection, as it was listed as a separate item on the form. When reinflated, the tyre retained pressure for the required 24 hours and so the tyre was not changed. As a result, a complete tyre change inspection, including non‑destructive inspection, was not performed.

As the wheel had been operated with a flat tyre, even if for a short time, it should have undergone the additional inspections outlined in the ‘Special cases’ section of the CMM. However, the documentation that maintenance personnel used did not identify this as a requirement, nor did it direct them to the CMM for further guidance in non-standard cases.

The ‘Special cases’ section of the CMM required a detailed visual inspection and roundness check to be carried out. The ATSB was unable to determine whether either of these inspections could have identified the crack. However, they would have been opportunities to determine that something was out of place and prompt further investigations. Although not required as part of the ‘Special cases’ section, had the wheel been subject to non-destructive inspection, the crack would have almost certainly been detected.

Findings

These findings, related to the landing gear wheel failure of Regional Express Saab 340B VH-ZLX, should not be read as apportioning blame or liability to any particular organisation or individual.

• A fatigue crack initiated at the bead seat and led to the failure of the left outboard main landing gear wheel.
• This wheel design was susceptible to fatigue cracking in the bead seat region.
• It is probable that a fatigue crack was present at the time of the last non-destructive eddy current inspection but not detected.
• The operator’s wheel maintenance forms did not adequately convey the inspection requirements for wheels operated with flat tyres. Subsequently, when the flat tyre was detected and the wheel brought in for maintenance, inspections that may have detected the crack were not carried out.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action.

Aircraft operator

The aircraft operator has advised the ATSB that in response to this incident they have updated several of the forms used for carrying out wheel maintenance. The forms now include additional steps to identify and treat wheels that fall into the ‘Special cases’ categories of the CMM and to ensure that all wheels in these categories undergo non-destructive inspection.

Additionally, they have made the tyre CMM more readily accessible to maintenance personnel, and disseminated advisory materials to ensure that the reason wheels are removed from service is correctly annotated on the unserviceable documentation. They have also provided retraining for a number of their staff in the correct wheel maintenance procedures.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Central Standard Time (CST): Coordinated Universal Time (UTC) + 9.5 hours.
2. The component maintenance manual stated that when one wheel in a dual wheel set was operated with a flat or damaged tyre, the other mating wheel must also undergo an inspection for damage due to potential for overload or other damage.
3. Post-inflation leak check required the tyre to be inflated to operating pressure for 24 hours. The tyre was then pressure-tested and the pressure reduction was not permitted to exceed 10 per cent.
4. Flight cycle: a completed takeoff and landing sequence.
5. SL-GS-36 was first issued in July 1993. The most recent revision, version seven, was issued in January 2006.
6. For ‘on condition’ components, maintenance is carried out as required rather than on a fixed schedule of flight cycles, time or operational hours.
7. Mating wheel: the other wheel on the same part of the landing gear

Safety summary

What happened

On the evening of 29 August 2019, a Regional Express Saab 340B, registered VH-RXX, departed Moruya, New South Wales. The aircraft was performing a scheduled passenger service to Merimbula, New South Wales. At the time, the aircraft’s right engine was being monitored for high oil consumption.

Soon after top of climb, the flight crew received an engine fire indication from the right engine. While conducting the engine fire checklist, the engine surged and then failed. A cabin crew member reported seeing a brief flash of light from the right side of the aircraft. The flight crew then shut the engine down.

Based on the close proximity to the destination, the flight crew decided to continue to Merimbula Airport. The aircraft landed without incident at about 1950.

What the ATSB found

The engine failed as a result of an internal oil fire, which weakened a turbine disk and resulted in turbine blades being released. The fire occurred when oil leaked from an oil sump due to carbon deposits, known as coking, within that oil sump. The coking was most likely due to either the component not being completely clean when installed at the last major overhaul and/or accelerated coking on the component.

What's been done as a result

The engine manufacturer has enhanced the troubleshooting procedures to identify internal engine oil leaks more effectively and developed enhancements to the overhaul facility cleaning procedure for the affected oil sump.

Safety message

This incident highlights the importance, when piloting multi-engine aircraft, of maintaining the ability to operate with one engine inoperative. Aircraft turbine engines are complex, and can fail for reasons that are rare and difficult to identify prior to the failure. In this occurrence, the maintainers had followed the correct troubleshooting procedure but were unable to determine the reason for the high oil consumption. The crew’s skill and knowledge, however, along with the built-in redundancies of the system ensured the overall safety of the flight.

The occurrence

What happened

At 2000 Eastern Standard Time^[1] on 29 August 2019, a Regional Express Saab 340B, registered VH-RXX, departed Moruya, New South Wales. The aircraft was performing a scheduled passenger service to Merimbula, New South Wales. The flight was expected to take about 20 minutes.

Approximately 8 minutes into the flight, and shortly after levelling off at an altitude of 9,000 ft, the flight crew received an engine fire indication from the right engine. In response, they commenced the memory items^[2] for the associated checklist. While conducting the first item on the checklist—reducing the power lever—they heard the engine surge and then produce a loud bang. The cabin crew member reported seeing a brief flash of light from the right side of the aircraft. The flight crew continued the Engine Fire checklist and subsequently shutdown the right engine.

Due to the close proximity to the destination, and with the aircraft already having been set up for the approach, the flight crew decided to continue to Merimbula Airport. A hold was established at a waypoint in order to allow the flight crew to complete all the required checklists, and to ensure the availability of emergency services at the destination.

At about 2040, the aircraft commenced the final approach to Merimbula. It landed without incident 7 minutes later.

A post-flight visual examination of the engine revealed that there were several small burn holes^[3] in the power turbine (PT) case (Figure 1) and that the C-sump assembly and a section of the PT shaft were missing (Figure 2). The engine had previously undergone unscheduled maintenance for elevated oil consumption.

Figure 1: Right-hand view of engine with burn holes indicated

Source: GE – annotations by ATSB

Figure 2: Rear-view comparison of undamaged engine (left) and the occurrence engine missing the C-Sump Assembly (right)

Source: GE – annotations by the ATSB

Context

Engine information

The engines fitted to VH-RXX were General Electric (GE) CT7-9B turboprop engines. At the time of the occurrence, the right engine, serial number ESN 785398, had accumulated 37,854.4 hours and 42,877 flight cycles since new.

The CT7-9B consisted of a modular power unit and a propeller gearbox. The modular power unit comprised the:

• accessory module – driving engine accessories (e.g. starter, fuel pump, oil pump)
• cold section module – including the compressor and the midframe assemblies
• hot section module – including the combustor and the gas generator turbine
• power turbine module – transmitted power from the power turbine to the output shaft and into the propeller gearbox.

Located within the cold section module and part of the midframe assembly was the B-sump. This supplied oil to the bearing that supported the gas generator. A labyrinth seal^[4] separated the B-Sump oil cavity and the B-sump air cavity (Figure 3). During normal operation, it was possible for oil to leak beyond the labyrinth seal and accumulate within the B-sump air cavity. A drain tube incorporated into the cavity was intended to direct any oil from the B-sump air cavity into the exhaust gas path. Another labyrinth seal separated the B-sump air cavity from the compressor discharge leakage pressure^[5] (CDLP) air cavity. Oil was not intended to accumulate within the CDLP cavity.

Figure 3: Cross-section diagram of the CT7 – zoom showing the B-sump in relation to the CDLP air cavity and the PT stage 3 disk.

Source: CT-7 Training Manual – Annotated by the ATSB

Maintenance information

In May 2018, at 36,366.7 engine hours (41,144 cycles), 1,481 flight hours before the occurrence, a major work scope^[6] was conducted on the cold section of the engine at an approved engine overhaul facility in the United Kingdom. The previous major work scope was conducted about 14,000 flight hours prior.

As part of that work scope, the midframe assembly (which included the B-sump) was replaced with a refurbished component. Prior to installation, the components were cleaned in accordance with the latest GE procedure. Due to the design of the midframe, there was no visual means to inspect the B-Sump oil cavity in order to confirm complete removal of any coking (see the associated section below). Assurance that the part was clean was provided by means of a repeated flushing technique until there was no further debris found on a filter within the fluid path.

On 30 May 2019, the maintainers began troubleshooting the engine for high oil consumption. The maintainers followed the most current manufacturer’s guidance for fault isolation of oil consumption issues but were unable to identify the cause of the oil consumption issue.

Manufacturer’s findings

GE reviewed all available flight and engine data from prior to the failure and found that the engine had been operated in accordance with their prescribed recommendations.

The engine was transported to the GE Strother facility in the United States for a teardown and detailed examination supervised by the National Transportation Safety Board. The examination found that:

• the B-Sump oil cavity and the B-sump air cavity were heavily coked (Figure 4)
• the B-Sump oil drain was coked and blocked at the time of disassembly
• there was minor presence of coking and oil in the CDLP cavity
• a number of the power turbine (PT) stage 3 disk blades had been released. Examination of the remaining disk post tangs showed elongation and hardness values consistent with a creep condition as a result of exposure to elevated temperatures.

Conclusions of the analysis were that heavy coke build-up in the B-sump oil cavity resulted in the sump flooding^[7] and oil leaking into the B-sump air cavity. Due to the blocked B-sump air cavity oil drain tube, oil leaked into the CDLP air cavity. An oil fire then occurred in the CDLP air cavity and at the stage 3 outer diameter near the disk posts. This weakened the disk posts and resulted in several blades being released. The resulting imbalance caused the separation of the section of PT shaft and the C-sump.

Figure 4: The coking within the B-sump of the occurrence engine (left) in comparison to the condition of a typical engine (right).

Source: GE

Coking

Coking is an artefact from exposure of oil to abnormally high temperatures that leads to oxidation and chemical breakdown of the oil. Coking can form as a thin film layered deposit or in thicker clumps. Determining the initiating source of coke formation is difficult, as it can be attributed to a combination of influences, including:

• operational conditions such as hot shutdown
• design traits such as abrupt changes in oil flow direction and areas of low fluid velocity that can lead to reduced oil flow rates
• low-drainage areas resulting in conductive or convective oil temperature increases post shutdown
• reductions in cross-sections such as scavenge ports that increase the likelihood of blockage
• prolonged aircraft inactivity leading to moisture absorption of coke deposit.

Related occurrence

In 2005, a SAAB 340B fitted with a CT7-9B (ESN 785179) (not operated by Regional Express) sustained an in-flight shutdown determined to be due to B-Sump oil leaking into the CDLP air flow and igniting just forward of the PT stage-3 nozzle. Analysis of that engine also found heavy coking of the B-sump oil cavity and a blocked B-sump air cavity drain tube.

As a result of that occurrence, GE made several changes to improve the effectiveness of the procedure for cleaning the midframe and modified the oil consumption fault isolation procedures with the intent of better identifying B-Sump leak issues.

Safety analysis

The engine failure involving Saab 340B VH-RXX, on 30 August 2019, was initiated by heavy coking in the B-Sump oil cavity, which resulted in oil leaking from the B-Sump and eventually causing an internal oil fire. This over-temperature condition weakened the PT stage 3 disk posts sufficiently to allow some turbine blades to be released, resulting in an imbalance and subsequent fracture of the PT shaft. The engine fire indication received by the flight crew was the result of hot gases being released through the burn holes in the PT case activating the fire-detection system.

The B-sump component had only completed 1,481 flight hours since it was installed on the engine in May 2018. This represented only about 10 per cent of the typical time between major work scopes. The high level of coking found in the B-sump could only have occurred in that timeframe if:

• the component was not completely clean on installation following the major work scope
• there was an accelerated formation of coking within the component

or a combination of both.

Despite the part being cleaned in accordance with the manufacturer’s recommendation, it was not possible to inspect the oil cavity of the B-sump visually to confirm complete removal of coking. In addition, if any coke deposits were remaining within the component, this could have affected the oil flow and cooling within the sump and contributed to further coking.

The manufacturer advised that there was no evidence that the engine was operated outside their recommendations, and so it is unlikely that there were any operational factors that contributed to the accelerated formation of coking. The exact mechanism which resulted in the level of coking present in the B-sump could not be determined.

A CT7 engine failure or in-flight shutdown due to significant coking in the B-sump is a rare event, with only two known occurrences in the 38 million flight hours accumulated by the engine type.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• Excessive coking in the B-sump oil cavity resulted in oil leaking from the B-sump. This ultimately initiated an internal engine fire and subsequent fracture of the PT shaft and separation of the C-Sump assembly.
• The excessive coking was most likely due to the component not being completely clean when installed at the last major work scope and/or accelerated coking on the component.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Engine manufacturer

As a result of this occurrence, the engine manufacturers (GE) have advised the ATSB that they:

• have completed a technical review and incorporated changes to the Maintenance Manual troubleshooting procedure to better identify a B-sump flooding condition.
• are ensuring licensed CT7-TP overhaul facilities are conducting the cleaning in accordance with the GE procedure. GE have also completed a review of the B-Sump cleaning procedure and developed enhancements which will be added to the next revision of the document.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Memory items are checklist items required to be committed to memory to allow an immediate response to high priority abnormal events such as engine fire or failure.
3. Burn holes are caused by hot gases above the melting temperature of the material. This is evidenced by the metal spatter around the holes and there being no direct path into the internal PT case.
4. A labyrinth seal is a type of mechanical seal that provides a tortuous path to help prevent leakage of oil.
5. The compressor discharge leakage pressure air provides cooling air to the power turbine.
6. A workscope is a defined series of maintenance tasks performed on an engine.
7. Flooding is the presence of excessive amounts of oil within the sump.

Safety summary

What happened

In August and October 2019, a Gippsland Aeronautics GA8 Airvan (GA8) aircraft, registered VH‑BFS and operated by Air Fraser Island, sustained failures of the right main landing gear, with both occurrences occurring during landings on beach aeroplane landing areas (ALAs) on Fraser Island. Both landings were described as normal with no excessive loads.

On 24 August 2019, during the landing roll, and just prior to reaching taxi speed, the right main landing gear collapsed, resulting in minor damage to the aircraft as it came to a stop. There were no reported injuries to the pilot or passengers on board. On 31 October 2019, during the landing roll the right main wheel and axle separated from the landing gear at slow speed, resulting in minor damage. There were no reported injuries to the pilot (the only occupant).

What the ATSB found

The ATSB found it was probable that a number of the eight mounting bolts securing the right main landing gear had loosened and wound out, placing excessive loads on the remaining bolts. The remaining bolts eventually sheared, resulting in the gear leg collapsing during landing on 24 August 2019. Although the bolts not being securely fastened would have been apparent during one or more periodic inspections, recent maintenance had not detected any problems.

The ATSB found that because of low weld penetration from manufacture at the right main landing gear axle attach sleeve, it was likely that a fatigue crack formed and propagated undetected, eventually resulting in the axle failure on 31 October 2019. It was likely the axle cracks were present, and detectable visually, when last inspected 27 flight hours before the occurrence. In addition, the axle inspection area had surface contamination and corrosion that indicated the requirement for cleaning prior to inspection had not been conducted for an extended period, thereby decreasing the likelihood of identifying cracks by visual means. Furthermore, the requirement for a magnetic particle inspection of the axles had not been carried out, and was about 470 flight hours overdue at the time of the 31 October 2019 axle failure.

The operator’s aircraft experienced increased loads on the landing gear when routinely operating from beach ALAs up to 20–30 times daily, and they were subjected to a salt-laden and humid environment. With consideration of this context, the ATSB concluded that the operator did not place appropriate emphasis on ensuring the continuing airworthiness of the landing gear of its GA8 fleet.

What has been done as a result

Following the incidents, Air Fraser Island made changes to the control and conduct of maintenance on its aircraft. This included the appointment of a new head of aircraft airworthiness and maintenance control (HAAMC), the appointment of a quality assurance officer to audit the operator’s maintenance system, and changes to the personnel conducting maintenance.

Safety message

Operators routinely conducting operations to beach landing areas should consider the options available for improving the resilience of their landing gear. In particular, they should ensure that they are conducting the required inspections in accordance with the manufacturer’s maintenance schedule and procedures as a minimum standard. Improved and additional inspections should also be considered by operators when aircraft are frequently operated in challenging conditions.

The occurrence

Right main landing gear collapse (24 August 2019)

On 24 August 2019, a Gippsland Aeronautics GA8 Airvan (GA8), operated by Air Fraser Island and registered VH-BFS, conducted a local scenic flight over Fraser Island, Queensland. There was a pilot and five passengers on board.

On completion of the flight, the aircraft landed on a beach aeroplane landing area (ALA).^[1] The landing was described as normal with no excessive loads. The pilot reported that, just prior to reaching taxi speed, the right main landing gear began to rotate towards the fuselage very slowly, and that the aircraft began to tilt to the right. This caused the aircraft to head toward the higher part of the beach before coming to a stop. The aircraft sustained minor damage and there were no reported injuries.

The operator’s licenced aircraft maintenance engineer (LAME) reported that the right main landing gear was no longer secured at its mount fitting by eight mount bolts, allowing it to rotate aft and upwards to a position where it could no longer support the aircraft (Figure 1). The aircraft was repaired and returned to service.

Figure 1: VH-BFS where it came to rest on 24 August, showing the right landing gear collapsed

Source: Air Fraser Island, modified by the ATSB

Right main landing gear axle fracture (31 October 2019)

On 31 October 2019, VH-BFS was operated to Fraser Island to collect passengers returning to the mainland. The pilot^[2] was the sole occupant.

The pilot reported that the landing was normal with no excessive loads. During the landing roll on the beach ALA, the right main landing gear wheel separated from the aircraft. There were no reported injuries. Following the flight, fuel was observed to be leaking from the right wing. Queensland Parks and Wildlife Service personnel were in attendance and attempted to manage the spill (Figure 2).

Figure 2: VH-BFS where it came to rest on 31 October, showing the right main wheel separated from the aircraft.

Source: Queensland Police Service, modified by the ATSB

The operator’s LAME established that the right main landing gear had fractured at the axle, which is the attachment point for the main wheel to the landing gear. Another main landing gear assembly from the operator’s other GA8^[3] was fitted to VH-BFS, and the nose wheel axle bolt was replaced. The aircraft was subsequently returned to service.

__________   

1. The Air Fraser Island operations manual specified that beach aircraft landing areas were to be established in accordance with Civil Aviation Advisory Publication (CAAP) 92-1(1) (Guidelines for aeroplane landing areas). The CAAP recommended minimum physical characteristics of landing areas applicable to daytime operation of the GA8
2. VH-BFS was flown by different pilots on 24 August and 31 October 2019  
3. The operator’s other GA8, VH-BNX, was under maintenance at the time

Context

Operations on Fraser Island

Air Fraser Island primarily conducted scenic charter flights over Fraser Island, Queensland. This involved positioning aircraft from the mainland to Fraser Island in the morning and making multiple scenic flights daily from beach ALAs. The operator utilised two GA8 Airvans, a Cessna 172, and a Cessna 206 for these flights.

Since October 2017, the operator’s head of aircraft airworthiness and maintenance control (HAAMC) was a LAME who also maintained and certified their aircraft under a third-party maintenance approval.

The operator’s LAME advised that generally, each of their aircraft flew about 100 hours in a 7-week period and made 200–300 landings in that time. The operator’s safety manager advised that, on a busy day, pilots would conduct 20–30 take-offs and landings.

The majority of take-offs and landings were on beach ALAs that typically were below the high tide mark on sand that had been compacted by the receding tide. The physical characteristics of beach ALAs regularly exposed the aircrafts’ main landing gears to additional loads when compared to graded or sealed runways. The salt-laden and humid environment also increased the speed and severity of corrosion on the aircrafts’ metal components.

Aircraft information

General

The Gippsland Aeronautics GA8 Airvan (GA8) is a high-wing, all-metal, unpressurised aeroplane with a fixed tricycle landing gear. It has a single, reciprocating piston engine driving a constant speed propeller. The aircraft type first entered service in December 2000 and 262 aircraft were produced.

VH-BFS was manufactured and first registered in Australia in 2003. The aircraft had been in service with Air Fraser Island since that time. VH-BFS was being maintained in accordance with the GA8 service manual and held a current maintenance release at the time of both occurrences. At the time of the second occurrence (31 October 2019), VH-BFS had accumulated about 10,492 flight hours total time in service (TTIS).

Main landing gear and mounting description

The GA8 main landing gear legs were manufactured from machined and heat-treated 5160 steel tube. They passed through fittings in the fuselage main landing gear carry-through structure and then into mount fittings that were bolted to the main keel members. The legs were fixed to these fittings by eight NAS6606-12 close-tolerance bolts per side. These mount bolts screwed into a special nut, with eight threaded holes, and the special nut was nested inside the landing gear tubing. The main landing gear tubing incorporated a waisted section that was designed to twist when subjected to excessive loads, such as a runway overrun, rather than transmitting those loads to the airframe via the mounting bolts.

The manufacturer, Gippsland Aeronautics, advised that the original design for fixing the main landing gear leg into the mount fitting was with four mount bolts per side. During testing with this arrangement, the bolts were found to shear off (in overstress) from the forces placed upon them. The design was subsequently modified to have eight bolts before the aircraft type first entered service. The manufacturer was not aware of any subsequent failures of the bolts after the aircraft type entered service.

At manufacture, the eight mount bolts fixing each main landing gear leg, after being tightened to the correct torque, were secured in place with safety wire.

Safety wiring is a means of securing hardware (such as bolts) to prevent them from loosening during operation. Safety wiring is not a means of maintaining the torque of a bolt, but rather to prevent their disengagement. Safety wire is most commonly stainless steel, and after being threaded through pre-drilled holes in bolt heads, is twisted together either by hand or by using special pliers (Figure 3).

Figure 3: Examples of safety wiring of bolts

Source: US Federal Aviation Administration, modified by the ATSB

In-service experience showed that the GA8 landing gear mount bolts would loosen slightly due to the vertical and ratcheting forces on the main landing gear during take-off and landing. Access to the upper mounting bolts for removal, installation and safety wiring was limited by their proximity to the underside of the cabin floor (Figure 4).

Figure 4: GA8 main landing gear assembly showing the location of the mount fitting, mount bolts and axle

Source: Gippsland Aeronautics, modified by the ATSB

Soon after the GA8 entered service, the manufacturer made a design change so that a bolt retaining cap was installed over the mount fitting that covered the eight bolt heads. When installed, the cap ensured that the bolts could not wind out of the special nut and the bolt heads no longer needed to be safety wired. The design change was incorporated on the production line and could be incorporated as a non-mandatory modification to aircraft in service.

VH-BFS had not been fitted with the retaining caps on its landing gear at the time of the first occurrence (24 August 2019). Following the occurrence, when the aircraft was being repaired, the operator fitted a retaining cap on the left landing gear. No retaining cap was fitted to the right landing gear.

Main landing gear axle description

The main landing gear axles were manufactured from 4130 steel tube that was machined and welded. They were fixed to the main landing gear with two bolts (Figure 5). The axles incorporated a torque plate to attach the brake callipers.

The design specifications for the main landing gear axle assembly were progressively improved from the time the aircraft entered service. From October 2009 they included references to an internal Gippsland Aeronautics welding procedure that was intended to improve the integrity of the welded region between the axle and landing gear tube.

In response to a GA8 operator sustaining an in-service failure from fatigue cracking of a main landing gear axle, Gippsland Aeronautics issued service bulletin SB-GA8-2016-169 (Inspection of the Main Undercarriage Axle Assembly) in 2016. The associated issue was that cracks had been found to form on the upper side of the axle on the inboard side of the brake torque plate (Figure 5).

Figure 5: GA8 main landing gear axle assembly inspection areas

Source: Gippsland Aeronautics, modified by the ATSB

As a result of the initial service bulletin inspections identifying cracks in some instances, the service bulletin was re-issued to make it mandatory.^[4] The service bulletin was issued for a third time on 11 November 2016 to give operators time to comply with the non-destructive inspection requirements. That inspection was to be conducted no later than 11 February 2017 if the axle had accumulated 2,000 hours TTIS.

The ongoing inspection requirements in the SB included:

• Part B - every 100 +/-10 flight hours, a detailed visual inspection of the external inspection area using at least 10x magnification and visual inspection internally
• Part C - from 2,000 flight (axle) hours, and every 1,000 +/-10 hours afterwards, a magnetic particle inspection.^[5]

In both cases the main wheel, brake calliper and torque plate required removal and the inspection areas had to be cleaned with solvent to ensure they were free of contaminants and corrosion prior to commencing the inspection. The service bulletin also stipulated that the aircraft logbooks had to be certified showing the completion of the service bulletin.

Another requirement of service bulletin SB-GA8-2016-169 was to report the results of inspections by completing the included document compliance notice and returning it to the manufacturer. Gippsland Aeronautics advised that of the 262 production aircraft, 10 compliance notices had been received. None of those notices were for inspections conducted on VH-BFS or the operator’s other GA8 aircraft (VH-BNX).

Recent scheduled maintenance

Periodic inspections of VH-BFS were certified as being carried out in accordance with the GA8 service manual at intervals of 100 +/- 10 hours or 12 months, whichever came first. They included the requirement to carry out a general inspection of the main landing gear attachment to the aircraft structure and, from 2016, a special inspection associated with SB-GA8-2016-169.

Recent periodic and special inspections were documented as being conducted on VH-BFS on:

• 2 August 2019 at 10,263.7 hours TTIS (22 days and 61.8 flight hours before the landing gear collapse occurrence)
• 15 September 2019 at 10,362.3 hours TTIS
• 21 October 2019 at 10,464.5 hours TTIS (10 days and 27.4 hours before the axle fracture occurrence).

Right main landing gear history

The right main landing gear involved in both of VH-BFS occurrences in 2019 was fitted to the aircraft following another occurrence in 2009 where the right wheel and brake calliper separated in flight due to a previous axle failure (see Previous right main landing gear axle failure (21 June 2009) in this report for further details). Based on the available evidence, the ATSB was unable to establish if the replaced landing gear was new or a part-life item at the time it was fitted in 2009.

The operator’s LAME advised that they began carrying out maintenance on VH‑BFS in October 2017 at 9,125.1 hours TTIS. They stated that the previous maintenance provider informed them that all the required inspections had been carried out. The LAME also reported that they expected the SB-GA8-2016-169 magnetic particle inspection (MPI) requirement to be due at 10,025.1 hours TTIS (900 flight hours after taking over the maintenance), but about that time experienced issues with their computer-based maintenance scheduling. That resulted in the most recent MPI of the main landing gear axle, as required by SB-GA8-2016-169, not being carried out.

At the time of the axle fracture occurrence (31 October 2019), VH-BFS was about 470 flight hours overdue for that inspection based on the statement from the operator’s LAME. Further, the ATSB’s examination of the aircraft maintenance documentation did not identify any previous occasion when the axle had an MPI conducted, including the initial inspection that was to be carried out no later than February 2017. MPI inspections were carried out on the operator’s other GA8, VH-BNX, in July 2017.

Examination of recovered components

Main landing gear mounting hardware

Initial inspection by maintenance personnel

The worksheet completed for the recovery of the aircraft following the 24 August 2019 occurrence indicated that the bolts had sheared during landing and that an aircraft inspection was carried out. The LAME advised that:

• three bolt remnants consisting of bolt heads and part of their shanks were found in the keel of the aircraft, safety wired together
• the other five bolt heads with partial shanks were unable to be located, possibly lost during the repair activity
• the special nut used to secure the landing gear leg was lost during the repair activity.

Therefore, only three bolt heads with partial shanks were available for inspection.

Detailed examination of the remaining mounting hardware

The ATSB conducted a technical examination of the three main landing gear mount bolt remnants that were recovered (Figure 6). A summary of the examination is as follows:

• Manufacturing stamps and measurements indicated the bolts were the right type and fit for purpose.
• There were no pre-existing defects with the bolts.
• There was no evidence of cracking, and there were shear lips present on all three bolts. Their fracture surfaces were consistent with shear overstress^[6] from a single event.

Dimensional examination of the bolt remnants showed it was likely that all three bolts were correctly tightened, and that the fractures occurred at the interface between the landing gear leg and its mount fitting.

There was no physical evidence provided to determine if the five missing bolts had sheared in the same way as the three bolts recovered, or if they had wound out of the special nut so that the three bolts provided had supported the landing gear shear loads.

Figure 6: The three recovered main landing gear mount bolt heads with partial shanks

Source: ATSB

Main landing gear axle assembly

Examination of photographs

Examination of photographs taken immediately after the main landing gear axle fracture occurrence on 31 October 2019 showed that significant amounts of pre-existing contamination existed at the axle inspection area, and that one of the mount guides on the brake calliper torque plate had broken off at an unknown time prior to the occurrence (Figure 7).

Figure 7: VH-BFS right main wheel, brake and axle taken just after 31 October 2019 occurrence

Source: Queensland Police Service, modified by the ATSB

Figure 8 shows dark and light areas across the axle fracture surface. Analysis of the photograph by materials failure specialists assessed the darkened areas as being pre-existing areas of fracture and the brighter areas, such as the area labelled as the ‘axle lower doubler’, were overstress in nature. Based on that evidence, the axle weld was cracked around about two thirds of the circumference. The remaining structure failed in overstress during the landing occurrence. 

Figure 8: VH-BFS right main landing gear axle failure taken just after 31 October 2019 occurrence

Source: Queensland Police Service, modified by the ATSB

Detailed examination of the axle fracture

The right main landing gear leg and axle were provided to the ATSB for examination (Figure 9). A summary of that examination is as follows:

• There was low weld penetration (less than 1 mm) in some areas.
• The axle assembly was fractured in the area known to crack as described in SB-GA8-2016-169. However, smearing^[7] and corrosion at the fracture surface prevented a determination on the degree of fatigue present prior to the occurrence.
• The axle assembly lower doubler had failed in overstress.
• There was paint missing on the leg and axle assembly with darker corrosion visible, likely present prior to the occurrence.
• Corrosion pitting was present on the fracture surface opposite the doubler, suggesting pre-existing damage.
• A secondary crack was found opposite the doubler, near the region of corrosion pitting.

Figure 9: VH-BFS right main landing gear axle after cleaning

Source: ATSB

Other noted defects

The ATSB identified that the right torque plate that located the brake calliper on the axle was significantly corroded and had a section of the brake calliper guide missing. The extent of the corrosion at the missing calliper guide indicated that it had been missing for an extended period.

Previous right main landing gear axle failure (21 June 2009)

On 21 June 2009, while travelling from Harvey Bay and during descent to Fraser Island, VH-BFS sustained a fracture of the right main landing gear axle assembly, resulting in separation of the wheel and brake calliper. The aircraft was diverted to Maryborough, Queensland, where it landed safely on the remaining portion of the axle.

To assist its investigation of the occurrence, the Civil Aviation Safety Authority (CASA) requested the assistance of the ATSB in the metallurgical examination of the fractured landing gear leg. The ATSB conducted that examination as an investigation under the Transport Safety Investigation Act 2003 (see AE-2009-045 for details).

The ATSB examination concluded the following [emphasis added]:

As a result of gross abrasion sustained during the aircraft landing, the amount of material lost from the leg attach fracture surfaces (including the doubler from the underside of the axle assembly) precluded an accurate determination of the failure mechanism.

Considering the assembly design, the fillet weld would likely have been the region of highest stress in the axle assembly and therefore, in the absence of material or manufacturing defects, it is probable that the fracture would have originated and progressed through the weld along its full path.

The onset of failure under low nominal stress conditions, that is, during flight, suggested a progressive or fatigue-type mechanism, rather than a gross transient overload event. However, there was no evidence of fatigue on the remaining fracture surface.

Future increased examination vigilance and possible enhanced inspections of the leg attach sleeve welds of other GA8 aircraft is suggested in view of the nature of the failure sustained.

__________

4. As the operator was maintaining its GA8 aircraft in accordance with the manufacturer’s maintenance schedule, it was required to comply with additional maintenance requirements, such as mandatory service bulletins
5. Magnetic particle inspection (MPI): a non-destructive inspection process for detecting flaws in ferrous metals. It requires specialist equipment and personnel who are trained and approved to carry out this work.
6. Overstress failure: occurs when the loads applied to a component exceed the strength of its material. Shear overstress failures occur on a plain parallel to the direction of the applied loads.
7. Deformation of the fracture surface that occurred as the axle failed.

Safety analysis

Introduction

On two occasions in 2019, while conducting a landing on a beach aeroplane landing area (ALA), VH-BFS sustained failures of the right main landing gear. In the first occurrence, the right landing gear collapsed, and in the second the right main wheel separated from the aircraft due to an axle fracture. There were no reported injuries from either occurrence.

This analysis will discuss the likely failure modes involved in each occurrence and maintenance issues that were identified during the investigation.

Right main landing gear collapse (24 August 2019)

Landing gear mount bolt shear forces

Figure 10 shows an illustration of the eight mount bolts that are designed to secure the landing gear to the airframe structure. The bolts pass through the airframe fitting, into the landing gear leg and then they are retained by a special nut with eight threaded holes. The illustration also indicates the point of intersecting forces or loads applied by the airframe against forces applied by the landing gear. These forces are in shear and the point of intersection is the location where the three provided bolts sheared in overstress.

Figure 10: Main landing gear leg, mount fitting and special nut

Source: Gippsland Aeronautics, modified by the ATSB

Scenarios to explain the overstress failure of the recovered bolts

Technical analysis of the three provided landing gear mount bolt remnants were of the appropriate specification and they had no pre-existing defects. The fracture surfaces showed they had sustained an overstress failure due to shear loads.

The ATSB considered two possible scenarios with regards to the 24 August landing gear collapse:

• the shear overstress failure of all eight mount bolts due to significant landing loads
• the migration and release of five mount bolts that were not safety wired and the overstress failure of the three remaining bolts during normal landing loads.

Possible overstress failure of all eight bolts

The operator’s LAME indicated that all eight mount bolts had failed in shear overstress during the landing. Apart from the three sheared bolt head remnants, the LAME was unable to provide any additional photographic or physical evidence to support that scenario; instead reporting that the five other sheared bolt remnants and the special nut were lost during repair activity. The LAME was unable to recall the circumstances regarding the removal of the eight bolt shanks and their threaded portions during the repair activity, and their subsequent whereabouts was not supplied.

In a scenario where all eight bolts fail in shear overstress, their shanks and threaded portion should retain the special nut in the landing gear leg, and the bolt heads should still be safety wired together, at least in pairs. Evidence such as the five missing bolts, the remaining threaded bolt shanks, and the special nut would have provided supporting evidence to show that all eight bolts were fitted and secure at the time of the 24 August occurrence. However, the only supporting evidence was the LAME’s statement.

Possible migration of five unsecured bolts

Evidence to support the migration of five bolts that were not safety wired was as follows:

• The aircraft manufacturer reported that there have not been any taxi, take-off or landing incidents or accidents where all the landing gear bolts had sheared in overstress.
• The manufacturer designed the landing gear to twist and deform at a waisted section during hard landings before landing loads were significant enough to deform the airframe and shear the mount bolts. VH-BFS’s landing gear was not twisted at the waisted section and was refitted to the aircraft during the repair activity.
• The manufacturer reported that, during pre-production testing, the original installation of four mount bolts would shear in overstress rather than deform the landing gear leg. Therefore, an aircraft with four or less bolts fitted would likely shear those bolts.
• The landing was reported to have been normal with no excessive loads.
• There was no physical or photographic evidence available to show that the five bolts had sheared in overstress.
• The bolts examined were the correct type and fit for purpose.

ATSB analysis of the two scenarios

In the absence of a hard/abnormal landing, it would be unlikely for all eight mount bolts to fail in shear overstress provided they were all secured, the correct type, and fit for purpose. Further details about the recovery, repair and the replacement of parts requested by the ATSB was not forthcoming. Therefore, the ATSB could not assure itself that the LAME’s account was entirely accurate.

The ATSB considered that, based on the available evidence, it was probable that the landing gear was not secured by all eight bolts prior to landing. It was also considered probable some bolts were not safety wired to ensure that they could not migrate out during numerous landing and take-off cycles. The replacement of the landing gear in 2009 due to the previous axle failure was at least one point in time where the bolts were removed and refitted with the possibility that they were not resecured by safety wire.

Access to the upper mounting bolts for safety wiring is limited by their proximity to the underside of the cabin floor. However, removal of this requirement could have been accomplished by retrofitting a main landing gear mount bolt retaining cap.

Each periodic (100 hourly) inspection required the examination of the landing gear securing points, which included the eight mount bolts. It was estimated that at least six periodic (100-hourly) inspections were conducted on VH-BFS every year. Each of those inspections provided an opportunity to identify an underlying issue with the security of the landing gear before it progressed to the point of failure.

Right main landing gear axle fracture

Landing gear axle examination

Technical analysis of axle fracture surfaces showed that a fatigue crack formed and propagated undetected around two thirds of the axle circumference along the weld and eventually failed in a weakened state during a normal beach landing. Examination of the weld points on the axle indicated that there was a low weld penetration at the axle attach sleeve. A combination of low weld penetration, operations on uneven beach ALAs and high landing cycles in a highly corrosive environment may have increased the crack initiation and propagation rate. Corrosion pitting inside the fracture surfaces indicated that the crack had been present for a significant period of time.

The age of the right main landing gear from VH-BFS was not able to be established, however the low weld penetration at the axle attach sleeve suggests that it pre-dated the specification change in October 2009, when greater definition was added to the welding procedure by the aircraft manufacturer.  

Maintenance aspects related to the axle failure

The ATSB’s investigation into the axle failure of VH-BFS in 2009 recommended increased examination vigilance and possible enhanced inspections of the leg attach sleeve welds.

The manufacturer was aware of the possibility of fatigue cracks forming in axle attachment sleeves from the 2009 occurrence, and later in 2016 via in-service data gathered during the compilation of service bulletin SB-GA8-2016-169. The resulting mandatory requirements of this service bulletin were designed to identify fatigue cracks before they propagated to the point of failure. The fatigue cracking on the right axle of VH-BFS was located in the inspection area described in service bulletin SB-GA8-2016-169.

The service bulletin required detailed visual inspections in the area of the fatigue crack with a 10x magnifier every 100 hours, and a magnetic particle inspection (MPI) every 1,000 hours. The visual and MPI inspections required the removal of the main wheels, the brake callipers and torque plates for access, and the area had to be cleaned prior to inspection. Following each examination, a maintenance log entry was required to show that the examination was completed in accordance with the service bulletin and certified by appropriately licensed maintenance engineers.

Since February 2017, the aircraft had a periodic (100 hourly) inspection, which included the service bulletin, about every 7 weeks, with the last one being about 27 flight hours prior to the occurrence.

In accordance with the maintenance schedule, a calculation of aircraft hours and dates indicated that two MPIs should have been carried out on the aircraft since February 2017. The ATSB could not find any documented evidence to indicate that the initial MPI had been carried out, however an MPI was carried out on the operator’s other GA8 in July 2017. The operator’s LAME cited issues relating to maintenance scheduling software as a reason for the overrun of the second scheduled MPI.

Additionally, there was significant amount of pre-existing contamination at the axle inspection area. This indicated that required cleaning of the inspection area had not been conducted for an extended period, which reduced the likelihood of identifying cracks in the inspection area.

Each of the scheduled MPI and visual inspections represented an opportunity to identify a pre-existing crack in the axle area prior to failure. The ATSB concluded that a detectable crack would very likely have been present in the axle over numerous periodic inspection periods.

The operator was routinely operating from beach landing areas with increased loads on the landing gear, was aware of the axle failure of VH-BFS in 2009 and, later, the mandatory inspection requirements of SB-GA8-2016-169. However, it did not place appropriate emphasis on ensuring the continuing airworthiness of the landing gear of its GA8 fleet.

Landing gear maintenance procedures

Scheduled maintenance is designed to capture irregularities well before they can manifest into failures. More specifically, both issues that led to the landing gear failures involving VH-BFS were known to the aircraft manufacturer and had been mitigated by scheduled and special inspections. The ATSB considered that the manufacturer’s maintenance schedule, requirements and documentation, if followed correctly, were sufficient to identify the associated issues before they become incidents or accidents.

Operating aircraft on beach ALAs exposes them to increased loads on the landing gear, as well as also exposed the aircraft to sand and a salt-laden environment. Accordingly, operators conducting such operations on a routine basis should consider the options available for improving the resilience of their landing gear. In addition, they should ensure that all minimum maintenance inspections and requirements are being conducted at the specified frequency, and even consider whether to conduct them more frequently.

As a result of investigating these two occurrences, the ATSB identified that the relevant inspections of the landing gear did not appear to have been conducted at the inspection intervals required. More specifically:

• Each 100 hourly / periodic inspection required the examination of the landing gear securing points, which included the eight mount bolts. It was estimated that at least six periodic (100-hourly) inspections were conducted on VH-BFS every year. Each of those inspections represented provided an opportunity to identify an underlying issue with the security of the landing gear before it progressed to the point of failure (on 24 August 2019).
• Each of the scheduled visual and MPI inspections represented an opportunity to identify a pre-existing crack in the axle area prior to the failure (on 31 October 2019). However, the available evidence indicates two required MPIs since February 2017 were not conducted. In addition, a detectable crack would very likely have been present in the axle over numerous periodic inspection periods, and the amount of contamination in the axle inspection area meant that at least some of the visual inspections would not have been able to be effectively conducted.

The operator was aware of the previous axle failure involving its aircraft in 2009 and was aware of the service bulletin. Both occurrences involving VH-BFS highlight the importance of ensuring scheduled maintenance is carried out at the appropriate times and in accordance with the required maintenance data.

In summary, based on the available information, the ATSB concluded that the operator did not place appropriate emphasis on ensuring the continuing airworthiness of the landing gear of its GA8 fleet.

The manufacturer’s ability to improve maintenance requirements relies partly on the provision of in-service data for analysis. SB-GA8-2016-169 incorporated an ‘inspection result compliance notice’ and, from 262 production aircraft, there have been only 10 responses. This represented a missed opportunity for the manufacturer and operators to obtain important ongoing airworthiness information.

Findings

From the evidence available, the following findings are made with respect to the landing gear failures involving a GA8 Airvan, VH-BFS, on 24 August and 31 October 2019.

Contributing factors

• It is probable that a number of the eight right main landing gear mount bolts had migrated out of the special nut undetected and over an extended period. The three remaining bolts failed in overstress, resulting in the gear leg collapsing during a normal beach landing on 24 August 2019.
• Recent maintenance inspections specific to the security of the landing gear attachment had not detected issues related to the migration of the right main landing gear mount bolts. It is probable that the mount bolt migration would have been apparent during one or more inspections.
• There was low weld penetration at the right main landing gear axle attach sleeve, which likely resulted in a fatigue crack forming, then propagating undetected and eventually failing during a normal beach landing on 31 October 2019.
• It was likely the axle cracks were present, and detectable visually, when last inspected 27 flight hours before the 31 October 2019 occurrence.
• The axle inspection area had surface contamination and corrosion that indicated the requirement for cleaning prior to inspection had not been conducted for an extended period, thereby decreasing the likelihood of identifying cracks by visual means.
• The most recent mandatory service bulletin SB-GA8-2016-169 requirement for a magnetic particle inspection (MPI) of the axles had not been carried out and was about 470 flight hours overdue at the time of the 31 October 2019 axle failure.
• The operator did not place appropriate emphasis on ensuring the continuing airworthiness of the landing gear of its GA8 fleet, although being aware of:
  • the increased loads on the landing gear when routinely operating from beach landing areas up to 20–30 times daily, and being subjected to a salt-laden and humid environment
  • the axle failure of VH-BFS in 2009
  • the mandatory inspection requirements of service bulletin SB-GA8-2016-169. (Safety issue)

Other factors that increased risk

• Although not mandatory, the operator had not retrofitted main landing gear mount bolt retaining caps on the landing gear of VH-BFS. Such retaining caps would have prevented the possible scenario of the main landing gear mount bolts becoming loose and thereby reducing the integrity of the main gear leg.
• A requirement of service bulletin SB-GA8-2016-169 was to report the results of inspections by completing the document compliance notice and returning it to the manufacturer. Of the 262 production aircraft, 10 compliance notices had been received. This represented a missed opportunity for the manufacturer and operators to obtain important ongoing airworthiness information.

Safety issues and actions

Maintenance processes for landing gear

Safety issue number: AO-2019-045-SI-01

Safety issue description: The operator did not place appropriate emphasis on ensuring the continuing airworthiness of the landing gear of its GA8 fleet, although being aware of:

• the increased loads on the landing gear when routinely operating from beach landing areas up to 20–30 times daily, and being subjected to a salt-laden and humid environment
• the axle failure of VH-BFS in 2009
• the mandatory inspection requirements of service bulletin SB-GA8-2016-169.

Sources and submissions

The sources of information during the investigation included the:

• pilot of the occurrence flight and another pilot who conducted flights for the operator
• chief pilot of Air Fraser Island
• Civil Aviation Safety Authority
• Queensland Police Service
• aircraft manufacturer
• maintenance organisation for VH-BFS at the time of the occurrences
• witnesses
• photographs taken on the day of the accident.

References

ATSB external investigation AE-2009-045, Engineering examination into the fractured main landing gear axle Gippsland Aeronautics GA-8 Airvan, VH-BFS, 21 June 2009, Australia.

Gippsland Aeronautics, Model GA8 service manual amendment 12, 15 May 2018.

Gippsland Aeronautics, Service Bulletin SB-GA8-2016-169 issue 3, Inspection of the Main Undercarriage Axle Assembly.

Federal Aviation Administration (1998), Advisory circular AC 43.43-1B, Acceptable methods, techniques, and practices – aircraft inspection and repair.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the pilots of the occurrence flights and another pilot who conducted flights for the operator
• the chief pilot and safety manager of Air Fraser Island
• the Civil Aviation Safety Authority
• the aircraft manufacturer
• the maintenance organisation for VH-BFS at the time of the occurrences.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

At approximately 0030 on 21 August 2019, freight train 4WM2 operated by Pacific National stopped at signal W26U near Waterfall, New South Wales. The train crew consisting of driver A and B were directed by the Waterfall Signaller at 0200 to remarshal the train. The train could not continue and was required to return to Coalcliff to clear the main line. The train consisted of three locomotives and a rake of 50 wagons.

Remarshalling the train required one of the drivers to enter the danger zone to apply hand brakes on the wagons. Driver A requested safeworking protection from the Waterfall Signaller before entering the danger zone. Driver A walked the length of the train applying hand brakes before returning to the locomotives.

The locomotives were detached and operated to Waterfall, before travelling to Helensburgh and returning to the stabled wagons near Waterfall.

On arrival at the stabled wagons, driver B requested safeworking protection from the Waterfall Signaller. Driver B entered the danger zone to release the hand brakes from the stabled wagons. At about 0417, driver A signalled (hand signals and red marker lights) to the driver of an approaching passenger train (404A) to stop. The train was travelling on the adjacent track towards driver B in the danger zone and the driver of 404A made an emergency brake application to stop the train. The train stopped before arriving at the location driver B and there were no physical injuries.

What the ATSB found

The safeworking network rule and procedure for protecting activities associated with in-service rail traffic were not used effectively to ensure workers were protected from rail traffic. The requests for protection were informal and did not detail the required activities or protection. Both drivers of 4WM2 unknowingly entered the danger zone without appropriate protection and were at risk of being struck by rail traffic.

There were multiple parties involved in the communication and decision making relating to the movements of 4WM2. This led to confusion and misunderstanding of the required activities and likely affected the actions of the Waterfall Signaller and train crew. Additionally, not all communications were conducted in accordance with the network rules.

What has been done as a result

The train crew and Waterfall Signaller underwent re-training and assessment before returning to rail safety work.

Sydney Trains reviewed the risk management processes applied by network operations and the processes relating to incident management. Pacific National reviewed the processes for protecting in­­‑service rail traffic and reinforced the requirements with train crew. 

Safety message

Rail infrastructure managers and rail transport operators must ensure that safety critical communication is conducted in accordance with network rules. Additionally, network controllers should consider the potential dangers train crews are exposed to before requiring them to enter the danger zone.

Workers must ensure they have appropriate safeworking protection in place before entering the danger zone and are protected from rail traffic. Workers must also ensure that rest periods are utilised to manage non-work related fatigue.

The occurrence

On 20 August 2019, Pacific National (PN) were operating freight train 4WM2 between Port Kembla, New South Wales and Melbourne, Victoria.

At approximately 0030,^[1] on 21 August 2019, the crew consisting of a driver A and driver B stopped at signal W26U near Waterfall, New South Wales. The Sydney Trains’ Waterfall Signaller (WS) advised the crew of train 4WM2 that they would be held at the signal due to a track fault in the adjoining network.^[2]

At 0158, the Train Services Delivery Manager (TSDM)^[3] Freight advised the WS that train 4WM2 could not proceed and the train would need to remarshal.^[4] The WS relayed the directive to the crew of 4WM2 to remarshal the train so the train could move to Coalcliff, clear of the main line.

Driver A contacted the WS at 0209 and requested safeworking protection stating ‘just wondering if we can get a block^[5] on the Down^[6] there please over’. The WS responded with ‘yeah, sure there driver, standby…ok driver I have secured points out of the Up refuge and on the main line and given you two signals at stop with blocks applied’. Driver A contacted the WS again at 0224, to confirm that protection was in place and was advised ‘yeah got blocks on up here on the city side of your train on the Down signals’.

Between approximately 0220 and 0319 driver A walked in the six-foot^[7] to manually apply the hand brakes on the wagons and to divide the locomotives from the rake.^[8] At 0320, the crew of 4WM2 requested the block to be removed and permission to shunt the locomotives towards Waterfall.

At 0321, the WS contacted the Wollongong North Panel Area Controller (WNP) to advise of the plan to run 4WM2 to Helensburgh before returning and attaching to the stabled wagons. 

The three locomotives departed Waterfall platform at approximately 0332, crossing from the Up Illawarra main line to the Down Illawarra main line to travel to Helensburgh in the Down direction.

The WS contacted the WNP at 0345, to discuss the progress of 4WM2 and make arrangements for managing approaching Up passenger service 404A. The WS and WNP determined that 404A could cross from the Up Illawarra and travel in the Up direction on the Down Illawarra.

At approximately 0359, the three locomotives departed Helensburgh station towards the rake of wagons in the Up direction on the Up Illawarra.

The WNP contacted the driver of 404A at 0409:12, to advise that they would cross to the Down Illawarra as there was a freight train remarshalling near the Waterfall accept signal (W26U).

At 0409:40, driver B contacted the WS requesting safeworking protection stating ‘We’re about to attach to our train again, can I please get a block on the Down? Over’. The WS responded with ‘Yeah I’ve got blocks on the Down and blocks on the Up. So we’ve taken away control from north panel [WNP] and there’s blocks on the Down’.

Following the communication with WS, driver B entered the danger zone^[9] on the Down main to reattach the locomotive. Driver A changed ends while driver B walked in the six-foot to release the hand brakes on the wagons.

At 0417:28, driver A called driver B on the radio to warn that they had stopped an approaching passenger train that was travelling towards their location (Figure 1). Driver A then contacted the WS to advise there was worker in the danger zone releasing the hand brakes when the passenger train approached. At the same time, the driver of 404A contacted WNP to advise that the crew of the freight train signalled 404A to stop. The driver of 404A confirmed the train was stopped and was requested to remain stationary until the WNP advised.

Figure 1: Location map

Source: Geoscience Australia and OpenStreetMaps, annotated by OTSI

Train 404A departed the location at 0423 after receiving authority and confirmation that driver B had moved clear of the Down Illawarra main line. Blocking facilities were applied following the departure of 404A to provide protection to driver B to release the hand brakes.

At 0505, 4WM2 departed towards Coalcliff with the crew relieved at 0525 at Helensburgh Station.

The WS was subjected to post incident drug and alcohol testing returning negative results for both tests. Neither driver reported the incident to PN’s Integrated Planning Services (IPS) before completing their shift, as such, post incident drug and alcohol testing was not conducted. 

______

1. Times shown in 24 hour time as Australian eastern standard time (AEST).
2. A track circuit fault within the Australian Rail Track Corporation (ARTC) network prevented freight services continuing through the Sydney Trains network. Freight services must be clear of the main line prior to the morning peak to avoid delaying passenger services.
3. See page 7 for a description of the roles and responsibility of the Train Service Delivery Managers.
4. Remarshal refers to changing the order of locomotives or wagons in a train’s consist.
5. Block refers to a method of safeworking protection, see page 10.
6. The Down track refers to the direction of travel for trains heading away from Sydney, the Up track refers to trains heading to Sydney.
7. The six-foot refers to the spacing between two adjacent lines, in this case the Up and Down Illawarra main lines.
8. Rake refers to vehicles, usually not formed as a train, moved as a unit during shunting and marshalling.
9. Danger zone, any area within 3 m horizontally and either above or below the outer most rail, unless constantly in a safe place.

Context

Train information

4WM2

Train 4WM2 was operating between Port Kembla and Melbourne at the time of the incident. The train consisted of three locomotives and a rake of 50 wagons. The total length was 925 m with a trailing mass of 3618 t.

Train radio

At the time of the incident train 4WM2 was not fitted with a compatible digital train radio system (DTRS), preventing the driver communicating with or broadcasting an emergency call to alert the driver of train 404A. The train radio at the time was operating on the National Train Communications System (NTCS).

PN advised the train radio software was updated across their fleet as of December 2019, as part of the Transport for NSW DTRS project.^[10] The revised train radio software allows freight drivers to initiate an emergency call that can be heard by passenger trains nearby. Direct communication is still not possible between freight and passenger trains without assistance from the signaller.

404A

Train 404A consisted of a four car Oscar operated by NSW Trains between Kiama and Central station. This service was scheduled to stop at Helensburgh at 0411 and Waterfall at 0419.

The driver of 404A was advised that they would crossover at Helensburgh to travel on the Down Illawarra in the Up direction. The driver operated the train as expected and stopped in response to the crew of 4WM2.

Location

The incident occurred between Waterfall and Helensburgh. The Up and Down Illawarra main lines operate with Rail Vehicle Detection (RVD) and both permit bi-directional running. The rail corridor runs through the Garawarra State Conservation Area and the track consists of steep cuttings, embankments and areas of cleared land based on the topography (Figure 1). The area is remote with no artificial lighting excluding train lighting or hand-held torches.

The crew of 4WM2 were advised to remarshal the train while stationary at signal W26U, located in a steep cutting at 40.191 km.^[11] The train length of 925 m positioned the rear of the consist at approximately 41.116 km (Figure 2).

The gradient between Waterfall and Helensburgh varies between 1 in 76 and 1 in 165. The location at which 4WM2 was required to remarshal varied between 1 in 80 and 1 in 165.  The crew were concerned about leaving the wagons on the grade so applied more than the required minimum of 50 per cent hand brakes for this grade. A total of 40 hand brakes were applied from the six-foot to hold the wagons on the grade before detaching the locomotives. The hand brakes could not be applied from the cess^[12] due to the cutting and ballast shoulder.

Following the remarshalling, the lead locomotive was positioned at approximately 41.182 km on the Up Illawarra. Driver B had walked approximately 300 m along the consist when contacted to advise that train 404A had been stopped.  

Figure 2: Position of 4WM2 before and after remarshalling

The image on the left shows the position of 4WM2 (orange) before remarshalling. The image on the right shows the position of 4WM2 (orange) after remarshalling and the approximate location of driver B and 404A (red) when stopped. Source: SixMaps, NSW Spatial Services, annotated by OTSI

At Waterfall there was a stabling yard for passenger trains located on the Down (eastern) side of the station. On the Up (western) side of Waterfall station, there were a number of sidings (Up yard) available for goods (freight) trains as below with siding length:

• Up refuge loop - 867 m
• Up goods loop - 711 m
• 1 Up siding - 239 m
• 2 Up siding - 251 m.

The gradient in this area varies between 1 in 120 and 1 in 220 and the area is close to suburban Waterfall with some artificial lighting.

Directly involved persons  

Waterfall Signaller

The WS had performed the role of a signaller since late 2011 and was qualified to operate Waterfall signal box. The signaller had undergone routine assessments relating to safety critical communications^[13] with the two most recent assessments completed on 19 February 2019 and 1 May 2019.

The WS’s duty periods for the 2 weeks prior to the incident on the morning of 21 August are shown in Table 1. The WS had worked seven out of eight days leading up to the occurrence, with the previous day off on 15 August after completing a night shift. The WS was on their fifth shift and second nightshift when the incident occurred.

Table 1: Actual duty times for the WS over the previous 14 days

The WS reported that when not working a night shift, they would get about 7–8 hours sleep at night. Following a night shift (ending at 0600) they would normally sleep for about 4–5 hours in the morning and then also sleep for 1.5–2 hours in the evening. They noted that their sleep during the day was never as deep or restorative as sleep at night, and they did not always achieve this planned amount of sleep.

The WS advised that they had been experiencing some personal stress relating to caring for a family member. This had been an ongoing issue for a number of months leading up to the occurrence and had required varying and unpredictable levels of attention, and that these issues had resulted in regular disrupted sleeping patterns and had presented some difficulties at times during work hours.

The WS could not recall the exact amount of sleep they obtained during the day on 20 August (following the night shift that ended at 0600). They reported they had cared for their family member during the day on 20 August, and they probably felt a bit tired, distracted and stressed. The WS advised they had considered taking the night shift off (20 August) but felt that this would impact Sydney Trains operations and thought that they could still complete their role effectively, noting that night shifts are typically less busy than a day shift. The WS also advised that it was their perception that reporting issues with fatigue or personal matters that could influence their performance could be detrimental to the security of their employment.

Sydney Trains had a fatigue management system that included the provision of rostered duty periods and periods off duty that provided rest opportunity. It also evaluated planned rosters using a bio-mathematical model of fatigue (BMMF), and the predicted scores for the WS’s roster using this model were below the limits it had set for a signaller’s roster.

Driver A

Driver A had approximately 30 years’ experience within the rail industry and was a qualified driver trainer. On the night, driver A was conducting a route verification of competence (VOC)^[14] of driver B.

Both drivers of 4WM2 commenced their shift at 1745 on 20 August at the Sydney Freight Terminal (SFT) for a rostered shift of 9 hours 37 minutes. Delays to the journey of 4WM2 extended both drivers shifts beyond their rostered finish time of 0322. Driver A finished at 0655 (13 hours 10 minutes) and driver B finished earlier at 0612 (12 hours 36 minutes) as they elected to take a taxi home.

The roster for driver A in the week prior to the incident is shown in Table 2. They were on their third shift in a row on the night of the occurrence.

Table 2: Actual duty times for driver A over the previous 7 days

Driver A reported that following a night shift they would normally sleep until midday and then also normally sleep for a couple of hours in the afternoon or evening prior to the next shift. The driver reported having a nap prior to commencing on 20 August but could not recall the exact amount of sleep. Driver A advised that they felt fine when they commenced on the night of the occurrence although probably felt a bit tired as the shift progressed. At the time, driver A’s commute was about 1-1.5 hours each way.

Driver B

Driver B had approximately 15 years’ experience operating trains in Australia and overseas and transferred to PN from another Australian operator in early 2018. Driver B was not qualified to operate the route and was under observation of driver A.

The roster for driver B in the week prior to the incident is shown in Table 3. They were on their second shift in a row on the night of the occurrence.

Table 3: Actual duty times for driver B over the previous 7 days

Driver B reported that they typically sleep around 8 hours when not on night shift. The driver advised that they would try to have a nap around 1400 and sleep for a 2-3 hours prior to a night shift but may not always have a nap. Driver B could not recall if they had napped or the amount of sleep prior to commencing on 20 August but advised that they felt pretty good when signing on. The driver advised that they probably felt a bit tired during the wait period at signal W26U. At the time, driver B’s commute was about a 1 hours each way.

Network operations

Sydney Trains as the rail infrastructure manager (RIM) is responsible for the safe operation of rail traffic across their network. Within the Sydney Trains Rail Operations Centre (ROC) there are a number of roles that assist co-ordinating movements of trains through the network and responding to incidents.

Train Service Delivery Manager

There are seven TSDMs within the ROC with each TSDM responsible for a defined network area, the boundaries for the relevant TSDMs are:   

• Main – Central to Emu Plains, Richmond, Olympic Park and the City Circle
• North – Sydney Terminal to Berowra via Strathfield and Central to Hornsby via North Shore
• Central Coast – Berowra to Hamilton
• Illawarra – Bondi Junction to Waterfall (yard limit^[15] inclusive) and Central to Macarthur, Merrylands and Lidcombe
• South West – Bomaderry to Waterfall (yard limit exclusive) and Lithgow to Emu Plains
• Freight – Monitors freight operations across the entire Sydney Trains network and liaises with the relevant TSDM to advise of any issues involving freight
• Desk – assists other TSDMs with administrative functions and relieves for rest breaks.

The TSDMs are responsible for planning and monitoring train movements, developing, implementing and co-ordinating alternative train working during service disruptions.

The TSDMs liaise with the various signalling staff within the area of their control to advise of changes to standard working or in response to an incident. The Illawarra, South West and Freight TSDMs were all involved in communication relating to the movements of 4WM2 at different stages through the night.

Train 4WM2 stopped at signal W26U which was the yard limits for Waterfall and within the boundary of the TSDM Illawarra.

Network Incident Manager

There are three Network Incident Managers (NIM) within the ROC responsible for monitoring the rail network, operationally leading and managing the response to incidents on the network. The NIMs manage a defined area with each NIM covering the following TSDM areas;

• North – Main, North and Central Coast
• South – Illawarra and South West
• Desk – assists North and South NIMs with administrative functions, relieves for rest breaks and responding to incidents and disruptions.

Duty Control Manager

The Duty Control Manager (DCM) forms the central functional and strategic operational lead within the ROC. The TSDMs and NIMs both report to the DCM.

Network rules

Sydney Trains requires that activities completed within their network are completed in accordance with their network rules and procedures. These rules apply to all rail transport operators (RTO) while within the Sydney Trains network.

Network communications

Communications within the rail network must be completed in accordance with the relevant network rules, procedures and standards. Network rule NGE 204 Network communication prescribes the rules for spoken and written communication within the Sydney Trains network. The principles of NGE 204 are that network communication must be:  

• Clear, brief and unambiguous
• Relevant to the task at hand
• Agreed to its meaning before acted upon.

Communication must also be confirmed to ensure that the messages were received correctly if the message relates to safety critical information including:

• a Condition Affecting the Network (CAN)
• a Proceed Authority
• an instruction not to proceed
• a work on track authority
• a work on track method
• work on track Train Running Information
• Special working.

Persons completing safety critical communications must not assume the receiver understands the message before the receiver confirms they understood the message. If the meaning of spoken communication is not understood, the receiver must ask for it to be repeated.

If a person cannot communicate directly with an intended receiver, a message may be relayed to the receiver by a qualified worker.^[16] The message must be relayed exactly as received.

It is also a requirement that if recorded communication devices are available, they must be utilised when communicating safety critical information.

Monitoring network communications

Network standard NS 0919 Network communications required organisations whose workers communicate within the Sydney Trains network to monitor and review network communications. Sydney Trains monitored network communications through random and routine assessments that focused on both technical and behavioural markers. Based on the assessment there may be either: no further action or participants may require coaching and further development. 

Pacific National monitored network communications through the following:

• auditing of local channels (PN controlled yards and terminals)
• checking through their critical control verification process (safety engagements)
• assessments by driver trainers as part of the VOC process.

Monitoring and reviewing network communication provides an indication of the performance of the persons involved in safety critical communication at that point in time.

Protecting activities associated with in-service rail traffic

Sydney Trains utilise network rule NTR 432 Protecting activities associated with in‑service rail traffic network procedure to provide protection for workers required to attend rail traffic while in‑service. Network procedure NPR 750 Protecting activities associated with in-service rail traffic is associated with NTR 432 and details the requirements for requesting and authorising protection, conducting work and removing protection as detailed below.

Requesting protection

The qualified worker must inform the signaller of their name, role, train details and the type of activity requiring protection. They must also identify the lines requiring protection, advise the location of work and ask the signaller to protect all points of entry into the portion of track.

The signaller must confirm all protection request details and confirm the location of the worksite. The signaller must also determine if the work requires involvement of more than one signaller to ensure that all rail traffic is excluded. If more than one signaller is required, the signallers must determine who will be the authorising signaller. In this case, protection was required on both the Up and Down main line between Waterfall and Helensburgh and as such required involvement of two signallers.

The signaller (authorising signaller) must:

• make sure that blocking facilities have been applied to exclude all rail traffic.
• confirm the location of the last rail traffic to enter the affected portion of track.
• ensure that there is no approaching rail traffic.

The authorising signaller must tell qualified worker:

• that blocking facilities have been applied.
• the affected portion of track is protected.
• location of the last rail traffic and confirm there is no approaching rail traffic.

The qualified worker must confirm the assurances and details with the authorising signaller.

Authorising protection

The signaller authorises protection to the qualified worker after confirming the assurances and issues a unique protection number for the protection. The qualified worker must make sure that the protection is authorised and they have been issued with a unique protection number prior to entering the danger zone.

Conducting in-service inspections

The qualified worker must ensure that a safe place^[17] exists or protection has been authorised prior to entering the danger zone.

Removing protection

The qualified worker must advise the signaller of their location, train details and unique protection number and confirm that all workers are clear of the danger zone. The signaller must confirm the qualified workers details and the workers are clear of the danger zone before removing protection.

Safeworking protection

The primary method for protecting rail traffic and workers attending rail traffic was the use of fixed signals and signal blocking.

Absolute signal blocking

Absolute signal blocking (ASB) is a method of protection to prevent unauthorised rail traffic entering a protected area. Signalling staff must manipulate the appropriate absolute signals^[18] and points to provide protection in accordance with the relevant network rule (NTR 432 or NWT 308).^[19]

There must be two absolute signals at Stop at all potential entry points with a block (physical or electronic) applied to prevent the inadvertent activation of the signal or authorisation of rail traffic.

In addition, Sydney Trains required the signaller to complete and record all associated protection details utilising form NRF 018 Absolute Signal Blocking (ASB). The form provided the signaller with a list of requirements and could act as a memory aid to ensure the protection was completed successfully.

______________ 

10. The Digital Train Radio System (DTRS) project addressed recommendation 38 from the Waterfall Special Commission of Inquiry, (McInerney, PA. 2005). Recommendation 38 states ‘There must be compatibility of communications systems throughout the rail network. It is essential that all train drivers, train controllers, signallers, train guards and supervisors of trackside work gangs in New South Wales be able to communicate using the same technology.’
11. The kilometre distance is measured from Platform 1, Central Station, Sydney, New South Wales.
12. Cess, the area between the outer most rail and the fence line or 15 m in non-fenced areas.
13. Safety-critical communication is any communication, spoken or written, that if not delivered, or incorrectly delivered, or not delivered promptly, there is reasonable likelihood of a safety incident occurring. Network standard NS 0919 Network communications.
14. Driver must be competent for a route to operate trains on that route. In this case driver B’s route knowledge was being verified by driver A.
15. Yard limit - a defined operational limit on a running line.
16. Qualified worker – a worker certified to carry out the relevant task, the WS and driver A and B were qualified workers.
17. Safe place, an area where a worker or their equipment cannot be struck by rail traffic. A safe place can be created within the danger zone, through the use of recognised protection arrangements.
18. Absolute signals must not be passed by rail traffic without authority from the signaller and in accordance with any applicable rule or condition.
19. Sydney Trains utilise NTR 432 for protection of in-service rail traffic and NWT 308 Absolute Signal Blocking for the protection of worksites not associated with rail traffic.

Safety analysis

Network communication and decision making

The communications relating to the decisions and movement of 4WM2 were assessed to understand the events leading up to the occurrence (Figure 3). It was found that while recorded network communication devices were available, not all communications, decisions or directions relating to 4WM2 were made utilising recorded communication devices as required by NGE 204.

Figure 3: Communication timeline

The timeline shows the parties involved with the decision making and communication relating to 4WM2. Times shown with an asterisk (*) are approximate times. Communication shown at 04:17:28 was driver A advising driver B of 404A by radio. Source: Sydney Trains recorded data, modified by OTSI

The TSDM Illawarra advised the WS at 0012 to hold train 4WM2 at the Waterfall accept signal (W26U) due to the track fault in the adjoining network. The TSDM discussed that 4WM2 would be too long for the goods loop or refuge loop at Waterfall and that the train may need to ‘run around [remarshal] on the Up main’. The TSDM suggested the train might be held for less than an hour.

Around 0140 the DCM requested the involvement of the NIM Desk to resolve service disruptions once it was determined freight traffic would be unable to transit through Sydney Trains network. The NIM Desk and TSDM Freight determined that 4WM2 would need to remarshal and return to Coalcliff as it would be too long for the sidings at Waterfall.

The TSDM Freight contacted the WS at 0158 to advise of the directive to remarshal 4WM2. The WS began to repeat the message when the TSDM responded with ‘they should be all over that procedure’. The WS broadly relayed the message to the crew of 4WM2 to remarshal as received.

It was a requirement of NGE 204 that messages were understood before acting on the message. In this case, the WS relayed a message that they did not understand the full meaning of. The crew of 4WM2 received the message from the WS not realising that the WS did not understand applying hand brakes required workers to enter the danger zone. Neither party explicitly clarified the requirements or meaning of messages before acting on the requests.

The TSDM Freight contacted the TSDM South West around 0158 to advise them of the plan for 4WM2; the TSDM South West responded with ‘Illawarra owns it [TSDM Illawarra]’. The TSDM Illawarra was not advised that 4WM2 would be remarshalling and was not involved again until 0338.

Prior to being directed to remarshal, the crew of 4WM2 reported discussing alternatives with the WS and IPS. The following alternatives had been discussed:

• dividing the consist and storing across two sidings at Waterfall, or
• utilising the Waterfall yard to remarshal the train.

The TSDM Freight contacted IPS to discuss the train path for 4WM2 and advised that 4WM2 would be remarshalling. IPS questioned why the plan of utilising Waterfall yard to store the train had changed. The TSDM Freight advised that they had been directed for the train to remarshal by higher management.

The decision for 4WM2 to remarshal and return to Coalcliff while at signal W26U was not made in consultation with or communicated to all parties. Train 4WM2 was stationary within the area of control of the TSDM Illawarra. The remarshalling movement crossed into and out of the TSDM South West’s area of control. Following the initial communication directing the train to remarshal, TSDM Freight was not involved in the movements until 0405. The three TSDMs and NIM while co-located in the ROC did not communicate effectively to discuss the movement prior to or during the remarshalling.

The TSDM Illawarra contacted the WS at 0338 enquiring about the movements of 4WM2 and raised that 404A would be approaching shortly. During the call the TSDM Illawarra reported they had been unaware that 4WM2 was remarshalling and that it had apparently been arranged by the TSDM Freight.

The lack of clear communication and consultation between relevant parties resulted in different levels of understanding among all involved. This likely affected the actions of the WS and crew of 4WM2.

Drivers are required to attend rail traffic while in the rail corridor, in particular, when there is a fault preventing the train moving to a safer location. Train 4WM2 did not have a fault and the dangers the drivers would be exposed to should have been considered before the drivers were directed to remarshal the train.

An alternate and safer location had been discussed between some of the individuals but was dismissed as it would have required the consist to be divided. The Waterfall Up sidings were available and had a number of benefits over remarshalling on the Up Illawarra:

• the sidings provide some separation from rail traffic on the main line.
• the track alignment, gradient, ballast and clearances would make it safer to walk.
• some artificial light was present.

The change to the perceived plan held by the crew of 4WM2 of utilising Waterfall Up yard possibly created further confusion and distraction. Stabling or remarshalling at Waterfall would likely have placed less pressure (perceived or actual) on the crew as the train could have cleared the main line quickly and remarshalling in the yard required fewer hand brake applications. Additionally, there were engineering controls^[20] in the yard to arrest potential uncontrolled movements should the hand brakes have failed or if insufficient hand brakes had been applied.  

Safeworking irregularity

Driver A requested safeworking protection after being directed to remarshal the train. The request for protection of ‘just wondering if we can get a block on the Down there please over’ was not clear that the driver wanted protection on the Down Illawarra main line. The drivers’ request did not detail the required activity, identify the lines requiring protection, the location of the work or request that all points of entry were protected. The WS applied the following protection in response to the initial request:  

• Set signal W19 and W27U at Stop in the Down direction on the Up Illawarra.
• Secured the points out of the refuge and set signal 41 at Stop in the Down direction.
• Applied blocks to signals W19, W27U, 41 and points 57.

The protection applied by the WS protected the train on the Up Illawarra main line in the Down direction (Figure 4).

Figure 4: Safeworking protection diagram

The image shows a line diagram for the track between Waterfall and Helensburgh. The area protected by the WS is shown with a red box, the area that required protection is shown in the orange box. Protection was required on both Up and Down Illawarra main lines in both directions. Source: Sydney Trains, modified and annotated OTSI

Both Driver A and the WS appeared to be working on the assumption that the other knew what was required without seeking clarification. The driver sought confirmation of the block at 0224 and the WS responded with ‘yeah got blocks on up here on the city side of your train on the Down signals’. The driver did not detect that the WS stated there was no protection on the country (Helensburgh) side of their train.

There were a number of other activities competing for the driver’s attention that may have distracted them from the safeworking aspect of remarshalling. These include determining the number of hand brakes required to hold the wagons (3618 t) on the grade, completing brake holding (retention)^[21] test and uncoupling the locomotive prior to the move.

The initial request for protection did not meet the requirements of NPR 750 and the WS did not identify the request was for protection under NPR 750.

Had the request been completed in accordance NPR 750, or the WS identified that workers were required to enter the danger zone, it is probable that additional protection would have been applied. In addition, the use of form NRF 018 Absolute Signal Blocking may have assisted if it had been used. The protection required the involvement of the WS and WNP to ensure that all points of entry were protected from rail traffic. This did not occur and the WNP was unaware of the remarshalling until 0321. The WNP facilitated the remarshalling movement but was not involved in protection arrangements for 4WM2.

After the locomotives had travelled to Helensburgh and returned to the stabled consist, driver B requested protection. The request for protection was informal, did not specify the required protection and was requested in a similar manner to driver A. The WS advised the driver that ‘I’ve got blocks on the Down and blocks on the Up. So we’ve taken away control from north panel (WNP) and there’s blocks on the Down’. The WS was referring to the protection on the Up main in the Down direction. Having not identified workers needed to access the danger zone in the first instance, the WS repeated the protection applied previously. 

Driver B completed a Take 3^[22] form noting ‘750 block’ as the method of safeworking protection before entering the danger zone. The driver believed that the requirements of NPR 750 had been met, assuming that their request had been understood as a request for protection on both the Up and Down Illawarra main lines.

Both drivers entered the danger zone unknowingly with no protection on the Down Illawarra in either direction and were at risk of being struck by rail traffic. No trains passed through the area while driver A was in the danger zone.

Driver A signalled to the driver of 404A to stop by switching the marker lights to red and displaying a stop hand signal^[23] from the drivers cab. The driver of 404A responded to the stop signal and made an emergency brake application stopping on approach to the location of driver B.

Fatigue and alertness

Introduction

Fatigue can have a range of adverse influences on human performance, including slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance and more lapses or errors of omission (Battelle Memorial Institute, 1998), as well as various effects on decision making (Harrison and Horne, 2000).

Sleep is vital for recovery from fatigue, with both the quantity and quality of sleep being important. Most people need at least 7–8 hours of sleep each day to achieve maximum levels of alertness and performance. Research has shown that obtaining less than 5 hours sleep in the previous 24 hours is inconsistent with a safe system of work (Dawson and McCulloch, 2005), with some research indicating less than 6 hours sleep can increase risk (Thomas and Ferguson, 2010, Williamson and others, 2011).

In addition to sleep, a number of other factors can increase fatigue, including time of day, time awake and the nature of work activities. Working during the window of circadian low or tough, from about 0200 to 0600, has been associated with increased sleepiness, slower response times and increased errors and incidents (Battelle Memorial Institute, 1998).

Waterfall Signaller

In this case, it is unclear exactly how many hours of sleep the WS had in the 24 or 48 hours prior to the incident. However, based on the available information, it is likely that they had less hours of sleep than normal following a night shift, and this sleep was disrupted. In addition, it is likely that the WS was experiencing a level of cumulative fatigue due to non-work related factors. The incident also occurred during the period between approximately 0200 and 0420. Overall, based on this information, due primarily to non-work-related factors, the WS was probably experiencing a level of fatigue that has been demonstrated to adversely influence performance.

Conducting night shift work undoubtedly increases the potential for fatigue, and most people will not be able to sleep as effectively during the day as during their normal sleep periods at night. However, fatigue risk can be reduced to an acceptable level with the use of a set of appropriate risk controls. In this case, Sydney Trains had limited the WS’s overnight duty periods to 8 hours and ensured there was a significant period of time off duty between duty periods.

Fatigue management is a responsibility shared between the organisation and employees. Employees are responsible for utilising the provided rest periods and managing their non-work related fatigue. In addition, they must report if they are affected by fatigue or unfit for duty in any other way.

In this case, the WS had not advised their employer of the potential for them to be affected by fatigue prior to commencing duty on the night of 20 August. It should be recognised that most people generally underestimate their level of fatigue (Battelle Memorial Institute 1998). Although it appeared the WS had some level of concern about their fitness for duty, it is likely that they did not fully appreciate the extent to which their performance could be affected.

The WS also advised that they perceived there could be some negative consequences associated with reporting that they were fatigued or not fit for duty. Such reservations are common in some organisations, and the ATSB did not fully examine the extent to which this was a commonly perceived problem amongst other Sydney Trains employees. However, this incident provides a reminder to all organisations and safety-critical workers of the importance of reporting concerns about their fitness for duty if their sleep has been adversely affected in the period prior to commencing work.

Although it is likely that the WS was experiencing fatigue, it is unclear based on the available evidence that the fatigue contributed to the limitations in their performance involved in this incident. It is likely there were that other factors including the personal stress and distraction and poor communications relating to the occurrence impacted their performance.

Crew of 4WM2

Both drivers of 4WM2 commenced their shift at 1745 on 20 August. Delays to the journey of 4WM2 extended both drivers' shifts beyond their rostered finish time of 0322. Driver A finished at 0655 (13 hours 10 minutes) and driver B finished earlier at 0612 (12 hours 36 minutes). However, both drivers had sufficient sleep opportunity prior to commencing their shift.

The first safeworking irregularity occurred within the drivers' rostered shift with the second occurring close to their rostered finish time. The drivers' shift extended approximately two hours after the safeworking irregularity in which time the remarshalling was completed and the crew were relieved.

There was a period of low workload between approximately 0030 and 0200 while stationary at signal W26U. Both drivers reported that during that period they probably felt a bit tired. It is possible that the combination of a period of low workload, time of night and time on shift may have increased their risk of fatigue-related errors. However, based on the available information, there was insufficient evidence to conclude that the drivers were experiencing a level of fatigue known to affect performance.

_________

20. Catch points - a set of points designed to prevent unauthorised access to a section of track by intentionally derailing the vehicle.
21. An air brake examination to check that the brakes on the last three vehicles of a train will remain applied for a predetermined time in the event of a break-away. Rail Industry Safety and Standards Board (RISSB)
22. Pacific National utilise a pocket book known as a Take 3 for risk assessing a task and recording the controls.
23. A signal given by hand movements, in this case, both hands raised above the head. In an emergency, vigorous waving of arms, any coloured light or flag or other material will indicate stop to the driver of approaching rail traffic. Rail Industry Safety Induction Handbook, Sydney Trains.

Findings

From the evidence available, the following findings are made with respect to the safeworking irregularity involving the crew of freight train 4WM2 on 21 August 2019.  

Contributing factors

• The safeworking network rules and procedures for protecting activities associated with in-service rail traffic were not effectively utilised by the either crew of train 4WM2 or the Waterfall Signaller to ensure workers in the danger zone were protected from rail traffic.
• There were multiple parties involved in the decision making and communications relating to the movements of train 4WM2. A lack of clear communication lead to confusion and misunderstanding of the required activities.
• The Sydney Trains and Pacific National personnel did not ensure that network communications were conducted in accordance with network rule NGE 204.

Other factors that increased risk

• Primarily associated with non-work related factors, the Waterfall signaller was probably experiencing a level of fatigue that has been demonstrated to adversely influence performance.
• The location the crew of 4WM2 were directed to remarshal the train placed the crew at increased risk as the area was remote, poorly lit and difficult to access.

Other findings

• The Waterfall Up sidings were available as a safer and practical alternative to either stow or remarshal the train until normal operations resumed.

Safety actions

Safety action not associated with an identified safety issue

Proactive safety action by Sydney Trains

Sydney Trains advised that the following proactive safety actions had been taken:

• The Waterfall Signaller completed training and coaching in the establishment of protection associated with in-service rail traffic before returning to full duties.
• Reviewed the risk management processes applied by Network Operations to the management of controls nominated as critical, including critical control nomination, type and frequency of assurance activities, control effectiveness rating and control improvement activities.
• Reviewed the risk management process applied by Network Operations to the network hazard identified as ‘Person in path of rail vehicle / Worker in path of rail vehicle - Absolute Signal Blocking (ASB) incorrectly implemented/maintained’, in the context of conducting protection activities associated with in-service rail traffic.
• Reviewed the processes as they relate to incident management and the duties, responsibilities, interdependencies and relationships between Duty Control Managers, Network Incident Managers, Train Service Delivery Managers, Area Controllers, Signallers and Qualified Workers.
• Reviewed the processes relating to the assessment of the ongoing competence of Signallers engaged in protection activities associated with in-service rail traffic.
• Reviewed the processes as they relate to the assessment of the ongoing competence of Drivers engaged in protection activities associated with in-service rail traffic.

Proactive safety action by Pacific National

Pacific National advised they reviewed the process for the protection of in-service rail traffic inspection and activities and ensured the requirements of both Pacific National and the Network Owners, were reinforced and understood by all required train crew.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Drivers of 4WM2
• Pacific National
• Sydney Trains
• Waterfall Signaller.

References

Battelle Memorial Institute (1998). An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle. Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, United States Federal Aviation Administration.

Dawson D & McCulloch K (2005). Managing fatigue: It’s about sleep, Sleep Medicine Reviews, vol. 9, pp. 365–380.

Harrison H & Horne JA (2000). The impact of sleep deprivation on decision making: A review, Journal of Experimental Psychology, vol. 6, pp. 236–249.

McInerney, PA. (2005). Special Commission of Inquiry into the Waterfall Rail Accident, Final Report, Vol 1.

Rail Industry Safety and Standards Board (2020). Glossary of Terms.

Sydney Trains (2015). Rail Industry Safety Induction Handbook, v5.1.

Sydney Trains (2018). NGE 204 Network communications, v4.1.

Sydney Trains (2018). NPR 750 Protecting activities associated with in-service rail traffic, v3.0.

Sydney Trains (2018). NTR 432 Protecting activities associated with in-service rail traffic, v3.0.

Sydney Trains (2019). NRF 018 Absolute Signal Blocking (ASB), v2.2.

Sydney Trains (2019). NS 0919 Network communications, v7.0.

Sydney Trains (2019). NWT 308 Absolute Signal Blocking, v8.2.

Thomas MJW & Ferguson SA (2010). Prior sleep, prior wake, and crew performance during normal flight operations, Aviation, Space, and Environmental Medicine, vol. 81, pp. 665–670.

Williamson A, Lombardi DA, Folkard S, Stutts J, Courtney TK & Connor JL (2011). The link between fatigue and safety, Accident Analysis and Prevention, vol. 43, pp. 498–515.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Drivers of 4WM2
• Office of the National Rail Safety Regulator
• Pacific National
• Sydney Trains
• Transport for NSW
• Waterfall Signaller.

Submissions were received from:

• Office of the National Rail Safety Regulator
• Pacific National
• Sydney Trains.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.