Investigation summary

What happened

In early May 2022, heavy rain fell across catchments of the Brisbane River. In response, the region’s water management agency performed several controlled water releases from dams located upriver from the Port of Brisbane. The subsequent high freshwater inflows resulted in increased current speeds through the port, exposing ships to the risk of breaking free from their berths. 

At 1313 local time on 16 May, the container ship OOCL Brisbane broke away from its berth at Fisherman Islands. All the ship’s mooring lines parted or paid out shortly after another ship, Delos Wave, passed OOCL Brisbane in the adjacent channel and berthed immediately ahead of it. 

At 0636 on 20 May, the container ship CMA CGM Bellini was working cargo alongside a berth at Fisherman Islands when 2 of its forward mooring lines parted and its bow drifted off the wharf. This breakaway also occurred shortly after another ship, APL Scotland, passed and berthed ahead of CMA CGM Bellini.

What the ATSB found

The ATSB found that the cause of the breakaways was a combination of increased ebb current flows and additional interaction forces and water flow disturbances introduced by Delos Wave and APL Scotland. These combined factors resulted in hydrodynamic forces which exceeded the berthed ships’ mooring arrangement capacities. 

The investigation identified that Maritime Safety Queensland (MSQ), the safety regulator, and the port’s pilotage provider, Poseidon Sea Pilots (PSP) did not have a process to jointly and effectively identify and risk assess the hazards to shipping and pilotage that were outside normal environmental conditions. As a result of this safety issue, MSQ and PSP did not identify and adequately address ship interaction as a hazard that increased the risk of a breakaway at Fisherman Islands. 

What has been done as a result

Following the breakaway of the oil tanker CSC Friendship in February 2022 further upriver in the port (ATSB investigation MO‑2022‑003) and these breakaways at Fisherman Islands in May, MSQ has taken the safety action summarised below. 

Between July and October 2022, MSQ commissioned several investigations and studies into the breakaways, which included analyses of mooring and river conditions, port operations and contingency planning arrangements.

Additionally, MSQ engaged with multiple port stakeholders, including PSP, terminal operators, the Australian Bureau of Meteorology and Seqwater to improve collaborative planning for, and response to, extreme weather events including river flood. Subsequently, MSQ has gradually amended its procedures for responding to extreme and adverse weather events. From late 2023, these procedures reflected the Queensland Government’s adoption of the Australian Warning System, which provides a nationally recognised set of warning levels and icons to communicate and manage dangers associated with extreme weather events.

In late 2024, MSQ established the Port of Brisbane Maritime Emergency Working Group (MEWG) and developed guidelines for the group’s role in responding to port emergencies, including severe weather, river flood and dam water releases. A stated function of the MEWG, which included representatives from MSQ, Port of Brisbane and PSP, was to facilitate timely and collective assessment of potential hazards to port safety posed by significant weather events and emergencies so that appropriate controls could be identified and implemented.

Capital improvements include the installation of 3 additional current meters in the river (with additional meters planned) and the provision of data from these meters to key stakeholders, including PSP. 

In December 2024, PSP advised the ATSB that it had worked closely with MSQ since the 2022 breakaways to establish a formal channel for all port stakeholders to collaboratively identify and risk assess hazards to shipping outside of normal environmental conditions. During this time, PSP progressively updated its pilotage operations safety management system to provide detailed procedures for preparing and responding to severe weather events. These procedures were developed in collaboration with MSQ and consistent with guidelines for the MEWG.

Additionally, PSP provided input for changes to MSQ’s standard port procedures. This included the joint development of procedures for movements to and from various berths under flood conditions using MSQ’s bridge/ship simulator.

Safety message

The breakaway incidents highlight the importance of structured and clearly defined emergency and risk management arrangements for managing port shipping movements outside of normal operating conditions. Such arrangements must facilitate accurate assessment of all the available information by the involved parties and provide for adequate assessment of all potential risks.

The occurrences

Background

In February and March 2022, areas of south‑east Queensland experienced unprecedented rainfall, which resulted in a series of destructive flooding events across the region, including the catchments of the upper and lower Brisbane River (Figure 1). The conditions over this period led to abnormally high currents (peaking at about 5 knots) in the Brisbane River and resulting in the breakaway of the oil tanker CSC Friendship from its berth on 27 February 2022 (see the section titled Previous occurrences).

Figure 1: The Brisbane River

Source: Queensland Government, annotated by the ATSB

While rainfall across the region eased during April, on 6 May 2022 the Australian Bureau of Meteorology (BoM) released advice of forecast significant rainfall for the following week. Subsequently, with catchments across south-east Queensland still saturated from the rainfall in February and March, Seqwater[1], as part of its strategy to manage dam water levels, issued advice on that same day that it would commence low-flow operational releases from Wivenhoe and Somerset dams, located upriver of the port. 

Later that day, following the Seqwater advice, Brisbane’s regional harbour master (RHM) directed the port’s vessel traffic service (VTS) to monitor river current meter readings against predicted flows every 2 hours and report any deviations. At the time, there was only one river current flow meter, located at the 2F beacon in Pelicans Banks Reach and immediately upriver of Fisherman Islands. (Figure 2).

Figure 2: Location of the 2F beacon current flow meter

Source: Australian Hydrographic Office, annotated by the ATSB

Additionally, the RHM directed VTS to notify port stakeholders, including terminal operators, ship masters (through the local agent) and the port’s pilotage provider, Poseidon Sea Pilots (PSP), of potential disruptions to ship movements in the coming days due to forecast rain and planned dam releases. Strong winds and rough seas and swell in the area of the pilot boarding ground (PBG) outside Moreton Bay at the port’s entrance were also expected to affect the pilot boat transfers. However, despite the predicted conditions, ship movements in and out of the port were able to proceed without disruptions over the following 3 days. 

On 11 May 2022, BoM forecast more significant rainfall across the region. At 0715, Seqwater’s flood operations centre advised that it had moved to its ‘stand-up’ activation level and was increasing dam releases to mitigate the risk of flooding. At 1145, Seqwater further advised that releases from Wivenhoe Dam would exceed 1,000 m³ per second overnight. At 1245, BoM issued a moderate flood warning for the upper Brisbane River.

In response to Seqwater’s notification of increased dam releases, the RHM directed VTS to suspend all immobilisation[2] permits and advise ships’ agents to ensure berthed and arriving ships deployed additional mooring lines. Ships berthed upriver from Pelican Banks were required to be at immediate readiness to depart and further arrivals to those berths were suspended. While movements at Fisherman Islands berths were to continue, nighttime pilot transfers were suspended later that day due to heavy swell at the PBG. 

On the morning of 12 May, BoM issued a minor flood warning for the lower Brisbane River, in addition to a series of major and moderate flood warnings for locations throughout the lower Brisbane River catchment. The RHM anticipated that flood waters from the lower catchment would result in stronger river current flows. 

Later that day, the RHM advised PSP via email that BoM had prepared a flood scenario outlook which indicated the lower Brisbane River would most likely experience minor flood levels at high tide on 14 and 15 May. This outlook also indicated that it was possible that the minor flood level could be reached on 13 May and remain at that level until 16 May. The RHM advised VTS and PSP that dam releases were being varied to manage the flood levels and therefore, unless there was significant rainfall over the lower river catchment, they did not expect a significant change to the increase in river current flow, which was observed to be about half a knot faster than normal spring ebb flows. By 1430 on 12 May, the last remaining ship berthed upriver from Pelican Banks had evacuated the river under the direction of the RHM. 

On 13 May, as rainfall over the lower Brisbane River catchments increased, releases from Wivenhoe Dam were temporarily stopped to allow peak inflows from catchments downstream of the dam to pass. Meanwhile, the maximum current flow recorded was 2.5 knots, about 1 knot faster than the normal predicted ebb (downriver) flow. With sea and swell conditions at the PBG continuing to disrupt pilot transfers, there were only a limited number of ship movements that day. 

That afternoon, the VTS manager advised PSP management, terminal operators, ships’ agents and other port stakeholders of the planned movements on the following day. Scheduled movements at Fisherman Islands were to proceed with additional restrictions in place due to the increased river current. The precautions prohibited the berthing of ships more than 300 m in length, with all others required to be berthed head-up (facing upriver). Only daylight movements were permitted, and with a minimum of 2 tugs. 

At 0300 on 14 May, releases from Wivenhoe Dam resumed. Meanwhile, sea conditions at the PBG had further deteriorated, preventing the resumption of pilot boat operations. Consequently, only a limited number of movements were conducted between Fisherman Islands and the inner anchorage, located within the relatively sheltered waters of Moreton Bay. 

OOCL Brisbane breakaway

By 15 May, conditions at the PBG had eased while the maximum ebb flow observed at the current meter was 2.3 knots. The RHM decided that these conditions allowed for the resumption of scheduled movements to Fisherman Islands. 

At 1058, a pilot boarded the container ship OOCL Brisbane at the PBG to conduct it to Fisherman Islands berth number 10. The pilotage proceeded normally and by 1725, the ship was berthed port side alongside (head-up) (Figure 3).

The ship was made fast with 16 polyamide mooring ropes – 4 head and stern lines, 2 breast lines fore and aft and 2 spring lines fore and aft, or 4-2-2 fore and aft. Of these 16 ropes, 12 were secured on their mooring winches held by a manual friction brake. The remaining 4  (both forward breast lines and 2 inboard stern lines) were turned up on bitts forward and aft. The ship’s outboard (starboard) anchor was lowered to the seabed as an additional precaution. The master ordered the moorings to be checked and tended every hour. Later that evening, cargo operations commenced. 

Figure 3: OOCL Brisbane mooring arrangement

Source: Maritime Safety Queensland and Seaport OPX, annotated by the ATSB

By the morning of 16 May, disruptions over the previous week had resulted in about 40 ships being anchored off the port limits, awaiting entry to the port. The maximum current recorded by the meter during the previous ebb tide had peaked at 2 knots, about 0.8 knots higher than predicted. The RHM decided that about 10 ship movements scheduled that day could go ahead subject to existing restrictions. 

At 0906, a pilot boarded the container ship Delos Wave, inbound to Fisherman Islands berth number 9, immediately upriver from OOCL Brisbane. At the time of the ship’s scheduled arrival alongside, the tide would be ebbing with high water (2.14 m) predicted for 0918 and low water (0.31 m) at 1537 (at the entrance to the Brisbane River). During the pilotage, VTS advised the pilot that the river current (ebb) was 2.2 knots. When the ship entered the river, the pilot estimated there to be an east-south‑easterly wind of about 7–10 knots. 

At 1116, VTS emailed port stakeholders advising that it was planning to resume further scheduled movements over the following days, also indicating that it was likely that some of the restrictions would be lifted from 17 May.

At 1239, Delos Wave was passing berth number 12 at a speed of 4.8 knots (over ground). The pilot planned to keep the ship close to the 212° (T) leading line for berthing that ran parallel to the Fisherman Islands wharf face (180 m from the face). The pilot had planned that by the time the ship was off berth number 9, its speed would have been reduced so it was stationary (over ground). The 2 tugs in attendance would then push it alongside the berth. 

At 1245, Delos Wave was passing OOCL Brisbane at a distance of about 113 m at 3 knots (Figure 4, Top). Five minutes later, Delos Wave’s speed was 0.9 knots as its stern passed the bow of OOCL Brisbane. The distance between the ships was about 100 m. 

Figure 4: Delos Wave passing OOCL Brisbane

Source: Australian Hydrographic Office and OOCL Brisbane’s voyage data recorder, annotated by the ATSB 

After Delos Wave passed OOCL Brisbane, the pilot began manoeuvring the ship towards its berth. At 1254, when Delos Wave was about 40 m from the berth, its first mooring line was passed ashore with the pilot directing the tugs as required. The pilot was also using short bursts of dead slow ahead on the ship’s main engine to counteract the current and keep the ship stationary off the berth. Astern of the ship, OOCL Brisbane had begun to surge and yaw. At about this time, a duty crew member on OOCL Brisbane’s deck reported to the second mate that the bow was moving away from the berth. The second mate immediately notified the chief mate (via UHF radio) and then instructed the crew to standby the forward and aft moorings. Meanwhile, stevedores working cargo noticed the ship moving away from the wharf and soon after, all 3 cranes stopped working cargo and raised their booms clear. 

When OOCL Brisbane’s master arrived on the bridge at 1258, its heading[3] was 218° (it had been 212° when alongside). One of its forward spring lines and both forward breast lines had parted and the remaining mooring lines forward had started to pay out.[4] 

At 1259, the master ordered the engineers to standby the main engine and bow thruster for emergency use, and then notified VTS (via VHF radio). Shortly afterwards, VTS advised the master that a tug (not one of those attending Delos Wave) was en route to assist. 

Meanwhile, the crew’s attempts to heave in the forward mooring lines had not succeeded and by 1303, the bow had swung about 15° away from the wharf. At 1304, the remaining forward spring line parted. Moments later, the master had the bow thruster at full port thrust. From 1307, the main engine was run (dead slow ahead and then half ahead) with the rudder hard to port to return the ship alongside. The ship, however, continued to move further away from the berth. 

By 1308, all forward lines had parted or fully paid-out (Figure 5). All the aft mooring winches had also begun to pay out and the 2 inboard stern lines turned up on the bitts parted at about this time. 

Figure 5: OOCL Brisbane breaking away (image shows the last headline parting)

Source: Maritime Safety Queensland

Meanwhile, Delos Wave had come alongside its berth and, by 1310, had one mooring line out at each end. Astern of it, OOCL Brisbane had broken away with its aft winches still paying out. The ship came close to the ship berthed astern of it before moving across to the other side of channel. By 1313, when the tug arrived to assist, all the ship’s aft mooring lines had parted or paid-out. One of the tugs attending Delos Wave was also released to assist OOCL Brisbane.

By 1323, OOCL Brisbane was near the opposite side of the channel with the 2 tugs assisting with controlling its movement (Figure 6). Shortly afterwards, the other tug attending Delos Wave was also released to assist OOCL Brisbane. The 3 tugs then aided OOCL Brisbane to remain within the channel while VTS arranged a pilot.

Figure 6: OOCL Brisbane at 1323

Source: Australian Hydrographic Office and OOCL Brisbane’s voyage data recorder, annotated by the ATSB 

At 1357, the master let go the starboard anchor to maintain position while waiting for the pilot. After boarding at 1418, the pilot agreed a plan with the master to take the ship to an anchorage at Moreton Bay (the ship had no usable mooring ropes). At 1505, after weighing anchor, the pilot conducted the ship to the anchorage.

As all OOCL Brisbane’s mooring ropes had parted and several mooring winches were damaged, it remained at the anchorage for several days while new ropes and spare parts were supplied. The RHM also required an independent surveyor to conduct an investigation and inspect the mooring equipment (see section titled OOCL Brisbane - Mooring equipment).

On 26 May, a pilot conducted the ship back to the same berth where 6 of its cargo hatch covers had remained after the breakaway.     

CMA CGM Bellini breakaway

Following the breakaway of OOCL Brisbane, MSQ continued to monitor river current conditions and reviewed ship mooring configurations using its NCOS[5] mooring tool, applying an assumed additional loading of 3 knots of current speed alongside the berths. Ship movements to and from Fisherman Islands berths continued, with existing restrictions still in place. Arrivals to berths upriver from Pelican Banks also resumed. On 18 May, the RHM decided that ships of more than 300 m in length could resume berthing at Fisherman Islands. While rainfall had eased, the continuation of controlled releases from Wivenhoe Dam was resulting in a greater ebb river current than during a normal spring ebb tide.

At 0836 on 19 May, the container ship CMA CGM Bellini berthed port side alongside (head‑up) at Fisherman Islands berth number 6 (Figure 7). The ship was made fast with 14 polyamide mooring ropes – 4 headlines, 3 stern lines, 1 forward breast line, 2 aft breast lines and 2 spring lines fore and aft. As an additional precaution, the starboard anchor was lowered to the seabed. Of the 7 forward ropes, 6 were secured on their mooring winches and held by a manual friction brake while the forward breast line was turned up on bitts. 

Figure 7: CMA CGM Bellini mooring arrangement

Source: Maritime Safety Queensland and Seaport OPX, annotated by the ATSB

At 0236 the following day, a pilot boarded the container ship APL Scotland at the PBG. The ship was bound for Fisherman Islands berth number 5, immediately upriver from berth number 6 where CMA CGM Bellini was working cargo. During the master and pilot information exchange, the pilot informed the master that a strong ebb current and south-easterly winds could be expected at the berth and additional mooring ropes would be necessary. 

At 0618, as APL Scotland entered the Brisbane River, a harbour tug attended the ship and made fast on its starboard quarter. At 0623, as the ship passed Fisherman Islands berth number 9 at a speed of 5 knots, another tug made fast on the ship’s starboard shoulder. The tide was ebbing, with the predicted high water (2.59 m) having occurred at 0028 and low water (0.61 m) predicted for 0725. At the time, the current meter recorded an ebb flow of 1.5 knots and the pilot recalled south-easterly winds of 16–19 knots. 

At 0625, APL Scotland’s speed had slowed to 4.2 knots as its bow came into line with the stern of CMA CGM Bellini. At this time, the distance between the ships was about 160 m. By 0628, APL Scotland was 120 m off CMA CGM Bellini’s beam, at a slight angle to the 212° leading line for berthing and its speed had reduced to 2.1 knots (Figure 8).

Figure 8: APL Scotland passing CMA CGM Bellini at 0628

Source: Maritime Safety Queensland

At 0634, CMA CGM Bellini began to surge and yaw at its berth as APL Scotland’s stern passed about 80 m from its bow. At about the same time, APL Scotland’s pilot ordered its main engine slow astern for a brief period to reduce speed. 

At 0635, as the pilot began manoeuvring APL Scotland towards the berth, one of CMA CGM Bellini’s inner headlines began to pay out. A duty crew member on deck saw the bow moving away from the berth and called the duty officer (the third mate) on the bridge (via UHF radio). The third mate alerted the chief mate via radio and then went forward. At 0636, the forward breast line partially parted, followed by the parting of one of its forwardmost headlines a few seconds later (Figure 9).

Figure 9: Headline parts at 0635

Source: Maritime Safety Queensland, annotated by the ATSB

By 0637, the ship’s bow had drifted about 8 m off the wharf face. On APL Scotland’s port bridge wing, the pilot had heard the headline parting and saw CMA CGM Bellini moving off the berth. The pilot alerted the shore mooring gang and asked the masters of the attending tugs to call another tug to assist CMA CGM Bellini. 

Meanwhile, CMA CGM Bellini’s third mate saw all except one of the headlines were paying out and, assisted by 2 other crew members, attempted to heave them in. On the bridge, the chief mate officer called the engine room and instructed the duty engineer to standby the main engine and bow thruster before calling the master. 

At 0642, a tug arrived to assist and began pushing up on CMA CGM Bellini’s starboard shoulder. At this time, APL Scotland was manoeuvring ahead of CMA CGM Bellini, and the pilot was using its engine intermittently at dead slow ahead to counteract the current and keep the ship stationary off the berth. When CMA CGM Bellini’s master arrived on the bridge at about 0650, its bow was slowly returning alongside the wharf. 

By 0655, CMA CGM Bellini’s bow thruster was being used and at 0705, the ship was alongside with the crew working with shore personnel to replace the parted lines. The master then contacted VTS and informed the duty VTSO of the situation while the chief mate attended to the mooring arrangements. 

By 0730, all mooring lines had been resecured. At 0800, the chief mate advised the master that the ship was again fast alongside before informing VTS that the situation was under control. The attending tug was released and shortly afterwards, cargo operations resumed. 

Context

OOCL Brisbane

OOCL Brisbane was built in 2009 by Samsung Heavy Industries, South Korea, registered in Hong Kong and classed with the American Bureau of Shipping. At the time of the occurrence, it was owned by Newcontainer No.138 (Marshall Islands) Shipping and managed and operated by Orient Overseas Container Line, Hong Kong. 

The 4,578 TEU[6] container ship had an overall length of 260 m, a moulded breadth of 32.25 m and a depth of 19.30 m. At its summer draught of 12.62 m, it had a deadweight of 50,575 t. 

Upon its arrival in port, OOCL Brisbane had a crew of 25 Singaporean, Chinese and Filipino nationals, all suitably qualified for their positions held on board. 

Mooring equipment

At the time of the breakaway, each of the 16 polyamide (nylon) mooring lines used to secure OOCL Brisbane alongside (Figure 3) had a minimum breaking load of 72.6 t, while each mooring winch had a brake holding capacity of 52.8 t. Following the breakaway, a surveyor inspected the mooring lines and equipment, as well as the service records relating to them, and determined that prior to the incident, the mooring lines, winches and gear had been properly maintained and were in serviceable order. 

Delos Wave

Delos Wave was a 2,824 TEU container ship built in 2007 by HD Hyundai Mipo, South Korea. The 222 m ship had a moulded breadth of 30 m, a depth of 16.80 m and a deadweight of 39,357 t at its summer draught of 12 m. 

The ship was registered in the Marshall Islands and classed with Nippon Kaiji Kyokai (ClassNK). At the time of the occurrence, it was owned by Box Carrier Corporation and managed and operated by Nautical Carriers Incorporated, Greece. 

Propulsive power was provided by a single Hyundai B&W 2‑stroke, single‑acting diesel engine that developed 25,270 kW at 104 rpm. The main engine drove a single, fixed-pitch propeller, which gave the ship a service speed of 22 knots. 

The ship was manned by 23 suitably qualified Ukrainian, Georgian, Moldovan, Greek and Filipino nationals. 

Pilot

Delos Wave’s pilot had trained and qualified as a licensed (unrestricted) Brisbane pilot when Poseidon Sea Pilots (PSP) commenced the provision of pilotage services for the port in January 2022. The pilot had previously been a pilot in the Queensland ports of Townsville and Gladstone for 6 years. 

CMA CGM Bellini

CMA CGM Bellini was built in 2004 by Samsung Heavy Industries, South Korea, registered in Malta and classed with Bureau Veritas. At the time of the breakaway, the 5,782 TEU container ship was owned, managed and operated by CMA CGM, France. 

The ship had an overall length of 277 m, a moulded breadth of 40 m and a depth of 24.33 m. At its summer draught of 12.53 m, it had a deadweight of 72,500 t. 

CMA CGM Bellini had a crew of 20 Croation, Montenegrin, Sri Lankan and Filipino nationals, all suitably qualified for their positions held on board.

Mooring equipment

At the time of the breakaway, each of CMA CGM Bellini’s 14 nylon (polyamide) mooring lines used to secure the ship alongside (Figure 7) had a minimum breaking load of 96.3 t. The ship’s maintenance records indicated they were in good condition. The mooring equipment maintenance records also indicated that the mooring winches and winch brake linings complied with the requirements of class and the ship’s safety management system. 

APL Scotland

APL Scotland was built in 2001 by Samsung Heavy Industries, South Korea, registered in Singapore and classed with Det Norske Veritas (DNV). The 5,510 TEU container ship was owned by CMA CGM Asia Pacific Liner and managed and operated by CMA CGM Asia Shipping, Singapore.  

APL Scotland had an overall length of 277 m, a moulded breadth of 40 m and a depth of 24.30 m. At its summer draught of 14 m, it had a deadweight of 68,017 t. Propulsive power was provided by a single Samsung-MAN B&W 2‑stroke, single‑acting diesel engine that developed 54,840 kW at 94 rpm. The main engine drove a single, fixed-pitch propeller, which gave the ship a service speed of 23.5 knots. 

The ship was crewed by 24 suitably qualified Chinese, Sri Lankan and Filipino nationals.

Pilot

APL Scotland’s pilot had extensive pilotage experience in various ports in Australia before obtaining an unrestricted pilot licence for Brisbane in 2021 after joining PSP.

Port of Brisbane

The Port of Brisbane (Figure 10) is located at the mouth of the Brisbane River in south‑east Queensland. It is one of Australia’s largest and most diverse multi-cargo ports, with 28 operating berths facilitating the handling of containers, general cargo, motor vehicles and bulk, as well as a dedicated international cruise ship terminal. 

Figure 10: The Port of Brisbane

Source: Port of Brisbane

Each year, approximately 2,150 ships visit the port, which handles approximately $55 billion annually in international trade, including 50% of Queensland’s agricultural exports and 95% of its motor vehicles and containers. In the 2021–22 financial year, the port handled 32 million tonnes of cargo, including 1.53 million containers. 

Under Queensland’s Transport Operations (Marine Safety) Act 1994, control of navigation in the port is the responsibility of the regional harbour master (RHM) appointed by Maritime Safety Queensland (MSQ). In 2010, the port was privatised and, under a 99-year lease from the Queensland Government, is managed and developed by the Port of Brisbane (PBPL).[7] MSQ and the PBPL were jointly responsible for managing the safe and efficient operation of the port. 

The Brisbane port limits encompass a significant area of Moreton Bay and extend to the northern end of the bay with about 45 miles[8] from the pilot boarding ground to river entrance beacons. The RHM’s area of responsibility extends beyond the port limits to include areas of other commercial and recreational activities, including Moreton Bay, the Brisbane River upriver from the port and the coastal sea area to about 45 miles further north of the port limits.

At the time of the occurrences, the port provided an equivalent of eight 300 m container berths (numbers 4 to 11) at Fisherman Islands (Figure 11). The design depth off the wharf face was 14 m and each berth pocket was 55 m wide. 

Figure 11: Fisherman Islands container berths

Source: Port of Brisbane, annotated by the ATSB 

Pilotage

All ships over 50 m in length calling at Brisbane were required to take a pilot. The pilot boarding ground was situated 3 miles south‑east from Point Cartwright. 

Pilot transfers were conducted by pilot boat, normally operating out of Mooloolaba Boat Harbour, located at the mouth of the Mooloolaba River near the north‑western shore of Point Cartwright. During rough sea conditions, the bar at the river entrance sometimes became hazardous for pilot boats to cross. In such circumstances, the boats operated from Scarborough, a short distance north‑west of Redcliffe. 

Vessel traffic service

The Brisbane vessel traffic service (VTS) was the principal resource available to the RHM to manage the movement of ships approaching, departing and operating within the Brisbane VTS area, which includes all areas within the Brisbane port limits and the compulsory pilotage area. 

The service was provided by MSQ and manned 24 hours per day by qualified vessel traffic service operators (VTSO). 

Brisbane River

The Brisbane River is the longest river in south‑east Queensland, travelling 344 km from Mount Stanley and flowing through the city of Brisbane and its port before emptying into Moreton Bay on the Coral Sea. 

The Brisbane River basin drains a catchment of about 13,560 square kilometres to the mouth of the river. The river system includes 2 water storage and flood mitigation dams – Somerset Dam on an upriver tributary, which drains to Wivenhoe Dam on the Brisbane River (Figure 12).

About half of the catchment is above Wivenhoe Dam, which is situated about 150 km from the mouth of the river. Seqwater estimated that water released from Wivenhoe Dam takes about 30 hours to reach the port. Wivenhoe Dam stores a significant volume of inflow water, reducing the Brisbane River level to mitigate the risk of flooding.   

Figure 12: Wivenhoe and Somerset dams

Source: Queensland Government

While the frequency and severity of floods has diminished since the 1985 construction of Wivenhoe Dam, severe flooding along the Brisbane River can still occur. Such events may result in widespread damage to surrounding areas, as documented during significant flood events in January 2011 and February 2022. 

Weather event

In early May 2022, onshore winds and a low-pressure trough across eastern Australia resulted in substantial rainfall in the east of the country, in addition to strong winds and hazardous surf conditions along much of its eastern seaboard. In south‑east Queensland, rainfall was significantly above average, with most locations recording more than twice the average for the month. In the Greater Brisbane area, rainfall was heaviest between 11 and 14 May, peaking on 13 May. By 16 May, the total accumulated monthly rainfall was 196 mm and by 20 May, this total had increased to 225 mm (Figure 13). Brisbane’s total rainfall for the month was 280 mm, 397% of the long-term average of 70.6 mm and the city’s wettest May since 1996. 

Figure 13: Daily and cumulative rainfall for Brisbane in May 2022

Source: Bureau of Meteorology, compiled by the ATSB

Impact on port and mooring conditions 

Following these occurrences, PBPL and MSQ engaged Seaport OPX, a specialist provider of hydrodynamic modelling and digital port solutions, to investigate the circumstances of the breakaways. This was to assist port management to evaluate existing mooring practices and procedures at Fisherman Islands. 

Seaport OPX used 3D hydrographic modelling and mooring analysis software to simulate and assess the environmental and dynamic conditions that may have contributed to each breakaway. In its investigation report, Seaport OPX noted that the complexity of the physical processes and their interactions on the moored ships were difficult to evaluate, even with the use of advanced numerical modelling tools. They were however able to provide insight into the factors that probably contributed to the breakaways.    

Increased river currents

Following heavy rainfall over the Brisbane River catchment areas, the resulting freshwater inflows to the river were observed to generate abnormally high currents in the port, including along the Fisherman Islands berths. These inflows coincided with a perigean[9] spring tide from 16 May, which resulted in a higher-than-average spring tidal range during the time of both breakaways, thereby further increasing ebb current flows.     

Seaport OPX estimated that at the time of both breakaways, freshwater discharges into the lower catchment were approximately 1,500 cubic metres per second (Figure 14).

Figure 14: Catchment inflows and subsequent water levels and current speeds

Source: Seaport OPX, annotated by the ATSB

The current meter at 2F beacon was installed at a minimum water depth of approximately 5 m. Simulation results produced by Seaport OPX for the time of the breakaways indicated that maximum surface current at the Fisherman Islands berths was greater than that recorded by the meter and estimated the ebb flows to be 1.5 to 2 knots higher than a normal spring ebb tide. Current speed was also found to vary across the channel, with lower speeds closer to the wharf. 

The report stated that hydrodynamic conditions ‘were complicated by the likely presence of a strong density-driven stratification of the flows over the draught of the moored vessels, with higher speeds and lower water density near the surface compared to at the bottom of the draught of the vessel’ (Figure 15). According to modelling, the vertical stratification of the flows over the draught of the moored ships meant that denser saline water could flow slowly upriver even while the freshwater surface layers were flowing seaward at up to 3 knots. 

Figure 15: Cross-section of simulated current speeds

Source: Seaport OPX, annotated by the ATSB

The report noted that these aspects could not be fully integrated into the mooring analysis software and increased the uncertainty of the analysis. While the forces simulated for the increased river current velocities introduced increased forces on both ships’ mooring systems, the model did not predict that the mooring line minimum breaking loads, nor the loads at which the mooring winches were expected to render, would be exceeded under those environmental conditions alone.

However, Seaport OPX also advised that limitations in the simulation software also probably resulted in the calculated line forces and the ship’s yawing motions being underestimated for each event.

Passing ship interaction

When a ship passes close to a berthed ship, there will be hydrodynamic interaction between them, potentially causing the berthed ship to move. The magnitude of the hydrodynamic forces, which may cause the berthed ship to surge, sway and/or yaw, will depend on factors such as the speed of the passing ship, the passing distance, both ships’ under-keel clearance and relative displacements and whether the berth is open to water on all sides or only on one side, for example, at a river berth.[10] 

The magnitude of these interaction forces and the risk of a breakaway can be reduced by the following measures as appropriate:

• ensuring ships pass at the minimum speed for steering
• providing a greater distance margin when manoeuvring in proximity to berthed ships
• reducing water flow disturbances through greater reliance on tugs to manoeuvre (as opposed to using the ship’s engine)
• in ports that experience fast-flowing water currents, planning ship movements to avoid peak ebb and flood tidal flows to reduce the risk of interaction with berthed ships.

Generally, these considerations are well known to pilots, who are experts in ship handling and have detailed local knowledge of the port, including factors related to tidal conditions and under‑keel clearances. 

Prior to each occurrence, OOCL Brisbane and CMA CGM Bellini had been berthed alongside for more than 20 hours. Each breakaway occurred shortly after another ship (Delos Wave and APL Scotland, respectively) had passed in the adjacent channel and started manoeuvring into the berth ahead. 

The Seaport OPX model indicated that the observed surging and yawing motions of OOCL Brisbane and CMA CGM Bellini were likely exacerbated by the effect of the passing ship’s surface displacement wave interactions. 

The interactions were also shown to be ‘enhanced by strong ebb currents, which effectively increased the through-water speed of the passing ships, resulting in additional squat and thus a greater drawdown wave.’ However, the model predicted that this effect alone was not significant enough in either occurrence to exceed the berthed ship’s mooring system capacities. 

Effect of a ship berthing ahead

In its analysis, Seaport OPX submitted that the increased surface currents at the berths were likely further accelerated by the berthing of Delos Wave and APL Scotland ahead of OOCL Brisbane and CMA CGM Bellini, respectively. The report stated that:

Hydrodynamic processes associated with strong surface currents generated during significant freshwater river discharges… were likely further accelerated locally by the berthing of a vessel immediately upriver… initiating lateral force and yaw moments on the moored vessels through mechanisms that could include: 

• inherent turbulence in the incident mean flows
• blockage effect interactions between the upriver berthing vessel and the berth structure and the seabed, resulting in uneven acceleration of flows and hydrodynamic forces around and under the downstream moored vessel
• vortex shedding around the blunt stern hull form generating alternating crossflow forces on the vessel hull
• variations in current speed forcing over the draught due to strong stratification and unequal forcing on the vessel hull
• internal wave effects

The report noted that the use of the main engine during the berthing of Delos Wave and APL Scotland introduced additional hydrodynamic interactions on the berthed ships which likely contributed to both breakaway occurrences. 

Wind

The Seaport OPX model simulation indicated that the mild to moderate winds observed at the time of each occurrence were unlikely to have contributed significantly to the breakaways. 

Maritime Safety Queensland

Marine legislation in Queensland is administered and implemented by Maritime Safety Queensland (MSQ), a state government agency within the Department of Transport and Main Roads (DTMR). As such, MSQ is responsible for safety oversight of pilotage, pollution protection services, vessel traffic services (VTS) and the administration of all aspects of ship registration and marine safety in the state.

The agency’s core focus is the preservation of life and property in the state’s waters and in the prevention of, and response to, ship-sourced pollution and other maritime emergencies and disasters. This includes the development of hazard‑specific plans.

Queensland’s 5 maritime regions, including the Brisbane region, are each controlled by a regional harbour master (RHM).[11] For their respective region, each RHM is responsible for:

• improving maritime safety for shipping and small craft through regulation and education
• minimising ship sourced waste and providing response to marine pollution
• providing essential maritime services such as pilotage, vessel traffic services and aids to navigation and
• encouraging and supporting innovation in the maritime industry.

Port Procedures and Information for Shipping manual 

The Port of Brisbane had a publicly available Port Procedures and Information for Shipping manual (PPM) which defined the standard procedures to be followed in the port’s pilotage area. The PPM also contained information and guidelines to assist the masters, owners, and agents of ships arriving in the port and traversing the area, including details of the services, regulations and procedures established for the port.

Port tidal and weather information

The PPM provided a basic description of the port and its facilities. A general description of environmental conditions that may be experienced in the port provided that:

The majority of berths at the port of Brisbane are located at Fisherman Islands, at the mouth of the Brisbane River which extends into Moreton Bay. The area is very exposed to the prevailing winds which include fresh to strong SE trades year-round, strong N/NE sea breezes in the afternoons during the summer months and strong to gale force SW/W winds in the late winter months.

Advice that the river on which the port was located was subject to dam releases and flooding was not contained within the manual.

General tidal information for the port was also provided in the PPM, including the mean spring tidal range (1.8 m) and the location of tide gauges. The PPM sought to remind port users that tidal ebb and flows can begin or continue after the times of high or low water at various localities in the Brisbane River, noting that ‘this should be borne in mind when booking ships in for ‘head up’ or ‘head down’ berthing’. 

The PPM advised that tidal stream information for the port was available from the office of the RHM. Additionally, VTS could provide real-time tidal/current conditions and weather information from tide gauges and weather stations within the port, as well as weather forecasts, shipping schedules, navigational warnings and any other special operational requirements. 

Fisherman Islands berth information

The PPM provided a description of the different berth locations in the port and any special requirements and precautions to be observed at each location. For Fisherman Islands berths, the PPM identified strong south‑easterly offshore winds as a factor requiring extra attention to ensure ships were moored safely. While the PPM highlighted that this responsibility lay with the ship’s master, it noted that pilots and terminal operators would provide support, including recommendations for mooring arrangements.

Ship interaction provisions

Berth surging and interaction in the Brisbane River was highlighted as a risk in the PPM for berths upriver from Pelican Banks. It stated that berth surge is caused by a variety of environmental factors, poor mooring arrangements and overall ship preparedness, and normally triggered by a ship passing the berthed ship. The PPM warned that surge events could result in parted mooring lines, damaged gangways, impacts to the environment and injury to persons. The PPM provided a list of berths within the port that were prone to ship interaction and detailed precautions that were to be taken by both passing ships and ships alongside. Berths at Fisherman Islands, where the adjacent channel is wider than for those upriver, were not included in the list.

To assist in the management of berth surge, the PPM stipulated an operational speed limit of 6 knots through the water for ships with draught of more than 3 m. This restriction applied only when passing ships upriver from Fisherman Islands berths.

Towage requirements

The PPM specified towage requirements for ships berthing and unberthing at Fisherman Islands. Two tugs were normally required for ships more than 150 m in length, while ships more than 300 m long required a third tug to be turned around in the channel. The PPM stated that tug requirements were based on the ship stemming the current when berthing and departing and that manoeuvring with the current on the ship’s stern may require the use of an additional tug. Under normal environmental conditions, a tug could be substituted by an efficient bow thruster. 

Extreme Weather Event Contingency Plan

The Queensland Government had published an Extreme Weather Event Contingency Plan (EWE) for each maritime region. Each plan detailed the response required from ship masters and owners to different warning and/or alert levels in that region.

The Brisbane EWE (2021–2022) was intended to address the range of adverse weather events that may affect the region, such as summer storms, river flooding or the effects of a cyclone. It was the responsibility of ship owners and masters to take the necessary action within the context of the official weather warnings to protect their passengers, crew and ships, and comply with any directions from the RHM. This included the requirement for all ships to have a safety plan.

The EWE noted that, at times, it may be necessary for the RHM to give directions in relation to the operation and movement of ships when entering, operating in or leaving the pilotage area. This included the evacuation of commercial ships to sea and closure of the pilotage area to all marine activities and operations.

The plan outlined an incremental response encompassing prevention, preparedness, response and recovery phases. The plan aimed to allow appropriate actions in response to the imminent threat to be planned and implemented. Under the EWE, the primary objective was to have the port area secure and safety plans enacted at least 6 hours before the weather event occurred.

Vessel traffic service extreme weather event procedure

An internal extreme weather event procedure provided information to VTSO’s for such events in the Brisbane region and the responses required. It stated that the procedure was informational in nature and was to accompany additional procedures outlining specific VTSO responsibilities and actions to be undertaken during extreme weather events.

The procedure outlined some general trigger points and related response actions for significant storm, wind and surf warnings, as well as notifications relating to potential dam release and flood warnings for the Brisbane River. 

General dam release and flood warning response actions included monitoring flood effects on tidal flows, debris in the river and weather warnings. Port users were to be kept informed of the situation through appropriate means of communication.[12] Individual, high‑risk commercial ships and facilities could also receive specific advice and instructions through direct messaging from the RHM. Other, relevant, flood-related precautions contained in the procedure are shown in Table 1.

Table 1: Selected VTS extreme weather event procedure flood warning related actions

Severe weather information

Advice for severe weather was publicly available via the MSQ website.[13] Among other information, this included links to state and regional extreme weather event contingency plans.

Weather monitoring

The principal source of weather forecasts, warnings and information for MSQ (via a subscription service) was BoM. Brisbane VTS received forecasts and warnings from BoM for weather, storm, rain, wind and flood conditions. The information received was passed on to port users by VTS via VHF channel 67 and other means such as email and phone messaging, as required.

In addition, MSQ obtained weather data from a network of 6 tide gauges and 12 weather stations located in the port and surrounding areas, as well as the single current flow meter. The current speed from the meter was prominently displayed on an electronic display board in the VTS centre. 

Brisbane VTS routinely received weather reports from several sources including Seqwater and the PBPL Nonlinear Channel Optimisation Simulator system (NCOS). The NCOS system provided wind forecasts and automated warnings to VTS for the port and surrounding Moreton Bay areas. Advice from Seqwater regarding water releases (forecast and actual) from Wivenhoe Dam was also provided to VTS. 

Risk management arrangements

The tools available to the RHM’s team for identifying and mitigating the risks that extreme or adverse weather posed to port operations consisted of the PPM, EWE and VTS extreme weather event procedure. The ATSB also reviewed email correspondence between the RHM and other MSQ officers between 5 and 23 May. The email archive documented MSQ’s response to notifications and warnings it received regarding forecast rain, dam releases and potential flooding. Further emails from the same period documented MSQ’s subsequent correspondence with port stakeholders such as PSP, ships’ agents, terminal operators and other government agencies. 

The correspondence indicated that MSQ began preparing for potential port schedule disruptions on 6 May, following receipt of the notifications and warnings. The preparation actions included increased monitoring of weather warnings and current meter readings, suspension of immobilisation permits, requesting that ships deploy additional mooring lines and the provision of information and advice to various stakeholders and port users. While these actions implemented by MSQ reflected those documented in the VTS extreme weather event procedure, they were developed in isolation rather than via the involvement of other stakeholders with specialist marine knowledge, such as PSP. Throughout this period, the RHM and PSP were also required to concurrently manage disruptions due to rough seas and swell at the pilot boarding ground (PBG).

As per the EWE, additional restrictions at Fisherman Islands, while not expressly provided in the PPM or VTS extreme weather event procedure, were implemented at the discretion of the RHM to mitigate the risk to port safety posed by the increased current flows. Ships more than 300 m long were not permitted to berth and all new arrivals were required to berth port side alongside (head‑up). New arrivals to berths upstream of Pelican Banks were also suspended.

Decisions relating to these restrictions were primarily informed by the RHM’s appraisal of current meter observations and the response measures implemented were consistent with the documented procedures in place at the time. The email correspondence did not refer to any specific pre-determined trigger points or safe operating limits at which additional measures might be required, or when river current strengths might be considered too strong for the safe continuation of ship movements. 

On the morning of 16 May, prior to the OOCL Brisbane breakaway, VTS notified port stakeholders, including PSP, that some of the restrictions at Fisherman Islands would be eased from the following day. This would allow some selected ships to berth starboard side alongside (head-down) at Fisherman Islands, subject to the specific berth, each ship’s particulars and observed current flow conditions. Movements to berths upriver from Pelican Banks were also to resume, subject to additional restrictions. 

Following the breakaway of OOCL Brisbane, the RHM decided that the restrictions that were to be lifted would instead be maintained, while planned movements upriver from Pelican Banks were permitted to proceed from 17 May. On 18 May, the RHM lifted the restriction on ships more than 300 m long berthing at Fisherman Islands. At the time of the breakaway of CMA CGM Bellini, restrictions and precautions for ships less than 300 m in length had not been changed or expanded on since the earlier breakaway 4 days prior. 

Pilotage

Pilotage is the key risk control to ensure safe movement of ships in the port. Pilots are competent ship handlers with detailed local knowledge, including currents, tidal variations and other relevant factors. Pilotage providers are responsible for managing the safety risks associated with delivering this specialist service and an essential resource for port authorities, particularly in abnormal weather conditions.

Since 1 January 2022, pilotage services for Brisbane have been provided by Poseidon Sea Pilots (PSP). 

Safety management system

As part of its obligations for ensuring safe delivery of pilotage services, PSP maintained a Pilotage Operations Safety Management System (POSMS). It was intended to complement the PPM and, in the event of inconsistency, the PPM was to take precedence. The POSMS was reviewed and endorsed by MSQ and subject to an annual audit schedule. 

The POSMS contained procedures and guidance for the preparation and conduct of pilotages, including passage planning. These provisions made it the responsibility of the assigned pilot to confirm the environmental conditions at the time of each scheduled pilotage, including current speed and direction. While some guidance was provided for wind conditions, including force calculations for wind speed versus exposed ship area, hazardous conditions associated with other factors such as river flood or abnormally fast current flows were not mentioned. 

The POSMS described general principles and processes for risk management and the responsibilities of key management personnel for managing issues related to the safe, effective and efficient delivery of the pilotage service. These responsibilities extended to engagement with pilots, PBPL, ships’ agents and VTS on operational issues and, where required, consultation with the RHM to discuss closure of the port during adverse weather events. Specific operational risks associated with environmental conditions were not included. There were no procedures contained within the POSMS to describe when and how PSP management would initiate its preparation and response to conditions which may negatively impact the safety of its operations.

The POSMS did not provide for any formal process or structure to address and document PSP’s participation in the management of wider port and regional safety to which the pilotage service provider is an important and major contributor. While PSP management supported decisions taken by MSQ and the RHM’s directions in response to the weather event, it was not directly involved in any formal process for assessing and addressing risks affecting pilotage, such as increased river current flows.

Previous occurrences

On 26 February 2022, the container ship S Santiago broke away from its berth at Fisherman Islands when its mooring lines parted as another container ship was being berthed ahead and upriver of it. S Santiago was resecured alongside its berth 30 minutes later, with tug assistance. At the time, the ship’s master stated that a 20 to 25 knot wind had pushed the stern away from the wharf, resulting in several mooring lines parting. At the time, the river was in flood following an extreme weather event.

The following day, as the weather event continued, the oil products tanker CSC Friendship broke free from its berth at the Ampol products wharf at Lytton, upstream of Fisherman Islands. At the time, a persistent ebb current was flowing at about 4.5 knots. The ship was swept across the adjacent channel and grounded about 400 m downstream, on the opposite side of the river. The ship remained fast aground until refloated at 0500 the next day.

A subsequent ATSB investigation (MO-2022-003) identified that the river current had exceeded the limits for the design of both the berth and the ship’s mooring arrangements. The investigation found that deteriorating conditions associated with the flood event and subsequent increased safety risk to shipping and the port were foreseeable. The BoM had issued warnings of the impending event from 21 February, which provided sufficient information to identify the increased likelihood of a breakaway. 

The investigation identified that MSQ did not have structured or formalised risk or emergency management processes or procedures and consequently, it was unable to adequately assess and respond to the risk posed by the river conditions and current. 

Additionally, PSP, as the port’s pilotage provider, did not have procedures to manage predictable risks associated with increased river flow or pilotage operations outside normal conditions. As a result, PSP had not properly considered risks posed by the increased river flow and taken an active role until after the breakaway.

Safety analysis

Introduction

In the early weeks of May 2022, areas of south-eastern Queensland, including catchments of the Brisbane River, experienced heavy rainfall that resulted in a series of controlled dam water releases upriver from the Port of Brisbane. The subsequent high freshwater inflows into the river resulted in increased current speeds through the port, exposing ships to the risk of breaking free from their berths. 

On 16 May 2022, the container ship OOCL Brisbane broke away from its berth at Fisherman Islands after its mooring lines parted. This occurred immediately after another ship, Delos Wave, had passed in the adjacent channel and manoeuvred to the berth immediately ahead of it. 

Four days later, another container ship, CMA CGM Bellini, was alongside a berth at Fisherman Islands when 2 of its forward mooring lines parted and its bow drifted off the berth. As in the breakaway on 16 May, another ship, APL Scotland, had just passed and berthed ahead of CMA CGM Bellini. 

The breakaways 

There was no evidence of any defective mooring equipment on either OOCL Brisbane or CMA CGM Bellini, which could have contributed to the occurrences. Each ship had been secured with sufficient mooring lines, including additional lines required by the regional harbour master (RHM) to mitigate the increased river current. 

At the time of the occurrences, freshwater inflows to the river from heavy rainfall and dam releases were estimated to be 1,500 cubic metres per second, resulting in ebb current flows at the port about 1.5–2 knots higher than observed during a normal spring ebb tide. The ebb tidal flows were also amplified by the advent of a perigean spring tide from 16 May which increased the average spring tidal range during the time of both breakaways.

Due to probable current variation with depth, surface current speeds at Fisherman Islands berths were likely higher than indicated by the port’s only current flow meter, located upriver from the berths. Both breakaways occurred on the mid to late ebb tide, when current flows were near their maximum. These conditions resulted in increased loads on the ships’ moorings. 

However, both OOCL Brisbane and CMA CGM Bellini had been berthed alongside for over 20 hours, during which time there had been no issues with the moorings of either ship. A mooring analysis conducted by a specialist hydrodynamic modelling company commissioned by port management later estimated that the additional mooring loads created by the strong ebb currents alone should not have exceeded the mooring equipment capacities of either ship.   

Significantly, each breakaway occurred shortly after another ship (Delos Wave and APL Scotland, respectively) passed in the adjacent channel and began manoeuvring into the berth ahead. Given the timings and the above finding of the hydrodynamic modelling specialist, it is almost certain that the interaction forces and water flow disturbances created by the proximity of the berthing ships contributed to both breakaways.

The speed and distance at which Delos Wave and APL Scotland passed the berthed ships were within the operating limits and usual pilotage practices for normal conditions, including usual river flow. The strong ebb current flow, however, meant the passing ships’ effective speed through the water (as opposed to speed over ground) increased the effect of surface displacement wave interactions associated with their movement, causing the berthed ships to surge and yaw. Further, the hydrodynamic modelling indicated that the forces associated with the ships passing were probably insufficient on their own to have led to the breakaways.  

When Delos Wave and APL Scotland manoeuvred ahead of the berthed ships, the already high surface current speeds at the berths were further accelerated due to a complex range of hydrodynamic factors. These included interactions between the upstream berthing ship, the berth structure and the seabed, as well as disturbances created from the operation of the berthing ship’s main propulsion. These factors, combined with the prevailing environmental conditions at the berths, contributed to the yawing forces on OOCL Brisbane and CMA CGM Bellini and increased the load on their respective mooring systems until they ultimately failed.

Risk management

Maritime Safety Queensland

Effective risk management relies first and foremost on identification of all the relevant hazards. The involvement of personnel/organisations with subject matter expertise and knowledge in that initial process provides the best opportunity to mitigate the associated risk. 

Maritime Safety Queensland’s (MSQ) procedures for managing risks posed by extreme and adverse weather events provided general guidance on precautionary steps to be taken in the event of river flood and increased current flows. However, they did not provide for any formal risk assessment arrangements involving specialist input from key stakeholders, including the port’s pilotage provider, Poseidon Sea Pilots (PSP). The collective expertise of PSP’s pilots in respect to ship handling (including factors pertaining to ship interaction) was a valuable resource available to the regional harbour master (RHM) for consultation and advice. 

In this case, MSQ received dam water release and flood notifications and subsequently identified that resulting high river current speeds would increase the risk of a breakaway. In response, MSQ increased its monitoring of current meter data and implemented precautions and restrictions at Fisherman Islands. While these measures were aimed at addressing increased current flows, the more complex hazard of increased hydrodynamic interaction between passing and berthed ships was not identified. 

While that complexity meant that the hazard may not have been obvious prior to the OOCL Brisbane breakaway, it was readily identifiable following that initial occurrence. Had MSQ and PSP engaged in a re-assessment of the risk and existing precautions it would have probably resulted in considering additional controls such as:

• restricting ship movements during ebb tides
• minimising passing speeds
• maximising passing distances
• the greater use of tugs to minimise use of the ship’s engine.

However, the opportunity to identify such controls was missed as MSQ procedures did not require or prompt formal collaborative risk assessment with PSP and other relevant stakeholders. Consequently, no further controls were in place when CMA CGM Bellini broke away 4 days later in almost identical circumstances. 

Further, MSQ procedures did not identify current speed or catchment inflow trigger points to inform its response to the escalating situation. Its procedures for weather event preparedness could have benefited from the routine and early involvement of PSP and other key stakeholders to help establish specific limits and triggers to assist with identifying the need for additional risk mitigation.    

Poseidon Sea Pilots

Pilotage is a principal risk control for ensuring the safety of port operations and ship movements. Pilotage service providers should therefore be actively involved in preparations for, assessment of, and response to, any situation affecting shipping in the port. 

As weather and river conditions began to impact the port in the days leading up to the breakaways, PSP management received communications from MSQ relating to dam releases, potential flooding and high ebb current flows. These exchanges included information regarding observed current data, the requirement for additional mooring lines and movement restrictions implemented by the RHM.

While PSP complied with the RHM’s directions, as detailed above, it was not actively involved in any formal process to identify and assess potential risks that the conditions would pose to pilotage operations. Greater involvement of PSP would have increased the likelihood that all hazards associated with the increased river flow were identified and addressed, particularly following the initial breakaway. 

The ATSB found that the company’s pilotage operations safety management system (POSMS) only contained procedures for conducting ships in normal conditions. It did not identify flooding or high current flows as a hazard that might affect pilotage operations nor contain any guidance on how these conditions would be managed. Consequently, the POSMS did not address all the operational risks that PSP pilots could be expected to manage when conducting ships. 

Finally, while the POSMS identified the responsibilities of key management personnel for managing issues related to the safe, effective and efficient delivery of pilotage services, procedures detailing how these duties were to be discharged did not exist.

Findings

From the evidence available, the following findings are made with respect to the breakaway occurrences involving OOCL Brisbane and CMA CGM Bellini in the Port of Brisbane, Queensland on 16 May and 20 May 2022, respectively.

Contributing factors

• Heavy rainfall resulted in significant freshwater inflows into the Brisbane River, including from several controlled releases from dams upstream from the Port of Brisbane. The inflows resulted in strong ebb currents through the port which increased the loads on mooring arrangements for ships berthed at Fisherman Islands.
• The combined effects of high ebb current speeds and interaction forces introduced by Delos Wave and APL Scotland when passing and manoeuvring ahead OOCL Brisbane and CMA CGM Bellini, respectively, resulted in the berthed ships’ mooring arrangement limits being exceeded.
• Maritime Safety Queensland and Poseidon Sea Pilots did not have a process to jointly and effectively identify and risk assess the hazards to shipping and pilotage that were outside normal environmental conditions. (Safety issue)

Safety issues and actions

MSQ and PSP assessment of risk  

Safety issue number: MO-2022-004-SI-01

Safety issue description: Maritime Safety Queensland and Poseidon Sea Pilots did not have a process to jointly and effectively identify and risk assess the hazards to shipping and pilotage that were outside normal environmental conditions. 

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the master and crewmembers of OOCL Brisbane
• the master and crewmembers of CMA CGM Bellini
• the master and crewmembers of Delos Wave
• the master and crewmembers of APL Scotland
• Australian Maritime Safety Authority
• Maritime Safety Queensland
• Queensland Government
• Bureau of Meteorology
• Seqwater
• Poseidon Sea Pilots
• Port of Brisbane
• Seaport OPX

References

Maritime Safety Queensland 2021, Port Procedures and Information for Shipping – Port of Brisbane, Queensland Government. <https://www.msq.qld.gov.au/shipping/port-procedures/port-procedures-brisbane>

Maritime Safety Queensland 2021, Maritime Safety Queensland Extreme Weather Event Contingency Plan Brisbane – 2021/2022, Queensland Government. <https://www.msq.qld.gov.au/safety/preparing-for-severe-weather>

The West of England Ship Owners Mutual Insurance Association (Luxembourg), Interaction Damage to Vessels Moored Alongside. 

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the master and operators of OOCL Brisbane
• the master and operators of CMA CGM Bellini
• the master and operators of Delos Wave
• the master and operators of APL Scotland
• Poseidon Sea Pilots
• Maritime Safety Queensland
• Australian Maritime Safety Authority
• Hong Kong Marine Department
• Ministry of Transport, Singapore
• Transport Malta
• Maritime Administrator, Marshall Islands

Submissions were received from:

• Poseidon Sea Pilots
• Maritime Safety Queensland

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 16 May 2022, a Robinson Helicopter Company (RHC) R44, registered VH-KOV and operated by Wellspring Rural Services Pty Ltd, was being used to conduct a series of sightseeing flights over the Limmen National Park including Lorella Springs Wilderness Park, Northern Territory, with a pilot and 3 passengers on board.

During the initial flight, the helicopter flew from the main house at Lorella Springs to the coast (Figure 1 inset), landing at 2 different locations where the passengers disembarked to fish. They then flew to a third location, where the passengers disembarked to swim at a waterhole. While the passengers swam, the pilot lit a fire to boil water for some refreshments. The fire was extinguished prior to departure.

The helicopter departed at approximately 1533 local time and flew to a valley which had sandstone rock formations along both sides of the valley, known as the Lost City, rising approximately 150 ft above the valley floor. They initially flew along the eastern side and then returned on the western side of the valley, at approximately 500 ft above the valley floor (Figure 1).

Figure 1: VH-KOV flight track overflying the Lost City

The dotted line is the final track of VH‑KOV, the inset details the track the helicopter took for the sight-seeing tour.

Source: Google Earth and OzRunways data, annotated by ATSB

The pilot later recalled that, as the helicopter re-crossed the valley to return to the main house, they detected a burning smell and recalled that within a couple of seconds the engine began to run slightly rough.

In response to the malfunction, the pilot advised their initial concern was getting over the sandstone formations on the eastern side of the valley and then landing at a nearby carpark ‑ the only clear space to land in the area. As the pilot lowered the collective to reduce power, in case the engine failed, they checked the engine oil temperature, pressure and cylinder head temperature gauges, which were all in the normal range.

Within about 3 seconds, the vibrations through the helicopter increased. A passenger in the right rear seat later reported detecting a light in the top left of the console along with a warning buzzer at this time, however this was not recalled by anyone else in the helicopter. The pilot observed the engine RPM suddenly rise, then drop to zero and assessed that the engine had failed. Still on the valley side of the sandstone formations, the pilot initiated an autorotation into an area of less dense trees. Prior to the flare just above the treetops, the pilot instructed the passengers to ’brace’.

The pilot advised that the helicopter fell through the trees, contacting the ground initially on the right front side, nose low, and then the helicopter spun and rolled on to the left side facing the opposite way to the direction of travel (Figure 2). 

Figure 2: VH-KOV

Source: Operator

The pilot advised that they undid their seatbelt and collected the emergency kit from under their seat. This contained a first aid kit, emergency rations and a satellite sleeve.[1] They then moved to the side of the helicopter and tried unsuccessfully to connect their mobile phone to the satellite sleeve (see the section titled Satellite sleeve) to raise an alert.

As a result of the impact, fuel was leaking from between the back seats onto the passenger in the rear left seat. The passenger located in the rear right seat, released themself from their seatbelt and assisted the other rear seat passenger out of the helicopter. The passengers asked the pilot for a fire extinguisher and were advised there was none onboard. They also requested a first aid kit, however this was not provided and the passengers later advised there was no first aid kit on the aircraft. Together, the passengers then assisted the front seat passenger to exit the helicopter.

The passengers then asked the pilot to ensure the emergency locator transmitter (ELT) (see the section titled Emergency locator transmitter) was working. The pilot re-entered the wreckage and selected the ELT remote switch in the cockpit to ON and reselected the main battery to ON, however the ELT unit failed to activate. As they were concerned about a fire starting due to the leaking fuel, the pilot and passengers began to walk to the carpark, about 1.5 km from their location.

When the helicopter did not arrive back at the main house at the pre-arranged SARTIME,[2] the operator took a second company R44 to search for VH-KOV. They flew directly to the landing area near the waterhole where the operator identified that the remains of the fire were still warm. Consequently, they flew towards the Lost City searching for VH-KOV as this was the next destination on the standard route flown during the scenic flight.

The operator detected the accident pilot and passengers near the carpark and landed the helicopter close to them. They then transported them, in 2 groups, back to the main house.

Two passengers sustained serious injuries, with the pilot and remaining passenger having minor injuries. The helicopter was substantially damaged.
 

Helicopter

The Robinson Helicopter Company (RHC) R44 Raven I is a four-seat helicopter, with hydraulically boosted flight controls. It is powered by a Lycoming O-540-F1B5 series, six-cylinder carburetted piston engine. VH-KOV, serial number 1762, was manufactured in 2007 and placed on the Australian register in the same year. The front passenger and pilot doors had been removed, leaving the rear passenger doors installed. Quick disconnect pilot controls for the front left seat had also been removed. In July 2015, the helicopter had undergone an overhaul at 2,200 hours with a second overhaul due in 116.4 hours.

The helicopter was maintained in accordance with the manufacturer’s maintenance schedule, which required a periodic inspection every 100 hours or 12 months, whichever came first. A periodic inspection was completed on 30 July 2021 at 4,183.7 hours in-service. The accident occurred at 4,283.6 hours.

The RHC maintenance manual stated that the ‘inspection interval may be extended up to 10 hours, without accumulation’. There were a number of occasions where the operator had overflown the 100 hourly inspection requirements, however the following inspection interval had not been reduced by the overflown hours. The operator had recorded the overflown hours and had purchased a second R44 to reduce the likelihood of this occurring in the future.

Table 1 details maintenance actions conducted between the last periodic inspection and the accident. 

Table 1: Overview of recent maintenance

Accident site

The ATSB did not attend the accident site. The helicopter was partly disassembled on site, including engine removal, and transported to Queensland for examination. Engine and airframe examinations were conducted between 19–21 September 2022.

Engine inspection

The engine teardown inspection was conducted at a CASA-authorised engine overhaul facility and observed by the ATSB. On removal of the cooling fan shroud, the engine cooling fan was found to have separated due to a fracture of the shaft at the clutch actuator lower bearing (Figure 3). The fracture location showed evidence of significant overheating. All associated components were retained for further detailed examination.

Some of the engine components displayed damage consistent with an overspeed event, however examination of the engine did not identify any condition or failure that would have resulted in sudden power loss or stoppage.

Helicopter examination

The ATSB examined the airframe at a storage facility. The tail cone and main rotor transmission assembly had been removed to assist transport. Similarly, the main rotor blades, sectioned near the hub, and some sections of the landing gear had also been removed and were not available for examination. The tail rotor gearbox and stabiliser assemblies separated from the helicopter during the impact sequence. All damage was consistent with overstress from impact forces. In addition, the examination identified:

• flight control continuity
• some impact damage to the fuel tanks however, the bladders were intact
• the fuel tank interconnect line had fractured in overstress and was the reason for the post‑impact fuel leak
• the main and tail rotor transmission assemblies exhibited no evidence of failure and could be rotated without restriction.

In summary, no failure or other condition, beyond the fan shaft failure, was identified that would have affected normal operation of the helicopter.

Lower sheave and fan shaft

Examination of the aft face of the lower sheave revealed accumulated grease consistent with it extruding past the lower bearing seal over a period of time. The maintainer reported wiping the sheave clean each time they worked on the helicopter however, the accumulated grease was not consistent with this having occurred at the last reported maintenance action requiring the bearings to be lubricated, 10 days prior to the accident or 22 hours of operation.

The fan shaft failed at the location of the lower bearing. The shaft exhibited deformation, necking, and gouging consistent with localised frictional heating. Circumferential scoring on the fracture surface was a result of the powered shaft contacting the bearing housing.

Figure 3: Lower sheave showing accumulated grease and failure of the shaft to the cooling fan

Source: ATSB

Lower bearing

The ATSB examined the clutch actuator lower bearing at its Canberra technical facility. The forward face of the bearing housing exhibited matching gouging from contact with the rotating fractured engine output shaft (Figure 4). The cover plate was removed, and the bearing was found to have seized. The damage observed was consistent with intense heat and subsequent seizing of some of the rollers. The cage and intermediate spacer were also found to be heat-damaged.

Figure 4: Damage to lower actuator bearing

Source: ATSB

Grease residue was visible in the bearing housing (Figure 5) however, the intense heat associated with the bearing and fan shaft failure precluded the ability to determine the quality and quantity of grease and the condition of the seals prior to the occurrence.

Figure 5: Lower actuator bearing housing, showing minimal dried grease

Source: ATSB

R44 drivetrain

A V-belt sheave is bolted directly to the engine output shaft (Figure 6). Rubber V-belts transmit power to the upper sheave, which contains an overrunning clutch. The upper sheave transmits engine power via a shaft both forward to the main rotor and aft to the tail rotor.

A bearing, connected to an electric clutch actuator, is mounted between a direct-drive fan wheel and the engine on the engine output shaft. The fan supplies cooling air to the cylinders and oil cooler via a fibreglass and aluminium shroud.

Figure 6: R44 drive system

Source: Robinson Helicopter Company, annotate by ATSB

The electric clutch actuator (Figure 4) raises the upper sheave and tensions the V-belts. The actuator senses compressive load and switches off when the belts are properly tensioned. The ‘clutch’ caution light, located in the top left of the console, illuminates when the actuator is engaging, disengaging, or retentioning the V-belts. Regarding activation of the light, the pilot operating handbook (POH) stated:

If … the [clutch] light flickers or comes on in flight and does not go out within 10 seconds, pull CLUTCH circuit breaker and land as soon as practical. Reduce power and land immediately if there are other indications of drive system failure (be prepared to enter autorotation).

RHC Safety Tip 7 included:

A change in sound or vibration of the helicopter may indicate an impending failure of a critical component. If unusual sound or vibration begins in flight, make a safe landing and have aircraft thoroughly inspected before flight is resumed.

RHC Safety Notice SN-28

Listen for impending bearing failure included:

An impending ball or roller bearing failure is usually preceded by a noticeable increase in noise. The noise will typically start several hours before the bearing actually fails or before there is any increase in bearing temperature. To detect pending failure of a drive system bearing, the pilot should uncover one ear and listen to the sound of the drive system during start-up and shutdown. After the pilot becomes familiar with the normal sound of the drive system, he should be able to detect the noise of a failing bearing. The failing bearing will produce a loud whine, rumble, growl or siren sound…Failure of a bearing in flight could result in a serious accident.

Do not rely on telatemps to indicate impending bearing failure. A failing bearing may not run hot enough to black out the telatemps until it actually starts to disintegrate. This may occur only seconds before complete failure.

Clutch light warning

It is normal for the clutch light to come on occasionally in flight for a short time (approximately 3 to 6 seconds) to re-tension the drive belts. If the clutch light flickers or does not go out within 10 seconds, it can indicate a belt or bearing failure….

If additional symptoms of drive system failure (smell of hot rubber, noise or vibration) are present, land immediately. If tachometer needle split occurs, enter autorotation.

The operator advised they listened for sounds of bearing noises during the start-up and shutdown of the helicopter and had not detected any unusual noises or vibration. The accident pilot advised this was their first flight in VH-KOV this season and they had not noticed anything unusual during the flight.

Robinson Helicopter Company maintenance requirements

Periodic inspection

As part of a periodic inspection, a helicopter was subject to a ground inspection, engine run up and flight check. This included checking for ‘no unusual bearing noise when varying RPM through operating range (mechanic to listen near V-belt drive)’. These inspections were not included in the worksheet records however, the maintainer reported they were completed each time.

Lower bearing

The fan shaft assembly, including lower bearing had been replaced at the 2,200-hour overhaul. The periodic inspection checklist required:

Inspect as much of bearing as can be seen. Inspect fibreglass scroll area at bearing attachment brackets for signs of cracking. Check bearing seals for evidence of deterioration…Inspect bearing per Section 2.502 if discrepancies are found.

RHC required the bearing to be inspected as per section 2.502 whenever there was a bearing discrepancy, or the fan wheel was removed. Section 2.502 required removal of the fan wheel and disconnection of the clutch actuator from the lower bearing. The bearing was to be rotated by hand to ‘verify no roughness, scraping or excessive looseness’. In addition, there was a requirement to ‘verify no seal damage, no heat damage and lubricate as per Section 1.140’.

The lower bearing was to be lubricated as per Section 1.140 every 300 hours or 3 years, whichever came first, or as directed by 2.502. The procedure required 4–5 g of the specified grease to be injected, by syringe, into the bearing via a screw hole (Figure 4). A ground run was to be conducted at 102% RPM for 2 minutes. Following shutdown, the bearing was to be inspected and cleaned of escaped grease.

Upper bearing

There was no maintenance requirement to lubricate the upper bearing on the R44. In contrast, the upper bearing on the R22 was to be lubricated every 300 hours or 12 months. The R22 upper bearing lubrication procedure required a syringe be filled with 2–3 g of grease. The syringe tip was to be inserted against the ‘cleaned’ inner lip of the rubber seal and grease injected into the bearing. Once the syringe was removed, the deflected seal could be gently manoeuvred back into place.

VH-KOV bearing lubrication

A review of the maintenance records identified documented lubrication of both the upper and lower bearings (Table 2).  

Table 2: Recorded lubrication of the upper and lower bearings

The maintainer advised they greased the bearings more often that the 300-hour requirement as the grease used, Grease 28, is very thin and as the helicopters were operating in a hot environment ‘we like to over maintain our bearings because if we didn’t, they would run dry’. Further, the maintainer advised they did not always certify the additional greasing in the maintenance records and therefore the frequency could not be verified.

Considering the recorded lubrication intervals of the lower bearing, Robinson Helicopters stated:

We do not see damaged lower bearings in any significant numbers. The ones that do get reported, typically have a poor service history. Every instance of bearing damage is going to be different so it would be impossible to apply a timeline to complete bearing failure after an unknown amount of damage. These particular bearings appear to have gone over 1000 hours since the most likely time of damage (after the 515-hour interval) and it is highly likely that signs of damaged bearings existed (noise, actuator issues, grease outside the seals, rough running bearings, etc.). There are two occasions…where the scroll had been removed for actuator repair when the mechanic should have put his/her hand on the bearing and rotated it to feel for roughness and any grease on the lower sheave would have been right there in plain view.

When questioned on the method for lubricating the upper bearing, the maintainer stated that they used the same method as for the lower bearing, via the screw hole. However, the ATSB inspected the upper bearing and noted the telatemp was covering the screw, with no evidence of it having been accessed. Additionally, the seal on the upper bearing, which was a type of rigid polymer, showed distortion consistent with the R22 syringe lubrication method (Figure 7). The grease was found to be solid and dark in colour (Figure 8). RHC advised that typically after 2,200 hours of operating, the grease will be dark brown but not grainy or gritty.

Figure 7: Distortion to the upper bearing seal

Source: ATSB

Figure 8: Grease found within the upper bearing

Source: ATSB

General provisions for lubricating bearings

Under-lubrication of a bearing can lead to over-heating due to the friction between the moving parts. However, lubricating more often than the procedures require can also result in over‑heating. When too much grease is added to the bearing cavity, it will result in the rotating bearing elements beginning to churn the grease and pushing it aside. This results in energy loss and rising temperatures. Over a long period of time, the grease will thicken into a hard, crusty build-up which can then impair lubrication and block new grease getting to the core. Excessive grease can also prevent heat from being dissipated, as the grease does not transfer heat from the load zone.

RHC advised the consequences of greasing more or less often than required   was not specifically mentioned in the maintenance manual as it was considered to be a basic maintenance practice, which should be covered during initial training. RHC also advised that, lower bearing maintenance and troubleshooting was covered in their Robinson Helicopter factory maintenance course.

Troubleshooting

The maintainer had replaced 3 of the 4 microswitches for the clutch actuator at the last periodic inspection and 22 hours prior to the bearing failure (refer Table 1). Replacing the microswitches required that the fan wheel be removed and hence, as per the procedure, the bearing was required to be lubricated.

There was no information in the trouble shooting section of the RHC maintenance manual to advise that if the microswitches were being replaced, then the maintainer should inspect the bearing. However, RHC advised this information was covered in their Robinson Helicopter factory maintenance course.

The troubleshooting section for ‘clutch light flickers in flight’ included to check the upper and lower bearing for rough running however, the operator had not noted a flickering clutch light prior to the accident flight.

Emergency locator transmitter

The KANNAD 40 AF-Compact emergency locator transmitter (ELT) fitted to the helicopter consisted of a remote switch/annunciator, located in the cabin left of the cyclic, and a transmitter, located in the main transmission bay, and normally selected to ‘ARM’.[3] With the transmitter selected to ARM, the 3‑position remote switch/annunciator, with indicator light, operated as follows:

• ON – ELT activated
• ARM – permitted ELT activation when subjected to high ‘G’ load
• Test/RESET – allowed brief functional testing of the ELT or reset in case of inadvertent activation
• Light – red light illuminated when the ELT was transmitting.

The remote switch in the cabin was normally selected to ARM during flight.

During the helicopter inspection, the remote switch in the cockpit was found in the ON position. It was reported that the ELT unit was also found in the ARMED position after the helicopter was transported. There were no indications of damage to the battery. The ELT mount was found secured to the correct frame with the required Velcro mounting strap and additional secondary black cloth strap. The antenna was securely mounted under the cowl. Due to the discontinuity of the wiring after the helicopter was moved, the wiring was not examined.

The ELT did not activate when the accident occurred however, the signal was received by the Australian Maritime Safety Authority (AMSA) about 10 hours later. The ELT was not examined and therefore the reason for the delay in transmission could not be determined. AMSA was contacted and confirmed there were no areas in Australia where an ELT signal could not be detected by satellite. The accident was in a remote location and so interference by a person was considered unlikely. Despite this, interference by an animal or a change in the conditions were possible. There was no forecast rain in the area.

Robinson Helicopter Company ELT maintenance procedures

While optional on the R44, many were fitted with the Kannad automatic fixed 406AF ELTs. Due to the high frequency of fitment, the ELT was recorded as a periodic inspection item in Chapter 1 of the maintenance manual where it stated that United States (US)‑registered helicopters were required to be inspected every 12 months, in accordance with the Code of federal regulations (CFR) 91.207 Emergency locator transmitters. This regulation does not apply to helicopters, however RHC advised it was guidance for the inspection of an ELT for US‑registered helicopters.

The ELT was not recorded as an inspection item on the periodic inspection worksheets in Chapter 2 of the maintenance manual for the R44 helicopter. In contrast, the R22 and R66 helicopter periodic inspections did list the ELT in their periodic inspection worksheets however, the inspection was limited to ensuring the ELT was secure in its mount and would not foul the drivetrain.

Chapter 37 Electrical systems of the maintenance manual stated that the component manufacturer’s instructions should be followed to conduct maintenance.

ELT manufacturer maintenance procedures

The ELT manufacturer’s installation and operation procedures recommended that a self-test be conducted once a month and that it was mandatory that the batteries be changed:

• on or before the battery expiration date
• following 1 hour of real use
• use in an emergency, or
• inadvertent activation of unknown duration.

In addition, the manufacturer acknowledged that some national aviation authorities may require a periodic inspection. They provided service letter SL S18XX502-25-12 with guidance on periodic inspection procedures to satisfy requirements as directed by the US, Canada and Europe. The service letter also stated that all other countries should refer to the local regulations and it was ‘the responsibility of the customer (aircraft owner) to determine which tests are applicable to its ELT’.[4]

Australian maintenance requirements for ELT

Airworthiness Bulletin 02-002 Emergency Locator Transmitter (ELT) installation and maintenance stated that:

A periodic inspection of the ELT system should be carried out in accordance with approved data, which can include FAA AC 43 13-1B Chapter 12-22, if AC 43.13-1B is identified in the aircraft logbook statement as part of the aircraft maintenance data, or is otherwise identified or incorporated in an approved System of Maintenance.

The aircraft’s maintenance documentation stated that minor repair work should be conducted in line with AC 43.13-1B Acceptable methods, techniques, and practices – aircraft inspection and repair, however CASA confirmed that this does not include maintenance actions. CASA also advised Federal Aviation Regulations do not apply in Australia and therefore operators cannot maintain the ELT in accordance with FAR 91.207.

VH-KOV ELT maintenance history

The operator advised that they occasionally conducted a self-test on the ELT, which it always passed. They presumed the ELT was being maintained during the 100-hourly inspection conducted by the maintenance organisation.

The maintainer advised that they did not maintain ELTs as the helicopters they maintained either had the units removed or switched to OFF, as they would ‘randomly transmit’. They further advised that they would have informed the operator of VH-KOV that the ELT would not be maintained when they initially began to maintain the helicopter in 2016. The maintainer also stated that they endorsed the maintenance release to state that pilots are required to carry a personal emergency position-indicating radio beacon (EPIRB)[5] or satellite phone. The ATSB could find no record of this endorsement on the current or previous maintenance releases for VH-KOV.  

The ATSB assessed the maintenance records and confirmed the ELT was serviced at the 2,200 hour major inspection on 17 July 2015. The only record of the ELT being inspected since then was on 2 occasions in 2018, when a different maintenance organisation conducted the periodic inspections. In addition, there was no note for the battery life in the maintenance records. An inspection of the ELT identified the battery had expired in March 2022.

At the time of the occurrence there was no regulatory requirement for VH-KOV to be fitted with an ELT (see the section titled Regulatory requirements around carriage of ELT). While optional, where it was fitted, it is important that a pilot is made aware of its operational status. Civil Aviation Advisory Publication (CAAP) 37-01 v5.1 Minimum equipment lists[6] included:

The operator or maintenance personnel must place the placard on or near inoperative equipment or instruments so that it is visible to the flight crew and alerts them to the inoperative equipment.

While the CAAP is only advisory, it represents best practice and an opportunity to ensure any pilot or maintainer is readily aware of the operational status of a component. There was no placard, or other notification, near the remote switch in VH-KOV to advise the ELT was not being maintained.

Inadvertent activation

AMSA was contacted to confirm if they had records of ELTs in Robinson Helicopters activating without cause. They advised that they were aware of the issue and considered it was due to:

• the position of the ELT switch between the front passenger seat and the pilot seat allowing accidental activation of the ELT switch when entering or exiting the aircraft.
• water ingress in the ELT assembly (the ELT is mounted inside the main transmission bay, which is not weatherproof). This was a regular and repeated event for Robinson helicopters.

RHC was contacted to see if they knew of any issues within the world fleet – they advised that one of their Australian repair stations confirmed they were aware of this issue. However, they advised there were no reports of issues in South Africa, Alaska or Canada other than ‘moving things in the cabin’ and hitting the switch.

The South African, US, and Canadian regulations require regular maintenance of the ELT unit.

The ELT manufacturer has advised that most inadvertent activations are due to water ingress in the wiring between the remote control panel and the ELT unit, however, this could not be verified.

Regulatory requirements around carriage of ELT

MOS Part 133 section 11.41 Carriage of ELTs required that a helicopter with more than 3 seats must be fitted with an automatic ELT. However, the transitional requirements allow operators to continue to operate under the previous legislation until 2 December 2023. The previous legislation, Civil Aviation Regulation 252A, permitted a helicopter on a flight within 50 NM from the departure aerodrome to operate without an ELT. As such, at the time, VH‑KOV did not require an ELT to be fitted.

The Mapping of Civil Aviation Regulations to CASR Part 91, 119 and 133-Australian air transport operations-rotorcraft identified this change to the legislation, however there is no mention of the change in the key operational changes document.

ELT effectiveness

Research conducted by the ATSB in 2013, A review of the effectiveness of emergency locator transmitters in aviation accidents identified that, while ELTs only activated in 40-60% of accidents in which their activation was expected, they were directly responsible for saving an average of 4 lives per year.

Operational considerations

Flight in a designated remote area

The flight was conducted in a designated remote area and as such was required to carry ‘survival equipment for sustaining life appropriate for the area being overflown’. The pilot reported that the helicopter had a survival bag which contained a first aid kit, extra food, water, satellite sleeve, mosquito dome, thermal blanket, and a signal mirror. However, passengers disputed that a first aid kit was available.

Legislation

On 2 December 2021, new legislation came into force that required charter operations to comply with Civil Aviation Safety Regulations (CASR) Part 91, 119 and 133 and the corresponding manuals of standards. This introduced a number of changes to the requirements for this operation type, some of which were notified by the Civil Aviation Safety Authority (CASA) to operators in a document highlighting the key operational changes. During the introduction period, there were some transitional exemptions in place to give operators time to comply. Some of the changes, discussed below, were relevant to this occurrence.

At the time of the accident, the operator’s procedures had not been changed to reflect the new regulations however, they had submitted an exposition, written by a third-party contractor, to CASA for approval. They also advised that they had an expectation that the new requirements did not come into effect until March 2023.

Safety briefing

In accordance with the Manual of Standards (MOS) Part 133 Chapter 7 Safety briefings, instructions and demonstrations, the pilot of a helicopter must provide passengers with a verbal safety briefing. With the introduction of the new legislation, the information required to be briefed had been updated and now included, among other new requirements, information on when and how to assume the brace for impact (brace) position. The changes to the briefing requirements were not included in the key operational changes document promulgated by CASA. The legislation was in transition and after 1 December 2022, required an operator to supply a safety briefing card to all passengers specific to the helicopter type and model, which included detail on how to assume the emergency brace position.

The inclusion of having to show passengers how to brace during the oral safety briefing, in a helicopter with more than 3 passengers and less than 6 seats, was a new requirement and CASR 133.240(3)(b) required that this be specific to the aircraft type and model.

CASA released a multi-part advisory circular (AC) 91-19, AC 121-04, AC 133-10, AC 135-12 and 138-10 version 1.0 Passenger safety information, coincident with the requirement to brief passengers on the brace position coming into effect. This AC was to give operators ‘guidance regarding the requirements for safety briefing cards and passenger safety briefings, instructions and demonstrations’. It stated that when passengers are informed about the correct use of equipment and the actions to take in the event of an emergency, including how to brace, the survival rate was improved. It also stated that bracing before impact reduces:

• flailing by having the forward-facing occupant flex, bend, or lean forward over their legs in some manner
• secondary-impact injuries by pre-positioning the body, predominantly the head, against the surface that it would otherwise strike during that secondary impact, thus reducing the momentum of the head and other parts of the body.

The AC included an appendix that provided information on the recommended brace positions for specific seat positions and restraint types. However, it did not indicate how to brace in a helicopter with a 3‑point harness (lap strap and shoulder harness with a single diagonal strap), as was the harness available in the R44. General guidance, applicable to all brace positions, in section A.2.1 of the appendix advised that:

• The lower torso should be firmly against the back of the seat.
• The lap strap portion of the seatbelt should be worn as tight and as low across the hips as possible. The more tightly the lap strap is adjusted, the better restraint it will provide.
• If the seatbelt includes a shoulder harness, the harness should be adjusted so that it is tight but does not pull the lap portion of the seatbelt upward.
• The webbing of a lap strap and shoulder harness should lie flat against the body and should not be twisted.
• Knees should be pressed together, and feet should be flat on the floor.

The US Code of federal Regulations Part 29 – Airworthiness standards: Transport category rotorcraft Subpart A 29.2 (a) required that a Category B rotorcraft[7] manufactured after 16 September 1992, was required to have a combined safety belt and shoulder harness with a single-point release. This requirement was also stated in section 27.785 (b) of the European Aviation Safety Agency CS-27 Certification specifications for small rotorcraft, which was released in 2003.

Advice was sought from CASA on how to brace in a helicopter with a 3-point harness, with the following response provided:

As detailed in A.3 of Appendix A to AC 133-10, there are a great number of variables affecting the brace position to be adopted. The AC aims to identify some general principles that will allow an operator to select an appropriate brace position in the context of their operation.

The information relating to brace positions contained in Appendix A of Multi-Part AC 133-10 is based on ICAO document 10086 Manual on Information and Instructions for Passenger Safety and Transport Canada Civil Aviation (TCCA) Advisory Circular TCCA AC 700-036 – Brace for Impact Positions for all Aircraft Occupants, which is also referenced in ICAO document 10086.

…Neither document (i.e., ICAO 10086 or TCCA AC 700-036) provide guidance on passenger brace positions for helicopters fitted with a 3-point harness.

RHC was contacted to seek advice on how best to brace using the harness in the R44. They advised that they do not have specific information on the brace position and recommended to use either the brace position in section A.2.1 of the AC or the brace position A.5 Forward-facing passenger seats fitted with a lap strap and single diagonal shoulder harness, which stated: 

A.5.1 In a forward-facing passenger seat fitted with a lap strap and single diagonal shoulder harness, passengers should brace according to Figure 2 [Figure 9] below and comply with the accompanying instructions:

a. Adjust shoulder harness to remove slack.

b. Rest chin on sternum, head should be tucked down as far as possible to try to eliminate secondary impact of the chin with the sternum.

c. Hands can be positioned on the lap, front edge of the seat can be held (do not lock elbows or wrists), or occupant can sit on palms of their hands (palms must be ‘up’ to avoid breaking wrists). Do not hold on to restraint system with hands; this can introduce slack into the restraint system.

Figure 9: Diagram of how to brace in a forward-facing passenger seat with 3-point harness

Source: CASA Multi-part advisory circular AC 133-10 Version 1.0

Transport Canada was also contacted in relation to the content contained within Canadian AC 700-036 and provided the following response:

Prior to the publication of AC 700-036, Transport Canada guidance had simply stated that ‘Helicopter occupant brace positions are the same as those for aeroplane occupants’, which was aligned with the guidance from the U.S. FAA at the time (i.e., AC 121-24C). During the development of the revised Canadian guidance in response to the recommendations contained in report DOT/FAA/AM-15/17, 2015-11-19 — Effect of Passenger Position on Crash Injury Risk in Transport-Category Aircraft, there was an identified need to provide guidance for helicopter occupants, specifically for those involved in offshore operations.

The focus was on offering guidance with respect to two specific configurations of passenger restraint systems: lap strap only and dual upper torso straps. As no new or unique recommendations were available or suggested for a helicopter passenger using a lap strap and diagonal shoulder strap (e.g., 3-point harness), the general guidance applicable to all aircraft passengers continues to be used for such a restraint system configuration (e.g., Sections 4.3 Forward-facing Seats Equipped with a Lap Strap and Shoulder Harness and 4.9 Aft-facing Seats Equipped with a Lap Strap and Shoulder Harness).

In the context of US operations, the Federal Aviation Administration (FAA) AC 121-24D Appendix 4 Brace-for-impact positions stated that:

Helicopter passengers … should adopt the same positions as recommended for aircraft seats of similar orientations and restraint system configuration; however, if possible, the occupants of all seat types should grip the edge of the seat pan, to help maintain orientation in the event of a rollover.

Both the pilot and the operator advised that they briefed passengers on how to brace in the event of an emergency. The operator advised they would advise passengers ‘not to lean forward’ and ‘always to sit up with a straight back’.

Safety brief prior to accident flight

On the morning of the accident flight, VH-KOV had been flown for 3–4 hours prior to arriving at Lorella Springs, as the operator’s second R44 had a minor fault. This resulted in the passengers waiting for the helicopter to arrive.

The passengers all reported they did not receive a safety briefing prior to the flight. However, they advised that they understood how to fasten the 3-point harness, their hand luggage was stored securely, and the operation of the headset was discussed with the pilot. When questioned sometime after the accident, the pilot advised they did not remember completing the briefing but would find it odd if they had not done so. They advised that normally their pre-flight briefing included:

• avoiding the tail rotor
• trip hazards such as skids
• how to get in and out of the helicopter
• door operation
• seatbelt operation
• no smoking
• not to interfere with controls
• brace position.

However, they also advised feeling slightly rushed due to the late arrival of the helicopter and that they were concentrating on checking the helicopter, refuelling, completing a fuel drain and checking the oil levels.

The passengers all commented that when the pilot called ‘brace’ prior to the accident, they did not know how to do so.

Pilot leaving controls

Prior to take-off, the passenger in the rear left seat could not close their door securely. In response, the pilot exited the helicopter, leaving the engine running and walked around to the left side to secure the door. The operator’s operations manual stated that:

the pilot-in-command must remain at the controls … from the time at which the engine is started prior to a flight, until the engine is stopped at the termination of a flight unless … the helicopter is fitted with a serviceable means of locking the cyclic and collective controls and … the pilot considers that their absence from the cockpit is essential to the safety of the helicopter...

The operator confirmed the helicopter had no modifications for locking the cyclic or collective.

The R44 is equipped with adjustable friction on the cyclic and collective, to allow a pilot to elect their desired level of force required to manipulate controls. This may be adjusted to suit conditions such as long flights, turbulence etc. These friction devices do not lock the controls and as such, RHC safety notice 17 stated:

NEVER EXIT THE HELICOPTER WITH THE ENGINE RUNNING

CASA had also advised in a previous ATSB investigation that a friction lock was not a substitute for a locking device.

CASR Part 91.550 (b) Seating for flight crew members required that at all times during the flight, ‘a pilot must occupy a pilot seat with the seatbelt securely fastened’. Where previously there was an exemption that a pilot of a helicopter could exit the cockpit if the helicopter had a means of locking the cyclic and collective, this exemption has been repealed.[8]

Operations manual

The operator’s operations manual, written by a third party, required that prior to boarding the helicopter the passengers be shown a helicopter safety card which provided information on how to enter and exit the helicopter when the rotors were turning. The passengers advised they did not receive a briefing on how to do this. One of the passengers reported that when they landed at the various stops, they were advised to leave the helicopter ‘going forward’. They exited the helicopter after landing while the rotors were turning at 2 landing sites carrying their fishing rods, and a third site, while the pilot allowed the helicopter engine to cool down.

Weight and balance

The operator’s operations manual stated that load calculations were to be made with actual weights for all passengers and baggage, using the loading form from the flight manual, however it then stated that a pre-calculated load and trim sheet could be used but may only be prepared by the chief pilot. The pilot advised they regularly use the pre-calculated weight form and an application on their electronic flight bag to calculate the weight and balance for the helicopter. The passengers advised they submitted their actual weights to the operator before the flight.

The ATSB assessed that the helicopter was operated within the weight and balance requirements for the flight.

Emergency equipment

Fire extinguisher

There was no fire extinguisher on the helicopter and the operator advised they did not carry one as they considered that if a fire started in flight, they would land immediately and exit the helicopter. However, their operations manual required that a portable fire extinguisher be carried on all flights.

Prior to December 2021, an airworthiness directive (AD/general/65 amendment 4) required that all aircraft with a maximum take-off weight of greater than 2,750 kg carry a fire extinguisher. The R44 does not fit into this category. CASA did recommend in AWB 26-002 Issue 3 Selection and Installation of Handheld Portable Fire Extinguishers, that all aircraft have at least one fire extinguisher accessible to a pilot.

Manual of standards Part 133 section 11.46 Hand-held fire extinguishers required that a rotorcraft must carry at least 1 hand-held fire extinguisher. However, the removal of the weight limit was not identified in the CASR Part 133 Key operational changes document. CASA advised this change was stated in the information they released to assist operators to write an exposition and had been discussed in early consultation with operators.

First aid kit

While it was reported that the helicopter had a survival bag which contained a first aid kit, the passengers advised that there was no first aid kit on the helicopter. The operator advised that when they found the pilot, they assessed that they were most likely in shock and injured and were concentrating on getting assistance rather than administering first aid. As the ATSB did not attend the accident site, the discrepancy in accounts regarding onboard emergency equipment could not be resolved.

Satellite sleeve

The operator advised that they used a satellite sleeve rather than a satellite phone in their operations. A satellite sleeve connected the user’s mobile phone to the satellite system and allowed them to make phone calls and send text messages. The operator advised that on the 20 April 2022, the unit was tested and found to be fully charged and operational. It was then switched to OFF and stored in a pouch on the helicopter.

The pilot had received training on how to use the unit and had the required application on their phone. Additionally, when the application is opened on a mobile phone, it provided simple instructions on how to use the device. The unit was tested after the accident and, while fully charged, it was not operational for unknown reasons.

Related occurrences

The ATSB identified two previous occurrences where the clutch actuator lower bearing had failed.

ATSB investigation 19905646

On the 25 November 1998, about 20 minutes after take-off, the pilot noticed a burning smell, and felt a slight shudder closely followed by the helicopter’s clutch light flickering. The pilot landed the float‑equipped helicopter on water with minimal impact forces.

The subsequent investigation revealed the fan shaft bearing located on the fan shaft between the engine and the cooling fan had overheated, melted and seized resulting in the shaft fracture. The examination by RHC revealed the lower actuator bearing lost lubrication after 926.4 hours of service, however they were unable to establish why this occurred with a distorted seal, loss of grease and water ingress considered the most likely sequence of events.

Aviation accident summaries ERA16LA216

The second failure occurred in the US in 2016, where 2 people were seriously injured. The helicopter was over a saltwater pond, about 300 ft above ground level. At that time, the pilot felt a lateral shudder followed by the clutch light illuminating. The helicopter then began a violent yaw and the low oil pressure light illuminated. The pilot performed an autorotation to shallow water near the shoreline.

Examination of the airframe revealed that the engine cooling fan had separated with the lower sheave being caked in grease, consistent with grease leaking from the clutch actuator lower bearing for a significant time. The roller bearings were found seized with no grease recovered. The investigation found that the times in the aircraft maintenance documentation had been incorrectly recorded. Consequently, the helicopter had not been maintained in accordance with procedures and the airframe major overhaul was due 59.5 hours prior to the accident. The lower bearing would have been replaced during this overhaul. Also, the lower bearing had not been serviced in accordance with procedures. While the bearing had been lubricated annually in the 2 years preceding the accident, there was no recorded servicing during a period of 4 years 11 months and 685.1 hours prior to this.

Safety analysis

Introduction

While flying at about 500 ft above a valley floor, the helicopter started to vibrate and within seconds, the clutch actuator lower bearing failed. This resulted in a loss of drive to the main and tail rotors and it is possible the engine stalled as it was unloaded. As the helicopter was flying over rising terrain, the pilot had very few recovery options, and they conducted an autorotation into trees resulting in serious injuries to 2 passengers and minor injuries to the remaining passenger and the pilot. The helicopter sustained substantial damage.

This analysis will consider the factors around the seizure of the lower bearing, passenger briefing, the introduction of new legislation by the Civil Aviation Safety Authority, and the issues around the maintenance of emergency locator transmitters (ELTs) in Australia.

Lower bearing seizure

The investigation identified that the lower bearing seized, resulting in the failure of the fan shaft. The maintainer advised that they had checked the bearing for roughness during maintenance about 20 flight hours prior to the accident and did not detect any issues. Additionally, the operator advised they regularly listened for unusual noises in the drive train as they shut down the engine, and none had been detected. On the day of the occurrence, the helicopter had been operated for approximately 5.1 hours, including several engine shut-downs, with neither pilot identifying anything unusual prior to the sudden failure of the bearing.

After the occurrence lower bearing was installed at the major inspection, the time between lubrication was initially greater than the required 300 hours. However, in more recent times, the maintainer advised they were lubricating the bearing more frequently than required as they felt this was warranted in the hot operating environment. In addition, the lower bearing was to be lubricated every time the fan wheel was removed, which had the potential to result in more frequent lubrication. However, the fan removal also afforded the opportunity for thorough inspection of the lower sheave.

Robinson Helicopter’s assessment was that bearing damage that ultimately led to failure most likely occurred during the period of initial under‑lubrication following fitment. They further advised that signs of bearing damage, including:

• noise
• rough running bearings
• actuator issues
• grease outside the seals

should have been evident. As detailed above, no noise or roughness was identified, but the accumulation of dried grease on the lower sheave indicated that grease had been leaking past the seal and/or over greased for an extended period. The bearing was also reaching the end of its service life.

Distortion to the upper bearing seal was consistent with that bearing being lubricated despite there being no procedural requirement to do so. Further, inspection identified that the grease was solid and therefore not likely to have been effectively lubricating and cooling the bearing.

Due to the extent of the damage to the lower bearing, the specific reason for its failure could not be identified. However, the available evidence indicates it was probably due to the inconsistent lubrication of the bearing. Both lubricating the bearing more and less often than required by the procedures can result in damage. Not following the maintenance procedures increases the likelihood of the bearings failing prior to their service life. Further, such failures can occur at a critical phase of flight, where the opportunity for a successful forced landing may be reduced.

The RHC maintenance procedures did not specify that the lower bearing should not be over lubricated and included a requirement to lubricate the bearing every time the cooling fan was removed, which was required when the clutch micro switches were replaced. The procedures also did not identify, in the trouble shooting section, that frequent changing of the micro switches could be an indication that the lower bearing was failing.

Passenger briefing

The passengers did not receive a safety briefing prior to the flight, which resulted in them being unaware of the safety equipment in the helicopter. Having knowledge of what is available, and how it is used, is important in the event of an emergency, especially if the pilot is incapacitated and/or the flight is in a designated remote area. Fortunately, this did not affect the outcome on this occasion as the operator responded quickly when the helicopter did not return after the SARTIME had elapsed.

Although not related to the accident, the passengers also did not receive a specific briefing on how to leave the helicopter with the rotors turning. Landing in a remote area, with no ground staff and unknown/undulating terrain levels, increases the risk of passengers inadvertently walking into the rotor arcs. They were also carrying fishing rods, which added to the risk level. According to the United States (US) Federal Aviation Authority (FAA) Helicopter flying handbook, ‘People have been injured, some fatally, in helicopter accidents that would not have occurred had they been informed of the proper method of boarding or deplaning’.

Another result of not receiving a safety brief was that the passengers were not given any information on how to brace during the accident. While all 3 passengers advised they did not know how to brace, it is difficult to assess if their injuries were increased as a result of not being briefed. An accident of this nature, where the helicopter falls through trees and spins, introduces many forces which cannot be foreseen when designing a general brace position. It is also very difficult to assess which people will adopt the demonstrated brace position when faced with an emergency.

Regulatory change management

Despite the variables outlined above, research has shown that knowledge of the appropriate brace position offers the best chance to reduce injury. As such, it is now a requirement that during the passenger safety briefing prior to a flight, passengers are informed of the brace position specific to the aircraft type. Despite that, this requirement, along with other new requirements for the passenger safety brief, for operators of smaller helicopters, were not identified in the document released by CASA to advise operators what had changed with the introduction of new regulations.

Also, the multi-part Advisory Circular (AC), released by CASA to give operators guidance for safety briefing cards and passenger briefings, did not give specific advice on how to brace in a helicopter with a 3-point harness. This harness type is used extensively in helicopters flying in Australia, including the R44.

The helicopter did not have a fire extinguisher on board, contrary to the operator’s operations manual. If, as on this occasion, operators are using a third party to write their exposition, it is vital that they have a full understanding of what is written to ensure they are complying with their own company procedures.

A fire extinguisher is now mandatory in all helicopters operating under the Civil Aviation Safety Regulation (CASR) Part 133. The change to this requirement for helicopters weighing less than 2,750 kg was also not stated in the document released to advise operators around the changes to the regulations.

As these were relatively small wording changes as part of the introduction of extensively revised regulations, they could be overlooked by an operator.

ELT maintenance procedures

The ELT fitted to VH‑KOV did not activate until many hours after the ground impact. The maintainer had not maintained the unit since taking over the aircraft maintenance and had not advised the operator of this. However, as the unit eventually operated, it was likely serviceable.

The Robinson Helicopter Company (RHC) maintenance manual Chapter 1-General stated that US registered helicopters should be maintained in accordance with FAR 91.207. This regulation, however, applied to airplanes only. The statement was also unclear as to how helicopters based outside the US were to be maintained. In addition, Chapter 2 - Inspections did not list a procedure for an inspection of the ELT, although inspections were listed for both the R22 and R66 helicopters. These inspections listed requirements to ensure the ELT unit was secure in the helicopter rather than ensuring it was operational.

The maintenance requirements from the ELT manufacturer required that the battery be changed when required and recommended that a self-test be conducted monthly. If the ELT had been placarded as not being maintained, this may have prompted the operator to have performed a self-test of the unit on a regular basis. As the self-test was a recommended procedure, it is not required to be written in any maintenance documentation. As such, it is likely an operator/pilot could be unaware of the procedure. An investigation conducted by the ATSB – AO-2021-020 Wirestrike and collision with terrain involving Robinson R22, VH-KLY 75 km west-north-west of Hay, New South Wales on 26 May 2021 – is an example of where the pilot had selected the ELT remote switch in the cockpit to ARM, however, the ELT was selected OFF at the unit. If the pilot of VH‑KLY had conducted a self-test of the unit, they would have realised that the unit was not operational.

The CASA Airworthiness Bulletin (AWB) 02-002, released on 15 November 2013, recommended that maintainers conduct maintenance on the ELT in accordance with approved data. However, as is the case for this helicopter, the approved data only required the operation of the unit to be checked when the batteries were replaced. This could result in the unit’s operational status only being ascertained every 6-7 years.

As shown in the ATSB research report, A review of the effectiveness of emergency locator transmitters in aviation accidents, ELTs in Australia only activate in 40-60% of accidents, but are effective in saving lives. Additionally, and as confirmed by AMSA, ELT units in Robinson Helicopters also activate erroneously. The lack of a formalised maintenance requirement may contribute to this.
 

From the evidence available, the following findings are made with respect to the to the clutch actuator lower bearing seizure and collision with terrain involving Robinson Helicopter R44, VH-KOV on 16 May 2022.

Contributing factors

• During cruise flight, the clutch actuator lower bearing seized resulting in a total loss of drive from the engine to the rotor system. The subsequent autorotation and collision with terrain over an inhospitable area, resulted in serious injuries to 2 passengers and minor injuries to the pilot and remaining passenger.
• The clutch actuator lower bearing was not being maintained in accordance with the manufacturer’s maintenance procedures, which likely resulted in the bearing failure.

Other factors that increased risk

• The passengers did not receive a pre-flight safety brief resulting in them being unaware of the emergency procedures, safety equipment and brace position. They also exited the helicopter prior to the accident while the rotors were turning, without a specific briefing.
• There was no fire extinguisher on board the helicopter. While this did not influence the outcome in this case due to the absence of post‑impact fire, it reduced the overall safety of the flight.
• As part of the regulatory changes to Civil Aviation Safety Regulation Part 133, the Civil Aviation Safety Authority changed the regulations relating to the carriage of fire extinguishers and passenger briefing. These safety‑related changes were not promulgated to operators in documentation related to the regulatory changes.
• Civil Aviation Safety Regulation Part 133 required that pilots brief passengers on the emergency brace position with information specific to their aircraft type and model. However, while the Civil Aviation Safety Authority provided guidance on how to brace in some configurations, they did not provide specific information on how to brace in a helicopter, like the R44, which had a 3-point harness.
• The emergency locator transmitter did not activate until 10 hours after the accident, reducing the likelihood that the helicopter’s occupants would be found in a timely manner.
• The emergency locator transmitter was not being maintained and the maintainer had not advised the operator.
• The Robinson R44 maintenance manual did not give clear guidance on how an emergency locator transmitter (ELT) should be maintained in aircraft outside the United States (US) and there was no procedure for inspecting its security. The US regulations referred to aeroplanes only and so there is no regulatory requirements to maintain an ELT in the US.
• The Civil Aviation Safety Authority did not provide clear guidance on how emergency locator transmitter units should be maintained.
• The emergency locator transmitter (ELT) manufacturer Kannad’s maintenance procedures stated that the monthly self-test of the ELT unit was recommended rather than required, which could result in the unit’s operation only being ascertained every 6-7 years. Current regulations do not mandate such a test.

Safety actions

Safety action by the involved maintainer

The maintainer of the helicopter involved contacted each of the operators of the helicopters they maintained to ensure they were aware that the emergency locator transmitter (ELT) was not being maintained and to ensure they were carrying a personal locator beacon in the helicopter.

Safety action by the Civil Aviation Safety Authority addressing the guidance on how to brace in a helicopter with a 3-point harness

The Civil Aviation Safety Authority has released multi-part advisory circular (AC) 91-19, AC 121-04, AC 133-10, AC 135-12 and 138-10 version 1.1 Passenger safety information to include information on how to brace in a helicopter with a 3-point harness.

Safety action by the Civil Aviation Safety Authority addressing the guidance on emergency locator transmitter (ELT) installation and maintenance

The Civil Aviation Safety Authority has updated airworthiness bulletin (AWB) 02-002 to include information on ELT maintenance and guidance if the information contained within the aircraft’s maintenance schedule is not sufficient.

Safety action taken by Orolia the manufacturer of the emergency locator transmitter (ELT)

The manufacturer of the ELT has advised that the discrepancy between the service letter and the installation manual will be corrected to reflect that the self-test should be a recommended practice as the current regulations do not require a self-test.

Glossary

AMSA              Australian Maritime Safety Authority

AWB                Airworthiness bulletin

AC                   Advisory Circular

AD                   Airworthiness Directive

CAAP               Civil Aviation Advisory Publication

CASA               Civil Aviation Safety Authority

CASR               Civil Aviation Safety Regulations

CAR                 Civil Aviation Regulations

ELT                  Emergency locator transmitter

FAA                 Federal Aviation Authority

MOS                Manual of Standards

POH                 Pilot operating handbook

RHC                 Robinson Helicopter Company

SL                    Service letter

US                    United States

Sources of information

The sources of information during the investigation included the:

• pilot of the accident flight
• passengers
• operator
• maintainer
• Australian Maritime Safety Authority
• Civil Aviation Safety Authority
• Robinson Helicopter Company
• photographs taken on the day of the accident
• Transport Canada.

References

ATSB research report, A review of the effectiveness of emergency locator transmitters in aviation accidents, May 2013, Australia

Airworthiness Bulletin 02-002 Emergency Locator Transmitter (ELT) installation and maintenance, November 2013, Australia

CASA (Civil Aviation Safety Authority) multi-part Advisory Circular (AC) 91-19, AC 121-04, AC 133-10, AC 135- 12 and 138-10 version 1.0 Passenger safety information, August 2021, Australia

Transport Canada Advisory Circular (AC) 700-036 Brace for impact positions for all aircraft occupants, Issue 1, September 2016 Canada

FAA (Federal Aviation Authority) Advisory Circular 121-24D Appendix 4 Brace-for-impact positions, May 2019 United States

FAA (Federal Aviation Authority) Helicopter flying handbook, United States

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• pilot of the accident flight
• operator
• maintainer
• Australian Maritime Safety Authority
• Civil Aviation Safety Authority
• United States National Transportation Safety Board
• Robinson Helicopter Company
• Transport Canada.
• Bureau d'Enquêtes et d'Analyses (France)
• Orolia SAS

Submissions were received from:

• pilot of the accident flight
• operator
• maintainer
• Civil Aviation Safety Authority
• Robinson Helicopter Company
• Bureau d'Enquêtes et d'Analyses (France)
• Orolia SAS
• Transport Canada
• passengers

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Draft investigation report submission from the helicopter maintainer

The helicopter maintainer’s representative requested that their submission be attached to the report. As such, the following document is appended:

Introduction

We note that the ASTB has prepared a draft report in relation to a clutch actuator lower bearing seizure and collision with terrain involving Robinson Helicopter Company, R44, VH-KOV near Nathan River Station, Northern Territory on 16 May 2022. The following is a submission pursuant to section 26 of the Transport Safety Investigation Act 2003 on behalf of the “maintainer” referred to in that report.

We note that s.25(3) of the Act includes that, “A published report may include submissions that were made by persons to the ATSB in response to a draft report... “. We further note that s.12AA(1)(c)(i) of the Act provides that the ATSB's function is to improve transport safety by means that include identifying factors that contribute, or have contributed, to transport safety matters. This submission is intended to assist the ATSB in identifying factors that may have contributed to this incident.

The draft report

The Executive Summary for the draft report includes that, “The ATSB found that during cruise, the clutch actuator lower bearing seized resulting in a total loss of drive from the engine to the rotor system. This bearing had not been maintained in accordance with the maintenance procedures, which likely resulted in its failure.” We submit that theory is drawn from certain assumptions, which assumptions may need revision in light of certain objective facts. We further submit that the objective facts suggest another factor may have contributed to the incident.

Page 5 of the draft report states that, “Examination of the aft face of the lower sheave revealed accumulated grease consistent with it extruding past the lower bearing seal over a period of time. The maintainer reported wiping the sheave clean each time they worked on the helicopter however, the accumulated grease was not consistent with this having occurred in the last 10 days or 22 hours of operation. The fan shaft failed at the location of the lower bearing. The shaft exhibited deformation, necking, and gouging consistent with localised frictional heating. Circumferential scoring on the fracture surface was a result of the powered shaft contacting the bearing housing.”

At page 22 of the draft report it is then stated that, “The accumulation of dried grease on the lower sheave indicated that grease had been leaking past the seal and/or over greased for an extended period.” The opinion that the dried grease was an accumulation of residue from a prolonged period of over-lubrication is, with respect, incorrect.

Firstly, to the use of the term “over-lubrication” is a mischaracterisation of the increased maintenance conducted by the maintainer. While additional events of lubrication occurred, they did not involve an application of excess lubricant so as to cause extrusion of that excess such as would cause a residue to accumulate. The process by which the maintenance is conducted and the components themselves limit the volume of lubricant that may be applied and do not result in residual lubricant remaining present.

Secondly, the as noted at page 4 of the draft report indicates, the components examined by the ATSB were apparently inspected approximately 126 days after the incident: “The ATSB did not attend the accident site. The helicopter was partly disassembled on site, including engine removal, and transported to Queensland for examination. Engine and airframe examinations were conducted between 19–21 September 2022.” That period between the incident and examination, during which the components in question were left undisturbed, does not appear to be accounted for in the draft report observations about the extent to which a “minimal dried grease” was observed on the lower actuator bearing housing (page 8, Figure 5).

Thirdly, the draft report does not account for the possibility that a “minimal” amount of lubricant may have escaped into the housing after the failure, at which point the components would have been super-heated due to the friction generated in the incident, which heat may have then caused the lubricant to dry out between the incident and the inspection 126 days later.

Fourthly, while the Executive Summary of the draft report states that, “During cruise flight, vibrations were detected through the helicopter, subsequently the pilot observed the engine RPM rise and then drop to zero”, the body of the report provides relevant additional details:

i. At page 1, the draft report notes that, “The pilot reported that, as the helicopter re-crossed the valley to return to the main house, they detected a burning smell and recalled that within a couple of seconds the engine began to run roughly.”

ii. At page 2, the draft report then notes that, “As the pilot lowered the collective to reduce power, in case the engine failed, they checked the engine oil temperature, pressure and cylinder head temperature gauges, which were all in the normal range. Within about 3 seconds, the vibrations through the helicopter increased. The pilot observed the engine RPM suddenly rise, then drop to zero and assessed that the engine had failed.”

iii. At page 9 the draft report notes that, “The operator advised they listened for sounds of bearing noises during the start-up and shutdown of the helicopter and had not detected any unusual noises or vibration.”

The theory that dried grease accumulated over time from over-lubrication and caused the bearing to fail appears to be borne out of the opinion that what is depicted in Figure 5 is an accumulation of dried grease from over-lubrication. Without that opinion, another source for failure must be considered.

The observations of those onboard do not require a conclusion that the causative event initiated from over-lubrication. Another possibility is that the lower fan shaft failed first, leading to a disruption of the bearing, ultimately leading to seizure, which seizure then expelled a quantity of lubricant which was super-heated and subsequently dried before being examined. This possibility is consistent with the observations of those onboard.

The clutch actuator lower bearing engages the main rotor. Seizure means an automatic loss of drive. Another possibility is that the bearing, which was nearing the end of its serviceable term, spontaneously failed and caused the seizure. Seizure as a result of spontaneous failure could, given the damage observed, have resulted in the expulsion of the lubricant that was subsequently observed in Figure 5 as “minimal dried grease”.

At page 5 of the draft report it is said that, “The maintainer reported wiping the sheave clean each time they worked on the helicopter however, the accumulated grease was not consistent with this having occurred in the last 10 days or 22 hours of operation.” Thus the observation of “minimal dried grease” is offered as a reason for rejecting the maintainer’s evidence. However, since the maintainer’s evidence is otherwise uncontradicted and unchallenged, the “minimal dried grease” may be seen as consistent with having in fact resulted from the seizure, rather than being the cause of it.

Further evidence that the incident may have originated with the lower fan shaft (and note due a residue of dried grease which the maintainer says was not present prior to the incident) comes from the condition of the clutch actuator observed in Figure 4 on page 7 of the draft report. Close examination of Figure 4 reveals that the clutch actuator is in an over-travel state with the tension spring damaged. It is also apparent that the fan shaft has failed from the lower bearing inner race spinning and creating excess heat, which heat would then have transferred to the lower bearing, which by failure would have super-heated the lubricant upon seizure would have expelled it to where it was then observed 126 days later.

We submit that what can also been seen in the photo of the lower bearing inner race is abrasions that may have been caused from excessive clearance between the fan shaft and lower bearing inner race. If the failure originated in connection with the fan shaft, what appears as scoring on the fan shaft may be linked to weakening and shearing. We note that the lower bearing, fan shaft and fan dropping down into the fan scroll would have released drive belt tension, causing an engine over speed and loss of drive to the main rotor transmission. This is consistent with the observations of those onboard, reported at pages 1 and 2 of the draft report:

“The pilot reported that, as the helicopter re-crossed the valley to return to the main house, they detected a burning smell and recalled that within a couple of seconds the engine began to run roughly”; and

“As the pilot lowered the collective to reduce power, in case the engine failed, they checked the engine oil temperature, pressure and cylinder head temperature gauges, which were all in the normal range. Within about 3 seconds, the vibrations through the helicopter increased. The pilot observed the engine RPM suddenly rise, then drop to zero and assessed that the engine had failed.”

We submit that these alternatives – the incident arising from a failure of either the fan shaft or the bearing should be included in the final report. We further submit that the characterisation of the maintainer’s increased frequency of lubrication as “over-lubrication” is not correct.

The specifications for a 12-month, 100 hourly check in section 2.140 of the manual, under item 7, states that if any discrepancies exist the maintainer is to inspect the bearing in accordance with section 2.502. That section then directs to section 1.140, which instructs the maintainer to lubricate the bearing with 4-5 grams of grease. Similarly, in section 2.501, it states that if any discrepancy is suspected, or the fan is removed, to proceed in accordance with section 2.502 and section 1.140, which is to lubricate the bearing with 4-5 grams of grease. In addition, in table 1 scheduled maintenance inspections it is stated that the maintainer is to grease the bearings in accordance with section 1.140, i.e. with 4-5 grams of grease every 300 hours or 3 years. Each of these grease applications is for the same amount – 4-5 grams. That is the prescribed volume on each occasion. The application of that amount, in accordance with the manual is, by definition, not over-lubrication.

In addition, because the bearing is a greaseable bearing and not a non-greaseable sealed bearing, Section 1.140 bearing lubrication instructs the maintainer to ground run the machine at 102% for 2 minutes after lubrication, and to then shut down and wipe any escaped excess grease. By following this procedure on each occasion the maintainer has not over-lubricated and has prevented any accumulation of residue.

Conclusion

Maintenance in accordance with the manual includes re-lubrication of the bearing every time the fan comes off. Given the various occasions for removal of the fan, the manual indicates re-lubrication of bearing could be, for example, as frequent as every 100 hours or whenever additional work is carried out that requires removal of the fan. The procedure for re-lubrication ensures that “over-lubrication” does not result. The hypothesis that the bearing seized due to “over-lubrication” by the maintainer therefore is, with respect, not correct.

We submit that the ATSB should consider instead the two alternative hypotheses: that the bearing near the end of its serviceable life spontaneously failed, or the incident independently arose due to some unspecified failure in the fan shaft. We also request that this submission should be included with the final report in accordance with s.25(3) of the Act.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     A device used to connect mobile phones to the satellite system.

Executive summary

What happened

On the morning of 27 April 2022, a Boeing 737-800 registered VH-YFZ and operated by Virgin Australia Airlines departed from Gold Coast Airport, Queensland. Immediately after take-off, the pilot noticed the aircraft tended to roll to the right, and trimmed the rudder to keep wings level. The aircraft no longer required trim when the flaps were retracted for cruise, but the issue returned when the flaps were extended for landing. There were no warnings of flap skew or asymmetry provided to the flight crew.

A walk-around inspection following the flight revealed that left outboard aft flap had not completely retracted. A subsequent engineering inspection found several components in the aft flap actuation system had failed.

What the ATSB found

The ATSB determined that a pre-existing fatigue crack progressed through the aft flap’s inboard programming roller cartridge resulting in component failure. This cartridge held a roller that guided the aft flap during extension and retraction. The failed cartridge affected aft flap performance when flaps were deployed, and resulted in the aircraft’s tendency to roll to the right. While it could not be determined precisely when the cartridge failed, it likely occurred at some point following touchdown during the previous flight, but before take-off on the incident flight.

Boeing specified a general visual inspection of the left outboard flap. On VH-YFZ, this inspection last occurred in October 2020, with no defects found. It could not be determined whether the fatigue crack was present at the inspection. Ten other instances of cracking and/or failure at the programming roller were reported to Boeing between 2017 and 2022. At least 6 of these were old enough to have been inspected several times prior to failure. Significantly, the area in which the fatigue cracks developed was not included in a detailed inspection that Boeing specified for the flap actuation system.

What has been done as a result

While it was identified that failure of this component would not significantly affect the controllability of the aircraft, the ATSB issued a safety recommendation to The Boeing Company that it take safety action to increase the detection of fatigue cracks in the roller cartridges of 737‑800 prior to failure.

Safety message

While modern aircraft provide pilots with detailed system information, certain malfunctions can still occur without detection, such as in this occurrence. While the flight crew were not able to determine the root cause of the roll tendency during flight, they maintained continual awareness of the issue, reacting quickly and appropriately to maintain control of the aircraft.

The occurrence

At 0706 local time on 27 April 2022, a Virgin Australia Airlines Boeing 737-800 registered VH-YFZ departed from Gold Coast Airport en route to Sydney. It was the first flight of the day for both the aircraft and flight crew. As per normal operating procedures, the aircraft took off with flaps partially deployed. Shortly after take-off, the pilot flying noticed that the aircraft had a tendency to roll to the right and added 1.5° of left rudder trim[1] to keep the wings level. When the flaps were retracted during climb, the rudder was trimmed back to 0°.

As the aircraft climbed through 10,000 feet, the cabin manager mentioned to the flight crew that a ‘muffled rumble’ could be heard coming from the left side of the aircraft. In the cockpit, the captain could perceive a sound, but thought it to be more of a ‘whine’. The flight crew discussed potential sources for the noise, and attributed it to some slight damage on one of the engine fan blades that had been previously identified and logged for maintenance.

The autopilot was engaged for most of the flight, including during flap deployment for the first portion of the approach into Sydney Airport. As the aircraft intercepted the localiser[2] track and the wings levelled out, the pilot flying noticed that the control column was substantially laterally displaced. The pilot disengaged the autopilot and immediately felt the aircraft rolling to the right. The pilot used the aileron to keep wings level as the rudder was trimmed back to 1.5° to the left. The flight crew landed the aircraft without further incident.

Once the passengers had disembarked, one of the flight crew conducted a walk-around inspection of the aircraft and noticed that part of the left outboard aft flap had not completely retracted after landing, resulting in a skew (Figure 1). The flight crew received no flap asymmetry or flap skew warnings throughout the flight. A subsequent engineering inspection identified component failures in the left outboard aft flap actuation system.

Figure 1:The skewed left outboard aft flap of VH-YFZ after landing in Sydney

Source: Flight crew, annotated by the ATSB   

Context

Flap actuation system and damage description

The aircraft’s trailing edge flap system contains an outboard aft flap nested within a larger main flap when fully retracted. Upon extension, a ball screw and gimbal transmit forces into pushrods rods to deploy the aft flap. The aft flap is guided by several rollers along tracks connected to the main flap. The roller on the inboard edge of the flap is known as the inboard programming track roller. In this occurrence, a component known as a ‘cartridge’ securing this roller to the aft flap failed (Figure 2).

Figure 2: The failed cartridge (left) and example cartridge highlighted in blue (right)

Source: Virgin Australia, copyright © Boeing. Used with permission, modified by the ATSB

When the damaged programming roller cartridge was found, the section still attached to the aft flap had caught on the underside of the main flap, damaging the skin (Figure 3, left). This contact with the main flap prevented the aft flap from retracting correctly. The other section of the cartridge, including the roller, detached from the aircraft and was not recovered. In addition to the damaged programming roller cartridge, one of the pushrods in the flap actuation system was also found to have failed (Figure 3, right).

Figure 3: The programming roller cartridge obstructed by the main flap (left) and the failed pushrod (right)

Source: Virgin Australia, annotated by the ATSB

The flap skew sensor—responsible for detecting asymmetry or skew in the flaps—tracked the position of the gimbal as the flaps extended and retracted. However, the failed cartridge and pushrod had no effect on the gimbal, so asymmetry or skew in the aft flap could not be detected.

Component examination

The failed inboard programming roller cartridge and pushrod were sent to the ATSB for detailed technical examination. Two regions of fatigue cracking were identified in the cartridge (Figure 4). These were separated by deformation resulting from contact with the main flap. Outside of these two regions, the fracture surfaces appeared to be consistent with overstress, with no evident fatigue cracking.

Figure 4: The fracture surface of the cartridge, with the entire component inset

Source: ATSB

The two fatigue regions were examined using optical microscopy (Figure 5). Red arrows indicate the most obvious beachmarks—evidence of crack progression. The orientation of the beachmarks suggest the crack propagated in the direction indicated by the orange arrows. The crack origin was likely near the bottom of fatigue region 1. It was either obscured by smearing of the metal, or was on the section of cartridge that was not recovered. Blackening and corrosion pitting on the lower half of fatigue region 1 indicate that this portion of the crack had been present for some time.

Figure 5: Fatigue regions 1 (left) and 2 (right) on the failed programming roller cartridge

Red arrows point to observed beachmarks. Orange arrows indicate the direction of crack propagation.

Source: ATSB

A visual examination of the pushrod revealed no evidence of pre-existing damage. Localised deformation at the fractured ends was indicative of buckling/bending failure (Figure 6). This was consistent with the compressive forces it would have experienced as the aft flap become stuck during retraction.

Figure 6: Both halves of the failed pushrod

Source: ATSB

Maintenance history

The programming roller cartridge, pushrod and associated aft flap actuation system were the original parts installed when VH-YFZ was manufactured in 2017. They had acquired 6,377 flight cycles since their installation. Inspection of the roller cartridge was conducted as part of a general visual inspection of the left flap. This was scheduled every 6,000 flight cycles or every 36 months. Guidance from Boeing described this type of inspection as:

A visual examination of an interior or exterior area, installation or assembly to detect obvious damage, failure or irregularity. This level of inspection is made from within touching distance, unless otherwise specified. A mirror may be necessary to enhance visual access to all exposed surfaces in the inspection area.

This inspection was performed on-wing with flaps deployed, and last occurred on VH-YFZ in October 2020, with no defects identified.

A more detailed on-wing inspection was specified for the flap actuation system, which Boeing recommended every 12,000 flight cycles. In the associated task card, the engineer was required to perform ‘a detailed visual inspection of… inboard and outboard programming rollers’, and a diagram was provided (Figure 7). The roller cartridge was not an intended part of the inspection. This inspection had not been carried out on VH-YZF as it was not was not yet due.

Figure 7: Reference diagram for inspection of the inboard programming roller

Source: Copyright © Boeing. Used with permission

Prior to the occurrence flight, there were no reports of aircraft handling issues related to VH-YFZ, and recorded data from the previous flight showed no significant rudder input required to keep the wings level. Walk-arounds were conducted by the captain and an engineer before the flight and no abnormalities with the flaps were reported.

Similar occurrences

At the time of writing, Boeing had received 10 reports of similar occurrences in which a skewed flap resulted from similar cracks and/or failures at the aft flap programming roller during flight operations. All of these reports were received between 2017 and 2022. In the reports where the failure mechanism was provided, some described cracking through the roller cartridge, while others reported failure of the roller itself. Six of these reports included flight cycles and, in every instance, the number of flight cycles prior to failure was between 14,000 and 29,000.

As a result of these reports, Boeing performed a safety analysis of this condition to determine whether the event presented a potential safety issue to the affected 737 fleet. As part of the study, Boeing performed an aerodynamic review of worst-case-scenario events involving the loss of different sections of trailing edge flaps, and the effect those losses would have on the pilot’s ability to control the aircraft in the roll axis. For each of the studied events involving skews or losses of the outboard aft flap, Boeing found that the aircraft remained well within the bounds of controllability by pilots, and the issue was evaluated to result in a slight increase in workload for the pilot in the worst possible case. Based on prior occurrences, Boeing determined that fleet experience aligned with that severity study, and that the rate of occurrence was less than that required by the United States Federal Aviation Administration for the level of hazard presented.

Safety analysis

Findings

Safety issues and actions

Sources of information

The sources of information during the investigation included:

• the flight crew
• Virgin Australia Airways
• The Boeing Company.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew
• Virgin Australia Airways
• The Boeing Company
• the Civil Aviation Safety Authority
• the United States National Transportation Safety Board.

Submissions were received from:

• Virgin Australia Airways
• The Boeing Company.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     In a 737-800, rudder trim makes a small change to the rudder position in order to maintain coordinated flight without constant pilot input.

[2]     The localiser is part of the Instrument Landing System and provides lateral position necessary to align with the runway centreline.

On the morning of 20 April 2022, a Kubicek BB78Z hot-air balloon, registered VH‑RJR and operated by Liberty Balloon Flights, was being prepared for a balloon transport[1] flight for 13 passengers from Royal Park, Victoria. This was the first flight of the balloon since manufacture and the intended destination was Moorabbin Airport.

Before the flight, the pilot conducted a pre-flight inspection. This involved partially inflating the balloon envelope with a fan while on the ground to inspect the deflation vent system (see the section titled Balloon information). The basket contained 6 full propane fuel tanks, sufficient for the intended flight, and the burners were used to inflate the envelope with hot air. After the balloon was ‘stood up’, the pilot confirmed the correct functioning of the deflation vent system.

After the pre-flight inspection, the passengers boarded the balloon, and at 0635, the balloon departed for an anticipated 1-hour flight. The pilot noticed during the pre-flight heating and initial stages of the flight, that the overlap of the vent panel – a fabric panel used to vent air out of the circular opening at the top of the balloon (vent aperture) – and the vent aperture was smaller than on other Kavanagh balloons they had flown. However, the deflation system was sealing correctly during these stages, and so the pilot was not concerned. Passenger images showed the vent panel before take-off and about 2 minutes after take-off (Figure 1). The image taken shortly after take-off showed that the vent panel was close to, or was, pushing through the vent aperture.[2]

Figure 1: Vent panel before (left) and after (right) take-off

Source: Passenger

At about 0640, the pilot activated the burners to ascend above the Melbourne Central Business District (CBD). About 4 minutes later, and with the balloon flying over the CBD, the pilot noticed a small gap between the edge of the vent aperture and the vent panel. This gap allowed hot air to leak out, reducing the buoyancy of the balloon. The pilot attempted to seal the gap multiple times using the deflation system rope lines but was unsuccessful and decided that a forced landing was necessary. The pilot then descended the balloon to a lower altitude in search of a suitable landing location. As the flight progressed, the gap between the vent aperture and the vent panel expanded and altitude control became increasingly difficult, with precise altitude control no longer possible.

At about 0656, the pilot attempted a landing in Fawkner Park (Figure 2), but as the balloon descended over the Royal Botanic Gardens it tracked away from the larger central areas of the park. The pilot heated the envelope and ascended into north-westerly winds to attempt to track back towards the park’s centre but was unsuccessful. The balloon then continued to track south‑south‑east along the western edge of the park adjacent to nearby buildings.

Figure 2: Balloon flight track

Source: Google Earth and Hot Air, annotated by ATSB

At about 0706, the pilot descended the balloon to track towards Elwood Beach and instructed the passengers to adopt the landing position. During the descent, the balloon’s basket impacted a glass fence on top of a building. Shortly after, the pilot advised the passengers of a malfunction with the deflation system, for them to remain in the landing position, and the intent to land at Elwood Beach. The pilot continued to fly the balloon at low altitude towards Elwood Beach, which required almost continual operation of 1 or 2 of the balloon’s 3 burners to maintain altitude, with precise altitude control not possible.

At about 0714, the balloon’s basket impacted the top of another building. At about this time, liquid fuel for 2 of the balloon’s 3 burners was exhausted, significantly reducing the heat generated by those burners and rendering them ineffective.[3] Unable to maintain altitude, the pilot continued to activate the remaining burner to reduce the descent rate as much as possible as the balloon descended through trees into a suburban street. As the balloon struck the trees, the pilot pulled the fast deflation line to deflate the balloon envelope. However, this was only partially accomplished as tree branches pulled the line out of the pilot’s hands.

During the landing, the basket was not orientated with the long side perpendicular to the direction of travel. Although this was the normal procedure for any landing, the impact with the trees rotated the basket, and the pilot did not have time to correct this using the balloon’s rotation vents. Furthermore, using the rotation vents would have increased the rate of descent.

The basket came to rest outside the entrance of an apartment building and the envelope deflated over the building’s roof (Figure 3). The balloon and basket sustained minor damage during the forced landing, and 3 passengers sustained minor injuries.

Figure 3: Balloon landing site during the post-incident recovery

Source: ATSB

Context

Pilot information

The pilot held a commercial pilot licence (balloon) and had accumulated 3,950 hours of flying experience, of which about 300 hours were on balloons in the same class[4] as the BB78Z. The pilot had flown 60 hours in the previous 90 days. The occurrence flight was the first flight the pilot was undertaking in a BB78Z.

In discussing the incident, the pilot stated that:

• After noticing the deflation system was not sealing correctly, the pilot maintained the balloon’s altitude as low as possible because it was safer and provided more potential landing areas. The heat required to ascend would have increased the fuel burn, reducing the balloon’s endurance. Moreover, later in the flight, keeping a lower altitude provided the shortest route to Elwood Beach – an area the pilot had previously landed a balloon. However, due to this low altitude with precise altitude control impossible, the pilot could not slow the balloon’s descent fast enough to avoid colliding with the two buildings.
• Albert Park was a potential landing option, but the recent Formula One Grand Prix race meant that there was still a lot of work happening at the park with lots of associated equipment. The reduced altitude control would have also made it difficult to manoeuvre towards the park for a landing.
• Elsternwick Park was also an option, but based on the prevailing winds would have required an ascent, increasing the fuel used. Therefore, the pilot attempted to land at Elwood Beach.

Figure 4: Balloon flight track with potential landing options

Source: Google Earth and Hot Air, annotated by ATSB

Meteorological information

North-north‑west surface winds at 7-8 kt and an air temperature of 11 °C were forecast at Essendon Airport and Moorabbin Airport for the balloon’s expected flying time.

The balloon’s GPS unit recorded its velocity during the flight (indicative of wind speed and direction) which, after descending over the Royal Botanic Gardens, mostly varied between 6‑10 kt.

Balloon information

The BB78Z is a 275,000 cubic feet hot-air balloon produced by Kubicek Balloons, a balloon manufacturer based in Czechia. The incident balloon (VH-RJR) was manufactured in 2021 (Figure 5) and included a T‑partitioned basket with 2 passenger compartments fitted with rope handles, and a triple burner system. The envelope has vertical load tapes which transfer the internal envelope forces to carry the basket, and 24 gores (vertical fabric panel sections between vertical load tapes).

Figure 5: VH-RJR

Source: ATSB

The balloon was equipped with a Kubicek 3-line deflation system (Figure 6). In-flight venting was achieved by pulling on the red-white line (parachute vent line) which in turn pulled the vent panel (Figure 7) at the top of the balloon for a controlled release of air through the vent aperture. Releasing the parachute vent line allowed the vent panel to close, being pushed upwards by the pressure of the heated air within the envelope.

The parachute vent line was used to descend the balloon, such as when approaching to land. For final landing, when the balloon was close to the ground, the fast deflation line (red line) was pulled so that the centre of the vent panel was pulled down into the balloon for rapid deflation. A white line was connected to the shroud centralising lines to stretch the vent panel over the vent aperture for proper sealing and to also reset the vent panel after the red line was pulled. A weight was attached to the white line to assist with sealing.

Figure 6: VH-RJR deflation system

Source: Kubicek Balloons, annotated by ATSB

Figure 7: Vent panel

Source: ATSB

The envelope was fitted with a temperature label which was a small strip sewn into the envelope fabric with several temperature-sensitive areas (116-154 °C) that changed colour permanently according to the maximum envelope fabric temperature reached. The envelope was also fitted with a temperature warning streamer which fell towards the pilot if the envelope air temperature exceeded its maximum limit of 124 °C.[5] Both temperature indicators were located internally near the top of the balloon.

Before the flight, the pilot completed a load chart based on the temperature at the launch site (10 °C) and expected maximum altitude (3,000 ft). This indicated that there was sufficient available lifting capacity to conduct the flight.  

Number of passengers

The balloon’s basket had 2 passenger compartments, each with a maximum occupancy of 6 people, which was based on a minimum floor area for each person. This number was independent of the actual weight and size of the passengers, which also needed to be considered by pilots before each flight. The manufacturer advised that the maximum passenger compartment occupancy must never be exceeded due to the limited number of rope handles available, and the requirement for each passenger to adopt a safe and comfortable landing position.

On the incident flight, 7 people (adults and children) were carried within one of the passenger compartments. Although the additional passenger was reportedly able to adopt a good landing position, and no injuries were reported by this passenger, the carriage of the additional passenger increased risk. While the ATSB assessed that the risk was not significantly increased in this case, it is important that pilots adhere to the flight manual passenger limitations.

Post-incident balloon testing

The balloon was retrieved from the incident site and stored in a secure facility. In May 2022, the ATSB arranged for tests to be conducted on the balloon’s deflation system in Yarra Glen, Victoria. Representatives from the ATSB, balloon manufacturer, operator (including the incident pilot), and the Civil Aviation Safety Authority (CASA) were in attendance.

The envelope was first inflated on the ground using a fan to conduct an external and internal inspection of the envelope (Figure 8), with the following observed:

• pulleys and rope lines were serviceable
• there was minor impact damage to the envelope fabric from the landing
• the temperature streamer was intact and the temperature indicator colour was unchanged.

Figure 8: Internal envelope inspection

Source: ATSB

A wireless temperature sensor was fitted to provide an indication of the maximum internal envelope air temperature reached during the test. The basket was tethered, and the burners were used to inflate the envelope. People were loaded into the basket to provide a similar weight to the incident flight. The ambient air temperature at the time of the test was about 7 °C at 230 ft above mean sea level.

The internal envelope air temperature was increased by operating the burners, while external and internal camera footage of the vent panel was taken (Figure 9). At low temperatures, the vent panel began to push up against the internal envelope and vertical load tapes as designed, creating a seal. At about 90 °C, edges of the vent panel between the vertical load tapes pushed up through the aperture creating many gaps for internal envelope air to vent out. Attempts to seal the gaps using the parachute vent line and white line were unsuccessful. At higher temperatures, the gaps became larger and more numerous.

Photos and video taken during the test indicated vent panel behaviour similar to that shown in the passenger’s video of the incident flight (Figure 1). The incident pilot also reported that the vent gaps were very similar to those observed during the incident flight. The balloon envelope was subsequently shipped to the manufacturer’s headquarters in Czechia for further examination.

Figure 9: Deflation system testing

Temperature values are approximate

Source: ATSB

Deflation system design change

The European Union Aviation Safety Agency (EASA) is the civilian aviation safety regulator for the European Union, responsible for prescribing minimum standards required in the interest of safety for the:

• design
• material
• construction
• quality of work
• performance

of aircraft, aircraft engines, and propellers. EASA issue sets of certification requirements based on aircraft category. Successful completion of the certification process, where an aircraft (such as a balloon) complies with the certification requirements, enables the aircraft to receive a type certificate.

The BB78Z was certified under the EASA regulations, receiving a type certificate from EASA in 2016. For the BB78Z, the relevant EASA certification requirements were found in the certification specification for hot air balloons (CS‑31HB).

Before VH-RJR was manufactured in 2021, the operator requested a larger deflation vent (aperture and panel) to increase the balloon’s descent performance. Greater descent performance was desirable for flights over built-up areas such as Melbourne, where landing options were limited and small in area. To accommodate the request, the manufacturer increased the radius of the vent aperture from the standard 3.6 m to 4.0 m, and utilised the 4.0 m deflation system design that already existed on the manufacturer’s larger balloons. This modification was to be accomplished via a change to the balloon’s type certificate.

Changes to a type certificate under EASA regulations followed a general process:

• Classification of the proposed change as either ‘major’ or ‘minor’[6] to determine the approval pathway.
• Determining the certification requirements affected by the proposed change.
• Providing evidence that the change is compliant with the affected certification requirements.

Change classification

Kubicek held a Design Organisation Approval^[7] issued by EASA that granted privileges to develop and approve minor changes and some major changes, including new deflation systems (major change) and an exchange of deflation systems between different balloons (minor change). A change that Kubicek was not authorised to approve, could be developed by Kubicek and submitted to EASA for approval.

As the VH-RJR deflation system design change was based on the 4.0 m deflation system used on its larger balloons, Kubicek classified it as a ‘minor change’.

Approval

During the design change process, the certification requirements affected by the change are determined. Approval of the change is then based on whether compliance with the certification requirements can be demonstrated. The manufacturer listed the following certification requirement as being affected by the deflation system design change:

The manufacturer’s design change approval form listed 8 documents against this requirement as evidence of compliance, and formed the basis upon which the deflation system design change was approved. The ATSB’s review of the compliance documents found that each one contained engineering drawings showing the larger 4.0 m deflation system geometry on the BB78Z balloon, but no evidence that the design met the stated certification requirement. The manufacturer provided the following comments on the design change approval:

• No further analysis or testing was required for compliance with the certification requirement since previous certification activities and in-service experience showed that the 4.0 m deflation system design was suitable on larger balloons.
• Although not explicitly part of the design change approval, the tethered manufacturer production test would provide some assurance on the suitability of the modified design.

Kubicek approved the design change and then manufactured VH-RJR with the modified deflation system. VH-RJR was the only balloon with this deflation system design change produced.

Post-incident investigation

After the incident, Kubicek compared the manufactured deflation system dimensions with the original design drawings and found no differences. The design differences between the VH‑RJR deflation system and the same size deflation system fitted to the manufacturer’s larger certified balloons was also reviewed. This found that when incorporated into the smaller BB78Z balloon, the vertical load tape spacing at the edge of the vent panel (Figure 10) differed from other designs as follows:

• VH-RJR BB78Z with 24 gores and 4.0 m radius vent aperture – 1,042 mm spacing
• Standard BB78Z with 24 gores and 3.6 m radius vent aperture – 940 mm spacing
• Standard larger balloon with 28 gores and 4.0 m radius vent aperture – 893 mm spacing

Figure 10: VH-RJR vent panel spacing between load tapes

Source: ATSB

Regarding the effect of the increased vertical load tape spacing on VH‑RJR, Kubicek stated:

Manufacturer testing

All balloons manufactured by Kubicek were subject to a tethered test to ensure the balloon flight controls performed correctly and the balloon was in a condition for safe operation. The test involved the following:

• balloon assembled with an internal envelope air temperature sensor, with the basket tethered to the ground
• weight placed in the basket to allow internal envelope temperature to be raised to a minimum of 100 °C (not to exceed 124 °C)
• heat the balloon to achieve a height of 0.5-3 m above the ground for at least 30 seconds
• record the take-off temperature and maximum temperature achieved
• check the function of the deflation system and rotation vent
• conduct a visual inspection of the balloon shape.

The VH-RJR test was performed with an ambient air temperature of 7 °C and at 814 ft above mean sea level. The test report indicated that the maximum internal envelope temperature reached 114 °C, with no issues with the deflation system function. After successfully completing the test, the balloon was delivered to the operator.

Post-incident investigation

The post-incident testing arranged by the ATSB on VH-RJR indicated that gaps in the deflation system were forming between the vent panel and edge of the vent aperture at about 90 °C internal envelope temperature. This temperature was below the reported temperature reached during the manufacturer test with similar ambient conditions (temperature and altitude) such that similar internal envelope temperatures created comparable internal envelope pressure. To examine this discrepancy, Kubicek used software to estimate the actual envelope air temperature reached during the test. The software estimated that the maximum internal envelope temperature only reached about 89 °C instead of the 114 °C recorded on the report.

Temperature sensors

As part of the manufacturer’s tethered test, a wireless temperature sensor (probe and transmitter) was fitted to the top of the envelope to record the internal envelope air temperature. The sensor probe was placed inside a Velcro tab designed to measure the temperature at 20 mm from the envelope fabric surface during the test (Figure 11). A receiver located in the pilot’s compartment was wirelessly linked to the temperature transmitter and provided the temperature reading during the test.

Figure 11: Envelope air temperature sensor

Source: Kubicek, modified and annotated by ATSB

The primary purpose of the temperature sensor was to ensure that the test’s minimum envelope air temperature was achieved (100 °C), and the maximum allowable temperature (124 °C) was not exceeded. The envelope air temperature is directly related to the buoyancy force acting on the balloon which is generated by the heated air within the envelope. Significantly, as the internal envelope air temperature increases compared to the ambient air temperature outside the envelope, the pressure pushing upwards on the vent panel also increases.

The position of the sensor probe from the envelope fabric was important to obtain the targeted temperature reading as the air temperature within the envelope could vary significantly depending on location. Balloon temperature sensor research data indicated that at the top of the balloon, where the heated air accumulates, the temperature reading would increase as the sensor moved away from the fabric. For example, a sensor that was 20 mm from the fabric could read 25 °C higher than if positioned directly on the fabric.

In addition to sensor probe position, temperature sensor readings can also be affected by aging during storage, thermal stress, mechanical stress, receiver issues, and calibration problems.

Kubicek provided the following information regarding the use of temperature sensors:

• Different models of temperature sensors and receivers were used to conduct the tests and each sensor and receiver combination was subject to an annual functional check. The sensors were not subjected to any recurrent calibration after purchasing from the temperature sensor manufacturers.
• The tethered test inflation procedure did not include any procedures for the installation of the temperature sensors.
• Information on the type of temperature sensor and receiver used during the tethered test inflations did not need to be recorded, and was not recorded during the VH‑RJR test.

The ATSB and balloon manufacturer reviewed images and video from the VH-RJR manufacturer test, but no conclusions could be drawn about the type of temperature sensor used, its location, or how it was installed.

Entry into service

Based on the BB78Z type certificate issued by EASA in 2016, CASA issued the BB78Z with a type acceptance certificate[8] in 2018, making the model eligible to receive an Australian standard certificate of airworthiness (CoA).

Under CASA’s Civil Aviation Safety Regulations, an imported aircraft certified by a recognised national aviation authority (including EASA) can be issued with a standard CoA if CASA or an authorised person[9] is satisfied that:

(a)  the aircraft conforms to the type design; and

(b)  any modifications or repairs to the aircraft have been carried out in accordance with a supplemental type certificate or an approved modification/repair design; and

(c)  the aircraft is in a condition for safe operation

In practice, this process involved review of relevant documentation such as the type certificate, modification and repair approvals, maintenance records, log books, flight manual, and compliance with any airworthiness directives. The issue of the CoA was reliant on the accuracy and completeness of the information available and the information provided to CASA or authorised person by the applicant.

An inspection of the aircraft, either remotely through photos or a physical inspection, was also required to confirm that the aircraft's physical condition was acceptable and in a condition for safe operation. A manned free balloon[10] such as the BB78Z, also required a test inflation to ensure there were no obvious flaws, but the test was not mandatory if a similar test inflation had been entered in the balloon's logbook.

The operator received delivery of VH-RJR on 13 April 2022 – one week before its first flight (the incident flight) – and arranged for information to be submitted to an authorised person to apply for the CoA. Included in the supplied information was an extract from the balloon’s logbook which showed a 0.5 hour flight for the balloon manufacturer’s tethered test in October 2021.

The authorised person reviewed the supplied information and filled out the necessary checklists. The CoA for VH‑RJR was issued on 17 April 2022, with no associated limitations, and permitted the aircraft to begin passenger carrying operations. Once the CoA had been issued, there was no requirement for the operator to conduct any test flight before entry into service.

In discussing the VH-RJR CoA process, the authorised person stated the following:

• No test inflation was conducted as part of the CoA application process since the balloon’s logbook included an entry for a manufacturer test.
• If a test inflation was conducted as part of the CoA application, in terms of checking deflation system operation, it would only require a functionality check, which would be performed at relatively low envelope air temperatures. Since the deflation system problem identified on VH‑RJR occurred at relatively high envelope temperatures, the problem with the deflation system would very likely not have been identified during such a test.
• None of the information supplied to the authorised person as part of the CoA application indicated that the envelope’s deflation system had been modified. However, for a new aircraft such as VH-RJR coming from the manufacturer, there was an assumption that any changes had been done in accordance with the type design, and any manufacturer approvals would be available. Therefore, even if the modification approval was reviewed as part of the CoA application, the CoA would still have been issued.

Safety analysis

Incident flight

On the morning of 20 April 2022, VH‑RJR was being prepared for a balloon transport flight for 13 passengers from Royal Park, Victoria to Moorabbin Airport. This was the first flight of the balloon since manufacture.

As the deflation system issue only became visible at elevated envelope temperatures normally reached during flight, the pilot was unable to identify the issue during the pre-flight checks. Shortly after VH-RJR departed, the pilot activated the burners to climb over the Melbourne CBD, raising the air temperature in the envelope which increased the upwards pressure on the vent panel. The increased pressure pushed the panel’s edge through the aperture creating gaps for the envelope air to leak out. The pilot noticed this, and after unsuccessful attempts to seal the gaps, decided to look for a suitable location for a forced landing.

Landing in built-up areas is challenging due to the many obstacles and limited large open spaces. Fawkner Park and Albert Park were potential landing areas, but both presented a high risk of collision with the adjacent buildings, while flying to Elsternwick Park would have required more fuel than Elwood Beach. The pilot's decision to remain at low altitude provided the best chance of completing a safe landing. Further, aiming for Elwood Beach, an area with minimal people and obstacles, and in the direction of the wind, was a suitable option.

The air escaping out of the envelope around the vent panel made it difficult for the pilot to control the balloon’s altitude and flight path, and required significantly increased burner use (and therefore fuel) to maintain altitude. In combination with flying at low altitude to search for a suitable landing location, obstacle avoidance was difficult, and the balloon’s basket collided with 2 buildings during the flight. However, the pilot instructed the passengers to adopt the landing position before each collision to reduce the risk of injury.

Although there was sufficient fuel on-board to conduct a normal balloon flight to Moorabbin Airport, the increased fuel burn to keep the balloon aloft reduced the fuel to a level where altitude could no longer be maintained. This occurred during the approach to Elwood Beach, and consequently, the pilot decided to land the balloon in a suburban street. During the forced landing the basket collided with trees and then terrain, resulting in minor injuries to 3 passengers.

Deflation system design change

Before VH-RJR was manufactured, the operator requested a larger deflation system to improve the BB78Z’s descent performance. The design change to the deflation system was classified as ‘minor’ and therefore approved internally by the manufacturer, Kubicek, within its EASA design organisational privileges. The change was based on the larger deflation system used on the manufacturer’s larger certified balloons.

As part of the design change approval process, the manufacturer needed to demonstrate that the change was compliant with relevant BB78Z certification requirements – which in this case was to establish the suitability of the design change by tests or analysis. However, the documentation used to show compliance with this requirement did not contain any tests, analysis, or information to demonstrate that the design was safe and suitable to use on the BB78Z.

The design change approval was based on 2 undocumented and incorrect assumptions:

• A previously certified design feature would be suitable on a different sized balloon, even though the vent panel geometry between the vertical load tapes changed due to the different number of gores.
• The manufacturer’s tethered test would provide assurance of the design’s suitability.

Implementing the 4.0 m deflation system design, used with the larger 28 gore balloons, on the BB78Z with only 24 gores, resulted in longer spacing between the vertical load tapes at the vent aperture edge. As this increased spacing was the only geometric difference identified, and production issues were ruled out, the longer spacing most probably allowed normal envelope pressure to push the vent panel up through the vent aperture.

Since no assessment on the design’s suitability was conducted during the design process, the design issues were not identified prior to approval of the change. The balloon was subsequently manufactured with the modified deflation system and subjected to the manufacturer’s production test.

Manufacturer production testing

All balloons manufactured by Kubicek were subject to a tethered test to ensure the balloon flight controls performed correctly and the balloon was in a condition for safe operation. The internal envelope temperature recorded on the VH-RJR manufacturer production test report (114 °C) was above the minimum required value (100 °C). However, based on post-test calculations, the actual temperature reached during the test was probably only about 89 °C. Information on the temperature sensor used during the test, its location, or how it was installed, was not available, so it was not possible to determine the reason for this significant temperature discrepancy.

Significantly, the lower envelope air temperature achieved during the test reduced the upwards pressure on the vent panel. As a result, the deflation system design problem, which began to occur at about 90 °C, was not identified. If the temperature reading during the test had been accurate and the minimum required value of 100 °C had been achieved, the vent panel gaps would have almost certainly been identified during the test. However, the production test was not a design‑related test, and as such, could not be relied on as assurance that a design was safe and suitable for use. For example, if the vent panel started to push up through the aperture at a temperature above 100 °C, the production test could be passed with a deflation system issue present.

The internal envelope temperature was an important parameter to record during the production test as it ensured that normal anticipated pressure acting on the vent panel were achieved. However, the manufacturer had limited ability to verify that the temperature being recorded was accurate since:

• there was no procedure or information about the installation and correct positioning of the temperature sensor
• the accuracy of the temperature sensors used by the manufacturer was not known
• a single temperature sensor was used.

If the manufacturer had sufficient means to verify that the recorded temperature sensor readings were accurate, the incorrect temperature reading during the VH-RJR test would almost certainly have been identified.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving Kubicek Balloons BB78Z, VH-RJR, 15 km north‑west of Moorabbin Airport, Victoria on 20 April 2022.

Contributing factors

• The balloon's modified deflation system had longer spacing between the vertical load tapes at the vent aperture edge compared to the standard deflation system design. This spacing allowed normal envelope pressure to push the vent panel upwards through the vent aperture, allowing air to leak uncontrolled out of the envelope.
• Shortly after take-off, air leaked out around the vent aperture edge. This reduced balloon control and led to a significant increase in burner (and fuel) use to maintain altitude.
• While searching for a suitable landing site at low altitude, control difficulties led to the balloon's basket colliding with 2 buildings.
• While approaching the intended landing area at Elwood Beach, fuel reduced to a level where altitude could not be maintained, and the pilot decided to land the balloon in a suburban street. During the forced landing, the basket collided with terrain resulting in minor injuries to 3 passengers.
• At the request of the operator, the balloon manufacturer had developed and approved a design change to the balloon's deflation system. However, the manufacturer had not conducted the required tests or analysis to ensure the safety of the design change on the balloon (VH-RJR).
• After the design change was approved, the balloon was subjected to the manufacturer’s production inflation test. For reasons that could not be determined, the actual internal envelope air temperature reached during the test was lower than that recorded, and below the minimum required value. The lower temperature achieved during the test reduced the upwards pressure on the vent panel such that the deflation system design issue was not identified.
• The balloon manufacturer did not have an adequate process to verify the accuracy of the temperature recorded during production inflation tests. (Safety issue)

Manufacturer test procedures

Safety issue number: AO-2022-028-SI-01

Safety issue description: The balloon manufacturer did not have an adequate process to verify the accuracy of the temperature recorded during production inflation tests.

Safety action not associated with an identified safety issue

Additional safety action by Kubicek Balloons

Kubicek advised that the flight manual for all balloons has been updated to include a new section which describes the purpose of the temperature sensor and its use during flight (a temperature sensor is optionally fitted to some balloons). At the time of this report, the revised flight manual was awaiting regulatory approval.

CASA               Civil Aviation Safety Authority

CBD                 Central Business District

CoA                 Certificate of Airworthiness

EASA               European Union Aviation Safety Agency

Sources of information

The sources of information during the investigation included the:

• balloon manufacturer
• Bureau of Meteorology
• Civil Aviation Safety Authority
• authorised person for VH-RJR certificate of airworthiness
• balloon operator
• pilot of the incident flight
• passengers
• recorded data from the GPS unit on the aircraft
• video footage and images of the incident flight.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the balloon pilot and operator
• the balloon manufacturer
• Civil Aviation Safety Authority
• the authorised person for VH-RJR certificate of airworthiness
• Civil Aviation Authority of the Czech Republic
• Air Accidents Investigation Institute of the Czech Republic
• European Union Aviation Safety Agency.

Submissions were received from:

• The balloon pilot and operator
• the balloon manufacturer
• Civil Aviation Safety Authority
• the authorised person for VH-RJR certificate of airworthiness.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     Civil Aviation Safety Regulations Part 131 (Balloons and hot air airships) commenced on 2 December 2021. However, at the time of the accident, the Part 131 Manual of Standards that contained most of the operational rules was deferred. Civil Aviation Order 95.53 (Commercial Balloon Flying Training and Balloon Transport Operations) Instrument 2021 required that balloon transport Air Operator’s Certificate holders comply with the operational requirements of the previously relevant Civil Aviation Regulations 1988 and Civil Aviation Orders.

The occurrence

Pre-flight

In the morning of 16 April 2022, the pilot of a Beechcraft B58 Baron (B58) registered VH-NPT (NPT) arrived at Aviair Pty Ltd, at Broome Airport to prepare for a regular charter flight to several remote locations in northern Western Australia. The operator’s duty maintenance officer (maintainer) reported that the pilot contacted them by phone before the flight, reporting a ‘fuel kind of smell’ in the aircraft’s cockpit. The maintainer recalled discussing the basics of the aircraft’s fuel system and asking the pilot to monitor the situation and report back if the smell did not go away.   

The flight

The flight, with one passenger, seated in the rear right seat, and 4 boxes of cargo onboard, was planned to transit through the East Kimberley Regional Airport at Kununurra (Figure 1), refuel, then continue to Halls Creek where the passenger was to disembark, Fitzroy Crossing to unload cargo and then return to Broome via Derby.

Figure 1: Flight area with planned stops

Source: Google Earth annotated by the ATSB

The aircraft departed Broome at 0613 local time and climbed to 9,000 ft while tracking to the north-east. The maintainer, reported that at 0628 the pilot contacted them again, advising that the ’fuel like smell’ detected on the ground was no longer present.

At 0749 the pilot contacted air traffic control (ATC) and requested traffic for a direct track to waypoint Kununurra Whiskey Foxtrot (KNXWF) for an approach to runway 12 at Kununurra (Figure 2). At 0817 the pilot of NPT contacted ATC advising that they were leaving their cruising altitude of 9,000 ft on descent for Kununurra.

Figure 2: NPT flight path and Brisbane Centre radio calls

Source: Google Earth and AvPlan annotated by the ATSB

The approach

Seventeen minutes later NPT joined a straight in approach to runway 12. The pilot recalled slowing the aircraft, extending the first stage of flaps, and attempting to extend the landing gear.

Upon selecting the landing gear handle to the down position, the gear down and locked indicators (3 green lights) illuminated immediately. The pilot reported that this was unusual, as normal operation required a few seconds for the landing gear to extend and the lights to illuminate. However, no sound was heard from the landing gear motor and no decrease in aircraft performance was felt that would indicate gear had extended. The pilot also recalled, co‑incident with the landing gear handle activation, that the landing gear warning horn erroneously activated. The pilot stated that these unusual indications were followed immediately by an electrical burning smell and smoke emerging from below the left side of the aircraft instrument panel, forward of the pilot’s circuit breaker panel.

About a minute later, at 0836, the pilot made a PAN-PAN[1] call on the Brisbane Centre frequency advising of smoke and suspected fire in the cockpit. The pilot then activated the SOS[2] function on a dash mounted Spider Tracks[3] unit. The pilot recalled switching off the electrical power to the aircraft, in accordance with the electrical smoke and fire emergency procedure. They also reported switching off the avionics master switch (see the section titled Electrical system) as an additional precaution. By that time flames were emanating from the same location as the previously observed smoke.

The pilot then expended the entire contents of the aircraft’s handheld portable fire extinguisher, while continuing the straight in approach to runway 12 (Figure 3). However, the fire almost immediately returned, emanating from the same location, with flame and significant smoke in the cockpit. The pilot reported difficulty maintaining control of the aircraft as their left hand and leg were exposed directly to the flames and the smoke prevented them seeing both the instruments and the outside environment. In response, they opened the aircraft’s storm window[4] in an attempt to clear the smoke and obtain a visual reference.

Figure 3: NPT approach to East Kimberley Regional Airport

Source: Google Earth, AvPlan and Airservices Australia, annotated by the ATSB

As the aircraft approached the Ord River, multiple airborne witnesses reported that it appeared to be below the standard approach profile and ‘skimming the treetops.’

Recorded flight data indicated that, at 0837, the aircraft started diverging left of the extended runway centre line, crossing the Ord River at low level approximately 1.5 km from the threshold of runway 12. The aircraft subsequently collided with terrain, coming to rest inverted about 600 m beyond the river and about 800 m from the runway 12 threshold (Figure 3) and was consumed by a significant post‑impact fire.

Several pilots who were listening to the Brisbane Centre frequency reported hearing a transmission of static at the approximate time of the collision with terrain.

Post impact actions

The pilot reported difficulty in releasing themselves from the restraint and exiting the inverted aircraft. After exiting the aircraft, they attempted to access the passenger through the rear doors but were unable to due to the presence of significant smoke and flame. The pilot then re‑entered the aircraft through the crew door and located the passenger who was still secured in their restraint. The pilot, with limited assistance from the semi‑conscious passenger, undid the restraint and proceeded to extract the passenger from the aircraft. Shortly after the pilot and passenger exited the aircraft, the pilot collapsed, and operator personnel arrived and moved them to a safe distance from the wreckage.

The passenger succumbed to their injuries at the accident site. The pilot suffered serious injuries and was airlifted from the site to East Kimberley Regional Airport for transfer to the Kununurra Hospital before being transferred to Darwin for further treatment.

Context

Aircraft Information

NPT was a Beechcraft B58, low-wing, twin engine aircraft (Figure 4). It was manufactured in the United States in 1996 and first registered in Australia in 2012. The aircraft was fitted with 2 Continental IO-550-C piston engines, driving 3‑blade constant‑speed propellers.

Figure 4: VH-NPT at the time it was purchased by the operator

 

Source: Operator

NPT was acquired by the operator in 2019. It was configured for charter operations with seating for up to 4 passengers in a club[5] configuration and seating for 2 pilots. The aircraft was configured with dual flight controls.

Access to the aircraft was through one of 2 doors, a crew door located on the front right of the aircraft next to the co-pilot’s seat, providing access to the front seats. Two rear or ‘barn doors’ on the right side of the aircraft provide access to the rear cabin for the loading of persons and freight (Figure 5). The aircraft was also fitted with an emergency exit window on the left side of the aircraft next to the left rearward facing passenger seat. This window could be opened by a passenger in the event of an emergency. The pilot reported that instruction on its operation was included in the pre-flight briefing to the passenger.

Figure 5: Aircraft schematic identifying location of key elements

Source: Manufacturer annotated by the ATSB

Weight and balance

Prior to departure the pilot determined that the aircraft would be within weight and balance limitations for each leg of the flight using the operator’s approved spreadsheet for NPT. The ATSB obtained a copy of the approved spreadsheet for NPT and confirmed the pilot’s calculations. This assessment also indicated that for the legs of the flight that the passenger was onboard, the aircraft remained within balance limits irrespective of the seat occupied by the passenger.

Fire suppression

In accordance with the manufacturer’s requirements, NPT was fitted with a handheld portable 2 kg halon fire extinguisher for emergency use by the crew. The extinguisher was located centrally between the pilots’ seats and the rearward facing passenger seats. The extinguisher was inspected and reweighed as part of the last 100 hourly inspection in accordance with Civil Aviation Safety Authority requirements.

The pilot commented that, while they were able to access and utilise the extinguisher, its positioning made it more difficult to access in the event of an emergency than in other aircraft within the fleet.

Electrical system

Aircraft power was supplied by a single battery and an alternator fitted to each of the aircraft’s 2 engines. These power sources could be connected and disconnected individually using 3 separate switches on the pilot’s sub‑panel labelled ‘MASTER’ (Figure 6). To protect the avionics from electrical damage when the master switches were being operated, a separate ‘AVIONICS MASTER’ switch (Figure 6) controlled power to these devices. The ‘AVIONICS MASTER’ was dependant on the ‘MASTER’ switches in the control hierarchy, meaning that if the ‘MASTER’ switches were off, the ‘AVIONICS MASTER’ was not able to be powered.

Figure 6: Schematic of the pilot’s subpanel showing master power and landing gear controls

Source: Manufacturer annotated by the ATSB

Electrical power was supplied to several systems including drive motors for the landing gear and flaps, aircraft lighting, avionics and communications. A circuit breaker panel on the pilot’s left side protects the circuits from overload and damage. Wiring was routed from the circuit breaker and instrument panels down along the left side of the aircraft in a series of looms. Figure 7 shows the area forward of the circuit breaker panel and below the pilot’s instrument panel in an exemplar aircraft.

Figure 7: Circuit breaker and instrument panel of an exemplar B58 showing the position of wiring looms.

Source: Operator annotated by the ATSB.

Based on the pilot’s report of the abnormal landing gear behaviour, the ATSB conducted a detailed examination of the system function. The landing gear system consists of:

• a motor driving the gear between the extended and retracted positions
• an indicating system that identifies to the pilot when the gear is retracted, extended or in transit
• an aural alert that the gear is not extended if the aircraft is otherwise configured for landing.

Landing gear motor

The landing gear handle (Figure 6) acts as an electrical switch closing either the retract or extend landing gear motor circuit and powering the motor. Current flows through the switch and landing gear limit switches[6] to the motor relays. They are connected to the pilot’s circuit breaker panel by wiring on the left side of the aircraft and protected by a 5-amp circuit breaker. The relays operate a separate 30-amp circuit providing power directly to the landing gear motor. The switches and relays within the gear motor system provide power, with the motor constantly grounded. The landing gear motor is located below the floor of the aircraft between the crew and passenger seats.

Landing gear indication

The landing gear indication system consists of 4 lights, including one for each of the left, right and nose gears indicating they are in the down and locked position. A fourth light indicates that the gear is in transit. The lights are positioned above the gear handle on the instrument panel on the pilot’s subpanel assembly (Figure 6).

The lights are connected to down-lock and up-lock switches on each of the gear.  The in-transit light is illuminated when either the down-lock or up-lock switches on any of the gear are not depressed. Once the down lock switches on each gear is closed, the light for that gear is switched on and once all 3 down lock switches are activated, the in-transit light switches off. These lights are connected to a 5-amp power supply and are switched on by grounding the circuit through these switches.

Landing gear warning

The landing gear warning system warns the pilot if the aircraft is incorrectly configured for landing due to the gear not being extended. The system consists of a warning horn connected to flap, throttle, and landing gear position switches. The horn will activate if the flaps are extended to full and the throttles are retarded while the landing gear is selected up.

The wiring for these systems, and several other electrical systems, are bundled together in the area where the pilot reported the fire started. The ATSB’s review of the aircraft electrical wiring schematics was not able to identify a single point of failure, either through a short between systems or to ground or an open circuit, which could have caused all 3 symptoms that the pilot reported. However, the bundling of multiple wires and the possibility of live circuits contacting one another meant that a multiple point failure in the landing gear, or within other electrical circuits, leading to the symptoms the pilot reported was possible.

Other electrical anomalies

After the pilot selected the landing gear to the down position and the fire commenced, the pilot reported switching off the aircraft’s electrical power and that the aircraft’s avionics screens went black. Spider Tracks data (see the section titled Recorded data) ceased shortly after this, however the aircraft’s ADS-B transponder continued to transmit (see the section titled Recorded data) until just before the aircraft collided with terrain. Following the PAN-PAN, no radio transmissions from the aircraft were recorded on the Brisbane Centre frequency. However, multiple pilots operating in the area at the time reported significant static on this frequency at approximately the time the aircraft collided with terrain, possibly indicating that NPT’s radio was powered.

Cabin heater

The B58 is fitted with a fuel‑burning cabin heater in the nose of the aircraft (Figure 5). Maintenance records indicated that the heater was infrequently used, and the pilot advised that the heater was not utilised during the accident flight. In the 12 months leading up to the most recent 100 hourly inspection the heater had been used for 102.5 of the aircraft’s accumulated 1,077 hours, of which only 3.3 had been accrued in the last 6 months. The heater’s hour count following the 100 hourly inspection was unable to be determined due to the post impact fire.

The heater is supplied with fuel via a direct line from the left-wing leading-edge fuel tank. The fuel line is attached to the tank at the wing root and traverses internally along the lower left fuselage. It passes through the aircraft cockpit below the pilot’s circuit breaker panel (Figure 6). The line then enters the aircraft’s nose-wheel bay and connects to the heater. The line fills with fuel as the tank is filled and will remain full of fuel at all normal flight attitudes. The line is secured at multiple locations with clamps to prevent damage from contact with the aircraft’s structure.

When the heater is running, fuel flows through the line at a rate of about 4 litres per hour.

Maintenance history

The last 100 hourly inspection was completed 9 days prior to the accident flight. Since that time, and prior to the accident flight, the aircraft had accrued 18.7 hours of flight time.

Concurrent with the 100 hourly inspection, additional maintenance tasks were carried out on NPT. One of these tasks was a repair to the leading-edge fuel tank in the aircraft’s left wing. A leak was identified during a post maintenance fuel leak check and traced to a gasket on the tank. Maintenance records indicated that the fuel bladder was manoeuvred to access and replace the leaking gasket. Records did not indicate if the line to the cabin heater was disconnected prior to the maintenance taking place. Following the repair to the gasket a further post maintenance leak check was carried out with nil defects identified. The aircraft manufacturer’s 100 hourly inspection required that the heater be inspected in accordance with the heater manufacturer’s manual. The manual required an operational check of the heater, including at least 2 operational cycles.

The ATSB reviewed the aircraft’s logbook and maintenance release, no references were identified to a fuel leak or a potential fuel smell in the cockpit between the time the 100 hourly was completed and the accident flight.

Restraints

NPT was fitted with 2 types of restraints, 4-point harnesses for the crew seats and 3-point harnesses for both the forward and rearward facing passenger seats in the main cabin. The 4‑point harnesses fitted to the crew seats were not original equipment and had been retrofitted to the aircraft prior to its purchase by the operator, replacing the existing 3-point harnesses. These restraints were in accordance with or exceeded regulatory requirements (see the section titled Survivability - Restraints).

Flammability resistance

The B58 was certified under Part 3 of the United States Civil Air Regulations as amended in 1956, which required that materials making up the cabin interior be ’flash resistant’, or ’flame resistant’ if the compartment could be used for smoking.

The type certificate data sheet for the B58 required placarding that the aircraft was non-smoking for serial numbers TH-2173 and later. The interior of NPT, being an earlier serial number, was required to meet the standard for a flame-resistant interior.

Flame resistant materials are required to resist flame advance of more than 4 inches per minute. Flash resistance required average flame advance to be less than 20 inches per minute.

These progression rates are tested under controlled conditions in accordance with FAA advisory circular 23-2A. The tests are conducted on the materials in isolation and do not account for accelerants being present.

Site and wreckage information

The initial collision point with terrain was approximately 45 m from the main wreckage location with the aircraft tracking approximately 117° and becoming inverted during the impact sequence.

Despite the aircraft being consumed by a post impact fire some of the aircraft’s contents, including several documents and personal effects were ejected during the impact sequence, leaving them largely unaffected.

Due to the severity of the post‑impact fire, the ATSB was not able to conduct a complete wreckage examination. However, there was evidence of engine rotation prior to the collision with terrain and no evidence found of pre-existing defects in the engines or flight control components that could have contributed to the accident. The landing gear was observed in the stowed position and no landing gear impact marks were visible at the accident site.

Aircraft windscreen

During the impact sequence the aircraft’s windscreen fractured and was liberated from the fuselage in multiple pieces. Some of these pieces, were clear of the post‑impact fire and were located nearby in long grass with their internal surfaces facing down.

The ATSB was able to reassemble almost the entire windscreen on-site (Figure 8). Once reassembled a soot trail was visible on the internal surface of the left side of the windscreen. The trail, emanating from the bottom of the windscreen, was approximately 34 centimetres from the left edge. The soot was of sufficient thickness that a clearly visible trail was able to be wiped into it. At the point where the soot trail initiated, the windscreen material exhibited a different failure mode, likely associated with significant heat.

Figure 8: Reassembled aircraft windscreen showing soot trail outline and heat damage

Due to environmental conditions on-site the soot trail was not easily visible in captured image. The outside surface of the windscreen was subsequently marked on site with yellow paint marker identifying lateral extremities of the soot trail.

Source: ATSB

The upper, aft corner of the pilot’s storm window surround (Figure 9) was located with the outer surface down, closer to the post‑impact fire than the windscreen. Soot was located on both sides with the external surface, consistent with soot being drawn out of the window by the airflow.

Figure 9: Smoke and soot indications on window surfaces adjoining the pilots storm window

Source: ATSB

Flaps

Due to fire damage to the flap actuators, the specific position of the flaps at impact was unable to be determined. The aircraft’s flap tracks were recovered for further examination at the ATSB’s technical facilities in Canberra. Impact markings on the flap tracks indicated that the flaps were likely extended to the first of the 2 flap positions (15°) at the time of impact (Figure 10). This corresponded with both the pilot’s report of having extended the flaps one position prior to activating the landing gear and the operator’s procedures that required first stage flap extension as part of the setup of the aircraft for the approach.

Figure 10: Left inboard flap track with markings indicating likely flap position at impact

Source: ATSB

Possible tree strike

In response to witness reports that the aircraft skimmed trees prior to the ground collision, the operator conducted an airborne search on the western side of the Ord River. This search identified a grouping of 4 trees in the approach to runway 12 that had damage consistent with aircraft contact.

The trees were approximately 500 m west of the river and 60 m north of the extended runway 12 centreline (Figure 11). Their position was consistent with the aircraft’s approach path, and were close to the lowest point in the aircraft’s flight path data on the western side of the Ord River. Tree damage was between 15 and 20 ft above ground level and the direction of the breaks and fallen limbs were consistent with the aircraft’s direction of travel.

Figure 11: Possible tree strike location

Source: Google Earth, Operator, AvPlan and Airservices Australia, annotated by the ATSB

Other than evidence of a collision with a number of small trees at the accident site, no additional tree strikes were identified, and no evidence of a foliage strike was located on the wreckage, however the significant fire damage prevented a detailed examination.

Pilot information

The pilot held a current Commercial Pilot License (Aeroplane), with their last flight review conducted in December 2021. They also held a:

• Class 1 aviation medical certificate, valid until January 2023
• multi engine aircraft instrument rating with retractable undercarriage and manual propellor pitch control endorsements.

Prior to the accident flight, the pilot had accumulated approximately 2,482 hours of aeronautical experience, of which just over 120 hours were in command of the B58. The pilot had completed their most recent operational proficiency check on 9 January 2022 and a line check in the B58 was carried out on 25 January 2022.

Meteorological information

An aerodrome meteorological report (METAR[7]) was issued by the automatic weather station at East Kimberley Regional Airport approximately 7 minutes before the accident. The report showed fine weather, with winds from the north at 2 kt, visibility greater than 10 km and nil cloud detected.

The ATSB also reviewed CCTV footage from the East Kimberley Regional Airport, which captured the smoke plume from the accident. Figure 12 shows the location of a camera covering the regular public transport apron. The camera image showed a smoke plume rising near-vertically from the accident site approximately 3 minutes after the accident indicating little to no wind immediately after the accident, consistent with the METAR.

Figure 12: Location of CCTV camera

Source: Google Earth annotated by the ATSB

Survivability

In reviewing the survivability aspects of this accident, the ATSB sought expert guidance from the Royal Australian Air Force Institute of Aviation Medicine (IAM). Their report formed the basis of the following section.

Restraints

Injuries to aircraft occupants arising from traumatic contact with aircraft structure occur at least 5 times more often than acceleration‑related injury. Within small aircraft that have confined interiors, lap belts and upper torso restraints are critical to crash survivability for both crew and passengers. The restraint of the upper body serves 2 purposes:

• reducing the likelihood of impacting structures by minimising body flailing
• distributing forces more widely across the body, making them more likely to be survivable.

Upper torso restraints can be provided with a single shoulder strap, like that used in a car seatbelt or 2 straps, one over each shoulder. Figure 13, below, shows the difference between 2-, 3- and 4-point restraints. The image also shows a 5-point restraint that has a crotch strap which provides additional protection for the wearer, preventing them from ‘submarining’ or sliding under the lap portion of the restraint.

Figure 13: Aircraft restraint types.

Source: United States Department of the Interior via IAM

Both 3- and 4-point harnesses restrain the upper torso. However, the 3-point only provides lateral restraint in one direction, if the person flails to the unrestrained side they may come out of the shoulder strap rendering it ineffective. Additionally, with only one strap over the torso, the 3‑point restraint has a smaller surface area than the 4-point, increasing the force exerted to the restrained area on the wearer.

In accordance with Civil Aviation Safety Regulation (CASR) 90.105 the flight crew seats must be fitted with a restraint that consists of a lap belt and at least one shoulder strap. Requirements for occupant restraints are outlined in CASR 90.110 and require all occupant seats for aircraft with less than 10 seats and manufactured after 13 December 1986 to be fitted with an approved seat belt and shoulder harness.  

Seating

It is generally accepted that in the event of a frontal impact a rearward facing seat will increase survivability in two ways.

• Spreading the impact force over the entire surface of the back rather than specific areas where a restraint is positioned.
• Limiting the movement of the head through flexion and extension of the neck, provided the seat is fitted with an appropriately positioned headrest.

There is no Australian regulatory requirement for the use of rearward facing seats. Their use is subject to availability and based on a range of operational considerations. These include weight and balance, emergency egress, other payload items (cargo), company procedure and passenger and pilot comfort. The ATSB recovered all seat frames from the aircraft wreckage. However, due to the severity of the post‑impact fire the ATSB was not able to conduct a detailed assessment and determine their effectiveness in attenuating impact forces and any subsequent effect on survivability.

Injuries

IAM reviewed the hospital and post-mortem records of the pilot and passenger respectively and provided a summary of their injuries. Both the passenger and the pilot received injuries attributable to both the fire and the collision with terrain. While there were some similarities in the injury profiles, the passenger’s injuries included more severe burns and trauma to the neck and chest, consistent with a single shoulder restraint and flailing within the aircraft, that the pilot did not suffer.

Recorded data

Spider Tracks

The last non-SOS Spider Tracks data point, available to the nearest minute was recorded at 0835. Immediately after this, still at 0835, two ’SOS Opened’ data points were recorded, indicating that the SOS function has been activated. No further data was received by the operator.

The SOS function increases the frequency of the data transmissions to 10-15 second intervals rather than the standard 2 minutes. Data from the pilot’s electronic flight bag (EFB) application indicated that the aircraft collided with terrain at 0837. If the Spider Tracks unit had remained powered after the 2 SOS data points at least 8 further transmissions should have been received. If the activation of the SOS function had not triggered the increase in data frequency, then one more point may have been received at 0837, depending on the exact time that the 0835 data point was transmitted.

The operator advised that the Spider Tracks unit was connected to aircraft power and the loss of signal from the Spider Tracks indicated a loss of electrical power to the aircraft.

Electronic flight bag

The operator utilised the AvPlan EFB application for pilots to undertake flight planning tasks, access electronic information, such as charts or relevant documentation and depending on the settings, display nearby traffic. The application can also record aircraft position information at 5‑second intervals. The pilot of NPT had a device with the application installed and active for the flight, for which the ATSB received data. This provided multiple flight parameters including ground speed and tracking details for the aircraft from the time of take-off until it collided with terrain.

The device was powered by an internal battery. However, it could be connected to aircraft power to keep the battery charged. The loss of aircraft power would not reduce the functionality of the device or effect the data recorded while the battery maintained its charge.

ADS-B

The aircraft was fitted with a transponder that broadcast ADS-B[8] data to ground stations and nearby aircraft fitted with ADS-B IN. The ATSB retrieved the data transmitted by this unit from ground stations operated by both Airservices Australia and other third-party receivers, including one at the East Kimberly Regional Airport.

Data obtained from the receivers operated by Airservices Australia and several third-party receivers, recorded the aircraft’s location from Broome until 0835 when the aircraft started the approach to runway 12 at East Kimberley Regional Airport. The signal was then lost, likely due to the aircraft’s descent taking it below the coverage altitude for these receivers.

An ADS-B receiver at the East Kimberley Regional Airport received data from the aircraft between 0834 and 0837. This recorded the aircraft passing KNXWF and commencing the approach to the East Kimberley Regional Airport. The final position report was received at 0836:43. Between 0836:43 and 0837:12 eight more data packets were received containing NPT’s mode S transponder code, however position information was not included.

The aircraft was fitted with a GTX33 ADS-B transponder unit, which was not equipped with an internal backup battery.

Related occurrences

The ATSB identified one occurrence in Australia and 3 in the United States that had similarities to this accident. These 4 occurrences involve in-flight fires accelerated by combustible hydrocarbons that were initiated by damaged electrical wiring. Each of these fires were different, with 2 relating to direct feeding fuel and oil gauges (which NPT was not fitted with), one was an engine fire, and one was a cockpit fire that was controllable. While different in detail, they all demonstrate the risks when electrical wiring and combustible hydrocarbons such as fuel and oil are in proximity.

AO-2014-040

On 26 February 2014 at about 1645 local time, a Beech 58 aircraft, registered VH‑SBS, departed Darwin for Gove, Northern Territory, on a private ferry flight with a supervising pilot and pilot in‑command-under-supervision (ICUS) on board.

At about 1815, the pilot flying ICUS saw smoke and flames by their left leg adjacent to the circuit breaker panel and immediately switched off the electrical master switch. The supervising pilot seated in the right seat took control of the aircraft and commenced an immediate descent. The pilot ICUS retrieved the fire extinguisher from underneath their seat and extinguished the fire.

An engineering inspection found electrical wiring penetrated through the heater supply fuel line causing it to arc and burn a hole in the fuel line. The wires had been bundled together and were rubbing on the fuel line.

NTSB investigations

Between 1983 and 2022 the NTSB’s public database identified 7 investigations where an inflight fire or explosion was listed as a factor. Of these, 3 were identified to be of particular relevance and are summarised below.

MIA00FA221

On 17 July 2000, approximately 7 minutes after departing Memphis Tennessee, the pilot of a B58 aircraft registered N158MT, serial number TH-1186, contacted ATC reporting that they had an electrical fire and were going to switch off the master. Following two further communications with ATC the aircraft collided with water at Arkabutla Lake. Witnesses reported seeing a ’vapor trail’ or ’dust’ coming from the aircraft. The pilot was fatally injured, and the aircraft was destroyed.

The NTSB investigation identified that the fire was likely the result of arcing of an electrical wire behind the pilot’s instrument panel and associated heat‑related cracking to fuel and oil lines that feed direct reading pressure gauges for fuel and oil pressure in the cockpit. The investigation also identified that the pilot had not switched off the engine alternator switches in accordance with the electrical smoke and fire emergency checklist.   

SEA02FA023

During take-off, on 2 January 2002, the pilot of a B58 aircraft registered N132Z, serial number TJ‑284, identified a fire in the aircraft’s left engine. The pilot reduced power and landed the aircraft on the remaining runway. The pilot and the passenger evacuated the aircraft, which sustained substantial damage.

Further inspection identified that an improper clearance had allowed an alternator wire to chafe against a pneumatic line in the engine bay. The exposed wire subsequently arced to the aluminium line igniting fuel vapor. The most probable cause of the accumulated fuel vapor was from a fuel cell leak that had previously been repaired.

ERA11FA312

On 25 May 2011, a B58 aircraft, registered N77AR, serial number TH-757, with a pilot and 3 passengers on board was conducting a flight from Atlanta, Georgia to Hazard, Kentucky. At 1612 local time the pilot contacted ATC to advise they were declaring an emergency due to a fire on board. No further radio transmissions were received. ATC recorded 7 further transponder and 2 primary radar returns. Several witnesses observed the aircraft in its final stages of flight before it collided with terrain at approximately 1613 local time. The 4 occupants were fatally injured, and the aircraft was consumed by a post‑impact fire.

The NTSB investigation identified that an in-flight fire likely initiated in the right front cockpit area forward of the instrument panel and below the glare shield. While the NTSB was unable to conclusively determine the origin of the fire, their analysis notes that the speed of the fire’s advance was consistent with a fuel fed fire. The analysis also identified that the area where the fire was believed to have initiated was an area that is near the direct‑reading oil pressure gauges.  

This report noted that B58 and 58A models with serial number TH-001 through TH-1193 were fitted with direct‑reading fuel flow and pressure indicators in the cockpit. Direct‑reading pressure indicators use a direct line from the engine to the cockpit for presentation of engine fuel pressure. The report noted that aircraft with serial number TH-1194 and later (NPT serial number TH-1769) were fitted with remote fuel flow indicators, removing the need for fuel lines to go directly to the cockpit.

Safety analysis

Introduction

At 0834 local time on 16 April 2022, the pilot of B58 Baron aircraft registered VH-NPT commenced a straight in approach to runway 12 at the East Kimberley Regional Airport at Kununurra. During the approach the pilot declared a PAN-PAN to air traffic control reporting smoke and suspected fire in the aircraft’s cockpit.

The pilot continued the approach, diverging from the runway centreline track as they crossed the Ord River. The aircraft collided with terrain on the eastern side of the Ord River approximately 800 m from the runway 12 threshold. The passenger sustained fatal injuries and the pilot sustained serious injuries.

The following analysis will examine the in-flight fire, looking at the sources of initiation and acceleration, the pilot’s loss of visual cues and factors that affected survivability.

In-flight fire

The pilot reported that smoke and subsequently flame emerged from below the left side of the instrument panel, below and forward of the circuit breaker panel. The pilot attempted to extinguish the fire with a portable handheld fire extinguisher. The extinguisher suppressed the fire, however once removed, the fire returned vigorously.

Within 90 seconds of the pilot declaring the PAN-PAN, the aircraft had collided with terrain. The pilot sustained serious burns to their left side and the pilot and passenger sustained fire‑related respiratory injuries.

Materials used in the interior trim of NPT were required to be flame-resistant. The fire progressed at a speed greater than what would be expected of flame-resistant materials, consistent with the fire being fuelled by an accelerant.

Acceleration

Several lines and multiple looms of electrical wiring pass through the area where the pilot reported that the fire initiated. The lines contain pitot and static air for instruments, air conditioning system gasses and the fuel line to the aircraft’s cabin heater. Of these, the fuel line to the cabin heater provided the only source for flammable liquid to accelerate the fire.

A breach in the fuel line forward of and below the pilot’s circuit breaker panel would allow fuel to enter the area behind the side wall trim panel, possibly being absorbed by the fibreglass insulation. This would provide a high energy acceleration source capable of overcoming the flammability resistance of the trim materials. A direct examination of the line, surrounding insultation and the trim panel was not possible due to the post impact fire. As a result, the integrity of the heater line was unable to be established.

Two possible scenarios were considered for when a breach in the fuel line may have occurred. The first was that the leak was initiated at the time the pilot detected the smoke. This would show significant similarity to the previous Australian occurrence (AO-2014-040) whereby the breach in the fuel line initiated and provided an accelerant for the fire. However, in the 2014 occurrence, the leak was small, and the fire was comparatively controllable. In the event of a larger breach, or the line fracturing, fuel would be liberated more quickly, decreasing the chances of controlling the fire effectively.

The second scenario considered fuel to have been leaking for some time prior to the initiation of the fire. If the fuel had been leaking previously this would allow accelerant to accumulate behind the trim panel and in the insulation. In this scenario a smaller leak could lead to the same issues controlling the fire as a larger breach occurring due to the accumulated fuel.

The pilot’s report of a ‘fuel like smell’ in the cockpit on the morning of the accident may support the line having been breached at some point prior to the aircraft taking off. However, the pilot reported that the smell was no longer present once airborne. Additionally, there was no reported evidence of fuel spillage on the ground and the aircraft had passed its fuel leak check following maintenance 18 flight hours earlier.

Due to the post impact fire damage the ATSB was unable to determine which of the 2 scenarios were more likely. However, once the fire was initiated, given its location, it would very likely have quickly burned through the heater line liberating fuel that remained in the line further accelerating the fire and contributing to its rapid return after the pilot suppressed it with the portable handheld fire extinguisher.

Initiation

The electrical burning smell reported by the pilot immediately before the smoke and subsequent flames were observed supports the fire being initiated by a fault in the electrical system. The pilot reported that all systems had been operating normally until the landing gear handle was selected to the down position. Following the operation of the landing gear handle the pilot reported that the landing gear did not extend and there were multiple abnormal landing gear system indications.

Wiring for both the indication and operational systems are contained in wiring looms that pass through the area where the pilot first observed the smoke. These looms run near one another and the aircraft structure. Undetected damage could occur to or within the wiring looms, providing an ignition source from chafing, overheating of wiring or wires shorting to another wire or the airframe. Due to the destruction of the aircraft wreckage the ATSB was not able to determine the exact sequence of events that led to the electrical fault, the initiation of the fire and the other electrical anomalies that occurred.

Despite that, previous occurrences in both Australia and the United States show the danger that damaged electrical wiring can pose in areas with flammable liquid lines.

Loss of visual cues

As the fire advanced it generated a large amount of heat and smoke in the cockpit as reported by the pilot and evidenced by the soot on the internal surfaces of the aircraft windscreen and the pilot’s storm window surround, both of which were separated from the post‑impact fire. The extent of this smoke likely prevented the pilot from being able to see visual cues external to the aircraft or to effectively use the instruments as a reference. That situation, combined with the direct heat of the fire, meant that the pilot was presented with significant difficulty retaining control of the aircraft.

Following the PAN PAN call the aircraft descended below the normal approach profile; however, the pilot was able to maintain the approach track until crossing the Ord River when the aircraft diverged to the left of the extended runway centreline. The pilot was subsequently able to regain the approach heading prior to the aircraft colliding with terrain.

Survivability

The survivability of the accident can be broken down into the environment within the aircraft prior to and after the collision and the impact forces related to the collision.

The fire generated significant heat and smoke in the aircraft’s cockpit. The reports of the pilot and the respiratory injuries to both occupants indicate that they were unable to effectively vent the smoke.

With the pilot able to self-extract after the collision, the passenger continued to be exposed to the environmental conditions within the aircraft until the pilot was able to re-enter the aircraft to extract them. This likely reduced the passenger’s chances of survival.

The pilot reported that they and the passenger were secured in their restraints at the time the aircraft collided with terrain. The pilot, in the left control seat was in a 4-point harness and the passenger, in the rear right seat, was in a 3-point harness. Generally, the 4-point harness improves survivability in 2 ways. Firstly, it better attenuates the impact forces, by spreading them more broadly over the body. Secondly, it secures the occupant more effectively laterally reducing flailing. This decreases the likelihood of injuries due to contact with obstructions or structure of the aircraft.

The primary difference in injuries between the 2 occupants of the aircraft was the chest and other trauma present in the passenger. This trauma was consistent with the differences between the use of a 3-point and 4-point restraint. The 3-point restraint did not distribute forces as evenly across the body and allowed significant multi-directional movement (flailing) inside the aircraft.  

Based on advice from the manufacturer, operator and ATSB research a 4-point restraint is not available for the rear seat of B58 aircraft. However, this accident demonstrates the fitment of the 4-point harness to the crew seats, can improve survivability over the 3-point restraint that is required under the regulations.

Seating position

NPT was fitted with a club passenger seating configuration, with 2 forward facing and 2 rearward facing seats. As the pilot and passenger were seated in forward facing seats a comparison of injury profiles due to forward or rearward facing seats was not possible. However, the available literature supports that in the event of a frontal impact the rearward facing seat will provide better restraint of the occupant. By both spreading impact force more evenly over the whole back and reducing the potential for flailing by forcing the body into the seat.

For this flight, the ATSB reviewed the weight and balance documentation, determining that the aircraft remained within limits regardless of where the passenger or the cargo were positioned. Additionally, due to the size of the cabin, the passenger’s emergency egress route would not have been altered by changing positions.

Recognising that, when flight planning, pilots have many operational considerations when it comes to passenger positioning, in the event of a frontal impact, such as a collision with terrain, a rearward facing seat will generally better protect the occupant and increase their chances of survival.
 

Submissions were received from the:

• pilot of the accident flight
• operator
• aircraft manufacturer

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 4 April 2022, the pilot of a de Havilland Canada DHC-2/A1 Beaver aircraft, registered VH-AAX, was conducting parachute flights overhead Moruya Airport, New South Wales. Shortly after the parachutists had exited the aircraft, the pilot heard a loud bang and experienced vibrations as the engine failed. In response, the pilot conducted a forced landing at Moruya.

A post-flight examination of the aircraft identified holes in the cowling above the engine compartment, perforation of the external wall of the engine combustion chamber, holes through the exhaust assembly, and significant damage to the turbine section.

What the ATSB found

The ATSB found that a low-cycle fatigue crack had initiated in the 3rd-stage turbine wheel of the Honeywell International Inc turbo-propeller engine and grown to failure. Errors made by a previous maintainer when determining the engine operating cycles and total equivalent cycles accrued by engine components resulted in the 3rd-stage turbine wheel remaining in-service beyond the component life-limit.

In addition, the ATSB established that the operator had estimated the number of engine shutdowns conducted each day based on recollection only. This increased the likelihood that the recorded cycles were incorrect. The ATSB was unable to determine if this resulted in any errors.

What has been done as a result

The maintainer who inadvertently introduced the errors into the count of engine operating cycles and component total equivalent cycles has audited these values for the other in-service turbine engines they maintained. In addition, this maintainer introduced new procedures including independent checks of input variables and calculations, and 6-monthly internal audits of cycles monitoring.

To ensure accurate recording of information on the aircraft maintenance release, the operator introduced a flight log for the pilot to record each flight, including noting whether there was an engine start associated with each flight.

Safety message

Accurate records of equivalent cycles accrued by an engine and engine components is a safety critical activity. As such, they should be diligently recorded, calculated, and checked to ensure the equivalent cycles accrued by a component is known with confidence. This means that components can be replaced prior to the published in-service life-limit being reached.

The investigation

The occurrence

On 4 April 2022, a de Havilland Canada DHC-2/A1 Beaver aircraft, registered VH-AAX, was being operated at Moruya Airport, New South Wales on parachuting flights. The pilot was conducting the second flight of the day and the aircraft had been operating normally. The pilot recalled that the wind was 5 to 10 kt from the NW on the ground and there was ‘quite a strong’ westerly wind up to 15 to 20,000 ft (estimated to be approximately 20 kt).

On approaching the drop zone (Figure 1), the aircraft descended from flight level (FL)[1] 150 to FL 145 in preparation for the parachute run, which would typically take about 30 seconds. The pilot reported checking the engine parameters just prior to and just after the parachutists exited the aircraft. Engine parameters were indicating normal engine performance. A few seconds after, the pilot reportedly heard a loud bang and detected some vibrations lasting a short time.

The pilot believed they had experienced an uncontained engine failure,[2] as they had observed small holes in the engine cowl. The pilot responded by pulling the fuel emergency shut-off lever, to shut-off fuel to the engine and release the oil pressure in the propeller system, resulting in the propeller blades moving into the feathered[3] position. They also shut down the electrical system, configured the aircraft for best glide speed, and contacted the company on the ground frequency to establish where the parachutists were.

The pilot broadcast a MAYDAY[4] call and no other aircraft were in the area at the time. The pilot identified runway 18 as the safest option for a forced landing as it was away from the parachute drop zone and other obstacles (Figure 1), despite a slight quartering tailwind. The aircraft landed safely and was manoeuvred onto a grass area clear of the runway.

Figure 1: Moruya Airport and parachuting drop zone

Source: Google Earth, annotated by the ATSB

A post-flight examination of the aircraft revealed holes in the cowling above the engine compartment (Figure 2). Examination of the engine identified a perforation of the external wall of the combustion chamber, holes through the exhaust assembly, failure of the main shaft and the torsion shaft,[5] damage to the turbine section, and loss of the 2nd and 3rd-stage turbine wheels (Figure 3).

Figure 2: Damage to upper engine cowl of VH-AAX

Source: ATSB

Figure 3: Damage to the engine combustion chamber, turbine section, and exhaust assembly

Source: ATSB             

Context

Pilot information

The pilot held a Private Pilot (Aeroplane) Licence and had a total flying experience of 1,078 hours, of which 540 hours were on the de Haviland Canada DHC-2/A1 Beaver. In the previous 90 days, the pilot had flown 154 hours total and 140 hours on the Beaver. The pilot was also employed by the operator as a licence aircraft maintenance engineer.

Aircraft information

General

VH-AAX was a de Havilland Canada DHC-2/A1 Beaver high-wing aircraft, with a single turboprop engine. At the time of the incident, the aircraft’s total time-in-service was 17,039.2 hours. The aircraft was last serviced 70 hours prior and there were no outstanding maintenance items recorded on the maintenance release.

Engine information and history

The engine fitted to VH-AAX was a Honeywell International Inc (formerly AlliedSignal, Garrett, and AiResearch) model number TPE331-2-201A, turbo-propeller engine (Figure 4), serial number P90018C. It consisted of:

• a 2-stage centrifugal compressor
• an annular combustion chamber
• a 3-stage axial turbine
• a reduction gear and shaft section.

The turbine section contained the 1st, 2nd and 3rd-stage turbine wheels. The exhaust assembly was considered part of the turbine section.

Figure 4: Schematic of Honeywell TPE331-2-201A Engine

Source: Honeywell, annotated by the ATSB

On 18 June 2009, the engine was overhauled and the engine components were certified with zero cycles at this time. On 14 August 2014, new 1st and 2nd-stage turbine wheels were fitted and a hot section inspection[6] was performed.

On 2 September 2019, the engine was removed from VH-AAX and sent for preservation to allow for an airframe rebuild by the new owner. Up until this time, the engine had been primarily maintained by a single organisation, the ‘first maintainer’. The engine was reinstalled in VH-AAX on 18 August 2020 and operated without issue until the date of the incident. The most recent 100‑hourly maintenance inspection was performed on 21 February 2022 by the ‘current maintainer’. The owner had arranged for the 1st, 2nd, and 3rd-stage turbine wheels to be replaced during an upcoming scheduled maintenance event as, according to the engine logbooks, the 3rd‑stage turbine wheel, part number 868630-9, was approaching the component life-limit.

Engine examination

The engine was transported to a Honeywell facility in the United States for a teardown and detailed examination supervised by the National Transportation Safety Board. The examination found that:

• there was evidence of rotational instability in the engine while the engine was running
• the main shaft and the torsion shaft had fractured
• a fragment of turbine wheel was lodged in the outwards rupture of the combustion case; this fragment (Figure 5) was consistent with the specified material of the 3rd-stage turbine wheel. No other parts of the 3rd stage turbine wheels were found in the engine
• evidence of low-cycle fatigue cracking[7] was identified on the fragment of the 3rd-stage turbine wheel found lodged in the combustion case (Figure 5 and Figure 6)
• the 2nd stage turbine wheel was not present
• the aft turbine bearing and bearing support, aft sump scavenge pump, aft bearing support struts, turbine nut, and tail cone were missing
• there was ‘no uncontainment’ of the combustion case.[8]

Both Honeywell and the National Transportation Safety Board concluded that the most likely reason for the engine failure was a low-cycle fatigue failure of the 3rd-stage turbine wheel.

Figure 5: Recovered fragment of 3rd-stage turbine wheel found lodged in the combustion case viewed from the aft (left) and forward sides (right)

Source: Honeywell, annotated by the ATSB

The photograph in Figure 6 shows the fracture surface on the 3rd-stage turbine wheel fragment. The fracture surface is in the radial plane located at a rivet hole. The crack initiation area has been indicated.

Figure 6: Fracture surface on the 3rd-stage turbine wheel fragment

Source: Honeywell, annotated by the ATSB

The scanning electron microscope image in Figure 7 taken of the fracture surface, showed features consistent with fatigue cracking. The direction of crack growth (white dash arrows), informed by the striations, indicated that the crack originated from the reduction in diameter of the rivet hole.

Figure 7: Microscopic fracture surface features adjacent to the fracture initiation area indicating fatigue crack growth

Source: Honeywell, annotated by Honeywell and the ATSB

Equivalent cycles in special operations

On 9 August 2006, the United States Federal Aviation Administration issued airworthiness directive (AD) 2006-14-03, applicable to Honeywell TPE331 series turboprop and TSE331-3U model turboshaft engines. The AD was issued to prevent an uncontained engine failure resulting from fracturing of the turbine rotor[9] due to low-cycle fatigue. This AD was developed in response to several reports of uncontained turbine rotor separation[10] that had resulted in metal fragments either penetrating the engine case or exiting the tail pipe, on engines used in ‘special-use’ operations. Special-use operations was defined as those aircraft that make multiple take-offs and landings without an engine shutdown, such as parachute and agricultural spraying operations. The additional take-offs and landings result in the life-limited parts accruing low-cycle fatigue damage at a faster rate when compared with passenger and freight transport flights.

The previously established cycle counting and life limits for life-limited parts used in Honeywell TPE331 turboprop engines were based on a cycle that consisted of an engine start, aircraft take‑off, cruise, landing, and engine shutdown (Figure 8). This is typical of a passenger transport flight. Applying this, an engine component such as a turbine wheel, would accrue a single cycle for each engine start/shutdown, irrespective of how many landings occurred.

Figure 8: Example of a passenger transport flight corresponding to a single engine cycle

Source: ATSB

The AD required implementation of a new flight cycle counting method, which involved tracking ‘equivalent cycles’ for turbine wheels in aircraft undertaking special-use operations (Figure 9). An equivalent cycle incorporated a damage fraction factor for each additional landing that occurred with no engine shutdown followed by a take-off. This was in addition to the cycle for one landing associated with the start/shutdown as shown in Figure 8. Total equivalent cycles were the sum of equivalent cycles for all operational flights.

Figure 9: Example of a special-use operation requiring an equivalent cycle calculation

Note: Schematic showing hypothetical day of operation for an aircraft used for ‘special-use’ operations. This example shows a total of 2 shutdowns and 5 landings.

Source: ATSB

The AD also referred to the use of Honeywell service bulletin TPE331–A72–2111, first issued in 2002, to determine the total equivalent cycles for TPE331-2 model engines. This included the engine fitted to VH-AAX, which was overhauled after the introduction of the AD and was reportedly always involved in special-use operations. The method outlined in the service bulletin for determining equivalent cycles for a turbine wheel in this engine, used the equation:

Where, the damage fraction applicable to the 1st, 2nd and 3rd-stage turbine wheels was 0.5, 0.6 and 0.2, respectively. For the part numbers fitted to the incident engine, the ‘turbine wheel removal schedule’ specified for the retirement of the 1st, 2nd and 3rd-stage turbine wheels was at 5,700, 5,400 and 6,000 total equivalent cycles, respectively.

Shutdowns and landings recorded by the operator

Operators conducting special-use operations, which included parachuting flights conducted in VH‑AAX, recorded the number of landings associated with each start/shutdown cycle to monitor the accumulation of equivalent cycles. The operator of VH-AAX recorded the total number of shutdowns and the total number landings performed in a day of operation as part of the daily line item on the maintenance release. The total number of equivalent cycles accrued by engine components was not calculated at the end of each shutdown as described in Honeywell service bulletin TPE331–A72–2111. Instead, the calculation was performed by the maintenance organisation at scheduled maintenance events.

The operator used their parachuting manifest to accurately record the number of landings that occurred in a day. The number of engine shutdowns was estimated by the operator at the end of each day, rather than by a pilot record being made at the time of each shutdown.

Equivalent cycles calculations by the maintenance organisations

Two maintenance organisations, the ‘first maintainer’ and the ‘current maintainer’, were primarily responsible for the maintenance of the engine since it was rebuilt in 2009. There was another maintenance organisation, the 'second maintainer’, that was only briefly responsible for maintenance of the aircraft. The maintenance organisations used the maintenance release to calculate total equivalent cycles accrued by engine components. At a scheduled maintenance event, the maintainer would sum the number of shutdowns and the number of landings for the period of the maintenance release. Then they would calculate the cycles accrued by a component over that period according to the following equation:

Where shutdowns was the total number of engine shutdowns recorded on the maintenance release, landings was the total number of landings recorded on the maintenance release, and damage fraction was 0.5, 0.6 and 0.2, for the 1st, 2nd and 3rd-stage turbine wheel, respectively. The maintainer would then add the equivalent cycles for the latest maintenance release period to the previous total recorded to obtain the new value.

The ATSB completed a review of the equivalent cycle counting recorded by the 3 maintainers, for the time from the engine rebuild in 2009 until the engine failure (Table 1). Comparison of the engine logbook and maintenance release identified errors in the total equivalent cycles and engine components recorded by the first maintainers. Calculation of the accurate number of cumulative equivalent cycles for the 3rd-stage turbine indicated that the turbine had completed 477.6 more equivalent cycles than recorded, resulting in the part having exceeded the retirement limit by 357.6 cycles at the time of the engine failure (red text in Table 1). The first maintenance organisation stated that a single individual was tasked with calculating and recording cycles and that there was no secondary check by another worker.

Another discrepancy between recorded and corrected total equivalent cycles related to the second maintainer appeared to be related to rounding.

The current maintainer did not record the total equivalent cycles accrued by engine components in each logbook entry, instead the remaining cycles was calculated in the work packs. The remaining cycles, rounded down to a whole number, were then communicated to the operator. No errors were identified in the total equivalent cycles recorded by the current maintainer.

Table 1: Number of equivalent cycles accrued by the engine and turbine wheels fitted to VH-AAX

Safety analysis

Low-cycle fatigue crack

When a low-cycle fatigue crack on the 3rd-stage turbine wheel, grew to a critical size, a fragment of the wheel was liberated under load, which initiated the engine failure. The fragment impacted the combustion case and became lodged. The separation of this wheel fragment resulted in significant rotational imbalance, which led to fracturing of the main and torsion shafts. Detached turbine section components then exited the engine, damaging the exhaust assembly. There was no evidence that any turbine wheel fragments exited through the combustion case with sufficient energy to cause a hazard to the aircraft. As such, the failure was deemed to be contained.

When the engine failure occurred, the pilot was descending from FL 145 above the airport, so had sufficient time to conduct all engine failure checks and prepare for a forced landing. The decision to land on runway 18, despite the tail wind, reduced the risk the aircraft posed to the parachutists.

Cycle counting error for 3rd-stage turbine wheel

The ATSB’s examination of the engine logbooks and available maintenance releases determined that the aircraft’s first maintainer made a number of traceable errors when calculating and recording engine cycles, and engine component equivalent cycles. There was limited opportunity to avoid these errors as the calculations were performed by one individual and no independent checking was incorporated into the process.

The cumulative effect of the errors meant that the 3rd-stage turbine wheel had accrued 477.6 equivalent cycles more than the reported value. Consequently, at the time of the engine failure, the 3rd-stage turbine wheel had exceeded its component life-limit by 357.6 equivalent cycles. The operator had planned to replace the 3rd‑stage turbine wheel upon reaching the life-limit (as recorded in the engine logbook). If the equivalent cycles had been correctly recorded, the part would have been replaced before an engine failure occurred.

Number of engine shutdowns estimated

The operator’s method for estimating engine shutdowns on a day of operation also introduced a potential source of error in accounting for cycles. The estimation of the number of shutdowns at the end of each day, combined with delaying the calculation of total equivalent cycles until a scheduled maintenance event, deviated from the method for monitoring equivalent cycles described in Honeywell service bulletin TPE331–A72–2111.

The maintainers relied on the record of landings and shutdowns in the maintenance release for the calculation of total equivalent cycles accrued by a component. In practice, if the information recorded on the maintenance release accurately reflected the operation of the aircraft, there would have been no difference between performing the calculation after each start/shutdown cycle or using the total number of landings and starts shutdowns for the period of the maintenance release. It was not possible for the ATSB to quantify the errors, if any, introduced by the operator’s estimation method without a record to compare the estimated and actual shutdowns.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the engine failure involving de Havilland Canada DHC-2 Beaver, registration VH-AAX, overhead Moruya Airport, New South Wales, on 4 April 2022.

Contributing factors

• A low-cycle fatigue crack, which had initiated on the 3rd-stage turbine wheel, grew to a critical size liberating a fragment of turbine wheel. Following this, the engine failed, requiring the pilot to shut down the engine and conduct a forced landing.
• Errors in cycle counting made by a previous maintainer resulted in the 3rd-stage turbine wheel remaining in-service beyond the component life-limit.

Other factors that increased risk

• The operator estimated the number of engine shutdowns conducted each day based on recollection only, which increased the likelihood that cycles recorded were incorrect.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety action by the first maintainer

In response to the incident, the first maintainer has implemented the following safety action:

• They have conducted an audit of the calculations of engine cycles and engine component total equivalent cycles for the in-service turbine engines they maintain, and any errors were corrected.
• They introduced new procedures for the calculation of engine cycles and engine component total equivalent cycles. The procedures included an independent check of input variables and calculation results. In addition, the maintainer will conduct 6-monthly internal audits of calculations.

Safety action by the operator

In response to this incident, the operator has introduced a flight log for the pilot to record each flight, including whether there was an engine start associated with the flight. The total number of flights and engine starts on the flight log are then used to populate the maintenance release with verifiable accurate information.

Safety action by Honeywell

Honeywell had been analysing engine performance data from aircraft with TPE331 engines in both agricultural spraying and parachuting operations. They found that, while agricultural spraying operations incur damage at a higher rate than the United States Federal Aviation Administration procedure originally used to set the cycle limits of the turbine wheels, parachuting operations incur damage at an even higher rate. Honeywell, working with the Federal Aviation Administration, is in the process of issuing a revised cycle counting methodology that will address the operating characteristics of parachuting and agricultural spray applications.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilot of VH-AAX
• operator of VH-AAX
• maintenance organisations for VH-AAX
• Civil Aviation Safety Authority
• Honeywell International Inc
• United States National Transportation Safety Board.

References

Aerospace Industries Association (2010) AIA Project Report on High Bypass Ratio Turbine Engine Uncontained Rotor Events and Small Fragment Threat Characterization 1969-2006, Volume 1, published January 2010, accessed 11 April 2023. https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/App%20B%20-%20Vol1%20AIA%20Rotor%20Burst%20Small%20Fragment%20Committeee%20Report%20Fina%20r1%20(2).pdf

Federal Aviation Administration (1997) Design considerations for minimising hazards caused by uncontained turbine engine and auxiliary power unit rotor failure, Document Number: 20-128A (Advisory Circular), published 25 March 1997, accessed 29 March 2023. https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_20-128A.pdf

Federal Aviation Administration (2006). AD 2006-14-03, Document Number: 06-5929, Published 7 July 2006. Effective 9 August 2006. Accessed 6 January 2023. https://www.federalregister.gov/documents/2006/07/05/06-5929/airworthiness-directives-honeywell-international-inc-tpe331-series-turboprop-and-tse331-3u-model

Honeywell International Inc. (2002) ALERT Category 1: Safety ENGINE – SERVICE LIFE – SERVICE LIFE LIMITS OF CRITICAL LIFE LIMITED COMPONENTS – SPECIAL USE OPERATION – PARTIAL CYCLE COUNTING, Document Number: TPE331-A72-2111 (Service Bulletin), published 12 November 2002.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• pilot and operator of VH-AAX
• maintenance organisations for VH-AAX
• Civil Aviation Safety Authority
• Honeywell International Inc
• United States National Transportation Safety Board.

Submissions were received from Honeywell International Inc. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 150 equates to 15,000 ft.

[2]     Uncontained failure of a turbine engine was any failure that resulted in the escape of turbine rotor fragments from the engine that had sufficient energy to create a hazard. An industry report differentiated between fragments breaching the engine casing and tail-pipe debris (including material passing through the wall of the tailpipe), which was considered lower energy and lesser risk (Aerospace Industries Association 2010).

[3]     Feathering is the rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown.

[4]     MAYDAY is an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.

[5]     The torsion shaft, which is coupled to the reduction gear section, is positioned concentrically inside the main shaft, which, along with the compressor impellors and turbine wheels, formed the rotating assembly.

[6]     A hot section inspection involves examination of components in the hot section of the engine, which includes the combustion, turbine, and exhaust sections. Typically, the condition of several key engine parts, including the turbine blades, the combustion chamber, the stators, the vane rings, the compressor impellers, and the shroud segments are examined.

[7]     Low-cycle fatigue cracking is associated with relatively high-loads, which produce elastic strain as well as plastic strain during each cycle. This is distinguished from high-cycle fatigue cracking, which is associated with relatively low-loads where the strain resulting from each cycle is primarily elastic. High-cycle fatigue cracking, nominally, requires more than 10⁴ cycles to failure.

[8]     ‘No uncontainment’ is equivalent to stating that the engine failure was contained.

[9]     The turbine wheels are referred to as rotors in AD 2006-14-03 (Federal Aviation Administration 2006).

[10]    In this context, ‘turbine rotor separation’ means the breaking apart, and fragmentation, of a turbine wheel.