The occurrence

On 14 July 2020, at about 0700 Western Standard Time,^[1] a SPENO rail grinder track machine crew prepared for planned work on the Up Main line near Midland, Western Australia. At about 0830, the rail grinder crew received authority from the network control officer (NCO) to occupy the Up Main line between Midland and Forrestfield. The rail grinder departed Midland in the wrong running direction on the Up Main line, then travelled over the Robinson Road level crossing to begin work on the ARC Infrastructure network metro line. The rail grinding work was within the activation zone for the Robinson Road level crossing, which resulted in the flashing lights activating and the booms lowering to protect the crossing.

Due to the extended operation of the level crossing, road traffic began to build-up along Robinson Road. Some motorists ignored the warning signals and drove around the boom gates and across the level crossing without knowing if safe to do so.

At about 0930, an employee (RG1) associated with the rail grinder, travelling to the Midland Yard, noticed that road traffic was queued and that some motorists were driving around the boom gates. The RG1 stopped motorists from crossing until it could be confirmed that no trains were approaching.

The RG1 called the rail grinder crew and advised them that the presence of the rail grinder working had triggered the level crossing and traffic had queued and some illegally crossed. A second employee (RG2) attended the level crossing to assist with traffic management.

The RG2 contacted the protection officer on the rail grinder to determine train running information. They confirmed that, based on information obtained from the NCO the night before, there were no approaching trains.

The RG1 and RG2, with technical assistance via phone from the protection officer, latched the boom gates in the up position and began to allow road traffic over the level crossing. The NCO was unaware of this altered working condition at the Robinson Road level crossing.

At about 1034, the rail grinder completed work, outside of the level crossing activation zone, and travelled toward Midland in the right running direction on the Up Main line. The RG1 and RG2 restored the level crossing to normal operation and unlatched the boom gates. Once the rail grinder entered the activation zone, the level crossing activated and the booms lowered into place. Once the rail grinder cleared the level crossing, it restored to normal with the booms raising to the normal parked position. On observing this, the RG1 and RG2 departed in preparation for the next level crossing. Unbeknown to the RG1 and RG2, the raised boom gates had relatched into the locked (up) position.

The rail grinder and its crew proceeded to the next work location during the allocated time between trains and in accordance with their authority. A short time later, the rail grinder was moved clear of the Up Main line to allow train 2430 to pass.

Freight train 2430, travelling towards Perth on the Up Main line, passed through the Robinson Road level crossing. At that time, the train crew noticed that the boom gates had not lowered, however, the flashing lights operated. The crew reported their observations to the NCO. The NCO reported the fault to an on-call signal electrician. During this conversation, it was noted that the rail grinder had been working in the area and may be involved. The RG1 heard this call and went back to the crossing, where they identified that the boom gate locking mechanism had been locked into the latched-up position. They subsequently locked the boom gate into the unlatched (normal) position. Shortly after, the signal electrician attended the crossing and did not identify any faults.

Investigation activities

During the investigation, the ATSB:

• interviewed members of the rail grinder work team
• analysed the rail grinder scope of work
• conducted analysis of data from event recorders and signalling infrastructure equipment
• analysed the reasons for the level crossing activation and degraded level of protection
• analysed the actions of the work crew
• conducted preliminary analysis of training and human factor aspects
• conducted an initial review of the rules and procedures for level crossing boom management and design
• conducted a document review of local agreements and regulatory requirements
• liaised with key stakeholders.

ATSB observations

From the investigation, the ATSB determined:

• Following completion of rail grinding work near the Robinson Road active level crossing, the boom gate locking mechanisms were left in a position that resulted in providing partial protection as train 2430 approached and passed through the crossing.
• The proximity of the rail grinder work to the level crossing meant that the crossing protections were continuously activated, which resulted in road users driving around the boom gates. Consequently, the gates were latched and locked in the up position.
• The project planning and approval process for the rail grinding work did not identify the possibility of interference with the level crossing operation and the road network. This led to inadequate traffic management being placed at the level crossing resulting in traffic queues and an ad hoc response latching the boom gates.

Reasons for the discontinuation

The ATSB gives priority to transport safety investigations that have the potential to deliver the greatest public benefit through systemic improvements to transport safety.

Given the ATSB’s constrained resources, the ATSB considered it was unlikely that further investigation would identify systemic safety issues or identify opportunities for the enhancement of transport safety. Consequently, the ATSB has discontinued this investigation.

The ATSB has briefed ARC Infrastructure and SPENO about its observations from this investigation and potential learnings. However, it considered that broader communication of this information would not be of significant benefit to other parties.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

__________

1.  Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.

Safety summary

What happened

On 9 July 2020, at about 0005 Eastern Standard Time, a Beechcraft 200 aircraft, registered VH‑FDO and operated by the Royal Flying Doctor Service, Queensland Section, was on approach to Cairns Airport, Queensland. On board the aeromedical flight were the pilot in command under supervision, supervisory pilot, flight nurse and two patients.

The Cairns runway 15 threshold was temporarily displaced due to runway works. During the approach, the flight crew sighted an airport safety officer’s car with its headlights directed at what appeared to be a row of lights across the runway, illuminating the displaced threshold. The aircraft passed above the row of lights and touched down beyond it. However, the aircraft had landed short of the actual displaced threshold and struck an unseen temporary runway end light. 

What the ATSB found

The ATSB found that the airport safety officer's car headlights were directed at reflective witches’ hats that marked the works limit line, which was in front of the displaced threshold. To the flight crew, this appeared as a row of lights across the runway. As a result, the flight crew misidentified the aerodrome works limit line as the displaced runway threshold lights. The actual displaced threshold lights were also indistinguishable from the taxiway lights that remained illuminated during the approach. This resulted in a runway undershoot as the aircraft landed short of the displaced threshold.

The works and airport safety officers laid out the aerodrome works lighting but did not ensure it was arranged such that the location of the displaced threshold was unambiguous to the flight crew. The requirement that lighting was not confusing to pilots was stipulated in the Civil Aviation Safety Regulations Part 139 (Aerodromes) Manual of Standards. However, the Cairns Airport procedures for temporary runway works lighting and markings were inconsistent and did not ensure they were laid out in accordance with the required standards.

What has been done as a result

After the incident, the following safety actions were taken by Cairns Airport for the remaining runway works:

• no vehicle headlights were to be directed towards the active runway
• the works limit line was marked by a single amber light on the side of the runway
• taxiway lights were only illuminated after an aircraft had landed
• witches’ hats with reflective tape were not to be used
• the notice to airmen was amended to advise that taxiways were not available, and of temporary blue taxiway edge lighting
• green temporary displaced threshold lights were replaced with solar lighting that did not require electricians to wire.

Safety message

Aerodrome works can pose a hazard to aircraft, particularly where there are unusable portions of a runway and a displaced runway threshold. Aerodrome works markings and lighting must be unambiguous and laid out in accordance with relevant standards, to minimise the likelihood of confusion for flight crew and the potential for a runway undershoot or excursion.

The occurrence

Tasked flight

On 8 July 2020, at about 1900 Eastern Standard Time,^[1] a Beechcraft 200 aircraft, registered VH‑FDO and operated by the Royal Flying Doctor Service (RFDS) Queensland Section, departed Cairns Airport, Queensland. The pilot in the left seat was in command under supervision (ICUS) of the supervisory pilot in the right seat. A flight nurse was also on board for the aeromedical flight, which collected one patient at each of Northern Peninsula and Kowanyama Airports, before returning to Cairns.

Cairns Airport was undergoing runway works, with the runway 15 threshold temporarily displaced 1,856 m. While the runway was closed at night during the works, a portion of the runway was available to the RFDS with prior notice. As such, when the aircraft departed Kowanyama at 2310, the pilot ICUS contacted air traffic control (ATC) to advise of their estimated arrival time in Cairns. The Cairns Tower controller subsequently radioed the duty airport safety officer (ASO) to let them know the aircraft was expected to arrive at 0013 (on 9 July).

When the controller switched on the runway and taxiway lights in anticipation of the arrival, the duty ASO reported driving in a southerly direction to make sure the green displaced threshold lights were visible. The duty ASO then drove to taxiway B3 and stopped at the holding point, angled about 45° down the runway, with the safety car headlights pointing at the works limit line (refer to section titled Works limit lights and markers and Figure 4). Closed-circuit television footage of the incident showed that the headlights were on high beam, however, the ASO thought they were on low beam at the time.

Arrival at Cairns

At about 0003, while on descent, the pilot ICUS contacted the Cairns Approach controller and advised that they had received the current automatic terminal information service.^[2] This included that the landing distance available was 1,300 m and the instrument landing system (ILS)^[3] was not available. The Approach controller responded that they should expect the area navigation Z (RNAV-Z) approach to runway 15 with displaced threshold as per the notice to airmen (NOTAM).^[4]

Two and a half minutes later, the controller cleared the flight crew to conduct the RNAV-Z approach. The flight crew then briefed for that approach, noting that there would be no precision approach path indicator^[5] or ILS guidance.

The RNAV-Z approach was programmed in the aircraft’s flight director to fly a 3° profile to the minimum descent altitude,^[6] which was 860 ft. Continuing the 3° profile would take the aircraft to the actual runway threshold, therefore, the flight crew planned to fly a short level segment until the aircraft intercepted a visually assessed position from which a 3° approach to the displaced threshold could be made.

When about 8 NM (15 km) prior to the runway threshold, the pilot ICUS extended the landing gear and selected the landing lights on. The Approach controller instructed the pilot to contact Cairns Tower, and at 0010:15, as the aircraft descended through about 1,900 ft, the Tower controller cleared the flight crew to land. At that time, the aircraft became clear of cloud and the pilot ICUS recalled seeing a large spotlight where the workers were operating at the closed end of the runway. When the aircraft descended to 860 ft, the flight crew had the runway in sight. The flight crew could also see the safety car with its headlights on, which appeared to be directed at a row of lights across the runway, depicting what they believed to be the displaced threshold.

At the time, the duty ASO observed that the reflective band on the witches’ hats were lit up ‘incredibly brightly’ with ‘a bright white light extending across the runway’.

The pilot ICUS reported selecting the autopilot off, flying a short level segment, and a 3° approach profile to what they assessed was the displaced threshold. The flight crew recalled that the aircraft passed over the displaced threshold at about 50 ft and touched down about two runway edge lights (120 m) beyond that, in accordance with normal procedures. However, at about 0018, the ASO observed the aircraft touch down short of the displaced threshold. The Airservices Australia radar data also showed that the aircraft landed at about the position of the temporary runway end lights, which were 60 m prior to the displaced threshold. The ASO reported not taking any further action that night, as there were no abnormal communications between the flight crew and the Tower controller. The flight crew taxied to the hangar and shut down the aircraft. 

Post-flight inspections

Later that morning, at about 0500, an ASO reported that one of the temporary runway end lights was broken. The metal base had been pushed about 30 cm across the runway and the red light was shattered. No aircraft other than VH-FDO had landed the previous night.

The aircraft operator’s senior base pilot was advised of the broken light by Cairns Airport personnel. The senior base pilot phoned the flight crew and asked whether the aircraft had struck anything the previous night, but neither was aware that it had. The supervisory pilot subsequently found a corresponding scuff mark on the right main landing gear tyre of VH-FDO. After some investigation, it was established that the flight crew had misidentified the works limit line as the displaced runway threshold and landed short of the displaced threshold. The aircraft tyre had struck the temporary runway end light, which was taped to be unidirectional to aircraft using runway 33 and was therefore not visible to flight crew when they landed on runway 15 (Figure 1).

Figure 1: Example of temporary runway end light – taped to be unidirectional

Source: Cairns Airport

___________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Automatic terminal information service: The provision of current, routine information to arriving and departing aircraft by means of continuous and repetitive broadcasts during the hours when the unit responsible for the service is in operation.
3. Instrument landing system: A precision instrument approach system which normally consists of the following electronic components: VH localiser, UHF glideslope, VHF marker beacons.
4. NOTAM: A notice distributed by means of telecommunication containing information concerning the establishment, condition or change in any aeronautical facility, service, procedure or hazard, the timely knowledge of which is essential to personnel concerned with flight operations.
5. Precision approach path indicator consists of four lights perpendicular to the runway abeam the touchdown point, which transition between red and white depending on the aircraft’s approach slope.
6. Minimum descent altitude: A specified altitude in a 2D instrument approach operation or circling approach operation below which descent must not be made without the required visual reference.

Context

Personnel information

Pilot in command under supervision

The pilot ICUS held a Commercial Pilot Licence (Aeroplane), an instrument rating and a Class 1 Aviation Medical Certificate. The pilot had been an RFDS pilot for 12 months and had accrued 1,864 hours of aeronautical experience, of which 515 hours were in the Beechcraft 200- and 300-series (King Air) aircraft, and 55.4 hours at night. At the time of the incident, the pilot had been awake for 9 hours and on duty for 6 hours, with a self-assessed fatigue level^[7] of ‘3: okay, somewhat fresh’.

Supervisory pilot

The supervisory pilot had been an RFDS pilot for over 17 years and had accrued nearly 13,000 hours total flight time, of which 6,224 hours were in the King Air aircraft and about 3,000 hours were at night. This experience included routinely operating into remote airstrips, with the use of improvised runway lighting. At the time of the incident, the supervisory pilot had been awake for about 7 hours and on duty for 6 hours, with a self-assessed fatigue level of ‘2: very lively, responsive, but not at peak’.

Aerodrome information

Cairns Airport runway works

The first two stages of Cairns Airport runway works had been completed, which involved removing and re-laying the asphalt runway surface. Stage three commenced on the night of 8 July 2020 and involved grooving the newly laid surface. For the duration of the works, the runway was closed at night other than for nominated aircraft. For those aircraft, a portion of the runway was available, with a temporarily displaced threshold. 

In preparation for commencement of the works that night, there were three ASOs, including one as the designated works safety officer (WSO) and one as the duty ASO. They were tasked with laying out the required aerodrome works lighting and blanking out runway and taxiway lighting on the unusable portions of the aerodrome. The portable lighting they laid out was:

• five green lights either side of the runway to mark the displaced threshold
• runway end lights across the width of the runway that appeared red for aircraft landing on runway 33, but were taped with black tape so that they were not visible to pilots of aircraft arriving on runway 15
• reflective witches’ hats (Figure 2) placed on the works limit line, with an orange flare torch placed between each pair of hats.

The WSO and ASOs commenced this task at about 2110. When completed, the WSO advised the Cairns Tower air traffic controller that the threshold was displaced as per the NOTAM (refer to section titled Pre-flight planning).

Figure 2: Witches’ hats used to mark the works limit line

Source: Cairns Airport 

Regulations regarding aerodrome lighting

Regulations pertaining to aerodromes were specified in the Civil Aviation Safety Authority’s (CASA) Civil Aviation Safety Regulations 1998, Part 139 (Aerodromes) and the associated Manual of Standards (MOS). Much of that information was also published in the Airservices Australia Aeronautical Information Publication, Part 3 – Aerodromes. The following was specified in the MOS with regard to runway lighting and markings.

General guidance

It is important for pilot recognition and interpretation of aerodrome lighting systems, that standard configurations and colours be used. The pilot always views the aerodrome lighting systems in perspective, never in plan, and has to interpret the guidance provided, while travelling at high speed, often with only a limited segment of the lighting visible. As time will be limited to see and react to visual aids, particularly in the lower visibilities, simplicity of pattern, in addition to standardisation, is extremely important.

Displaced threshold lighting

Applicable to the Cairns runway width, five green lights either side of the runway depicted a temporarily displaced threshold.

Runway edge lighting

Due to the works in progress, runway 15 was a non-precision approach runway. As such, it was required to have runway edge lights along both sides of the full length of the runway available for use. At least six red runway end lights were required to be positioned across the runway, between these runway edge lights. The 60 m of the runway that was available for aircraft use prior to the displaced threshold was required to have runway edge lights showing red in the direction of approach. The ground crew had covered all edge lights prior to the displaced threshold.

Taxiway centreline lighting

The green taxiway centreline lights in the vicinity of the displaced threshold were required to not cause confusion with the green displaced runway threshold lights.

Extinguish closed portions

When all or part of a runway or taxiway is closed, all the associated aerodrome lighting must be extinguished. Additionally, the lighting was required to be electrically isolated or disabled, to prevent inadvertent activation of the lights. However, it was acceptable to cover lights with an opaque cover for short time periods provided the cover was firmly attached to the ground and could not be dislodged, and it did not pose a hazard to aircraft operations.

Works limit lights and markers

The works limit line, also known as the equipment limit line (ELL) delineates a safety barrier for workers. Portable amber, yellow or orange works limit lights were to be used to indicate the limits of the works area to the works personnel.

Daytime works limit markers were fluorescent orange PVC cones or witches’ hats (Figure 3). These were to depict aerodrome works to the works personnel and not to convey information to pilots regarding the movement area.

Figure 3: Works limit marker

Source: CASA

Civil Aviation Safety Authority guidance

The stated purpose of CASA’s Advisory Circular 139-20(0) – Safe planning and conduct of aerodrome works was ‘…to discuss the areas of safety concern and offer suggestions on how to minimise the hazard which may be created by aerodrome works’. The circular also noted that it was the aerodrome operator’s responsibility to ensure aerodrome safety during aerodrome works. Of particular relevance to this incident, the circular included the following regarding the extinguishing of unnecessary lighting and the use of vehicle headlights:

10.6 Extinguish Unnecessary Lights – Aerodrome lighting must show only the usable aerodrome facilities. Where because of aerodrome works, a portion of the runway or taxiway is not usable, the lights on those portions of runway or taxiway must be extinguished so as not to create confusion. One method of extinguishing a light is to place masking tape over the light, another is the use of a bucket to cover the light.

11.3 If there are aircraft operations at night, the lights from vehicles engaged in night work must not cause confusion to pilots. Vehicle light fittings should be checked to ensure that the lights are not directed unduly upwards. Drivers must be told that as a matter of course, high beam is not to be used.

Method of working plan

The MOS required a method of working plan (MOWP) for the works to be conducted at Cairns Airport. The Cairns Airport MOWP included that, for stage three of the works, the runway would be closed nightly until 1 August 2020 for specified hours. The closure would be advised by NOTAM and applied to all aircraft operations except for RFDS King Air and other nominated aircraft. For these aircraft, the runway could be used with 30 minutes prior notice. The MOWP also included template text for the NOTAMs.

The MOWP stipulated that the designated WSO’s responsibilities included ensuring:

• the safety of aircraft operations
• unserviceability markers and lighting were placed in accordance with the MOS.

The MOWP also stated that:

• works personnel were to remain behind the works area limit line marked by a row of orange witches’ hats
• drivers must use low beam only on vehicle headlights.

The RFDS operational procedures supplement to the MOWP documented the arrangement between Cairns Airport, RFDS and Cairns ATC, to allow for medical flights to continue during the scheduled runway works. Much of the information detailed in the supplement was provided to the flight crew in a notice to aircrew (NOTAC) (refer to section titled Pre-flight planning).

Runway works drawing

The drawing of the overlay for the runway 15 displaced threshold operations, an extract of which is depicted in Figure 4, was an annex to the MOWP. The drawing indicated that the displaced threshold was 1,856 m beyond the permanent runway 15 threshold, and the temporary runway end was 60 m prior to the displaced threshold. The works limit line was 200 m prior to the runway end and there was 260 m between the works limit line and the displaced threshold. The legend for the drawing described the following:

• equipment (works) limit line was orange witches’ hats during daylight hours and flashing amber lights at night
• runway end lighting was at least six lights spaced evenly between the rows of runway edge lights
• displaced threshold lighting was five green lights either side of the runway, 2.5 m apart, with the innermost lights on each side omnidirectional and in line with the runway edge lights.

Figure 4: Extract of drawing depicting the displaced threshold and associated lighting

Source: Cairns Airport, annotated by the ATSB

Laying out the lights

Airport safety officers

Of the three ASOs assigned for the works on the incident night, one was designated the WSO and another the duty ASO. While the WSO was responsible for aerodrome safety according to the MOWP, the three ASOs worked together to set up the runway lighting. The duty ASO was the most experienced, having worked at Cairns Airport for 34 years.

When the WSO collected the witches’ hats from their storeroom, there were no MOS-compliant orange witches’ hats available, only traffic cones with reflective bands (Figure 2). These were branded with ‘ELL’, which indicated to the WSO that they were appropriate for use. The WSO reported that an orange flare torch was placed between each pair of witches’ hats on the works limit line.

Blacking out lights

Inset lights, recessed into the aerodrome surface, were blacked out with 400 x 400 mm carpet tiles and raised lights were covered with a vinyl sock. The ASO reported that they laid carpet tiles over the runway end lights, lead-on and lead-out lights for taxiways B2 and B3, holding point lights, and taxiway A2. They placed a vinyl sock over each of the runway edge lights between the displaced and permanent runway 15 threshold, and on the blue lights on the aircraft turning areas on the runway.

Taxiways A3, B3, A4 and B4 remained lit from the holding point, and taxiway A4 and ‘some of’ A3 (green) lead-in lights and temporary blue taxiway edge lighting parallel to the runway between A3 and A4 remained illuminated. In accordance with the NOTAM, the high intensity approach and runway lights, and the precision approach path indicator were not available and were therefore not selected on by the Cairns Tower air traffic controller. There was no reference to the closed taxiways in the NOTAM.

During stage two of the works, as the runway asphalt was progressively taken up and new surface laid, electricians isolated light circuits, removed and re-laid the cables, thereby extinguishing taxiway lights. This was not done for stage three. On the incident night, an electrician assisted with laying out the temporary displaced threshold lights and runway end lights. After the incident night, these were replaced with solar lights that did not require wiring.

Works safety officer tasks

The first task for the WSO each night was to attend the works contractors’ ‘toolbox’ meeting as the representative for Cairns Airport. The WSO reported that, on the incident night, the contractors’ toolbox meeting was scheduled to start at the time the WSO arrived at work. After attending the meeting, the WSO recalled then being pushed for time to get the runway set up. The WSO split the tasks to be completed with the two ASOs, so that one person did either side of the runway, and the third did the threshold and runway end lights. Despite the rush, the WSO and ASOs thought the displaced threshold and lighting was set up correctly. Subsequent to the incident night, the rostering was amended to allow more time between the start of shift and commencement of runway works for the WSO to set up and check the works lighting.

The WSO reported that their normal plan each night was to enter the runway to cover and lay out the lights at the commencement of the works hours. The WSO was responsible for ensuring the runway was set up according to the MOWP, drawing, associated emails, and the MOS, which were accessible on an iPad.

Once complete, the WSO advised the Cairns Tower controller, and the other ASOs resumed their normal duties. When the works contractors started work, the WSO was then responsible for monitoring the worksite, and escorting workers on and off the site. 

Works checklist

Cairns Airport issued a works safety officer tasking list when stage one of the works commenced. The checklist detailed the items to be completed by the WSOs and ASOs at the start and end of each shift. The items were based on the car number and assigned role, however, car 18/34 was referenced, which was not in use for stage three. The WSO reported that they had used a checklist when they first started the works, but not for stage three. The WSO checklist tasks for the start of shift that also applied to stage three included:

• attend the works toolbox meeting
• set up the works limit line
• request ATC deselect the lighting as required
• deploy the displaced threshold – carpet squares on inset lighting, cover runway lighting and tape lights as required
• confirm with ATC that the displaced threshold has been established and request selection of the runway lighting to confirm the visual aids are correct.

According to the checklists, the duty ASO was to conduct a runway inspection with the aerodrome ground lighting energised, prior to any RFDS movement and prior to the runway being opened after the works. The ASO was also required to check the NOTAMs for accuracy. There was no reference to covering taxiway lighting in the checklist.

Closed-circuit television footage

Closed-circuit television footage taken of the incident flight, showed that the taxiway lights were illuminated, including the A3 and B3 taxiways. The safety car headlights were on high beam and directed at the witches’ hats (designating the works limit line), and the runway edge lights between the witches’ hats and displaced threshold were not visible.

Lighting on a subsequent night

Several nights after the incident, the flight crew again flew into Cairns, using the runway 15 displaced threshold. The flight crew reported that, compared to the incident night, the displaced threshold was distinct and that, due to the absence of extraneous lighting, there was no confusion. Differences to the runway lighting arrangement included:

• the reflective witches’ hats were absent and a single amber light to the side of the runway marked the works limit line
• no safety car headlights were directed at the runway
• taxiway lights were deselected until the aircraft landed such that the only green lights leading to/from and perpendicular to the runway were the displaced threshold lights
• there was no runway lighting prior to the displaced threshold (Figure 5).

Figure 5: Runway lighting for the runway 15 displaced threshold several nights after the incident

Source: Flight crew

Operational information

Pre-flight planning

The flight crew signed on at about 1800, were tasked for the flight and conducted the pre-flight planning. The pilot ICUS performed aircraft weight and balance, and fuel calculations, and discussed the implications of the NOTAMs and forecast weather with the supervisory pilot. The aircraft operator provided the NOTAMs to flight crew, transcribed as NOTACs.

Regarding stage three of the runway works, the NOTAC detailed the work periods when the displaced thresholds would be in place and that initially, the runway 15 threshold would be displaced 1,856 m, followed by displacement of the runway 33 threshold. While the runway 15 threshold was displaced, aircraft would be required to enter and exit the runway via taxiway A4 and backtrack the runway as required.

The NOTAC referenced the MOWP drawing (refer to the extract in Figure 4), detailed the runway lengths, and take-off and landing distances available. The NOTAC also stated that the localiser, glide path, precision approach path indicator and high intensity approach and runway lighting were not available. It stated that the temporary threshold would be lit by five green lights each side of the runway.

The flight crew received and reviewed the NOTAC and MOWP 2 days prior to the incident. Then, during the pre-flight briefing, they noted that it was the first night the runway threshold would be displaced for stage three works. They also identified that the ILS would not be available and that they expected to conduct the RNAV-Z approach to Cairns.

Flight crew interpretation of aerodrome works lighting

During the approach to Cairns, both flight crew assessed that the lit witches’ hats looked like a row of lights indicating the displaced threshold, although both thought it odd that the safety car’s headlights were directed at the threshold. The flight crew also reported that the actual displaced threshold green lights placed either side of the runway merged with the green taxiway centreline lights. This resulted in multiple rows of green taxiway lights extending from both sides of the runway.

The pilot ICUS recalled aiming to land two runway edge lights beyond what they assessed was the displaced threshold. Therefore, the pilot ICUS thought that the runway edge lighting must have been on from between the works limit line and displaced threshold. However, closed-circuit television footage correlated with the ASO reports that those runway edge lights had been covered and were not visible. The lights the flight crew referenced as cues were therefore not runway edge lighting, but may have instead been temporary taxiway edge lighting on the western side of the runway.

Earlier that night, the flight crew had landed at Kowanyama and Bamaga Airports, which had lighting that created rectangular runways. The lit witches’ hats, which they thought were lights across the runway, made the Cairns runway also look rectangular.

Aircraft landing lights

The aircraft had two landing lights and a third designated as a taxi light, all attached to the nose landing gear leg. It was standard practice to select all three lights on for landing (and take-off). The landing lights were high intensity discharge lights, which the pilot ICUS reported were only ‘useful’ from about 500 ft above the runway elevation. The aircraft fleet’s landing lights were gradually being replaced with LED lights, but VH-FDO’s had not yet been replaced.

Similar occurrences

A search of the ATSB’s occurrence database for the 10 years prior to the incident identified 10 runway undershoot events involving a displaced threshold, all of which occurred during daylight hours. Nine of these were during runway works and one was with a permanently displaced threshold. None resulted in injuries.

______________

7. The ATSB and RFDS Queensland Section use the Samn-Perelli fatigue scale from 1 (Fully alert. Wide awake. Extremely peppy) to 7 (Completely exhausted. Unable to function effectively. Ready to drop).

Safety analysis

Introduction

Runway 15 at Cairns Airport, Queensland had a displaced threshold due to runway works. During landing on that runway at night, the aircraft touched down prior to the displaced threshold.

This analysis details the flight crew’s interpretation of the aerodrome works lighting and the airport safety officers’ actions in laying out the lighting. Although the works safety officer reported that the tasks to lay out the lighting were rushed, they were of the view that the aerodrome works lighting had been set up correctly. Additionally, Cairns Airport’s planning and procedures for establishing the aerodrome works lighting will be considered.

Displaced threshold misidentification

It was the first night the flight crew had operated into Cairns with the temporarily displaced runway 15 threshold in place, and they had briefed for, and set up the approach accordingly. While on approach, the flight crew sighted the airport safety officer’s car headlights directed at what appeared to be a row of lights.

The pilot in command under supervision and the supervisory pilot, who was highly experienced at operating at night, both misidentified the row of lights as the displaced threshold. Like the two previous runways they had landed on that night, the runway lighting appeared to form a perfect rectangle. Additionally, the five green displaced threshold lights placed either side of the runway, were indistinguishable from the green taxiway centreline lights and did not alter the flight crew’s misperception of the threshold.

Although the pilot in command under supervision reported aiming to land the aircraft two runway edge lights beyond the displaced threshold, those lights were extinguished, and it could not be determined what the pilot had referenced as runway edge lights. Nevertheless, due to the misidentification, a runway undershoot occurred. The radar data showed that the aircraft landed short of the displaced threshold, near the temporary runway end lights and beyond the works limit line. As a result, the aircraft’s right main landing gear tyre contacted a temporary runway end light, which was blacked out and not visible to the flight crew.

Lighting requirements

The works safety officer was responsible for ensuring the aerodrome works lighting was in accordance with the Manual of Standards Part 139 – Aerodromes (MOS) and that it was unambiguous to pilots. The works safety officer was assisted by two other experienced airport safety officers in laying out the aerodrome works lighting. However, they did not identify that the witches’ hats with reflective bands were contrary to the MOS and the method of working plan (MOWP) diagram.

Further, the use of the safety car headlights on high beam, as shown in the closed-circuit television footage, was contrary to the MOWP. The duty airport safety officer believed that it was the aircraft’s landing lights (rather than the safety car headlights) that illuminated the reflective bands. However, the aircraft’s lights were not effective from the height at which the flight crew had misidentified the works limit line as the displaced threshold.   

Additionally, the MOS required that lights on unusable portions of the aerodrome were extinguished so as not to create confusion to pilots. In the two previous works stages, electricians had isolated and removed taxiway (and other) lights. However, this was not done for the third stage of works and the unusable taxiway lights were not blanked out. The lights remained illuminated on taxiways that were not available for use by the flight crew. Leaving the green taxiway centreline lighting illuminated perpendicular to the runway increased the likelihood of confusion with the green displaced threshold lighting. 

Therefore, the combination of the safety car headlights lighting up the reflective witches’ hats and the lit taxiways did not ensure that the displaced runway threshold was unambiguous to the flight crew.

Cairns Airport procedures

The MOWP stated that the works limit line was to be designated by orange witches’ hats, which was not in accordance with the MOS for night-time works. In contrast, the MOWP diagram specified the use of amber flashing lights to designate the works limit line at night and witches’ hats only for daytime works, which was in accordance with the MOS. The MOS also specified that red runway edge lights were required in the usable runway (60 m) prior to the displaced threshold, however, these were not included in the MOWP diagram or laid out.

Additionally, during previous works stages, the green taxiway lights were isolated and removed by electricians. Electricians would not be doing this for stage three, therefore the taxiway lights had to be extinguished to avoid potential confusion with the green displaced threshold lights. However, deselecting or covering the taxiway lights was not included in the MOWP.

Lastly, Cairns Airport had provided checklists to the works and airport safety officers detailing the tasks to be completed, but ground crew had not used the checklist for stage three. The checklist referenced tasks by car number, which required amendment to reflect the roles for stage three and did not include covering or extinguishing taxiway lighting. Use of an appropriate checklist would have assisted the airport safety officers with setting up the runway correctly, particularly as they were unaware prior to the incident that the lighting was ambiguous.

Therefore, it is important that procedures are in place to ensure runway works lighting and markings are in accordance with the standards. As it was, the Cairns Airport procedures were inconsistent, and did not assure the works lighting met the requirements, including that the lighting was unambiguous to pilots.

Findings

From the evidence available, the following findings are made with respect to the runway undershoot involving Beechcraft 200, VH-FDO, at Cairns Airport, Queensland, on 9 July 2020.

Contributing factors

• The flight crew misidentified the aerodrome works limit line for the displaced runway threshold lights, resulting in a runway undershoot and collision with an unseen portable runway end light.
• The works and airport safety officers did not ensure the aerodrome works lighting was arranged such that the location of the displaced threshold was unambiguous to the flight crew.
• Cairns Airport procedures for temporary runway works lighting and markings were inconsistent and did not ensure lighting was not confusing to pilots.

Safety actions

Additional safety action by Cairns Airport

Following the incident, and for the duration of the remaining runway works, Cairns Airport took the below safety actions.

• No vehicle headlights were to be directed at the active runway during any aircraft operations on, or on approach to, the runway.
• The works limit line was marked by an amber solar-powered light only.
• Witches’ hats with reflective tape were not to be used.
• Air traffic control was requested to only activate taxiway lights once an arriving aircraft had landed and to deactivate the taxiway lighting after an aircraft had departed.
• Green temporary displaced threshold lights were replaced with solar lighting that did not require electricians to wire.
• The notice to airmen was amended to advise that taxiways were not available, and of temporary blue taxiway edge lighting on taxiway A between A3 and A4.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• flight crew
• operator
• Cairns Airport managers and airport safety officers
• Airservices Australia
• the Civil Aviation Safety Authority.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew
• the operator
• Cairns Airport managers and airport safety officers
• Airservices Australia
• the Civil Aviation Safety Authority.

Any submissions from those parties will be reviewed and, where considered appropriate, the text of the draft report will be amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

In the early afternoon of 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA), was conducting test flights following aircraft maintenance. After completing a successful autonomous test flight, the pilot toggled the automatic mode switch to disengage the aircraft’s automatic mode for taxi back to the hangar.

The pilot then increased the throttle to provide the aircraft with sufficient momentum to taxi. As the aircraft turned towards the pilot, they determined that the aircraft was not responding to commands to reduce the engine thrust. The pilot considered attempting to arrest the aircraft by hand but determined it was moving too quickly and instead toggled the automatic mode switch to regain control of the aircraft and turn it away from bystanders.

The pilot then directed the aircraft across the airfield and it came to rest against the perimeter fence, resulting in minor damage to the aircraft’s skin.

What the ATSB found

The ATSB determined that, following the autonomous flight, the pilot did not correctly disengage the aircraft’s automatic mode. Subsequently, when they increased the throttle to provide the aircraft with momentum to taxi back to the hangar the ’abort landing’ function activated, increasing the throttle to maximum and overriding the pilot’s commands to decrease throttle. The pilot was able to deactivate the ’abort landing’ function by toggling the automatic mode switch.

It was determined that the pilot did not identify visual, audible and tactile cues that indicated the aircraft had not exited the automatic mode prior to increasing the throttle for taxi. The most likely reason for this was that they were experiencing a level of fatigue known to impact performance.

Additionally, the pilot’s controller utilised switches with 3‑positions for 2‑position (on – off) roles, increasing the likelihood of incorrect or incomplete selection. The controller also lacked the means to enable the pilot to immediately shut down the aircraft’s engine.

What has been done as a result

In response to this incident the operator implemented several changes to their systems and procedures. They advised that 3‑position switches on the aircraft controllers, which were being used for 2‑position roles, have been replaced with 2‑position switches. A formalised taxi-in procedure has been introduced that requires personnel to shutdown aircraft on the runway and push them to the hangar by hand. A gated switch was installed on the remote controller that was capable of overriding all other controls, placing the flight controller into manual mode and commanding the throttle to shut down the turbine engine.

For subsequent operations the flight test timeline was increased from 7 to 10 days with no increase in workload. The additional time was to allow for aircraft setup and testing prior to operations commencing and to ensure that all crew members were provided with adequate rest and recovery time during both setup and operations.

Safety message

This incident has 3 key learnings for RPA operators:

• Fatigue is a risk, particularly in high tempo commercial operations. Even when fatigue management is not mandated, operators should ensure that their fatigue management processes are robust and effective.
• All controls for RPA’s should be as simple and reliable as possible. If a control leaves room for human error, then it will increase the risk of this error occurring even if procedural controls are in place. Consideration should also be given to a system that allows the remote pilot to shut down the aircraft immediately in the event of an unexpected state or failure.
• Operators should be prepared for the RPA to do something unexpected and know and frequently practice emergency procedures.

The occurrence

On the weekend of 13‑14 June 2020 a team of remote pilots and maintainers from Remote Piloted Systems (the operator), RF Designs (the maintainer) and a client company arrived at Bruhl Airfield, 2 km south-west of Tara, Queensland (Figure 1). Over the weekend they set up and prepared for a week of test flying of two autonomous test bed aircraft, the RF Designs Albatross and the RF Designs Mephisto (Mephisto). The aircraft were assembled, following disassembly for transport, and systems tested prior to operations commencing on the Monday morning. This work was overseen by the operator’s chief remote pilot (CRP) and a senior manager of the maintainer.

Figure 1: Location of Bruhl Airfield

Source: Google Earth annotated by the ATSB

Throughout the following week the team conducted multiple test and evaluation flights for the client each day. These usually involved multiple aircraft and multiple pilots through the launch (take-off), mission, and recovery (landing) phases.

On the morning of Friday 19 June, the final operational flights were carried out for the client company. Following this, the client’s personnel commenced packing up and preparing to depart the site. With all relevant permissions and approvals in place, the operator’s CRP took the opportunity to conduct post maintenance test flights on Mephisto HP001, to ensure that it was airworthy and prepared for future operations. During the week, HP001 had undergone maintenance which included the aircraft’s flight controller being removed and reinstalled following its use in another Mephisto aircraft.

The flight plan for the test consisted of two flights, testing all three of the aircraft’s modes (see the section titled Aircraft operations), and the flight controller setup and tuning. The first flight was to involve a launch in manual mode, followed by a circuit and recovery in fly by wire (FBW) mode. If the results of this flight were acceptable the aircraft was to be repositioned to the western end of the runway for the second flight. There it would be transitioned to autonomous mode and conduct a fully autonomous launch, circuit, and recovery.

At 1242 Eastern Standard Time,^[1] HP001 was launched, with both flights completed without incident. Figure 2 shows the Global Positioning System (GPS) tracks of the aircraft during the first and second flights with the track colour indicating the aircraft’s mode. Figure 3 shows the transition between the flights and the completion of the second flight, the initial taxi, loss of control and the recovery.

Figure 2: Mephisto test flights 19 June 2020

Source: Google Earth and operator annotated by the ATSB

Following the autonomous recovery at the conclusion of the second test flight, the pilot attempted to transition the aircraft out of the autonomous mode and back into manual mode for taxi to the hangar. The pilot toggled the automatic mode switch and increased the throttle setting to provide thrust to taxi the aircraft. Once the aircraft had sufficient momentum to allow for the taxi the pilot attempted to reduce the throttle setting. However, the aircraft did not respond to the pilot’s commands and the turbine engine continued to accelerate.

The aircraft was now in relatively close proximity to the pilot and moving towards other personnel who had been observing from nearby. The pilot considered arresting the aircraft by hand but, due to the aircraft’s speed and momentum, they determined that was not practical. The pilot re‑toggled the automatic mode switch, allowing them to regain control. With the aircraft back under control, the pilot directed the aircraft across the runway to the southern side of the airfield away from the hangar and personnel. The aircraft was arrested, at low speed, by the airfield boundary fence.

The aircraft was then attended by the pilot and several other personnel who conducted a normal shutdown before pushing it back to the hangar for inspection. The inspection determined that the aircraft only had minor damage to the skin due to the impact with the fence.

Figure 3: Mephisto test flight 2 - occurrence flight

Source: Google Earth and operator annotated by the ATSB

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours

Context

Aircraft information

The RF Designs Mephisto remotely piloted aircraft (RPA) (Figure 4) is a high-performance autonomous testbed aircraft. First flown in 2019, it is based on the CARF-Models Mephisto large model aircraft and modified by RF Designs at their facility in Brisbane. These modifications included a flight controller, additional fuel tank, additional shielded wiring, and some larger and more robust control components, all allowing for autonomous test operations.

Figure 4: RF Designs Mephisto

Source: RF Designs

The aircraft, which can be disassembled for transport, is a composite construction of carbon fibre and fibreglass, 3.1 m long, with a wingspan of 2.6 m. It has a maximum take-off weight of 35 kg, retractable undercarriage and flaps and is powered by a Kingtech K260G2 turbine. Delivering 26 kg of thrust, the turbine can propel the aircraft to a maximum speed of 85 m/s (165 kt) and an altitude of more than 5,000 feet.^[2]

The client owned a fleet of 6 of the aircraft that were operated and maintained by Remote Piloted Systems and RF Designs respectively. Of the fleet, 5 were operationally capable (Figure 5), and 1 (HP001) was used for testing and training.

For the week of 15‑19 June the operator brought 4 of the fleet to conduct operations for the client, 3 operational Mephistos and the test and training aircraft for backup and spare parts.

Figure 5: Operational Mephisto fleet

Source: RF Designs

Aircraft operations

The Mephisto could be operated in three different modes, manual, fly by wire (FBW) or automatic.

In manual mode the remote pilot in command (RPIC) had full control over all aircraft functionality with no interaction from the flight controller’s stabilisation programming. This required that the aircraft be manually trimmed and stabilised by the RPIC. In FBW mode the RPIC commanded the aircraft directly, however, the flight controller’s stabilisation programming interpreted and implemented these commands to ensure stable flight. This meant that if the pilot removed control input, then the aircraft would continue in straight and level flight.

Finally, in automatic mode a flight plan consisting of a series of waypoints was programmed into the flight controller using the ground control station (GCS). When the RPIC activated the automatic mode and the flight plan, the flight controller commanded the aircraft through the programmed waypoints with full control over aircraft systems. When the automatic mode was disengaged the aircraft’s systems return to the settings commanded by the RPIC’s controller.

The crew of the Mephisto consisted of two remote pilots - the launch and recovery pilot (LRP) and the GCS operator. The pilot who was actively flying the aircraft was designated the RPIC. For the autonomous flights the RPIC was the GCS operator as they were monitoring the flight and had the ability to intervene and take control of the aircraft if required.

The LRP primarily conducted launches and recoveries and operated the aircraft in manual or FBW mode within visual line of sight. This usually involved flying the aircraft to or from a holding point where it was transitioned to or from the command of the GCS operator for automated flight.

The GCS operator monitored aircraft systems during all flights, conducted flights beyond visual line of sight (BVLOS) and monitored automatic flights. Due to the difference in their roles the LRP and GCS operator were located at different points on the field (Figure 3). The LRP was on the flight line next to the runway providing them the best view of the aircraft for launch and recovery. The GCS operator worked from inside a hangar which provided a more stable environment for the equipment used to monitor and control the aircraft while away from the launch and recovery location. Due to their physical separation, the pilots communicated via radio.

Due to the risk to the aircraft of an inadvertent mode change when transitioning from the GCS operator to the LRP following a flight, a specific process was used for the handover. This process started after launch once the LRP handed over control to the GCS operator. At this point, the LRP would place the automatic mode switch (see the section titled Remote controller) on their controller in ’auto on’ and set the flaps to fully retracted.

At the time of the occurrence, following the automated test flight, the GCS operator had handed control back to the LRP for taxi. The pilot advised that prior to the hand over their controller had been set up with the automatic mode switch selected to ’auto on’ and the flap control in the fully retracted position.

Flight controller

Each Mephisto aircraft was fitted with a Pixhawk 2 flight controller, which was programmed with ARDUpilot software to enable flight in all modes. The flight controller recorded a range of parameters which could be downloaded and used for simulation, recreation, and analysis.

The flight controller received a constant stream of data from a range of inputs including control inputs from either the LRP remote controller or GCS, GPS information, airspeed and engine fuel flow. It then controlled the aircraft via a series of servos that manipulated the aircraft flight control surfaces and turbine engine controls.

Abort landing command

The ’abort landing’ command within the flight controllers programming allowed the GCS operator or LRP to abort an autonomous landing via the remote controller or GCS. The LRP controller triggered the command when 3 criteria were met.

- The aircraft was in the autonomous mode.
- The aircraft was in the landing stage.
- The throttle on the LRP controller was increased above 90 %.

When these criteria were met the aircraft overrode control inputs, increased turbine power to the take-off throttle setting (100 %), pitched up and maintained the current heading until a target altitude was reached.

Remote controller

To control the Mephisto the LRP used a TARANIS X9D Plus hand-held controller, manufactured by FrSKY. The TARANIS X9D Plus (Figure 6) was a programmable, 24 channel, 2.4 GHz transmitter that could be used to control a range of remote devices, including RPA. The controller had 8 programmable control switches, (6 3-position and 2 2-position) that the user could assign to modes or operational settings.

For this operation, to ensure redundancy, the 2 position switches activated the ’return to launch’^[3](RTL) function. This meant that 3 position switches were used to control the aircraft’s modes. To reduce risk of the automatic mode being inadvertently deactivated the modes were switched separately. One switch controlled the automatic mode (on and off) and the other selected manual or FBW. The control hierarchy placed the automatic mode switch above the manual or FBW switch so an inadvertent movement of the manual or FBW switch would not disengage the automatic mode.

Figure 6 shows the location of these switches. The operation of any of these switches required a defined movement and the pilot described that changing between positions made an audible ’click’.

The automatic mode switch was configured with 2 ’auto on’ and 1 ’auto off’ position, which was the top position. This configuration had recently been updated from 1 ’auto on’ and 2 ’auto off’ positions. This change was due to a risk to the aircraft associated with inadvertent deactivation of the automatic mode during flight, particularly when the aircraft was BVLOS. To ensure that the switch was in the correct position it was normal for pilots to drive the switch to an end point of the control to ensure that the desired mode had been selected.

The LRP controller was not fitted with the ability to activate the aircraft’s flight termination system (FTS) (see the following section titled Flight termination systems and active failsafe) or operate as a ’kill switch’, cutting power the aircraft’s engine. In the event that the LRP required the FTS to be activated they would request the GCS operator activate it.

Figure 6: TARANIS X9D Plus with key controls identified

Source: FrSKY annotated by the ATSB

Flight termination systems and active failsafe

Under the Civil Aviation Safety Authority (CASA) permission for the operation (see the section titled Operational information) the aircraft was required to be fitted with a primary active failsafe system and primary and secondary flight termination systems. The primary active failsafe system was designed to ensure that the aircraft did not depart the operational area in the event of a communications loss with the controller. It was designed to return the aircraft to either the launch point or some other holding point within the operational area that allowed the RPIC to conduct necessary checks and perform relevant actions to re-establish communications. If necessary, the system could be activated by the LRP, GCS operator or automatically if the aircraft exited the operational area. The aircraft’s RTL function met this requirement.

The FTS was a secondary level of control that was activated if the primary active failsafe failed or was unable to return the aircraft to a stable location. The system worked by bringing the aircraft to the ground as quickly and as safely as possible, with the main aim of protecting personnel and property. In the case of the Mephisto, the FTS was set to place the aircraft flight control surfaces in a configuration to induce a spin and cut fuel to the engine. This arrested as much forward momentum as possible prior to impact with terrain. The FTS was activated by either the GCS on a dedicated control link or automatically if the aircraft departed a contingency area around the operational area.

CASA specifically stated that the FTS was not intended for use on the ground. However, the system’s process meant that, in the event of an issue on the ground, it would provide a way to rapidly arrest momentum of the aircraft and put it into a known state.

At the time of the incident the aircraft in question was fitted with both the primary active failsafe and FTS. However, due to the rapid development of the aircraft the flight manual had not been updated and contained information that the flight termination system had not been fitted and remained in development.

Operational information

The operator, maintainer and client company had been conducting BVLOS, autonomous and multi-aircraft test flights from Bruhl airfield since November 2019. They had been using a range of smaller, primarily electrically driven aircraft types and recently began using the Mephisto, to allow for higher performance operations and testing.

Bruhl airfield, located approximately 265 km west-north-west of Brisbane Airport (Figure 1), was chosen for 3 reasons. Firstly, it was familiar to several of the crew members. Secondly, it was remote and the surrounding area desolate. This meant that the operational area had a low the risk to persons and property in the event of an aircraft malfunction. Finally, it was accessible by road for the operator, maintainer, and client company from Brisbane.

Operational permissions

Permission for autonomous, BVLOS, multi-aircraft operations at Bruhl airfield operations was granted by the CASA in November 2019. The operator was authorised for flight BVLOS above 400 ft within defined areas and in compliance with certain conditions until 30 November 2020 or revoked. These conditions included:

• the fitment of a ’primary failsafe mode’ which could command a return to launch, ensuring that, during this process, the aircraft did not increase height or depart from the operational area
• fitment of both primary and secondary flight termination systems, with the secondary being able to command immediate flight termination in the event of the loss of communications with the primary.

Operational schedule

Operational test flights for the client’s systems were carried out throughout the week, finishing prior to the incident flight at approximately midday. Through the week these operations started at around 0900 and continued throughout the day, with a break for lunch.

Following each flight there was the requirement to download and analyse the aircraft flight data, liaise with the client company, conduct any required maintenance, and prepare aircraft and flight plans for following flights. These tasks were usually carried out by the incident pilot in their role as the operators CRP.

There was no formalised procedure for taxiing the aircraft back to the hangar. However, the pilot reported that there was a standard process that Mephisto pilots followed to provide the aircraft with enough momentum for the taxi. This process, as outlined below, was for a Mephisto aircraft having completed an autonomous recovery and positioned on the runway.

1. LRP to take control of the aircraft.
2. automatic mode to be deactivated with the aircraft in either FBW or manual
3. remote controller throttle advanced to 100 %
4. pilot to wait for the throttle to spool up to the desired level (approximately 30 %), due to throttle lag this could take approximately 6-7 seconds
5. pilot to throttle back on the controller to desired level
6. pilot to taxi the aircraft back to the hangar under its own power.

Crew information

A team of five pilots, all cross trained on the GCS and as LRP for the Mephisto aircraft, were available to conduct the week of flight activity. In addition, at the time of the incident, multiple training pilots were observing the test flight in preparation for CASA flight testing during the following operational period.

For the incident flight the aircraft crew consisted of the LRP, who was also the operator’s CRP, and a GCS operator. Both the LRP and GCS operator held current remote pilot licenses (RePLs) with appropriate category and type endorsements for operation of the Mephisto.

Fatigue

The International Civil Aviation Organization (2016) defined fatigue as:

A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety related operational duties.

Fatigue is a known contributor to a range of adverse effects on human performance. These can include, slower reaction times, decreased vigilance, shortened attention span, reduced short term memory capacity, and reduced decision making capability.

The pilot reported that at the time of the incident they, and others undertaking the operation, were experiencing a heightened level of fatigue due to the tempo of the operation.

Three people on site were designated to monitor fatigue of the operational crew, the incident pilot (as the operators CRP), a senior manager of the maintainer’s company, and a representative from the client company. The pilot reported that following an out‑landing incident earlier in the week, the client’s fatigue management personnel reported that they believed that there was a heightened level of fatigue among the operational personnel. This increased awareness of the fatigue levels prompted increased monitoring of the crew. However, no further action was deemed to be necessary.

Fatigue guidance

At the time of the incident, there was no regulation that applied to fatigue management for operators of RPA. However, in the company operations manual, the operator had used guidance from CASA's sample operations manual, which identified the following 3 areas of fatigue management to be followed:

• the chief pilot must consider and minimise the potential for fatigue to effect operations
• pilots were not to conduct RPAS operations if they believed that they were suffering from fatigue that was likely to impair their performance
• pilots must immediately report fatigue related concerns to the chief pilot who would take appropriate action to remedy the situation.

To comply with this, the chief pilot was required to consider several factors relating to each mission, including:

• travel time to the operation
• complexity and duration of the operation
• the time of day that the operation was to take place
• environmental conditions.

Fatiguing conditions

Through a review of the operation and the pilot’s history the ATSB identified 3 factors that could have contributed to a significantly heightened fatigue level. These were environmental conditions, operational requirements, and disrupted sleep.

Environmentally, while the incident occurred during winter, the LRP were operating outside on the flight line, in sunny and warm conditions. While there was no concern about the effect of the temperature, the pilots did identify a risk of dehydration, which can be a contributor to fatigue. These factors were being managed through breaks through the day and access to shade, fluids and food.

Operationally there were 2 periods that would have affected the pilots fatigue levels. Firstly, in the week leading up to the operation the pilot had been undertaking a range of maintenance testing and other preparatory activities. This involved multiple round trips to and from Brisbane to the airfield for test flights, a trip of approximately 3 hours each way. In addition to the flights and aircraft preparation this also involved data download, analysis and associated aircraft tuning both at the airfield and in Brisbane.

These activities were not only fatiguing themselves but limited the pilot’s opportunity for rest in preparation for the operational week, which they were aware was going to have an increased operational tempo. The pilot was aware of the heightened risk of fatigue due to these factors and sought to mitigate them over the weekend prior to the operation by taking more of an oversight role of preparations and leaving individual tasks to crew members.

The pilot reported that during the operational week they had 12 to 14 hours of duty each day. This involved carrying out aircraft test flights for the client company, overseeing LRP and GCS operations for the operational and test aircraft. In their role as CRP, the incident pilot, was also monitoring the crew for signs of fatigue, overseeing maintenance, preparing aircraft, and planning and reviewing data for the operations undertaken each day. The maintenance and preparatory tasks were undertaken in the morning prior to commencement of the days flying operations and, in the evening, following the completion of operations until going to sleep. This meant that, with the exception of mealtimes, there was limited to no time where the operations were not the focus. While the incident occurred in the middle of the day it was at the end of the final test flight of the week’s operations.

The pilot reported that sleep opportunity was in line with their regular habits, getting approximately 7 hours each night. However, during these operations they were staying at the airfield and rooming with another person. The pilot reported that this probably resulted in disrupted sleep. All other members of the crew were roomed off site in individual accommodation, which both promoted sleep opportunity and removed them from the operational environment.

Fatigue review

Unlike crewed aircraft operations, this operation did not need to comply with Civil Aviation Order (CAO) 48.1 Instrument 2019. Despite that, the ATSB reviewed the pilot flight and duty times against the instrument and appendices 1 (basic limits), 4 (any operations) and 5A (daylight aerial work operations and flight training associated with aerial work) to gain an appreciation of what level of fatigue was considered likely to affect performance.

Based on this review it was determined the pilot had exceeded the cumulative duty period limits, had not had sufficient off duty time and did not have adequate sleeping facilities as per the instrument requirements. As such, if the pilot had been seeking to fly a crewed aircraft subject to CAO 48.1 requirements, they would have been considered unfit to fly.

Recorded data

As discussed in the Flight controller section, the Pixhawk 2 flight controller can record and store a range of timestamped flight data and status messages.

The data for the two test flights, was downloaded by the operator and the data and relevant software for interpreting it were provided to the ATSB. Figure 7 shows data from these flights with throttle, flap and altitude traces. Additionally, the active aircraft mode is shown and some of the recorded aircraft status messages.

Figure 7: Flight data showing 19 June test flights

Source: ATSB utilising data provided by the operator

Figure 8 shows data from the second flight with the transition into automatic mode and the aircraft then launching conducting a circuit and being recovered. Following the landing there were a number of mode changes and an aircraft status message that corresponded with the ‘abort landing’ function being activated, the pilot toggling the mode switch to disengage this function and directing the aircraft away from personnel on the flight line.

Figure 8: Flight Data - Mephisto test flight 2 - 19 June

Source: ATSB utilising data provided by the operator

Figure 9 shows greater detail of the incident over the period of 20 seconds from 12:47:00 to 12:47:20, during which the aircraft was under the control of the LRP. This time covers the aircraft on the ground preparing to taxi, the throttle being advanced, and the ’abort landing’ function being activated, as identified by aircraft status message 2. It shows the mode selections by the pilot as they disengaged the abort landing function and toggled into manual mode as the aircraft was directed towards the airfield fence.

The chart shows that the aircraft remained in automatic mode and the flaps remained extended until approximately 12:47:04 when the throttle trace showed an increase to 100 %. At this time the aircraft status message appeared, giving the indication that the ’abort landing’ function has been activated and the flaps retracted while the throttle remained at 100 % as the aircraft followed the ’abort landing’ process.

The data showed the pilot toggling the automatic mode switch to off, and back on, to overwrite the ’abort landing’ function. It shows the throttle trace as the pilot directed the aircraft away from the flight line and across the runway towards the fence, and finally the re-engagement of the manual mode for the aircraft to be shutdown.

Figure 9: Flight Data - Incident - 19 June

Source: ATSB utilising data provided by the operator

__________

2. The aircraft’s maximum altitude was not confirmed – 5,000 ft is the maximum altitude allowed under the operational permissions obtained from the Civil Aviation Safety Authority.
3. When activated the return to launch function automatically flew the aircraft back to the launch point or another designated point and, depending on programming, either held in place (allowing the RPIC to regain control) or conducted an automated recovery.

Safety analysis

Introduction

At 1247 on 19 June 2020, the pilot of an RF Designs Mephisto, remotely piloted aircraft (RPA) completed an automated test flight and attempted to transition the aircraft out of automatic mode to taxi it back to the hangar.

The pilot was unaware they had not deactivated the aircraft’s automatic mode prior to increasing the throttle to provide sufficient momentum for the taxi. This action activated the aircraft’s ‘abort landing’ function and prevented the engine from throttling down as the pilot was commanding.

The following analysis will look at the factors that resulted in the incomplete deactivation of the automatic mode, the pilot not realising the aircraft remained in the automatic mode and the delay in regaining control of the aircraft.

Deactivation of automatic mode

Following the landing, the pilot attempted to deactivate the aircraft’s automatic mode using the automatic mode switch. The switch had 3 positions with 2 positions set for automatic mode on and 1 for automatic mode off. The pilot recalled that they had moved the switch as indicated by the click and movement that was felt. However, they did not recall whether it was moved 2 positions or 1. The data showed no deactivation of the autonomous mode, indicating a single position change.

This meant the aircraft was in a state different to what was intended leading to the activation of the ’abort landing’ function when the pilot advance the throttle, and the subsequent loss of control.

The LRP remote controller (TRANSIS X9D Plus) had only two 2-position switches available, which for redundancy were both being used for return to launch functionality. This meant that the automatic mode selection was relegated to a 3-position switch. The technique of driving the switch to an end point that the Mephisto pilots used went some way towards mitigation of an error. However, the use of a 3-position switch increased the likelihood of a mis-selection and an undesired state.

This potential had been identified by the operator with the change of layout for the 3 positions from off-off-on to off-on-on. It was believed that this was a way to limit the risk of an aircraft accidentally being forced into manual or fly by wire mode while flying beyond visual line of sight. However, it did not overcome the issue of an incomplete or incorrect mode selection.

Aircraft state awareness

There were 3 cues to alert the pilot that the aircraft remained in the automatic mode. Firstly, the aircraft’s flaps had not retracted when they attempted to disengage the automatic mode, despite being set to fully retracted on the controller. Secondly, the pilot should have felt and heard two distinct ’clicks’ as the control moved through the second ’auto on’ position and into the desired ’auto off’ position.

The pilot commented that they did not remember seeing the flaps retract and recalled feeling and hearing 1 click but could not recall the second. The ATSB considered a number of reasons why the pilot may not have detected or reacted to these cues. These included: deliberate pilot action, distraction, expectation bias, and fatigue. Based on the available evidence, it was considered that the heightened level of fatigue was the most likely explanation. This is discussed further below.

Delayed control recovery

In the event of a RPA loss of control on the ground, where the engine was still functioning at a high-power setting, removing engine power is the quickest and easiest way to arrest momentum and bring the aircraft back under control. The flight termination system (FTS), as required under the CASA permission for the operation and fitted to the aircraft, provided the ability override the aircraft’s automatic mode, immediately cut fuel to the turbine and drive the aircraft controls into a configuration to induce a spin.

While this system was designed to operate in the air, its functionality, specifically cutting fuel to the turbine, would have allowed the aircraft’s momentum to be arrested more quickly. However, this system could not be activated from the launch and recovery pilot’s (LRP) controller and relied on communications with the ground control station operator to activate it. The aircraft’s data showed that there were only seconds for the pilot to react and take appropriate action. While calling for the activation of FTS would have stopped the aircraft it would not have been practical in the time available.

Had the LRP’s controller been fitted with a switch that could activate the FTS, there would have been no requirement for the extra control inputs to deactivate the ‘abort landing’ function and regain control of the aircraft.

Fatigue

For this operation the potential effects of fatigue on crew members had been identified and a range of fatigue management and mitigation strategies were in place. However, these strategies did not specifically account for the added work created by the incident pilot’s additional role as the operator’s chief remote pilot (CRP).

For example, in addition to flight operations and testing, they were liaising with the client company, monitoring other team members for signs of fatigue and staying at the field in shared accommodations. Additionally, while the crew was being monitored for fatigue, the 3 personnel assigned to monitor the fatigue - the CRP, the maintainers senior manager and the clients fatigue monitoring personnel did not have anyone assigned to monitor their fatigue levels. Fatigue monitoring is only effective if all personnel are being monitored.

Considering their workload and reduced rest opportunity, the ATSB assessed that it was likely that the pilot was experiencing a level of fatigue that affected performance. Heightened fatigue levels are known to cause a reduction in ability to react to external stimuli and effect a person’s attention and decision-making capacity.

The level of fatigue felt by the pilot at the time of the incident likely had an effect on them missing the visual (flaps not retracting), tactile (not feeling one click rather than two) and audible cues (hearing one click not two) that indicated the aircraft had not exited the automatic mode.

Findings

From the evidence available, the following findings are made with respect to the loss of control during taxi involving RF Designs Mephisto, HP001 at Bruhl Airfield on 19 June 2020.

Contributing factors

• When the throttle was advanced for taxi, the automatic mode, which had not been correctly deactivated, entered an ’abort landing’ state. This overrode the pilot’s commands to decrease throttle and the turbine thrust continued to increase, resulting in a loss of control.
• The use of a 3-position switch (with 2 positive and 1 negative position), for a 2‑position role, increased the likelihood that a pilot would inadvertently not deactivate the automatic mode prior to manoeuvring the aircraft.
• The controller did not have a ’kill switch’ to override the aircraft’s automatic mode and shutdown the turbine in the event of an issue. As a result, the pilot was forced to toggle the aircraft’s mode switches and direct it away from personnel rather than being able to override it.
• The pilot was experiencing a level of fatigue known to impact performance. This likely led to a lack of reaction to multiple cues that the aircraft had not exited the automatic mode.

Safety action

Safety action not associated with an identified safety issue

Safety action by Remote Piloted Systems (the operator).

In response to this incident the operator introduced the following changes to the Launch and Recovery pilot’s controller switch layout and allocations, procedures for taxiing the Mephisto aircraft and operational planning to reduce risks identified:

• 3‑position mode switches were replaced with 2‑position mode selection switches to eliminate issues with incomplete deactivation of the automatic mode.
• All launch and recovery pilot controllers had a ’kill switch’ added that overwrites the aircraft’s mode to manual and drives the throttle immediately to zero thrust. This switch is gated to enable easy to operation, when necessary, but is also difficult to inadvertently activate.
• Taxi procedure has been changed/formalised to require that all aircraft are shutdown on the runway and pushed back to the hangar by hand rather than under their own power.
• The operational timeline has been extended from 7 to 10 days, with additional time to setup and prepare the aircraft and a break before operations commenced.

Safety action by RF Designs (the maintainer).

Since this event the RF Designs has introduced the following two safety improvements:

• The aircraft flight manual has been updated to clarify the presence of the flight termination system, removing the phrase ’not currently fitted, in development’.
• Specific fatigue management requirements, including references to CAO-48.1, have been added to the RPA operations manual.

The ATSB welcomes the prompt safety action taken by the operator and maintainer to address the deficiencies identified in this incident.

Glossary

BVLOS             Beyond Visual Line of Sight

CASA               Civil Aviation Safety Authority

CRP                 Chief Remote Pilot

FBW                Fly by Wire

FTS                  Flight Termination System

GCS                 Ground Control Station

GPS                 Global Positioning System

LRP                 Launch and Recovery Pilot

RePL                Remote Pilot License

RPA                 Remotely Piloted Aircraft

RPIC                Remote Pilot in Command

RTL                  Return to Launch

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilot flying
• aircraft manufacturer and maintainer
• Civil Aviation Safety Authority
• Operators manual for the FRSky TARANIS X9D Plus
• recorded data from the aircraft
• ARDUpilot documentation.

References

ICAO. (2016). Doc 9966: Manual for the Oversight of Fatigue Management Approaches 2nd Edition. Quebec, Canada: International Civil Aviation Organisation.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the operator and pilot flying
• the maintenance organisation
• CASA

No submissions were received.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

The occurrence[1]

Aeromedical tasking and flight preparation

In June 2020, the ATSB commenced a transport safety investigation into a main rotor blade strike involving a Leonardo Helicopters AW139, registered VH-EGK and operated by Queensland Government Air, about 16 km west‑south‑west of Caboolture airfield, Queensland.

On 20 June 2020, at about 1709 local time, the aircrew (comprising the pilot, aircrew officer (ACO) and rescue crew officer (RCO)) and medical crew (flight doctor and paramedic) were tasked with retrieving a patient from a property near Caboolture and transporting them to the Royal Brisbane Hospital. In preparation for the flight, the pilot completed an operational pre‑flight risk assessment, which indicated ‘normal operations’, permitting acceptance of the task without further discussions with the operator’s duty management pilots. The remaining crew refuelled the helicopter and configured the cabin for a night winch rescue.

Transit to the site

At about 1746, the helicopter departed Archerfield Airport. The flight was operated under the instrument flight rules,[2] with the aircrew using night vision goggles.[3]

On approach to the rescue site, the ACO contacted the ground paramedic to confirm the patient’s status and ascertain whether any areas nearby could be used for a landing, to avoid the requirement to winch. The ground paramedic advised that a suitable landing site was not available, but there was a possible suitable winching position about 20 m behind the ambulance. The ACO requested the ground paramedic keep the ambulance lights and roof top emergency beacon on, to assist in identification of the winch location. 

Arrival on site and insertion winches

The helicopter arrived in the vicinity of the site at about 1800 in dark conditions, approximately 30 minutes after last light.[4] The pilot and ACO identified the site, completed the pre-landing checklist, and put the ‘Trakkabeam’[5] on. The aircrew discussed the site characteristics and planned the approach. 

Recorded flight data showed that several orbits of the rescue site were conducted. During the final orbit, the pilot briefed the crew on the site. At about 1813, the pilot commenced a descent to the site and completed power checks and briefed the escape route. At about 1818, the pilot manoeuvred the helicopter to a low reference datum[6] of about 200 ft above ground level and 50 m north of the insertion winch location. From this position, the aircrew conducted the reconnaissance brief. They checked the power setting, radio altitude reading, security of harnesses, and if they had ‘good references’. The pilot then handed the conning[7] over to the ACO. 

Between about 1821 and 1826, the crew completed 2 insertion winches to lower the RCO, flight paramedic and stretcher, from a height between 65–100 ft. The helicopter then departed the site to the east and orbited for about 20 minutes while the patient was prepared for extraction. During this time, the pilot and ACO commented on the rain passing through the area and prepared for the extraction winches. 

The extraction winch and collision with terrain

The patient was moved from the side of the hill to a position in an open area considered suitable for winching. At about 1841, the RCO radioed the ACO to report that they were ready for the winch. The pilot verbalised to the ACO ‘same brief as before’, which was acknowledged by the ACO. The pilot and ACO both reported there was no re-identification, verbalisation or re-briefing of the critical hazards (outlying trees) associated with the revised extraction winch position. They then completed their final checks. At about 1846, the helicopter was established in a hover about 80 ft directly above the patient. At interview, the pilot approximated the helicopter’s main rotor was rotating about 1 m from the surrounding tree line.

The flight paramedic and the patient on a stretcher were winched into the helicopter. As the winch was lowered to collect the RCO, the ACO directed the pilot to move forward and right, twice. As the RCO was about to be winched, they verbalised for the ACO to hold them on the ground as they had momentarily lost their night vision goggles mount. At about 1851, the ACO confirmed to the pilot that they were holding a good position. The recorded data showed that, over the last minute, the helicopter’s height ranged between about 50–65 ft above the ground (861–876 ft above mean sea level) and the heading changed between about 111–120°.

Shortly after, the doctor called out ‘trees, trees’, at which point the helicopter’s main rotor blades contacted a tree. Immediately following the main rotor strike, the ground paramedic reported seeing a branch fall through the trees, with an estimated diameter of 10 cm and length of about 1‍–‍1.5 m.

Recovery and return to Archerfield

In response, the pilot immediately manoeuvred the helicopter away from the tree line. The RCO was subsequently raised off the ground, contacted the trees and went into a spin. Shortly after, the RCO was safely secured inside the aircraft. The pilot reported that feedback through the flight controls remained normal, with no abnormal vibrations. However, as a precaution, the pilot elected to return to the helicopter’s base at Archerfield Airport. 

Helicopter damage assessment

An engineering inspection of the main rotor blades identified damage to one of the 5 tip caps, which was missing about 50 g of honeycomb and skin material (Figure 1). Two other main rotor blades had minor abrasions to the paint layer. No other significant damage was observed.

The helicopter manufacturer considered a loss of 40–50 g on a main rotor blade tip was generally not enough to generate a perceivable vibration in the aircrew or passenger compartments. 

Figure 1: Damage to the main rotor blade tip

Source: ATSB

Environmental information

Meteorological conditions

The Bureau of Meteorology graphical area forecast applicable for the flight and occurrence location indicated the conditions were:

• visibility was greater than 10 km, with broken[8] stratus cloud between 2,000–3,000 ft above mean sea level, and from 1900 local time, broken cumulus and stratocumulus cloud between 3,000–6,000 ft 
• visibility reducing to 3,000 m in isolated showers of rain, with broken stratus cloud between 1,000–3,000 ft and broken cumulus cloud between 3,000–8,000ft.

Significant rainfall had been recorded in the vicinity of the site over the preceding days. Immediately prior to the occurrence, the Bureau of Meteorology weather radar indicated light rain in proximity. The pilot reported there was more weather to the west of their site and that it was clear to the east. The cloud base had reduced as they were operating, and they had passing showers, with some rain on the windscreen. Recorded audio from the helicopter captured the aircrew discussing rain while orbiting to the east before returning for the extraction winch. Mobile phone footage taken from the ground showed moderate rain during the extraction sequence. 

Lighting conditions

It was reported that there was limited ambient lighting generated from surrounding residential and farming properties. The astronomical conditions indicated very low celestial illumination in the vicinity of the site, with 1.7% moon illumination. Despite this, both the pilot and ACO reported they had good visibility, and they did not notice any scintillation[9] of their night vision goggles due to the low light. 

Investigation activities

During the investigation, the ATSB:

• interviewed the aircrew, medical crew and relevant safety personnel
• examined data from the helicopter’s multi-purpose flight recorder and mobile phone footage of the winching operation
• reviewed the environmental conditions
• reviewed the operator’s standard operating procedures
• consulted the helicopter manufacturer
• considered similar occurrences.

ATSB observations

Helicopter drift and visual cueing environment

Unbeknown to the pilot, the helicopter drifted during the night extraction of the RCO, resulting in the main rotor blades impacting a tree. Further, the aircrew were potentially operating in a degraded visual cueing environment due to the meteorological and lighting conditions at the time. 

Pre-flight operational risk assessment 

The operator’s pre-flight operational risk assessment tool was not accurately completed, resulting in a low-risk score that did not reflect the accurate flight conditions. Further, the tool did not consider the relative humidity when evaluating the environmental conditions, nor did it include a risk level that equated to a mandatory no-go decision.

Obstacle clearance limits

During the extraction, the helicopter was hovered closer to the surrounding tree line. It was noted that there were no minimum obstacle clearance limits prescribed by the operator, particularly for when operating in confined areas.

In-flight risk assessment

The aircrew did not fully complete the reconnaissance brief for the insertion winch sequence and therefore had not identified the closest obstacles or external hover references. 

Actions following a suspected or actual obstacle collision

As no apparent issues were identified with the helicopter following the main rotor blade strike, it was returned to the operator's base. This involved flying over a populated area, although the damage severity was unknown. The operator did not have a published procedure regarding the actions required by aircrew following a suspected or actual collision with an obstacle such as conducting a precautionary out-landing. 

Operator safety action

In response to this occurrence, the operator has implemented a range of safety actions, such as:

• Introduced additional requirements to strengthen the operational risk assessment process. Such as, the inclusion of relative humidity (temperature dewpoint spread) in the pre-flight risk assessment operational tool, the requirement to consult with a management pilot when the risk was assessed as ‘orange – extreme caution’ or above, increased coordination with the tasking agency regarding the acceptance of the rescue task, and the recording and auditing of risk assessment scores. Similarly, an instruction was issued to aircrew emphasising that the risks associated with winching operations should be assessed at tasking, dispatch, arrival on site, and throughout the operation.
• Released a standards directive and updated the aircrew operations manual with additional obstacle clearance requirements. This included mandatory minimum distances from obstacles when operating in, or within the vicinity of a confined area, or manoeuvring near obstacles.
• Released a standards directive and updated the aircrew operations manual requiring the pilot in command to land as soon as possible when either ‘suspecting or observing’ helicopter damage. 

Safety message

The flight planning and task preparation stage provides an important opportunity to assess the operational environment prior to task acceptance and departure. Risk management strategies such as a pre-flight risk assessment tool can help pilots apply a systematic process to decision‑making and assist with mitigating other hazards that could adversely affect the safety of flight. 

However, as a pre-flight risk assessment tool cannot anticipate all hazards and corresponding risks that may emerge during the flight, aircrew should continually reassess the operational risk to determine if the applied risk controls are appropriate or require adjustment to ensure flight safety is maintained. In-flight briefings are an effective mechanism for achieving this. Likewise, such briefings aid an aircrew’s shared understanding of how the tasking is to be completed. This understanding is then reinforced through positive communications between the aircrew throughout the tasking.

Finally, this occurrence illustrates the importance of an appropriate response if a helicopter is suspected of colliding with terrain, regardless of the presumed severity. Unknown damage to a helicopter’s main or tail rotor system could quickly develop into a much more serious situation, particularly when operating over a densely populated area.

Reasons for the discontinuation

Based on a review of the available evidence, the ATSB considered it was unlikely that additional investigation would identify further important safety lessons. Queensland Government Air has been briefed about the ATSB’s observations and potential learnings. While the broader communication of this information is useful to other similar operators, in this case, appropriate safety action has been taken by Queensland Government Air. 

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation. Consequently, the ATSB has discontinued this investigation. 

Safety summary

What happened

On the afternoon of 2 July 2020, the pilot of a Cessna 208B aircraft, registered VH-DQP, was conducting a ferry flight from Cairns to Redcliffe, Queensland. After encountering unforecast icing conditions and poor visibility due to cloud, the pilot climbed from 10,000 ft to 11,000 ft. When the aircraft was about 53 km west-north-west of Sunshine Coast Airport, air traffic control attempted to contact the pilot regarding the descent into Redcliffe. No response was received from the pilot at that time, or for the next 40 minutes. During this time, air traffic control, with the assistance of pilots from nearby aircraft, made further attempts to contact the pilot of VH‑DQP.

When the aircraft was about 111 km south-south-east of the intended destination, the pilot woke and communications were re-established. The pilot was instructed by air traffic control to land at Gold Coast Airport. The pilot tracked to the Gold Coast and landed safely without further incident.

What the ATSB found

The ATSB found that the pilot was likely experiencing a level of fatigue due to inadequate sleep the night before and leading up to the incident. Further, operating at 11,000 ft with intermittent use of supplemental oxygen likely resulted in the pilot experiencing mild hypoxia. This likely exacerbated the pilot’s existing fatigue and contributed to the pilot falling asleep.

Safety message

The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported by industry. One of the priorities is Fatigue, which is a physical and psychological state typically caused by prolonged wakefulness and /or inadequate sleep. Most people generally underestimate their level of fatigue and tend to overestimate their abilities. The incident emphasises the importance of pilots monitoring their own health and wellbeing, to ensure that they are well-rested and adequately nourished, especially when conducting single pilot operations.

Further, it demonstrates that, although mild hypoxia is not known to impair complex cognition it has been found to increase fatigue and decrease vigour. Symptoms of hypoxia can begin very subtly at lower altitudes and can also begin to show below 10,000 ft for people who are smokers, unfit, or fighting off an illness.

Further information about assessing your fitness to fly and hypoxia can be found on the ATSB website and in the Flight Safety Australia article Do not go gentle: the harsh facts of hypoxia.

The investigation

The occurrence

On 2 July 2020, at about 1230 Eastern Standard Time,^[1] the pilot of a Cessna Aircraft Company 208B aircraft, registered VH-DQP (DQP), departed Cairns on a ferry flight to Redcliffe, Queensland under instrument flight rules.^[2] The pilot initially maintained 10,000 ft, however, during the flight they encountered unforecast icing conditions and poor visibility due to cloud. Consequently, at about 1541, the pilot climbed to flight level (FL)^[3] 110.

At about 1634, the pilot made first contact with air traffic control’s (ATC’s) Burnett sector. About 20 minutes later, when the aircraft was about 29 NM (53 km) west‑north‑west of Sunshine Coast Airport, Queensland, ATC attempted to contact the pilot regarding the descent into Redcliffe. No response was received from the pilot. Air traffic control, with the assistance of pilots from nearby aircraft, continued attempts to contact the pilot of DQP. The aircraft was observed by ATC to overfly Redcliffe and continue tracking toward Brisbane. During this time, ATC declared an uncertainty phase^[4] and contacted the Australian Maritime Safety Authority Joint Rescue Coordination Centre and the Australian Defence Force for support.

At about 1713, ATC asked the pilot of a Royal Flying Doctor Service Beechcraft B200 aircraft, which was departing Brisbane, to intercept DQP. The B200 pilot intercepted the aircraft but was unable to establish communications with the pilot of DQP. The B200 pilot then attempted to attract the pilot’s attention by dipping the aircraft’s wings and approached DQP in an effort to activate its traffic alert and collision avoidance system.^[5] The pilot did not respond to these attempts. At about 1725, ATC upgraded the uncertainty phase to a distress phase.^[6]

At about 1735, after 40 minutes without contact and when about 60 NM (111 km) south‑south‑east of Redcliffe (Figure 1), communications with the pilot of DQP was re-established. Air traffic control instructed the pilot to conduct an immediate descent to 8,000 ft and to change to a discrete ATC frequency. After a minute of no change in the aircraft’s altitude, ATC again instructed the pilot to change frequencies and to use oxygen as they were treating the situation as a hypoxic event. This was also reiterated to the pilot of DQP by the B200 pilot. Air traffic control reported that the pilot sounded ‘groggy’ and ‘not really with it’ upon first contact and took a few minutes before slowly commencing the descent to 8,000 ft.

Figure 1: VH-DQP flight path and distance from Redcliffe Airport

Source: Google Earth, annotated by the ATSB

Upon changing frequencies, ATC instructed the pilot to land at Gold Coast Airport. The pilot accepted the instruction at first, but then later advised that they would prefer to continue to Redcliffe instead. Air traffic control reiterated that, given the situation it would be better for the pilot to land at the Gold Coast as there was runway lighting and emergency services available.

The pilot accepted the instruction and tracked to the Gold Coast, while the B200 pilot continued to follow and monitor the aircraft. Air traffic control reported that the pilot continued to sound ‘groggy’, but gradually improved on approach to land.

The aircraft was landed safely at 1801 and the pilot was attended by the Gold Coast aircraft rescue and firefighting officers and the aerodrome safety officer. The officers conducted a visual observation of the pilot. The pilot, who reported falling asleep, declined first aid and an ambulance.

Context

Pilot information

The pilot previously held an Air Transport Pilot Licence (Aeroplane), but at the time of the incident was exercising the privileges of a Private Pilot Licence, with a valid Class 2 Aviation Medical Certificate. The pilot had a total flying experience of about 20,000 hours and had accrued 500 hours on the Cessna 208. They had been retired from full-time flying for about 10 years and had been ferrying aircraft for about 12 years The pilot reported that, on the day of the incident, they:

• Boarded a flight from Brisbane at 0730 and arrived at Cairns at 1000.
• Had a light breakfast and a cup of tea between 0500-0530, and a small bottle of water on the flight up to Cairns. After departing Cairns in DQP and established in the cruise, the pilot had a sandwich and a milk coffee.
• Had the heater on while in the cruise at FL 110. The heater was on for about 20 minutes, and it was reasonably warm in the cockpit. The pilot believed that this contributed to falling asleep.
• Had a low workload prior to falling asleep and had no memory of commencing the descent. Upon waking up, the pilot was confused and had not realised how far off course the aircraft had flown.
• Did not recall ATC advising that they had been out of communication for a significant time.
• They were a non-smoker.
• They did not take any medication or have any pre-existing medical conditions that would have contributed to the incident.
• Had a chest infection for several months, which had cleared up in the weeks prior to the incident.

Sleep history

The pilot recalled having disturbed sleep the night before the flight, which had been a regular occurrence, on and off for the last 1-2 years. They could not estimate the amount of time asleep the night before the incident. However, a typical night would consist of going to bed at around 2230 and waking up at around 0030. They would then tend to lie awake for 1-2 hours before drifting off into a mildly disturbed sleep. The night before the incident, the pilot went to bed at 2230 and woke up between 0500 and 0530. The pilot reported feeling a little tired on the day of the incident but was okay to fly.

Hypoxia

Hypoxia is the result of a lack of oxygen to the body tissues. The most common type of hypoxia in aviation is altitude (hypobaric) hypoxia and is associated with breathing air at low barometric pressure. Hypoxia can be prevented by pressurising the aircraft or by breathing supplemental oxygen. VH-DQP was not pressurised.

The onset of hypoxia can be insidious and may not necessarily be noticed by a pilot. Symptoms of altitude hypoxia relevant to this incident, include sleepiness, drowsiness, slurred speech, confusion, impaired cognition and decision making. Loss of consciousness is also a symptom of hypoxia, however, a person would not typically regain consciousness without additional oxygen.

According to the International Civil Aviation Organization (2012), the threshold of hypoxia is generally considered to be about 3,300 ft as no obvious physiological reaction to decreased atmospheric pressure has been reported below this altitude. As altitude increases above this level, the first detectable symptoms of hypoxia begin to appear, and a more realistic threshold would be around 5,000 ft. However, symptoms become more pronounced above 10,000 ft.

Studies have found that hypoxia between 8,000-12,000 ft does not impair complex cognition, but at FL 120, can increase fatigue and reduce vigour. These effects can be subtle and can depend on the individual (Legg et al., 2015, Bouak et al., 2018). Factors that can increase an individual’s susceptibility and severity of the symptoms can include illness, fatigue, physical fitness and activity, mental health and the use of certain medications and drugs (Campbell & Bagshaw, 2002, Nethus et al., 1997), cabin temperature, altitude, rate of ascent and duration at altitude (Skybrary, 2019). 

Supplemental oxygen

Civil Aviation Safety Authority Civil Aviation Order 20.4 – Provision and use of oxygen and protective breathing equipment stated that:

A flight crew member who is on flight deck duty in an unpressurised aircraft must be provided with, and continuously use, supplemental oxygen at all times during which an aircraft flies above 10 000 feet altitude.

Civil Aviation Order 20.4.4 – Duties of crew members in relation to oxygen and protective breathing equipment also stated that a crew member must check the serviceability of the oxygen system of the aircraft prior to take-off.

The pilot reported checking the oxygen system pressure but did not complete a full oxygen system check prior to the flight, as they were not expecting to use the system. No oxygen masks were supplied on the aircraft, however, the pilot kept a personal mask in their flight bag. A post‑incident inspection was conducted by the Civil Aviation Safety Authority on the aircraft, in particular, the oxygen system, with no defects found.

The pilot reported that they started using oxygen about 5-10 minutes after receiving the ATC clearance to climb to FL 110. After this, the pilot was taking a ‘sniff’ of oxygen on and off for a total of about 15-20 minutes while maintaining FL 110.

Speech analysis

The ATSB conducted a speech analysis on the pilot’s radio transmissions to determine if the pilot was experiencing hypoxia. The pilot’s response times, delay between mic‑keying and speaking, their average speech rate, their voice pitch, their mic un-keying delay, and the duration to annunciate the aircraft’s call-sign were analysed.

The speech analysis found that these aspects were all affected above 10,000 ft. However, the ATSB was unable to confirm if the pilot was hypoxic as the speech characteristics may have been influenced by other factors.

Dehydration

The pilot reported possibly being dehydrated after drinking minimal amounts of water throughout the day, having only consumed about 500 ml, and not having the need to go to the toilet from the time they first arrived at Cairns to later that night after 2000. Dehydration is caused by excessive water loss and can result from not drinking enough water (Flight Safety Foundation, 2001). A symptom of dehydration includes fatigue.

Medical advice

The ATSB engaged an aviation medical specialist to determine if the pilot was suffering from hypoxia. The specialist concluded that the intermittent use of supplemental oxygen would not have been sufficient to offset the cumulative effects of hypoxia. Despite this, while a degree of hypoxia was likely, this would not have resulted in a loss of consciousness when operating at FL 110. It was more plausible that the pilot fell asleep. This was likely to due to acute and chronic fatigue from the sleep issues described by the pilot, and inadequate fluid intake and diet.

Similar occurrences

ATSB investigation (AO-2018-075)

On 8 November 2018, a Piper PA-31-350 was being used for a freight flight from Devonport to King Island, Tasmania. During the flight, the pilot fell asleep and overflew their destination with the autopilot engaged. About 78 km past the intended destination of King Island Airport, the pilot awoke and manoeuvred the aircraft back to King Island. The investigation concluded that the pilot was very likely acutely fatigued to a level affecting performance, predominately due to the lack of recent sleep and hours awake. Although there was opportunity, the pilot did not plan or obtain sleep prior to commencing the night shift.

ATSB investigation (AO-2013-155)

On 1 September 2013, the pilot of a Cessna 210 aircraft was conducting a private flight from Port Macquarie to Bankstown, New South Wales. Prior to the flight, the pilot reported feeling a little tired and unwell. During cruise, the aircraft entered controlled airspace above Williamtown without a clearance. Air traffic control tried to contact the pilot, but no response was received. At that time, an uncertainty phase was declared, and ATC again attempted to contact the pilot. About 20 minutes later, the pilot recalled waking up. Believing they may have fallen asleep, the pilot checked the aircraft’s instruments to determine their location. The pilot then realised they had entered controlled airspace without a clearance twice. In a state of shock, the pilot decided to descend the aircraft to 2,500 ft to regain the original flight plan track. They continued the flight to Bankstown without further incident.

Safety analysis

Use of supplemental oxygen

After departing Cairns for Redcliffe, the pilot was initially intending to operate at 10,000 ft but climbed to FL 110 due to weather. In which case, the pilot was always required to use supplemental oxygen. However, the pilot reported only using oxygen intermittently during the flight. According to the ATSB’s medical specialist, the occasional use would not have been sufficient to offset any cumulative effects of hypoxia.  

Fatigue and mild hypoxia

While en route, the pilot became unresponsive for about 40 minutes and flew past their destination. The pilot reported falling asleep, although they only felt slightly tired, and suspected the warm cockpit environment might have been contributed this. However, a sleep history review indicated that it was likely that the pilot was experiencing chronic fatigue due to their reported inadequate sleep the night before and disturbed sleep over an extended period leading up to the incident. Most people generally require 7-8 hours of sleep to achieve a maximum amount of alertness and performance. Inadequate sleep can result in sleep debt, which is the difference between the amount of sleep you should be getting, and the amount acquired below that. Sleep debt can be cumulative and can result in degraded performance and uncontrolled sleep episodes (Orlady & Orlady, 1999, Hawkins, 1993).

It was also reported that the pilot sounded ‘groggy’ and did not seem to comprehend ATC instructions when communications were restored. While they did gradually improve with time, this suggested that the pilot may have been experiencing sleep inertia. When awakening from a deep sleep, an individual will typically feel the effects of sleep inertia including sleepiness, disorientation and impaired cognitive performance. These effects can last for 5 minutes or up to 30 minutes, with impaired performance for over an hour if an individual is abruptly awoken. It has been found that the effects of sleep inertia can be greater with sleep deprivation and restriction (Groeger et al., 2011, Hilditch & McHill, 2019).

In addition, the influence of operating at FL 110 while only intermittently using supplementary oxygen was also considered. Research has shown that hypoxia at FL 120 can increase fatigue and reduce vigour. Further, although a common symptom of hypoxia is loss of consciousness, it is not typical for someone experiencing hypoxia to regain conscious, while still operating at the same altitude and without additional oxygen. Therefore, from the information obtained by the medical specialist and from studies conducted on mild hypoxia at moderate altitudes, the ATSB determined that it was unlikely that the pilot had lost consciousness solely due to mild hypoxia. Rather, the pilot had fallen asleep likely due to a combination of fatigue and mild hypoxia, possibly exacerbated by dehydration and diet.

Findings

From the evidence available, the following findings are made with respect to the pilot incapacitation involving a Cessna 208B, registered VH-DQP that occurred 56 km west-north-west of Sunshine Coast Airport, Queensland, on 2 July 2020.

Contributing factors

• The pilot did not appropriately use the supplemental oxygen system while operating at flight level 110, likely resulting in mild hypoxia.
• During the flight, the pilot’s ability to remain awake was likely reduced by a combination of fatigue and mild hypoxia.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• the pilot
• Airservices Australia
• Royal Australian Air Force Institute of Aviation Medicine
• the Civil Aviation Safety Authority.

References

Bouak, F., Vartanian, O., Hofer, K., & Cheung, B. (2018). Acute mild hypoxic hypoxia effects on cognitive and simulated aircraft pilot performance. Aerospace Medicine and Human Performance, 89(6), 526-535. doi: 10.3357/AMHP.5022.2018

Campbell, R.D., Bagshaw, M. (2002). The Basics of Flight Physiology. Human Performance and Limitations in Aviation. (3rd ed., pp. 11-38). Blackwell Science.

Flight Safety Foundation. (2001). Dehydration Presents Unique Risks for Pilots. Human Factors and Aviation Medicine, 48(4):1-6. Retrieved from https://flightsafety.org/hf/hf_jul-aug01.pdf

Groeger, J.A., Lo, J.C.Y., Burns, C.G., Dijk, D.J. (2011). Effects of Sleep Inertia After Daytime Naps Vary With Executive Load and Time of Day. Behavioural Neuroscience 125(2), 252-260. doi: 10.1037/a0022692

Hawkins, F.H. (1993). Fatigue, Body Rhythms and Sleep. In H.W. Orlady (Eds.), Human Factors in Flight (2nd ed., pp. 56-83). Ashgate.

Hliditch, C.J., & McHill, A.W. (2019). Sleep inertia: current insights. Nature and Science of Sleep 11, 155-165. doi: 10.2147/NSS.S188911

International Civil Aviation Organization. (2012). Doc 8984 Manual of Civil Aviation Medicine (3rd ed.). Retrieved from https://www.skybrary.aero/bookshelf/books/2242.pdf

Legg, S.J., Gilbey, A., Hill, S., Dubray, A., Iremonger, G. & Mündel, T. (2015). Effects of mild hypoxia in aviation on mood and complex cognition. Applied Ergonomics 53(2016), 357-363. doi: 10.1016/j.apergo.2015.10.002

Nethus, T.E., Rush, L.L. & Wreggit, S.S. (1997). Effects of Mild Hypoxia on Pilot Performances at General Aviation Altitudes. Federal Aviation Administration. https://www.tc.faa.gov/its/worldpac/techrpt/AM97-9.pdf

Orlady, H.W., & Orlady, L.M. (1999). Human Factors in Multi-Crew Flight Operations. Ashgate.

Skybrary. (2019). Hypoxia. Retrieved from https://www.skybrary.aero/index.php/Hypoxia

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

 __________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours. 
2.  Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR).
3.  Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 110 equates to 11,000 ft.
4. An emergency phase declared by the ATC when e uncertainty exists as to the safety of an aircraft and its occupants.
5. Traffic alert and collision avoidance system (TCAS): a type of airborne collision avoidance system (ACAS).
6.  An emergency phase declared by the ATC when there is reasonable certainty that an aircraft and its occupants are threatened by grave and imminent danger or require immediate assistance.

Executive summary

What happened

On 4 July 2020, a Robinson Helicopter Company R44 Raven I helicopter, registered VH-NBY and operated on a private flight, departed an industrial property 3 km north of Broome Airport, Western Australia on a local flight. On board were the pilot and 3 passengers.

The pilot made a vertical departure to climb clear of obstacles before transitioning forwards. At that time witnesses heard a loud bang, and the empennage and tail rotor system of the helicopter broke away. The helicopter initially continued to climb and rotated to the right with increasing angular velocity.

Control of the helicopter was then lost, and it collided with terrain on its right side in a nose low attitude. The pilot and a passenger seated on the right side of the helicopter were fatally injured and the two passengers on the left side were seriously injured. The helicopter was destroyed.

What the ATSB found

Following the onset of vibration in the tail rotor pedals, an overstress fracture of the attachment lugs of the tail rotor gearbox input cartridge occurred. The source of the loading that led to the overstress fracture was not conclusively determined however, shortly after take-off, it led to separation of the tail rotor gearbox from the helicopter. This in turn led to fracture of the aft tail cone bulkhead and separation of all components attached to it, including the horizontal and vertical stabilisers.

Although presented with limited time and the stress associated with the emergency event, the pilot did not apply the pilot’s operating handbook procedure for responding to a tail rotor emergency. Prompt application of the procedure would have reduced the likelihood of loss of control, and therefore improved the potential for survivability. The pilot’s response may have been influenced by them not having a valid flight review for the helicopter type at the time of the accident.

Following identification of the vibration during the previous 2 flights, ground running of the helicopter was conducted by maintenance personnel, with no fault identified. However, as the vibration was reported to only occur in flight, and no defect was identified, it was reasonable to have concluded that the problem may still be present. As such, the safest next step (recommended by the helicopter manufacturer) was the conduct of a graduated flight check by a solo pilot. However, the next and final flight involved the conduct of a high‑power towering take-off from a confined area with 3 passengers on board.

The unnecessary carriage of passengers resulted in a significantly more severe outcome following the in‑flight break‑up.

Safety message

The pilot’s operating handbook for this helicopter stated that the onset of unusual vibrations can indicate impending failure of a critical component. Pilots should land as soon as possible and formally declare the helicopter unserviceable. Crucially, the helicopter should not be returned to service until the source of the vibration, both on the ground and airborne, has been found and rectified.

The registered operator of an aircraft has ultimate responsibility for its airworthiness. This accident demonstrates the importance of following a conservative troubleshooting process that minimises risk. The tools to manage airworthiness are freely published by the Civil Aviation Safety Authority and include the correct use of an aircraft’s maintenance release to clearly communicate the state of the aircraft and any required maintenance action.

Finally, private pilots do not have the benefit of regular flying and frequent training and checking afforded to commercial pilots. Therefore it is recommended that private pilots do not rely on minimum training and checking and currency to keep them safe. Instead they are encouraged to assess their risk profile and seek opportunities to maintain and develop their skills with a flight instructor.

 

The occurrence

Overview

At about 1436 local time on 4 July 2020, a Robinson Helicopter Company R44 Raven I helicopter, registered VH-NBY and owned and operated by a private pilot, departed an industrial property in Bilingurr, a northern suburb of Broome, Western Australia on a local flight. On board were the pilot and 3 passengers.

The pilot made a vertical departure to climb clear of obstacles before transitioning forwards. At that time witnesses heard a loud bang, and the empennage and tail rotor system of the helicopter broke away. The helicopter initially continued to climb and rotated to the right with increasing angular velocity.

Control of the helicopter was then lost, and it collided with terrain on its right side in a nose low attitude. The pilot and a child seated on the right side of the helicopter were fatally injured. An adult and a child seated on the left side were seriously injured. The helicopter was destroyed.

Detection of vibration

On 22 June 2020, VH-NBY was repositioned from the industrial site to Broome Airport, about 3 km to the south, by another helicopter pilot. During that approximately 6 minute flight, the pilot noticed a vibration in the tail rotor pedals which they described as ‘tapping with spoons’, adding that the sensation was noticeable but not strong. Upon landing, the pilot advised the owner of the aircraft (accident pilot) about the vibration. This was the first report of such vibration in this helicopter.

On the afternoon of 2 July 2020, the owner of the helicopter met a friend at Broome Airport. The owner flew VH-NBY indirectly back to the industrial site; the flight took around 18 minutes. During that flight, the owner sent a text message to the other pilot confirming that the helicopter had a problem.

Upon landing, further discussion about the vibration took place between the 2 pilots. It was reported that they were both concerned about the vibration, and that the owner described the vibration as roughness through the tail rotor pedals. Another person familiar with the reported vibration stated that the owner of the helicopter believed the vibration indicated a tail rotor balance problem. They said it was thought to be due to excessive application of paint to the leading edges near the tips of the tail rotor blades[1] at the previous 100 hourly scheduled maintenance inspection, around 4 flight hours prior. The owner requested the other pilot to contact their local approved maintenance organisation (AMO) to assess the vibration.

The AMO advised that the vibration was described to them not as tapping with spoons, but as ‘jackhammers’. It could not be determined if this change in description was due to a variation in pilot detection thresholds, worsening of the condition, or for emphasis.

Engineering actions

Maintenance troubleshooting

On the morning of 3 July 2020, the helicopter was due to be delivered to the AMO’s hangar at a nearby station. However, no pilots were available to relocate the helicopter, so the engineers attended the industrial site where the helicopter was located.

The chief engineer was the attending licenced aircraft maintenance engineer (LAME). The engineers reported that a review of maintenance records during preparation for the job identified that VH-NBY’s tail rotor blades had not been painted at the previous 100 hourly inspection, rather they were painted about 50 flight hours prior to that.

The planned maintenance activity was to measure and, if necessary, correct the dynamic balance of the tail rotor.

Witnesses stated that at around 1500 the engineering team, consisting of the owner of the AMO (a pilot), the chief engineer LAME, and an apprentice aircraft maintenance engineer (AME), arrived on site. The worksheet for the job stated, ‘Pilot reported tail rotor vibe’.

The owner of VH-NBY was also on-site when the AMO pilot and engineers arrived. They spoke briefly and the AMO pilot stated that they advised their intended course of action was to rub back the paint and measure dynamic balance of the tail rotor. The owner departed shortly after.

The team completed a daily inspection of the helicopter, including a close inspection of the tail cone, tail rotor, and empennage of the helicopter. This included searching for signs of damage, and/or movement or fretting in the aft flex plate, and all rivets and component attachment hardware. No issues were detected. The engineers then attached the electronic vibration monitoring equipment, and the AMO pilot operated the helicopter at flight rotor rpm on the ground. The tail rotor balance was confirmed to be well within limits.

The LAME reported that they then used fine grit sandpaper to make a cosmetic correction to the paint which had been previously applied to protect the leading-edge tips of the tail rotor blades. The dynamic balance of the tail rotor was measured again and found to be well within limits.

The AMO pilot reported that no vibrations were felt in the tail rotor pedals while the helicopter was operating. Additionally, the LAME leaned into the cabin and placed their hands on the tail rotor pedals and was unable to detect the described vibration. The AME also felt the tail skid, [2] attached to the bottom of the vertical fin, but did not detect any excessive vibration.

Requirement for further diagnosis

The troubleshooting identified to the AMO engineering team that it was highly unlikely the tail rotor balance was a potential source of the reported vibration. The electronic vibration monitoring equipment was removed from the helicopter. The LAME reported wanting someone to fly the helicopter as they wanted to determine if the reported vibration in the pedals was detectable in flight.

The AMO pilot elected not to hover or fly the helicopter in the industrial site as they felt that it was too confined and were concerned about foreign object damage if they hovered the helicopter. The site owner stated that they could have made the area safe for a test flight if they had been requested to do so.

The LAME advised that the test regime they wanted a pilot to apply was:

• hold the helicopter light on the skids, and check for vibration
• then if necessary, hover the helicopter and check for vibration
• then if necessary, fly the helicopter, and check for vibration.

The LAME completed the work pack, closing the job, and added a note that said:

Carried out tail rotor balance check. Found to be 0.05ips. No adjustments made. Nil defect found. Owner was notified flight check to be carried out. 

The LAME stated that they passed the requirement for a maintenance check flight to the owner of the AMO. The owner of the AMO stated that they in turn advised both the owner and the pilot who first detected the vibration of the findings, of the requirement to fly the helicopter to provide more information.

The requirement for a maintenance check flight was not recorded on the helicopter’s maintenance release.

Post‑maintenance communication

The AMO engineering team stated that, as there was a fault reported, but no fault found during ground running, that a maintenance check flight was necessary to continue the troubleshooting to provide more information.

While still on-site with the helicopter, telephone records showed that the owner of the AMO called the pilot who first reported the vibration at 1530. The call lasted about 4 minutes. The owner of the AMO reported that during this call the pilot was advised that the tail rotor balance was good and that a pilot was needed to fly the helicopter. The pilot was unable to fly the helicopter that afternoon, however reported being told that the helicopter was ‘good to go’ and said there was no mention of a check flight requirement.

Immediately after that call, the owner of the AMO called the owner of the helicopter. They spoke for about 3 minutes. The owner of the AMO stated that during this call they advised the owner of the helicopter that the tail rotor balance was good, the engineers did not find anything wrong, and that a maintenance check flight was required. The owner of the AMO reported that the owner of the helicopter was also unavailable to fly the helicopter.

The owner of the AMO stated that they then intended to meet the first pilot in person to discuss the vibration issue, however they could not locate them, and was unable to contact them by phone again.

With respect to verbal notification of the requirement of a maintenance check flight for further diagnosis, there were differing accounts of whether this was communicated to the owner of the helicopter. A friend of the owner of the helicopter, who overheard the call on car speakerphone, agreed that the owner was told there was nothing wrong with the balance of the tail rotor, but disagreed with mention of the need for a maintenance flight.

Accident flight

The helicopter’s next flight was the accident flight on the afternoon of 4 July 2020. The flight was conducted as a private operation under the visual flight rules. The helicopter was configured with the front doors removed and rear doors installed.

The owner of VH-NBY had accommodation at the site and was familiar with the industrial location. Nearby buildings, high fences, vehicles, and trees necessitated a vertical departure. The prevailing easterly wind at around 10 kt favoured a departure over unoccupied ground.

The pilot started the helicopter at about 1428. The pilot then loaded 2 children and an adult into the helicopter. Due to the helicopter landing site being located within Class D airspace for Broome Airport, the pilot was required to obtain a clearance from air traffic control (ATC) to depart from the site. At 1434, the pilot contacted Broome ATC and received a clearance to depart the site. At about 1436, the pilot made an airborne call to ATC.

There were 4 witnesses at the industrial site at the time the helicopter took off (Figure 1). Their accounts of the departure varied between the pilot holding a low hover for a few seconds before conducting a steep departure, and the pilot making a steep departure directly from the ground without a hover.

Figure 1: Location of witnesses

Source: ATSB

Witnesses familiar with this departure process stated that nothing appeared out of the ordinary, the engine sounded normal and the helicopter climbed as expected. None of the witnesses saw or heard the helicopter make contact with any obstacles or foreign objects, or observed any items leave the cabin of the helicopter.

Nearby witnesses described hearing a bang as the helicopter reached an estimated height of about 55 ft. One witness described the sound as like a ‘metal bar hitting a metal pole’. Recordings from closed circuit television (CCTV) nearby showed a rearward movement of the upper vertical fin, and the helicopter nose pitch up, followed by parts releasing from the tail section. The empennage, tail rotor gearbox and surrounding components separated and tumbled from their attachments at the rear of the tail cone. A small section of one tail rotor blade was also identified in the security vision departing from the helicopter.

The helicopter continued climbing to about 75 ft while rotating twice to the right with increasing angular velocity, before rolling and descending rapidly toward the ground. The helicopter impacted heavily onto a road surface, about 30 m from the departure point (Figure 2). Calculations from a security camera recording showed that the duration from the first moment of the disturbance of the vertical fin to a total loss of control of the helicopter, was about 2.7 seconds.

The helicopter struck the road surface predominantly on its right side and in a nose-low attitude. The pilot, and a passenger, both seated on the right side of the helicopter were fatally injured. The front and rear left seat passengers were seriously injured. The helicopter was destroyed.

Figure 2: Location of aircraft and components following in-flight break-up

Source: ATSB

Post-impact events

Witnesses and neighbours were able to reach the occupants and begin recovery within seconds of the event. A forklift was used to lift the fuselage by the mast fairing to allow access to the right side of the passenger compartment. Australian Defence Force personnel and Western Australia Police Force officers were also nearby and quickly conducted triage and treatment prior to fire and ambulance services arriving.

The helicopter was fitted with fuel tank bladders. Although a bladder had punctured as a result of the impact, and fuel had subsequently leaked, there was no post-accident fire. Aviation Rescue Fire Fighting Service and Department of Fire and Emergency Services units were deployed to the accident site and together contained the fuel spill and fire risk.

The police, with assistance from the State Emergency Service (SES), closed the street. Police officers from the forensic crash unit documented the accident site and maintained the integrity of the scene until the ATSB arrived. Police and SES personnel protected the accident site for the duration of ATSB’s on-site activities.

Context

Pilot information

Licence

The pilot attained a Private Pilot Licence (Helicopter) PPL(H) in May 2015 and held an endorsement for the Robinson R44 helicopter. To exercise the privileges of this flight crew licence, a pilot is required to have a current aviation medical certificate and helicopter flight review (HFR). A logbook for the pilot was not able to be located, however a family member estimated the pilot’s total flying experience to range between 1,200 and 1,500 flight hours.

Medical

The pilot had previously held a Class 2 aviation medical certificate, however that certificate expired on 9 March 2019, and had not been renewed. A review of the pilot’s post-mortem report found no evident natural disease.

Toxicology results showed a 0.012% urine alcohol concentration and zero blood alcohol concentration. The pathologist that conducted the autopsy indicated this was probably from consumption, although a possibility of post-mortem alcohol production also existed.[3] Furthermore, the pathologist considered the low level of alcohol in the urine to be toxicologically insignificant as there was zero alcohol detected in the blood.

Flight review

An HFR is an opportunity for pilots to practice in-flight emergencies with an instructor and to demonstrate the required competence to safely operate a helicopter. HFRs for private pilots have a validity of 2 years. In discussing the aim of a flight review, the Civil Aviation Safety Authority (CASA) published Civil Aviation Advisory Publication (CAAP) 5.81-01 - Flight crew licensing flight reviews, which stated:

Commercial Pilot Licence (CPL) and Air Transport Pilot Licence (ATPL) holders are often part of a system that involves some form of training and checking, whereas the average private pilot is not. With the passage of time and lack of practice some skills and knowledge can degrade. A flight review affords the opportunity to restore these degraded skills and gain new knowledge.
 

The flight review must be seen in the context of a broader aviation safety philosophy. The flight review, although important (and required by legislation), is one process that contributes to continuing pilot proficiency and consequently the safety of flight. A flight review every two years does not, in itself, ensure safety. Safety is achieved when each pilot takes responsibility for a continuing process of hazard identification and risk management for their own aviation activities. 

The Civil Aviation Safety Authority (CASA) required, via document CASA 007/17,[4] that HFRs for Robinson helicopters were to be conducted in Robinson helicopters. The pilot’s last HFR in a Robinson helicopter was a flight of 1.9 hours on 20 November 2017. That HFR expired 20 November 2019.

Following endorsement on a Bell 505 in the United States (US), to validate the endorsement in Australia, the pilot undertook an HFR in a Bell 505 on 31 May 2018. The validity of that HFR was extended to 1 December 2020 by CASA’s COVID management process through EX5720.

While the pilot of VH-NBY had a valid review for other types, in accordance with CASA 007/17(8), they did not have a valid HFR for the Robinson R44 at the time of the accident.

Endorsements

The pilot began a low-level endorsement in October 2018, which was not completed. An external load rating was not conducted or issued at any point.

Despite not having obtained the qualifications required to conduct these activities, the ATSB identified that the pilot had previously performed low‑level flight and external load work.

Training in tail rotor emergencies

The pilot completed PPL(H) training with 74.8 hours of flight time. Despite being required to demonstrate competence in emergencies, including tail rotor failures, to pass a licence test, the pilot’s student progress checklists did not record tail rotor emergencies (failure in forward flight and hover) being briefed or taught. However, on 6 May 2015 the pilot undertook a flight test and tail rotor malfunctions were recorded as tested and passed.

At the time of the accident the pilot had last conducted tail rotor emergencies in a helicopter 2 years and 2 months prior and had not conducted tail rotor emergencies in a Robinson Helicopter for 2 years and 8 months.

Helicopter information

General information

The Robinson Helicopter Company R44 Raven I is a 4‑place, light helicopter, powered by a Lycoming O-540-F1B5, 6-cylinder, horizontally-opposed piston engine. It has a 2‑bladed main rotor system and a conventional 2‑bladed tail rotor.

The R44 helicopter type was approved by the US Federal Aviation Authority (FAA) on 10 December 1992 and approved in Australia on the basis of that certification in 1994. The R44 Raven I was introduced in January 2000.

At the time of the accident, there were 558 R44s on the Australian civil aircraft register. Total R44 helicopters production was around 7,100 helicopters. Together, the worldwide R44 fleet had flown an estimated 17.7 million flight hours.

The tail rotor pedals of the R44 are connected to the tail rotor through a series of bellcranks and push-pull tubes (Figure 3). That is, a continuous physical linkage. Therefore any dynamic movement, such as vibration, associated with the tail rotor system would be transmitted to the pedals.

Figure 3: R44 tail rotor control system

Source: Robinson Helicopter Company, annotated by ATSB

VH-NBY maintenance history

The R44 Raven I helicopter involved in the accident, serial number 2544, was built in May 2018 in the US. It was test flown, then disassembled and shipped to a distributor in Australia by the manufacturer. On 11 September 2018 the helicopter was reassembled by a Robinson Helicopter Company distributor in Queensland and placed on the Australian register as VH-NBY.

Maintenance conducted on VH-NBY is detailed in Table 1.

Table 1: VH-NBY maintenance history

Date	Maintenance	Total time	Notes
30 May 2018	Built at RHC	0.0	Serial number #2544
11 September 2018	Re-assembled in Australia	4.0	Issued certificate of airworthiness on 12 September 2018
28 March 2019	SB-96	46.70	SB-96 Change clutch actuator time delay assembly
13 May 2019	100 hourly inspection	88.62	Nil issues
20 July 2019	100 hourly inspection SB-99	186.41	SB-99 Battery Electrolyte leakage
29 July 2019	Cargo hook installation	195.03	Onboard Systems Cargo Hook fitted
After 25 August 2019	MR blade repair	224.6	Probably due to main rotor bird strike. Large bird (brown booby) No documentation of inspection or repair in logbooks or maintenance releases Evidence of paint on blade tip in location of damage
9 October 2019	100 hourly inspection	248.80	Removed emergency locator transmitter Cylinder head temperature probe replaced TR blade tips painted and balanced to below 0.2 ips
Around 24 November 2019	Inspection panel replaced	Not recorded	Oil filler access panel cracked at hinge replaced under warranty No evidence of inspection or repair in logbooks or maintenance releases
24 January 2020	Front right bubble replaced	262.35	Bubble cracked by unrestrained front door on ground Replacement recorded on maintenance release by engineer
4 June 2020	100 hourly inspection 300 hourly inspection SB-103	286.90	Number 2 cylinder changed due to compression loss SB-103 MR tip plates complied with (95 days overdue)
24 June 2020	Hard wired Spidertracks tracking system	Not recorded	Carried out fault finding to aircraft tracking device. Replaced damaged wiring
3 July 2020	Pedal vibration inspection	291.00	Tail rotor paint lightly sanded  Tail rotor balance checked Recorded vibration 0.05 ips

Sources: VH-NBY maintenance logbooks, interviews, Western Australia Police Force

Tail rotor blade refinishing

Most areas of Australia present harsh conditions for operation of helicopters. Coastal areas have salt laden air, sand, and dust that may erode main rotors and tail rotors at a rate high enough to render components unserviceable before their life-limit[5] is met. Rotor blade erosion damage has potential to significantly increase the operating costs of helicopters. To combat this, refinishing the tips of Robinson Helicopter tail rotor blades is common practice in Australia (Figure 4).

The R44 maintenance manual allowed for repaint of tail rotor blades where erosion exists. Section 30-00 of the manual stated:

The tail rotor blades are constructed with aluminium skins and root fittings. Maintaining the paint finish will reduce corrosion and erosion.

Section 30-36 carried instructions for painting the tail rotor. Adding paint to the blade tips adds weight that could upset the balance of the tail rotor. Therefore, following painting, the balance of a tail rotor was required to be checked and adjusted if necessary.

The tail rotor blades on VH-NBY were last refinished on 9 October 2019 and the balance was found to be within limits.

Figure 4: Refinished area of tail rotor blades (Paint transfer and damage due to accident)

Source: ATSB

Maintenance release

An aircraft’s maintenance release (MR) (CASA form 918) is a document used to record and communicate the airworthiness of an aircraft between registered operators, pilots, and engineers. It included a section (Part 2) for defects to be recorded (and cleared), and a section (Part 3) to record daily inspections and flight hours.

Part 2

A person with knowledge of a defect is required to record the defect in part 2 of the MR. This would cause the MR to cease to be in force and serve as a notice to pilots and engineers that the aircraft is not to be flown until the defect is resolved. Following the detection of vibration during the flight conducted on 22 June 2020, no defect was recorded on the MR.

When a defect was endorsed, resulting in the MR ceasing to be in force, a qualified person would have to declare the defect resolved in Part 2, to restore the airworthy status of the aircraft. This can include restoration of airworthiness after a successful maintenance check flight.

A requirement for a maintenance check flight following 100‑hourly maintenance on 4 June 2020 was endorsed on the MR. This endorsement was cleared by conducting the flight and finding no defects. While the requirement for a maintenance check flight following the tail rotor balance check of 3 July was written on the approved maintenance organisation’s (AMO) work pack, it was not annotated on the helicopter’s MR.

Part 3

Part 3 of the MR required certification of the daily inspection by a qualified person[6] prior to flight, and the recording of flight hours to manage the ongoing maintenance requirements of the aircraft. If the daily inspection had not been certified, the aircraft must not be flown.

Part 3 of VH-NBY’s MR was incomplete. The only flight recorded was the maintenance check flight of 4 June 2020. The helicopter was flown on 4 separate days after that date, with only one daily inspection being recorded. This does not necessarily indicate that daily inspections were not conducted. For example, the owner of VH-NBY was photographed checking the oil level of VH-NBY on 2 July 2020. This was part of the daily inspection for this helicopter. However, due to the lack of documentation, the extent to which the helicopter was inspected on these dates could not be determined.

No flight time was recorded for any of these 4 flights; however the helicopter was fitted with an hour meter which recorded flight time.

Pilot’s operating handbook advice on vibration

In the safety tips and notices section of the Robinson R44 pilot’s operating handbook (POH), there was advice on vibration and checking for resolution of a problem. It stated:

7. A change in the sound or vibration of the helicopter may indicate an impending failure of a critical component. If unusual sound or vibration begins in flight, make a safe landing and have the aircraft thoroughly inspected before flight is resumed. Hover helicopter close to the ground to verify the problem is resolved, and then have aircraft reinspected before resuming free flight.

The following tail rotor driveshaft failure in the United Kingdom (UK) in 2003 demonstrated the success of this staged approach in a situation whereby the source of vibration was not as expected and could not be identified on the ground.

Robinson R44 Clipper, G-KAZZ, tail rotor driveshaft failure, UK, 2003

The helicopter was being flown to Sywell for a 50 hour maintenance inspection when it developed a lateral vibration with a frequency coincident with main rotor rotation. It was able to land successfully at Sywell where the main rotor drive system was examined. As no apparent problems were identified an engineering test flight was carried out to see if the vibration event could be replicated. Normal handling failed to reproduce the event so a towering climb from the hover was initiated. This produced worsening vibration levels, an increase in engine manifold pressure, and difficulties in yaw control necessitating an immediate descent and landing. After landing it was discovered that the tail rotor was not rotating. An inspection of the tail rotor drive system revealed a failure of the tail rotor drive shaft aft of the whirl mode damper bearing. The subsequent AAIB [Air Accidents Investigation Branch] investigation could not find any evidence to explain the cause of the failure….
 

The decision to carry out a test flight however, given the circumstances, was considered to be the normal course of action to take when troubleshooting a defect of this kind. The engineers had already undertaken a full inspection and testing on the ground of the main rotor system, with no defect detected. They continued testing the helicopter in a logical manner and were fully aware of the implications of undertaking a test flight. The quick reaction of the test pilot following the onset of the failure kept the situation under control, no one was injured and the helicopter suffered only minor damage.

Controllability

Centre of Gravity

The components lost in flight had a direct effect on controllability of the helicopter. Along with the obvious loss in primary yaw control, a significant change of centre of gravity occurred (Figure 5).

The ATSB recovered almost all of the components that had separated from the rear of the helicopter. These components weighed 17.7 kg. A weight and balance calculation used 18 kg to account for some missing fragments, and oil from the tail rotor gearbox.

As fuel leaked from the wreckage and no fuel records were kept, it was not possible to determine exactly how much fuel was onboard VH-NBY for departure. However, with full fuel the helicopter would have been below the maximum allowable all-up weight. The minimum required flight fuel was calculated to be 34 L. This was based on a 10 minute flight with 20 minutes of reserve and 4 L of unusable fuel. The actual fuel load was probably higher as 30 L of fuel was drained from the wreckage and an unknown, but substantial, quantity of fuel was released post‑accident.

While there was a large shift forward in centre of gravity it is highly likely that VH‑NBY’s centre of gravity remained within limits following the in-flight break-up (Figure 5).

Figure 5: Centre of gravity calculations

Source: Robinson Helicopter Company, annotated by the ATSB

Emergency procedure

R44 POH

Loss of the empennage of the helicopter is an extreme event, causing significant disruption to the controllability of the helicopter. The helicopter’s POH includes information on handling a loss of tail rotor thrust. The manufacturer confirmed that symptoms of this occurrence are nearly identical to a loss of tail rotor thrust.

The POH stated:

LOSS OF TAIL ROTOR THRUST IN FORWARD FLIGHT

Failure is usually indicated by nose right yaw which cannot be corrected by applying left pedal.

1. Immediately enter autorotation

2. Maintain at least 70 KIAS if practical

3. Select landing site, roll throttle off into overtravel spring, and perform autorotation landing.

LOSS OF TAIL ROTOR THRUST IN HOVER
Failure is usually indicated by nose right yaw which cannot be stopped by applying left pedal.

1. Immediately roll throttle off into overtravel spring and allow aircraft to settle
2. Raise collective just before touchdown to cushion landing.

Energy available for engine off landing

The energy to successfully land a helicopter in an engine off situation comes from a combination of available potential and kinetic energy in the form of height, forward speed and rotor RPM. A pilot can utilise that energy to maintain drive to the main rotor and create lift.

As shown in Figure 6, at the time the empennage and tail rotor system detached the helicopter was being operated within the R44 height/velocity diagrams ‘avoid’ area. In practice, this meant that there was probably insufficient total energy to be able to conduct the required power‑off landing without damaging the helicopter.

 

Figure 6: R44 Raven I height / velocity diagram

 Source: Robinson Helicopter Company, annotated by the ATSB 

Site and wreckage information

Location

The industrial site at Bilingurr contained private residences, a hangar, and a large shed. The fenced property provided storage for assets of an associated business. The effect of COVID-19 restrictions meant that more equipment than normal was stored in Bilingurr (Figure 7). As a result, the site was more confined than usual, presenting an increased risk for helicopter operations.

The site at Bilingurr was used as the home base for the helicopter and partly intended for use for the arrival or departure of helicopters (Figure 8). The operator stated that the site was operated as a basic helicopter landing site (HLS)[7]. However, helicopters had been used at the site for at least 4 years. The CASA civil aviation advisory publication (CAAP) 92(2)[8] detailed guidelines and provided advice for development and operation of helicopter landing sites. The site did not meet the guidance of CAAP 92(2) with respect to arrival and departure profiles, nor was it required to do so.

Figure 7: Bilingurr site equipment storage

Source: Google Earth, annotated by the ATSB

Figure 8: Helicopter landing site at the industrial site in Bilingurr

Source: Supplied, annotated by the ATSB

Meteorological information

Weather data recorded by the Bureau of Meteorology showed that at the time of the accident the weather was suitable for helicopter operations. There were clear skies, the temperature was 33º C, and the wind was a south-easterly at about 19 km/h.

Recorded closed‑circuit television imagery

A portion of the flight shortly after take-off and then most of the subsequent break-up sequence was captured on three nearby closed-circuit television (CCTV) security cameras (Figure 9). A fourth CCTV camera at Broome Airport also captured the occurrence. The recordings were of high value to the investigation. Analysis of the recordings identified the break-up sequence and showed that the rotor rpm was operating in its normal range at the time of the accident.

The break-up sequence of events is described in Table 2. Images showing the continuity of the event recorded by the closest cameras are shown in Figure 10.

Figure 9: Nearby CCTV locations and relative fields of view

Source: Google Earth, annotated by the ATSB

Table 2: CCTV timeline of event

Time (seconds)	CCTV 1	CCTV 2	CCTV 3
0.0	Helicopter climbs to around 30 ft at a calculated rate of about 325 ft/min.	Not in frame.	Not in frame.
0.5	Helicopter enters extreme top left of frame.
3.7	Helicopter enters frame.	Helicopter exits frame, not yet rotating.
4.0	Empennage vertical fin rotates top back/bottom forward around its mount. Estimated moment of tail rotor blade contact with fuselage.	All but empennage of helicopter in frame. Section of tail rotor blade enters frame at high speed.	Not in frame.
4.2	Helicopter nose pitches up.	Helicopter nose pitches up.	Section of tail rotor blade enters frame. Helicopter shadow shows helicopter rotating to the right.
4.7	Tail rotor gearbox visible behind stabiliser. Empennage separates.
6.3	Helicopter leaves frame climbing and rotating.
6.7	Helicopter continues climbing and completes a full right rotation. Fuselage rolls about 20° to the left. Estimated moment of loss of control.	Not in frame.	Clear shadow of the helicopter in frame shows completion of first rotation to right.
7.7	Helicopter continues climb and makes a second full right rotation.	Shadow shows second full rotation.
8.1	Helicopter continues to rotate. It rolls and descends before becoming inverted. The main rotor contacts the right skid and both separate.	Helicopter re-enters frame with 90° right roll before becoming inverted.	Helicopter re-enters frame with 90° right roll before becoming inverted, and impacting ground nose low on its right side.

Figure 10: Continuity of the accident sequence on nearby security cameras (CCTV)

Source: Western Australia Police Force, annotated by the ATSB

Wreckage information

All components of the tail section of the helicopter were accounted for and recovered at the accident site. All fastener and assembly hardware was recovered. Most of the components and fragments were found between 0‑36 m to the left of the intended track (Figure 2). There were 4 main wreckage areas comprising the fuselage, tail rotor blade tip, empennage, and tail rotor system, including the tail rotor gearbox (TRGB).

The fuselage lay on its right side and was complete apart from the right skid tube, the outboard half of one main rotor blade, and components from the aft flex-plate back. The tail rotor blade section was found 13 m from the fuselage, slightly to the right along the intended track. The empennage which carried a large section of aft tail cone bulkhead, was left of the intended track at a distance of 30 m from the fuselage. The TRGB and tail rotor system were also left of track, 36 m from the fuselage.

On-site examination showed that the aft tail cone bulkhead had fractured together with the input cartridge lugs, and that the tail rotor blades had struck the empennage and tail cone. To determine the sequence and mechanism of failure, the components were transferred to the ATSB technical facilities in Canberra, Australian Capital Territory for detailed examination.

Flight controls

Inspection of the wreckage confirmed that all components and attaching hardware of the flight controls were present and displayed no pre-accident damage. As such, continuity of all flight controls almost certainly existed prior to the in-flight break-up. Furthermore, following the loss of the empennage and tail rotor system, control of the cyclic, collective and throttle would have remained available to the pilot.

Tail cone

Onsite examination showed that the forward end of the tail cone was securely attached to the fuselage of the helicopter with correct attaching hardware. At the aft end of the tail cone, the skin was cut and torn through from repeated impact and flailing of rotating driveshaft components (Figure 11).

 

Source: ATSB

Aft flex plate

The rear of the tail rotor drive shaft sustained severe rotational contact against the tail cone structure. Inspection confirmed that the attachment hardware between the tail rotor gearbox input yoke, rear flex plate, and tail rotor drive shaft was correctly oriented and all attaching hardware (nuts, bolts, and washers) was assembled in accordance with Robinson requirements.

The fracture surfaces of the flex plate attachment were examined at very high magnifications using a scanning electron microscope (SEM). The fracture surface was comprised of predominantly dimples from micro-void coalescence indicating the fracture was by ductile overstress. There was no evidence of pre-existing fatigue cracking that might have otherwise predisposed the flex plate to premature fracture.

Tail rotor gearbox input yoke

Both arms from the input yoke to the TRGB fractured and separated from the body of the yoke (Figure 12). The fracture surfaces of one of the yoke arms contained distinct progression bands that suggested the component had fractured under cyclic loading. Subsequent optical and SEM examination of the fracture identified features of cyclic overstress. There was no evidence of fatigue or any other damage that might have indicated the yoke arm fractures occurred prematurely.

It was concluded that the attachment yoke arms had fractured from cyclic bending loads during the break-up sequence.

Figure 12: Tail rotor gearbox input yoke

Source: ATSB

Aft tail cone bulkhead

During the conduct of this investigation, the ATSB was advised of aft tail cone bulkhead fractures caused by impact to the horizontal stabiliser during ground handling in Robinson helicopters. The ATSB made a request of the Australian helicopter industry to provide information on these events (see Appendix B). Received information showed that damage during ground handling was unlikely to be a factor in this occurrence as these incidents produced a different fracture plane, compared with that present in VH‑NBY. Additionally, the associated impact damage typically present on stabiliser surfaces of affected helicopters, was not present on VH‑NBY.

Examination of the aft tail cone bulkhead from VH-NBY showed that it had fractured into several pieces (Figure 13). The primary fracture plane was through the horizontal centre line. All 4 attachment bolts and their threaded inserts[9] had been pulled free of the bolt hole within the casting (Figure 14). The fracture features of the bulkhead attachment bolt holes where the TRGB input cartridge had been mounted, were consistent with tensile overstress. There was some mechanical damage and associated impressions on the mating surfaces, but no evidence of fretting was found on any of the contact surfaces that might have otherwise indicated the bolts had insufficient tension.

SEM examination of the fracture surfaces confirmed a predominantly brittle surface of cleavage facets.[10] Some minor locations showing shrinkage pores[11] and micro-dendritic defects[12] were observed, however, these were limited along the fracture surface and not considered to be contributory to the break-up. The SEM examination confirmed that the cast bulkhead had fractured in a brittle instantaneous manner. There was no evidence identified to indicate the surfaces had been rubbing, nor was there evidence found of any progressive crack mechanism (fatigue) through the structure.

Figure 13: Aft tail cone bulkhead and input cartridge (shown in red)

Source: ATSB

Figure 14: Threaded bolt holes of the aft tail cone bulkhead

Source: ATSB

The interior of the fragmented tail cone structure, which was still attached to the aft tail cone bulkhead section showed curling of the skin and contact marks from rotating contact damage by the flailing drive shaft.

Empennage

The empennage separated following fracture of the aft tail cone bulkhead. There was impact damage on the lower vertical fin from a tail rotor blade strike and the upper fin had ground impact damage following the break-up. The horizontal fin also displayed minor levels of post break-up damage. The bulkhead had fractured horizontally and retained the bolts and a lug from the TRGB input cartridge (Figure 15). The tail skid situated below the lower vertical fin was unmarked.

Figure 15: Empennage

Source: ATSB

Input cartridge examination

The input cartridge is a machined part fitted to connect the TRGB to the aft tail cone bulkhead. It contains 4 lugs designed for bolting to the bulkhead. The examination confirmed that all 4 attachment lugs that abutted against the cast bulkhead had fractured during the accident sequence. Each of the lugs had deformed and twisted across the section, and the hole within each lug was elongated or deformed and a thread profile from the attachment bolts had been impressed within the bore of the holes (Figure 16).

The contact areas of each lug showed no evidence of fretting or wear damage that might suggest the surfaces had been ‘working’ or that the input cartridge had been loose and moving about during service.

The fracture surfaces of each of the 4 lugs were examined in detail using an optical microscope. The surfaces were clean and free of deposits, flat in shape and texturally quite ‘rough’, indicating that the overstress fracture had occurred in a ductile manner. There was the no evidence of beach marks[13] indicative of fatigue fracture.

A secondary zone of about 1.5 mm in depth was present on each fracture surface. A detailed study of the fracture surfaces of all 4 lugs was completed at high magnifications using an SEM. The examination confirmed that all four fracture surfaces were comprised of two regions, a planar ‘flat’ zone and a larger zone of overstress dimples. There was no evidence of crack progression in any of the lugs that might suggest that the input cartridge had contained a metallurgical defect (pre-existing cracking) that would otherwise have led to an increase in net section stresses from operational loads.

Figure 16: Tail rotor input cartridge

Source: Robinson Helicopter Company and ATSB, annotated by the ATSB

Some evidence of micro movement of the fitted components was found on the washer surface facing the cast bulkhead at location 1 (Figure 17). Here, minor fretting and elongation of the washer was observed.

Figure 17: Input cartridge attachment bolt

Source: Robinson Helicopter Company and ATSB, annotated by the ATSB

Tail rotor gearbox and input cartridge manufacturing records

In 2012 the Robinson Helicopter Company changed the aluminium alloy used to manufacture the input cartridge from 2024 T351 to 7075 T7351. The change in material strengthened the input cartridge to improve outcomes in tail rotor strikes. VH-NBY’s tail rotor gearbox input cartridge was made from 7075 T7351 aluminium alloy.

Examination of the manufacturer’s TRGB and input cartridge build and quality records showed that TRGB serial number 8702 was assembled in a lot of 10 units. During the assembly process, the gear tooth contact pattern and backlash were documented by the manufacturer, and no-issues were identified in the records.

The manufacturer also provided the ATSB with component specifications, which the ATSB used in examination of the components from VH-NBY. The input cartridge was sectioned and measured against its design drawing. Measured dimensions of the input cartridge were confirmed to meet the dimensions of the approved design.

Samples of the input cartridge were also destructively sectioned for metallurgical analysis. Both the chemistry and the strength levels of the material comprising the input cartridge were assessed against the material specifications[14] listed in the design drawing. Semi-quantitative chemical analyses showed that the cartridge alloy was consistent with the chemical composition of aluminium alloy 7075, as specified. Hardness testing showed that the cartridge alloy exceeded the specified minimum strength requirements.

In summary, the input cartridge was found to conform to the approved design specifications.

Disassembly of the TRGB

All hardware associated with the TRGB was accounted for, both at the accident site, and again during the ATSB laboratory examination.

The TRGB and input cartridge were x-rayed prior to disassembly and no anomalies were noted. The TRGB exhibited no internal faults, gear meshing errors or evidence of abnormal operation that might have otherwise been contributory to the failure. Additionally, the magnetic chip plug and oil remaining in the TRGB were checked and no debris, metallic or otherwise, was identified.

Disassembly of the TRGB was witnessed by involved parties.[15]

The fastening torque of the bolts joining the input cartridge to the tail rotor gearbox casting was identified to be very low. Additionally, the adjoining lock wire that formed a secondary security to the keep the bolts tensioned and in place had been pulled away from the security hole on to the bolt head (Figure 18). The anodised surface at the interface of the input cartridge to the TRGB displayed no wear to the finished surfaces. The contact surfaces for each of the washers was examined and there was no evidence of significant fretting.

The absence of any significant wear/fretting to these surfaces indicated that the loosening of the bolts probably occurred from a shock/impulse load through the gearbox on separation from the bulkhead casting.

Figure 18: Tail rotor gearbox and input cartridge

Source: ATSB

Tail rotor pitch control

Bending of the pitch rod confirmed that it was intact and remained connected after the separation of the tail rotor gearbox from its connection to the cast bulkhead (Figure 19). Measurements showed that a 120 mm length of the tail rotor pitch control rod (neutral pedal position) had bent around the bulkhead before fracturing at the bell crank rod end.

Fracture surfaces at the rod-end connection to the bell crank were characteristic cup-and-cone that indicated ductile overstress. The tail rotor pitch change rod was severed during the accident sequence from repeated rotating contact damage at the aft flex plate position. Additionally, there were no anomalies detected in the bell crank, pitch control assembly or pitch links.

Figure 19: Pitch control rod

Source: ATSB

Tail rotor system

The TRGB, tail rotor pitch control assembly, and tail rotor hub and blades assembly had separated from the empennage and were situated 36 m away from the main wreckage.

The examination identified that one tail rotor blade had struck the underside of the tail cone (Figure 20), and tail rotor guard, and a prominent hole had been pierced through the bonded tip cap (Figure 21). The other blade had struck the lower vertical fin (Figure 22).

The tail rotor blade skin surrounding the point of fracture for both blades were examined optically and using an SEM. They showed predominantly angular tear ridges[16] and ductile morphological features[17] on the fracture surfaces. There was no evidence of a pre-existing defect such as fatigue, nor were there any anomalies noted with the blade construction.

The skin surrounding the point of fracture was examined optically and using an SEM with predominantly angular tear ridges and ductile morphological features on the fracture surfaces. There was no evidence of a pre-existing defect such as fatigue, nor were there any anomalies noted with the blade construction.

Figure 20: Tail rotor contact with tail cone

Source: ATSB

Figure 21: Tail rotor system (underside view)

Source: ATSB

Figure 22: Tail rotor contact with lower vertical fin

Source: ATSB

Analysis of the break‑up sequence identified that the TRGB was almost certainly separated from the end of the tail cone at the time of tail rotor blade contact with the tail cone, and with the lower vertical fin.

Tail rotor blade deposit analysis

Examination of each tail rotor blade surface at high magnification using a binocular microscope confirmed the presence of the surface deposits, which was further analysed. Exposure of the blade surfaces to ultra-violet light also identified numerous fluorescing substances.

The ATSB consulted the Australian Centre for Genomics at the Australia Museum, and using their supplied DNA test kits, swabbed the blade surfaces and sent the samples to the museum for analysis. The genomic testing reported no evidence of wildlife DNA that might otherwise indicate the surface deposits were from a wildlife strike.

Summary of examination

Examination by the ATSB of the aircraft on-site, of CCTV footage, and laboratory examination of tail section components found that:

• there were no pre-existing defects identified in any of the rotating or static tail section components
• there were no missing fasteners or assembly anomalies
• the TRGB exhibited no evidence of abnormal operation
• the TRGB assembly records showed no abnormalities at the time of manufacture
• the input cartridge was found to conform to all aspects of the Robinson design specifications
• the input cartridge attachment lugs had no evidence of fatigue cracking and had fractured in overstress
• the low fastening torque of the input cartridge was likely a consequence of loads experienced during the in‑flight break-up
• micro movement was found on a washer surface facing the cast bulkhead
• there was no evidence that the tail rotor blades had been subject to a wildlife strike.

Previous occurrences

Worldwide Robinson R44 fleet

The ATSB analysed worldwide accident data to identify previous occurrences involving loss of the empennage and/or TRGB. That review identified 8 accidents that bore similar post-accident damage signatures to the in‑flight break-up of VH-NBY. The ATSB received valuable support from the Flight Safety Foundation’s Aviation Safety Network, the United Kingdom Air Accidents Investigation Branch, and from the US National Transportation Safety Board (NTSB) to identify and analyse previous relevant accidents.

Analysis of worldwide accident data did not show any statistically significant increase in the frequency of these events between the time periods 2002 to 2011 and 2012 to 2021 (representing the time periods before and after the change in the aluminium alloy used to manufacture the input cartridge – see the section titled Tail rotor gearbox and input cartridge manufacturing records).

Table 3: Worldwide accident data

Reg (with link to report)	Location	Year	Notes	Injuries
N111PH	Seattle, Washington, US	2001	Abrupt misapplication of controls	Fatal
G-EKKO	Tupton, Chesterfield, UK	2007	Tail rotor strike	Minor
N7531D	Easton, Washington, US	2007	Separated following loss of control	Fatal
N168AG	Topanga, California, US	2008	Undetermined	Minor
N444KD	Ketchum, Oklahoma, US	2015	Overstress as result of impact with undetermined object	Minor
N7162R	Fort Glenn, Alaska, US	2015	Overstress as result of impact with undetermined object	Nil
N797JR	Albany, Texas, US	2018	Undetermined	Nil
N1241W	Key West, Florida, US	2019	Two loose attachment bolts	Minor

Most of these events resulted in only minor injuries. In 2 events a cause was unable to be determined. In 2 more overstress was detected and contact with an object was described as more than likely but the investigation could not identify what.

The pilot of N1241W made a successful ditching following loss of empennage and TRGB (Figure 23). The 3 occupants sustained minor injuries. The NTSB found that 2 of the input cartridge attachment bolts were loose.

Figure 23: N1241W ditching and evacuation

Source: Mike Hartley

Survivability

Crashworthiness

The Robinson Helicopter Company R44 met the airworthiness standards of, and was certified against, US 14 Code of Federal Regulations (CFR) Part 27.[18] The helicopter was certified in Australia on that basis. The standard the R44 had to meet for strength requirements of the helicopter with respect to protection of occupants was Sec 27.561 issued in 1964. It required protection to the occupants from inertial forces of:

(iii) Sideward – 2.0g
 

(iv) Downward – 4.0g

The R44 (and many other helicopter types) provided very little protection in a sideways impact. The R44 is fitted with energy absorbing skid gear and energy absorbing seats. It is therefore vital to land on the skids to ensure maximum protection for occupants.

Figure 24 shows R44 N797JR which experienced in-flight break-up similar to VH-NBY while hovering at a height of 50 ft (see the section titled Previous occurrences). The pilot reportedly followed the POH emergency procedure and, even though operating in the ‘avoid’ area of the height/velocity curve chart, the severity of the ground impact was cushioned by the energy remaining in the main rotor system, and the helicopter’s skid gear. There was one person on board who had minor injuries.

Figure 24: N797JR post in-flight break-up

Source: NTSB, annotated by the ATSB

Figure 25 illustrates the deformation in VH-NBY from the side impact. The tail rotor gearbox and empennage fractured from the tail cone at around 55 ft and the helicopter fell from about 75 ft above the ground.

Figure 25: Diagram of cabin deformation in VH-NBY

Source: ATSB

Fuel tanks

R44 helicopters were originally fitted with aluminium fuel tanks and rigid fuel lines. These fuel tanks and lines were known to rupture on heavy impact. The manufacturer issued a service bulletin (SB78A) to all owners and operators of R44 helicopters to install crash‑resistant fuel bladders by 31 December 2013. The ATSB and CASA separately highlighted the importance of this modification. Today, all R44 helicopters in Australia must be fitted with fuel bladders and flexible fuel lines.

The aluminium skin of the fuel tanks fitted to VH-NBY split at the riveted joints upon impact. The left tank ruptured, but the fuel bladder remained intact, retaining its fuel. The right tank ruptured and the bladder was punctured on impact by the hydraulic pump which was co-located with the main rotor gearbox (Figure 26).

The puncture allowed the release of fuel, but at a low rate (Figure 27). An unknown quantity of fuel leaked from the bladder and attending fire services contained the spill. About 30 L of fuel remained in the helicopter. Given the previously‑observed rupturing of aluminium fuel tanks during significant impact, without the fuel bladders, the risk of a post-crash fire would probably have been significantly higher.

Figure 26: Fuel tank rupture (view forward)

Source: ATSB

Figure 27: Fuel bladder tear

Source: ATSB

Organisational and management information

Registered operator

The owner of VH-NBY was also a director of the registered operator, Avanova Pty Ltd. This company was one of a group of family-owned and related entities. The group consisted of aircraft operators with air operator’s certificates (AOC), and a maintenance organisation that maintained a fleet of float planes. Avanova Pty Ltd did not have an AOC. An associated entity, of which the pilot was also a director, had an AOC for aeroplanes only.

Avanova Pty Ltd was the registered operator of 5 helicopters and 2 aeroplanes at the time of the accident. The helicopters were used for private, business, and commercial purposes for a tourism company. Commercial usage was for tourism charter under third party AOCs.

Private use of the registered operator’s helicopters involved scenic flights, personal transport, and adventure trips. While still classified as private operations, the helicopters were also used in support of the tourism business. They were used to transport workers to remote areas, as well as the conduct of external load work for maintenance and the recovery of company owned‑ vessels.

Approved maintenance organisation

The approved maintenance organisation (AMO) was an authorised Robinson Helicopter service centre. It was a company which provided services to the helicopter industry in the Kimberley region. The AMO’s facilities, located on a station near Broome, were equipped with appropriate tooling for the specific purpose of maintaining and operating Robinson helicopters.

The owner of the AMO was a highly experienced helicopter pilot with around 20,000 hours flight time, mainly in Robinson helicopters. The AMO employed licenced aircraft maintenance engineers and apprentice aircraft maintenance engineers. The AMO had maintained VH-NBY throughout its service history.

VH-NBY operational history

On 29 March 2019, after a period of being operated privately by a different owner, VH-NBY was transferred and registered to Avanova Pty Ltd for tourism work at the Horizontal Falls area in Western Australia. Under a third-party AOC, VH-NBY commenced commercial operations in Western Australia on 13 April 2019 with 60.3 hours from new. On 22 October 2019 it was returned to private use, with Avanova Pty Ltd remaining the registered operator. The company used the helicopter in support of their tourism operations and for personal use.

Operational use of VH-NBY

A potential cause of unusual vibration leading to tail rotor gearbox input cartridge overstress failure was prior damage or stress to the tail rotor. While no evidence of a pre‑existing defect (including fatigue damage) was identified in any of the tail rotor components, given the potential for a previous loading event to have created invisible damage, the ATSB reviewed the prior usage of VH-NBY for events that may have overstressed critical tail rotor components.

Examples of usage with the potential to damage the helicopter were identified, specifically previous instances of:

• excessive manoeuvring
• flight in the obstacle environment
• loss of control near the ground.

The R44 Raven I POH carried advice on excessive manoeuvring. In the safety tips and notices section it stated:

6. Avoid abrupt control inputs or accelerated manoeuvres, particularly at high speed. These produce high fatigue loads and, over time, could lead to failure of a critical component.

The risk of a rotor or wildlife strike increases the lower an aircraft flies. Additionally, operation close to water and foliage also presents opportunity for unidentified damage (Figure 28). The helicopter’s manufacturer advised that contact with objects such as clothing, water or foliage may cause damage without marking the tail rotor. While examples were found of operation that had the potential to damage the helicopter, no specific evidence was identified. 

Figure 28: VH-NBY landing sites

Source: Western Australia Police

Imposition of risk

Intentional non-compliance during previous operation of VH-NBY, and the carriage of passengers on the first flight following ground assessment of the observed vibration prompted an examination of the owner’s risk appetite, and their willingness to expose third parties to risk. For example, the flight conducted on 2 July 2020 was a passenger flight over water following advice of an unusual vibration in the pedals. That flight carried risk of worsening of a condition or failure of a component, without any option to quickly land.

Further examples of imposing risk on third parties without mitigation of that risk were readily found. These activities included:

• exceedance of maximum passengers
• carriage of unrestrained passengers
• external carriage of passengers
• landing in uncontrolled public spaces
• unapproved low flying with passengers

These activities, several of which were witnessed by other parties, carried significant risk, yet there was no evidence that any action was taken to prevent or report them.

The ATSB has a confidential reporting system (REPCON) that enables the identification of unsafe behaviours without jeopardy.

Regulatory oversight of private operations

In line with the Civil Aviation Act (1988) and within the resources available to the Civil Aviation Safety Authority (CASA), CASA oversighted authorisation holders, such as pilots, engineers, and commercial AOC holders. For authorisation holders, CASA had three types of surveillance; planned, sector campaign, and response.

Planned surveillance was conducted under the National Surveillance Selection Process (NSSP). CASA prioritised high volumes of fare paying passengers in their oversight of over 2,000 authorisation holders. In line with CASA’s remit, they did not include private pilots in the NSSP.

Sector campaigns looked at specific industry sectors, such as airline heavy maintenance, or air ambulance services. These sector campaigns were conducted with similar priorities of public benefit and addressed the risks specific to specialised groups. Private pilots would not be expected to feature in these programs.

Private pilots were most likely to be subject to oversight in response surveillance. Response surveillance could be triggered by an incident, observation, or a report to CASA about unsafe behaviour or unsafe condition of aircraft.

Management of airworthiness

In 2005 CASA published a document titled ‘maintenance guide for owners/operators’.[19] This publication was revised in 2012 and updated in 2019. It covered the responsibilities of registered owner/operators and stated:

As a registered owner/operator, you are responsible for the continuing airworthiness of your aircraft. This responsibility begins and ends with you.

To assist registered operators, CASA published regulations, advisory publications, and plain language guides. All the information a registered operator needed to manage the airworthiness of their aircraft was published and freely available from CASA’s website.

Related occurrences

Registered operator’s helicopters

When investigating potential opportunities for previous damage to VH-NBY it became apparent that there was a history of unreported accidents and incidents within the registered operator’s Robinson R44 fleet (Table 4). These included tail rotor strikes and total loss of a helicopter resulting in serious injury.

In order to facilitate safety learning from the latter occurrence, detail is included in Appendix A. The loss of another helicopter (collision with water), which occurred in commercial operations was reported by a third party and investigated by the ATSB (see AO‑2017‑047).

Table 4: Unreported accidents and incidents in registered operator’s R44 fleet

Helicopter	Occurrence	Location	Date
VH-SCM	Tail rotor strike	Broome, WA.	September 2016
VH-ZGY	Tail rotor strike	Horizontal Waterfalls, WA	August 2017
VH-ZGY	Collision with water	Raft Point, WA	July 2019
VH-NBY	Bird strike	Broome, WA	August 2019
VH-TUY	Main rotor strike	Unknown	November 2019
VH-NBY	Loss of control	Cyclone Creek	March 2020

VH-NBY, Main rotor bird strike, near Broome, WA. 25 August 2019

During cruise, the helicopter’s main rotor blade struck a bird. The species was brown booby, a large bird with weight up to 1.4 kg and wingspan up to 1.4 m. The surface of one main rotor blade tip was damaged (Figure 29).

The main rotor blade tip was painted at some point after this event. There is no mention of inspection or repair in any of the helicopter logbooks or maintenance releases.

Figure 29: Damage to VH-NBY main rotor following bird strike, and blade at accident site

Source: Western Australia Police, annotated by the ATSB

VH-NBY, loss of control while landing on a vessel, near Cyclone Creek, WA. March 2020

VH-NBY was used in support of recovery of the domestic commercial vessel Jetwave Pearl which had capsized in a storm at Cyclone Creek.

While landing on the vessel Kimberly Quest 2, the skid gear caught the edge of the rubber matting on the helipad. This led to loss of control, the helicopter pitched forward and right before control was recovered. The matting on the deck of the vessel was torn.

It is not known if any tail strike or damage to VH-NBY occurred during this event and the captain of the Kimberley Quest 2 reported that no such incident occurred.

Safety analysis

Introduction

Two pilots detected the existence of an unusual vibration in the tail rotor pedals of R44 VH-NBY. The vibration was referred to an approved maintenance organisation (AMO) which completed troubleshooting involving ground running of the helicopter with no defect identified. Subsequently on the following flight with the pilot and 3 passengers, major sections of the tail that included the empennage and tail rotor gearbox (TRGB) fractured and then separated from the helicopter in-flight. Control of the helicopter was lost, resulting in fatal injuries to the pilot and one of the passengers and serious injuries to the remaining 2 passengers.

In that context, this safety analysis will examine the nature of the defect and the factors that led to it resulting in a fatal accident.

In-flight break-up

Examination of the aircraft and components found that the TRGB was functioning correctly, the TRGB input cartridge was manufactured to design specification, and the helicopter design was certified under the United States 14 Code of Federal Regulations (CFR) Part 27. All attaching hardware from the tail rotor system was present, and there was no evidence of incorrect assembly.

No components showed evidence of continual abnormal operation, or damage such as pre‑existing fatigue cracking.

Break-up sequence

The in-flight break-up of the tail rotor components was a rapid and complex sequence of events. A review of the recorded closed-circuit television (CCTV) and analysis of the physical evidence (tail rotor and empennage components) determined the following likely sequence:

• it is likely that the in-flight break-up began at the bolted connection between the TRGB and the aft tail cone bulkhead
• dynamic loads during take-off overstressed the attachment lugs of the input cartridge to the TRGB
• the attachment bolts and threaded inserts that secured the lugs of the input cartridge were also pulled at about that moment, shearing the internal threads from within the cast alloy bulkhead
• the TRGB dislodged, moving rearward and down
• the trailing edge of the lower vertical stabiliser was struck by a tail rotor blade. The other tail rotor blade impacted the underside of the tail cone
• the resultant shock loading through the stabiliser from the rotor blade impact fractured the cast bulkhead
• the stabiliser and gearbox both separated from the tail cone
• due to the bending applied from the now out of position gearbox, the bolted interconnection between the rear flex plate, drive shaft and tail rotor input yoke was compromised
• impact damage from the flailing driveshaft led to further break-up of the remnant section of bulkhead casting and aft end of the tail cone.

Source of vibration

Vibration in a helicopter can come from a multitude of sources. Tail rotor imbalance, a common source of vibration in pedals, was found to be within limits by the attending engineers the day before the accident. It was therefore considered to be an unlikely source of the vibration felt by the pilots of VH‑NBY. The minor fretting identified in the attaching hardware of the TRGB input cartridge (Figure 17) was indicative of movement with the potential to have increased vibration in the tail rotor system.  

Main rotor vibrations ordinarily present as a bounce or lateral shimmy felt through the pilots’ seat, and there were no reported faults with main rotor track or balance. The main rotor drive train displayed no pre-accident damage, and cyclic, collective, and throttle control systems were found to be continuous and displayed no pre-accident damage.

A disturbance in the engine can cause fluctuations of power and therefore change thrust from the tail rotor, which can present as ‘kicks’ in the yaw plane. An engine cylinder change had occurred 4 flight hours earlier, and the helicopter had been test flown with no fault found. Additionally, there were no reported concerns with the engine from the pilots or engineers. The engine was producing power and was stated to sound normal on the day of the accident. Additionally, CCTV analysis showed rotor rpm to be within its normal range.

Tail rotor drive train disturbances were also considered unlikely, as examination of the tail rotor drive train and TRGB found no pre-existing faults.

If an undetected problem existed in any of the above systems, it could not be ruled out, nor linked with certainty to a characteristic vibration that would manifest as tapping in the pedals. Therefore, it was not possible to identify the source of the vibration.

The precursor to this in-flight break-up echoes the pilot’s operating handbook (POH) warning of a change in sound or vibration forewarning of a potential failure of a critical component. In other similar in-flight break-ups, the pilots also reported vibration in the pedals, which have a direct linkage through the control rods and bell cranks to the tail rotor system, prior to component failure.

While the association cannot be made beyond doubt, the reported vibration in the pedals is likely to have been associated with the developing sequence that ultimately led to in‑flight failure of the tail section.

Input cartridge failure

The input cartridge was examined in detail alongside several other input cartridges from other helicopters. The component was found to be made of the correct material and to the approved design. There was no evidence of manufacturing defects that predisposed the input cartridge to prematurely fail. The lug fracture surfaces contained only evidence of overstress, with no indications of pre-existing damage such as fatigue.

There was no evidence of incorrect assembly. The fasteners were all accounted for, and the mating surfaces of the attachment lugs showed accident damage. There were signs of micromovement on one attachment bolt. This suggests that the input cartridge may have moved under load in service and could have been the source of tapping reported in the pedals.

There were no pre-existing abnormalities to the TRGB, nor pre-existing damage to the tail rotor blades that might otherwise explain the source of the extreme loading. The manufacturer advised that it is possible to impart unusual load on a tail rotor system without permanently marking the tail rotor. While opportunity for that to have occurred existed, there was no evidence of any such contact prior to this event. Additionally, witnesses on the day of the accident stated that they did not see any foreign objects contact the tail rotor.

In summary, the source of any potential initiator of the vibration or overstress of the lugs that precipitated the in-flight break-up of the tail section components could not be determined.

Fuel bladders

While the skin of the aluminium tanks had ruptured, the fuel bladders in the tanks retained most of the fuel during the event. A tear in the left bladder made by the hydraulic pump leaked fuel at a rate low enough to significantly reduce the risk of a post-impact fire.

Response to the identified vibration

The tail rotor pedal vibration was first identified during the short flight from the industrial property to Broome Airport. Although the pilot reported it to the owner, it was not annotated as a defect on the maintenance release (MR) and no engineering examination of the helicopter was conducted prior to the return flight.

The vibration was reported to have been light at that stage and thought to be related to paint on the tail rotor, its implication therefore may not have been recognised. However, examination of the helicopter at Broome Airport would have permitted a maintenance check flight to have been conducted in an open area. Compared to the industrial helicopter landing site, this would have offered a safer response in the event of a worsening condition or failure. It also offered the advantage of on-site emergency services.

Following the return flight to the industrial property and having had the opportunity to personally assess the vibration, the owner arranged for examination by maintenance personnel. Again, the defect was not annotated on the MR, although the vibration was conveyed to the maintenance organisation.

In addition to not annotating any defect in Part 2 of the MR, the ATSB identified that the MR had not been correctly used to record the operation of the helicopter for the 4 weeks preceding the accident. While this may have been influenced by the small number of pilots using the helicopter and verbal communication of the tail rotor vibration, it bypassed a vital tool for recording and communicating the airworthiness of the helicopter.

Due to an assessment by the pilot associated with the maintenance organisation that a check flight could not be safely conducted at the industrial property, evaluation of the reported vibration was confined to a ground run of VH‑NBY, with no defect identified. There were varying accounts of what follow‑up troubleshooting was required. As annotated in their maintenance documentation, the maintenance personnel reported that the owner was advised that a check flight should be conducted. However, the pilot that first detected the vibration and the accident pilot were reportedly unaware that a check flight was required. Again, no related entry was made on the MR, removing an opportunity to clearly detail any required actions.

Understanding defect resolution processes is vital for registered operators to manage the airworthiness of their aircraft. The process includes an iterative cycle of fault finding and critical analysis of every step until the reasons for the defect have been identified and rectified. In this case, and irrespective of the understanding relating to the need for a follow‑up check flight, as the vibration was reported during flight, and no defect was identified, or significant corrective action undertaken, following the ground‑based maintenance assessment, it is reasonable to have concluded that the problem may still be present.

In that context, the safest next step was the conduct of a graduated flight check (the stated preference of the attending engineer and consistent with the advice of the helicopter manufacturer) by a solo pilot. By contrast, the next and final flight was conducted with 3 passengers and involved a steep, high-power departure, possibly following a brief pause in the hover. The unnecessary carriage of passengers resulted in a significantly more severe outcome following the in‑flight break‑up.

The pilot’s decision to conduct the flight in this manner may have been influenced by a belief that the vibration was a minor issue associated with excess paint on the tail rotor blades. However, there was also evidence that the pilot was willing to take, and expose others to, elevated risk. Specifically, despite being important safety defences, the pilot did not have a current aviation medical certificate or R44 helicopter flight review at the time of the accident.

Additionally, during a review of the past usage of VH-NBY to identify any previous events that may have damaged the tail rotor, numerous instances of high risk operation by the accident pilot were identified (together with several reportable matters that had not been conveyed to the ATSB). These included the conduct of low flying and external load operations without the required training or qualifications and, more significantly, the carriage of passengers in an unsafe manner on multiple occasions.     

The ATSB concluded that the pilot’s high-risk appetite may have influenced the way the accident flight was conducted. It may also have made the pilot less likely to heed the warning in the R44 POH regarding the significant implication of a change in sound or vibration of the helicopter. Finally, while there was no evidence that the identified reportable matters contributed to this accident, the notification of occurrences to the ATSB is an important component of the aviation safety system.

Departure and emergency response

In other similar tail rotor failure occurrences, use of the POH emergency procedure resulted in a safe outcome for the occupants. One of the similar occurrences involving N797JR, happened in a high hover, similar to VH-NBY, though VH-NBY was likely heavier at the time.

The confined area associated with the industrial property required the pilot of VH-NBY to conduct a near-vertical departure, within the avoid area of the height / velocity diagram, limiting the energy available in the helicopter to use in an emergency response. That departure also demanded higher power than the recommended take-off profile over open ground. With the higher power was an associated higher torque, which sought to rotate the cabin of the helicopter to the right with more force. That in turn required higher counteracting thrust from the tail rotor.

CCTV showed that after the initial break-up VH-NBY continued climbing and rotating. The flight manual procedure of lowering the collective and/or closing the throttle would have seen rotation stop or slow, and VH-NBY would have descended. Use of that procedure while the aircraft was still oriented upright would have exposed the skid gear to contact with the ground first, and absorbed the impact energy, improving survivability.

Impairment and response times

Pilot intervention time is an important factor in recovery from an emergency, and unless primed, the stress of an emergency can impair response times. Startle is a stress response to a sudden intense event. It can cause involuntary reflex and cognitive impairment and can last from 0.3 seconds at the low end, to 1.5 seconds for a high intensity response (Rivera and others 2014).

The United Kingdom Civil Aviation Authority (CAA) published a paper on Helicopter Tail Rotor Failures in 2003. The purpose of the paper was to examine tail rotor failures and explore potential mitigators to reduce the incidence and consequences of tail rotor failures. The report related that pilot intervention time is highly variable. The CAA determined an intervention time of 2 seconds was a realistic average to use for their simulator trials.

CCTV analysis showed an approximate 2.7 seconds from contact of the tail rotor blade with the lower vertical fin, to the end of the first rotation. In the case of VH-NBY, the forces in the first rotation would have been roughly equivalent to 2.6 g. The forces in the second rotation would have climbed too high for a pilot to manipulate the controls. As such, the end of the first rotation was probably the last opportunity to prevent the total loss of control. Any impairment greater than 0.7 seconds could have prevented initiation of recovery actions in time to prevent loss of control.

Training and checking of private pilots

Once licenced, private pilots can fly with very little further training and supervision. The regulations require private pilots to demonstrate competence through a helicopter flight review (HFR) every 2 years. Yet over time, a pilot’s skills and knowledge can degrade. The owner of VH-NBY had not demonstrated competence in an R44 for about 2 years and 8 months and had completed a flight review in a Bell 505 within 2 year and 2 months. The emergency procedure for tail rotor failure is similar between the R44 and Bell 505.

A pilot cannot be reasonably expected to maintain competence in emergencies without deliberately exercising their skills and knowledge, supported by independent assessment of their abilities. CASA advises pilots that the two-year cycle of flight reviews does not guarantee safety. Consequently, they encourage pilots to assess their risk profile and seek opportunities to develop their skills, utilising for example training and checking with an experienced instructor.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors. Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the in-flight break-up of Robinson Helicopter Company R44 Raven I serial number 2544 registered as VH-NBY on 4 July 2020, 3 km north of Broome Airport, Western Australia.

Contributing factors

• Following a period of pedal vibration over at least 2 flights, overstress fracture of the attachment lugs of the tail rotor gearbox input cartridge occurred. The source of the loading that led to the overstress fracture was not conclusively determined.
• Two pilots experienced vibration through the helicopter’s tail rotor pedals on separate flights and did not endorse the problem on VH-NBY’s maintenance release. Additionally, following tail rotor inspection and vibration analysis on the ground, the engineers did not endorse the requirement for a maintenance check flight on the maintenance release. As a result, the value of the maintenance release as a tool for communication and management of airworthiness was lost.
• A recommendation in the R44 pilot's operating handbook was not followed. It advised pilots that following detection and inspection of an unusual vibration, they should hover the helicopter then have it reinspected before resuming free flight.
• The pilot conducted a towering high-power take-off in VH-NBY from a confined area with 3 passengers on board. The unnecessary carriage of passengers resulted in a significantly more severe outcome following the inflight breakup.
• Shortly after take-off, following the overstress fracture of the attachment lugs, the tail rotor gearbox separated from the helicopter. This led to fracture of the aft tail cone bulkhead and separation of all components attached to it, including the horizontal and vertical stabilisers. 
• With limited time and the stress associated with the emergency event, the pilot did not apply the pilot’s operating handbook procedure for responding to a tail rotor emergency. Prompt application of the procedure would have reduced the likelihood of loss of control, and therefore improved the potential for survivability.

Other factors that increased risk

• The pilot did not have a valid flight review for the R44 helicopter type or a current medical certificate. The former increased the risk of an inappropriate response to the tail rotor emergency and the pilot was not legally authorised to operate an R44 helicopter at the time of the accident.
• The owner of VH-NBY demonstrated acts of non-compliance with multiple aviation safety regulations. Additionally, VH-NBY was operated in a manner that increased the risk of damage or stress to the helicopter on multiple occasions. These actions had an adverse influence on safety and imposed unnecessary risk on passengers and third parties.
• Although the registered operator of VH-NBY was responsible for the continued airworthiness of its helicopter fleet, they did not employ a conservative defect resolution process that would have supported further trouble shooting.

Other findings

• The attending engineers found that visual inspection of the tail rotor system and associated components, running the helicopter on the ground, and dynamic tail rotor balancing, could not replicate the stated problem. It is likely that the vibration only presented in powered flight.
• There was a history of unreported accidents and incidents with the registered operator of VH‑NBY's aircraft, in both commercial and private operations. These occurrences included 2 tail rotor strikes in different R44 helicopters, and a total hull loss of another R44 helicopter (VH‑ZGY) that resulted in serious injuries to a passenger.
• Although a fuel bladder was punctured during the accident sequence, and fuel was lost from the tanks, the fuel bladders reduced the flow rate of escaping fuel, which reduced the risk of a post-crash fire.

Glossary

AAIB                 Air Accidents Investigation Branch (United Kingdom)

ALARP             As Low As Reasonably Practical

AOC                 Air Operator’s Certificate

AME                 Aviation Maintenance Engineer

AMO                 Approved Maintenance Organisation

CASA               Civil Aviation Safety Authority

EDS                 Energy Dispersive x-ray Spectrometer

FAA                  Federal Aviation Administration (United States of America)

HAAMC            Head of Airworthiness and Maintenance Control

HFR                  Helicopter Flight Review

LAME               Licenced Aviation Maintenance Engineer

MR                   Maintenance Release

NTSB                National Transportation Safety Board (United States of America)

POH                 Pilot’s Operating Handbook

PPL                  Private Pilot’s Licence

RHC                 Robinson Helicopter Company

SEM                 Scanning Electron Microscope

SES                 State Emergency Service

TRGB               Tail Rotor Gearbox

TR                    Tail Rotor

VFR                  Visual Flight Rules

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilots of VH-NBY
• maintenance organisations for VH-NBY
• commercial operators of the registered operator’s aircraft
• next of Kin
• flight schools attended by the pilot
• Civil Aviation Safety Authority
• United States National Transportation Safety Board
• United Kingdom Air Accidents Investigation Branch
• Aviation Safety Network
• Western Australia Police Force
• Robinson Helicopter Company
• Airservices Australia
• witnesses
• video footage of the accident flight and other photographs and videos of company aircraft
• recorded data from the aircraft tracking unit on the helicopter

References

Australian Transport Safety Bureau, AR-2020-014, Aviation Occurrence Statistics 2010 to 2019, 2020, Canberra.

American Society for Metals International, 2004, ASM Handbook, Volume 9: Metallography and Microstructures, Materials Park, Ohio.

American Society for Metals International, 2021, ASM Handbook, Volume 11 Failure Analysis and Prevention, Materials Park, Ohio

Casner SM, Geven RW & Williams RT, ‘The effectiveness of airline pilot training for abnormal events’, Human Factors: The Journal of the Human Factors and Ergonomics Society, 2013 vol. 55, pp.477-485.

Civil Aviation Authority United Kingdom, CAA Paper 2003/1, Helicopter Tail Rotor Failures 2003.

Dismukes RK, Berman BA & Loukopoulos LD, The limits of expertise: Rethinking pilot error and the causes of airline accidents, 2007, Ashgate Aldershot UK.

Flight Safety Foundation, Simulator-based study of Emergencies Yields Insights into Pilot’s Reaction Times, March-April 1999, Vol. 25, No. 2, Alexandria, VA.

Glendon AI, Mckenna EF, Human safety and risk management, 1995, Chapman & Hall, London

Greening L, Chandler CC, Why It Can’t Happen to Me: The Base Rate Matters, But Overestimating Skill Leads to Underestimating Risk, Journal of Applied Psychology, 1997, 27:9, 760-780.

Hudson, P, Safety culture: The ultimate goal, Flight Safety Australia, September-October 2001 Civil Aviation Safety Authority, Canberra.

Hunter DR, Risk Perception and Risk Tolerance in Aircraft Pilots, Federal Aviation Administration, DOT/FAA/AM-02/17, 2002.

Klein G, Sources of power: How people make decisions, Massachusetts Institute of Technology 1998.

Landman A, Groen EL, van Passen VV, Bronkhorst AW & Mulder M, ‘The influence of surprise on upset recovery performance in airline pilots,’ The International Journal of Aviation Psychology, 2017 vol. 27, pp.2–14.

Lawton R, Not working to rule: Understanding procedural violations at work, Safety Science, 1998, 28:2, 77-95.

Rivera, J., Talone, A.B., Boesser, C.T., Jentsch, F. and Yeh, M., Startle and surprise on the flight deck: Similarities, differences, and prevalence. In Proceedings of the human factors and ergonomics society annual meeting September 2014 (Vol. 58, No. 1, pp. 1047-1051). Sage CA: Los Angeles, CA: SAGE Publications.

Yates JF (ed), Risk-taking behavior, 1992, John Wiley & Sons, New York, NY.

Zinn, JO. The meaning of risk-taking – key concepts and dimensions, Journal of Risk Research, 2019, 22:1, 1-15.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the registered operator of VH-NBY
• Civil Aviation Safety Authority
• maintenance organisation for VH-NBY
• Robinson Helicopter Company

Submissions were received from the registered operator of VH-NBY and the Robinson Helicopter Company. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

 

Appendices

Appendix A – VH-ZGY collision with water

What happened

On 12 July 2019, a private vessel, High Calibre, had repositioned to Raft Point, Western Australia (Figure 30). A Robinson R44 Clipper II, serial number:12491 registered as VH-ZGY was parked on the helipad of the vessel (Figure 31). There were 4 people aboard High Calibre, the owner of the vessel (and helicopter), and 3 individuals. The weather was fine and the water in the bay was calm.

Figure 30: Occurrence location

Source: Google Earth annotated by ATSB

It was reported to the ATSB that 2 people required transfer to another helicopter (VH-NBY) located nearby on-shore, to return to Broome. A witness stated that VH-ZGY had been used twice already that day and had landed to load a third passenger without shutting down. Simultaneously, friends and family of the vessel’s owner were due to arrive at Raft Point via seaplane to holiday aboard High Calibre. It was reported that the transfer to VH-NBY in VH-ZGY needed to be completed in time for the owner to get back to High Calibre and meet their guests.

The owner of the helicopter was piloting the helicopter and sat front right. One passenger sat front left, and the second passenger sat rear right. It was reported that upon take off the helicopter yawed left and then tipped forwards and rolled to the right. The main rotor blades contacted the starboard side of the vessel (Figure 32). The helicopter then collided with water and sank.

While it was reported to the ATSB that a tie-down was still attached under the nose of the helicopter and that initiated the roll over, another witness stated that all tie downs had been removed and stowed. They added that access to the helicopter meant climbing a ladder which put the pilot and passengers at eye level with the deck. Allowing them to check for tie-downs as they climbed.

It is possible that control was lost due to the helicopter remaining tethered. Alternatively, if it had recently landed and was untethered, a mishandled departure may have initiated the roll over. The helicopter was not inspected and the actual cause of the rollover was not determined.

Figure 31: VH-ZGY on High Calibre

Source: Western Australia Police Force annotated by ATSB

The front left occupant had serious injury, the owner sat front right, had severe bruising, and the rear right passenger had minor injuries. The helicopter was destroyed. The Civil Aviation Safety Authority confirmed the loss of VH-ZGY with an insurance agent, and the helicopter was not recovered. High Calibre had significant damage and the hull was penetrated above the water line. High Calibre was repaired in a remote location 11 days later.

Figure 32: Damage to High Calibre

Source: Western Australia Police Force, annotated by the ATSB

Under section 18 of the Transport Safety Investigation Act 2003 a responsible person with knowledge of an immediately reportable matter must report it. The loss of VH-ZGY was not reported to the ATSB.

Safety action

It is not known whether the registered operator took safety action as a result of this event.

Safety message

In 2016 the Federal Aviation Administration in the US released a safety alert SAFO16016. This alert advised pilots of the importance of utilising checklists and performing stabilised hover checks. This allows pilots to ensure vital actions have been performed before departure and allows a pilot to abort a take-off if anything is not right or discovered amiss. While SAFO16016 may require adjustment to suit waterborne operations the principals apply.

The reporting of accidents and incidents is vital for the sharing of lessons learnt that may be implemented by industry, reducing the risk of future accidents and incidents. Additionally, the data the ATSB and other agencies collect through reporting is deidentified and used in Australia and worldwide for analysis of factors impacting aviation safety to improve outcomes for all users of aviation services of all types.

Organisations and individuals that report accidents and incidents contribute to the growth towards a generative safety culture[20] in Australia and around the world. Those organisations and individuals are more able to generate safe outcomes in aviation operations as a result.

Occurrence details

Date and time:	12 July 2019
Occurrence category:	Accident
Primary occurrence type:	Collision with water
Location:	Raft Point, Western Australia
Latitude:  16º 04.34' S	Longitude:  124º 27.45' E

Aircraft details

Manufacturer and model:	Robinson Helicopter Company R44 Clipper II
Type of operation:	Private
Activity:	General Aviation / Recreational
Sector:	Helicopter
Departure:	Raft Point, Western Australia
Destination:	Horizontal Falls, Western Australia
Persons on board:	Crew – 1	Passengers – 2
Injuries:	Crew – 1 minor	Passengers – 1 serious, 1 minor
Aircraft damage:	Destroyed

Appendix B – Robinson Helicopter ground handling incidents

Introduction

In the course of investigation into the in-flight break-up of VH-NBY. The ATSB received anecdotal evidence of aft tail cone bulkhead castings failing after contact of the horizontal stabiliser with a solid object during ground handling.

While the ATSB welcomes reporting of ground handling incidents, it is not a requirement under the Transport Safety Investigation Regulations to report them. Therefore, the ATSB did not have a suitable record of events to examine.

An update to the investigation was published on 17 August 2021. In that update the ATSB sought information from operators who had experienced ground handling issues. Specifically resulting in damage to the aft tail cone bulkhead and tail rotor gearbox input cartridge.

Response from industry

The ATSB is grateful to the large number of members of the helicopter industry in Australia and overseas who provided valuable insight, experience, information, and components to the ATSB. This knowledge and material was analysed in the context of the failure of VH-NBY and supported the investigative process.

Three casting fractures were identified one in each of R22, R44 (Figure 33) and R66. Each was the result of contact of the horizontal stabiliser with a fixed object while ground handling the helicopter.

Figure 33: Ground handling damage to an R44

Source: Supplied

These failures were a known issue and the manufacturer had published service letters for each type on 11 March 2020.

• R22 service letter SL-86
• R44 service letter SL-72
• R66 service letter SL-33

With the support of R44 owners and operators, the ATSB was able to analyse these materials and rule this out as a mechanism of failure for VH-NBY.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     Refinishing the painted tips of Robinson Helicopter tail rotor blades is common practice in Australia, as sand and dust erodes tail rotor blades, potentially reducing their useful life.

[2]     Tail skid: A guard device below the empennage to protect the tail rotor blades from ground strike.

[3]     Interpretation of Measured Alcohol Levels in Fatal Aviation Accident Victims: Interpretation of Measured Alcohol Levels | ATSB

[4]     CASA 007/17 was superseded by CASA 62/20, and the requirement remained.

[5]     The tail rotor blade life limit is 2,200 hours of operation or 12 years, whichever occurs first.

[6]     Qualified person: a suitably licenced aviation maintenance engineer or pilot endorsed and current on the aircraft type.

[7]     Basic HLS: a place that may be used as an aerodrome for infrequent, opportunity and short term basis for all types of operations, other than RPT, by day under helicopter VMC.

[8]     CASA CAAP 92-2(2) Guidelines for the establishment and operation of onshore Helicopter Landing Sites.

[9]     Threaded inserts: Robinson Helicopter Company manufacturing required threaded inserts to be fitted at each of the bolt holes in the casting, to secure the bolts.

[10]    Cleavage facets: Bright reflective facets remaining following cleavage fracture

[11]    Shrinkage pores: Cavities formed in the metal casting process

[12]    Micro dendritic defects: A crystal with a treelike branching pattern. It is most evident in cast metals slowly cooled through the solidification range.

[13]    Beach marks: The most characteristic feature usually found on fatigue-fracture surfaces are beach marks, which are centred around a common point that corresponds to the fatigue-crack origin. Beach marks can occur due to changes in loading or frequency or by oxidation of the fracture surface during periods of crack arrest from intermittent service of the part or component.

[14]    Material specifications: US Federal Specification QQ-A-225/9E Aluminium Alloy 7075, Bar, Rod, Wire and Special Shapes; Rolled, Drawn or Cold Finished. 24 August 1971

[15]    Attendance at disassembly: Involved parties could not attend in person due to COVID restrictions. A video link, and on‑site photographer were made available to them.

[16]    Angular tear ridges: Tearing caused by ductile overstress following plastic deformation.

[17]    Ductile morphological features: fracture features that are characterised by tearing of metal and appreciable gross plastic deformation and expenditure of considerable energy. Ductile fractures are those that occur by microvoid formation and coalescence.

[18]    14 CFR Part 27: Airworthiness standards for normal category rotorcraft. Including subparts covering strength requirements and, design and construction.

[19]    CASA’s Maintenance guide for owner/operators is available at their online store.

[20]    Generative safety culture: This is the highest level of Hudson’s safety culture ladder and is described as safety behaviour being integrated into everything the organisation does.

Safety summary

What happened

On the evening of 22 June 2020, a Royal Flying Doctor Service, Pilatus Aircraft Ltd. PC-12/47E registered VH‑OWI was conducting a positioning flight from Jandakot to Albany, Western Australia. Approximately four minutes into the descent to Albany Airport in instrument meteorological conditions the pilot observed an airspeed miscompare indication on the left primary flight display (PFD).

Having assessed that a blocked pitot tube was the likely cause of the issue, the pilot elected to climb the aircraft in an attempt to get clear of cloud. During this climb the pilot’s indicated airspeed increased and exceeded the aircraft’s maximum allowable speed. The pilot reported also receiving an overspeed alert at this time and consequently elected to discontinue the planned flight and return the aircraft to Jandakot.

When unable to obtain visual conditions, the pilot elected to descend the aircraft. During this descent the left indicated airspeed reduced to zero, however, no stall warning was activated. At 6,000 ft visual conditions were obtained, however, the turbulence at this level was severe. At this time the pilot observed a heading miscompare on both the left and right PFDs. Due to the severity of the turbulence at 6,000 ft the pilot climbed the aircraft first to 8,000 ft and then 10,000 ft on the return to Jandakot.

The pilot reported that on approach to Jandakot all indications had returned to normal and remained that way until short final when an altitude mismatch and low airspeed warning was identified on the PFDs.

What the ATSB found

The ATSB determined that during the flight, water entered the aircraft’s pitot tube either as rain or an accumulation of moisture from flying through cloud. Due to a blockage in the pitot tube drain the water had been unable to escape. This in turn obstructed the flow of air to the aircraft’s air data attitude heading reference system, resulting in an incorrect airspeed being displayed on the left PFD and triggering miscompare indications on both PFDs.

In addition, a heading miscompare was likely caused by the aircraft’s movement through an area of moderate to severe turbulence during the return to Jandakot.

Finally, the ATSB found that recent training that the pilot had undertaken helped them to identify the erroneous airspeed data.

Safety message

Spurious instrument readings can create a more complex scenario for flight crew than an instrument failure.

In this case the pilot’s recent training assisted in effectively assessing the situation, determining the likely failure mode and identifying the most accurate source of available data for a safe return to the departure airport.

The investigation

The occurrence

At 2122 Western Standard Time^[1] on 22 June 2020, a Royal Flying Doctor Service - Western Operations (RFDS), Pilatus Aircraft Ltd. PC-12/47E, registered VH-OWI (OWI), departed Jandakot Airport, Western Australia (WA) for Albany Airport WA, to collect a patient and transfer them back to Jandakot. The pilot, a doctor and a flight nurse were onboard.

At approximately 2150 the pilot commenced a descent to Albany from flight level^[2] (FL) 210. About 4 minutes later, while in icing^[3] conditions and passing through FL180, the pilot received an airspeed miscompare,^[4] indicated by an amber colouration on the airspeed tape on the primary flight displays (PFD).

At this time the pilot reported that there was a light dusting of ice on the leading edge of the aircraft’s wings and on the radome.^[5] The pilot did not deem this level of icing to be a concern and did not observe any issues or receive any alerts from the aircraft’s anti-icing systems.

While continuing the descent the pilot compared the airspeeds displayed on the two PFDs with the airspeed indication on the electronic secondary instrument system (ESIS) (Figure 1). Based on the speed readings from the PFDs and the ESIS the pilot determined that the left PFD was likely displaying incorrect information.

As the descent continued, the pilot observed the airspeed on the left PFD continuing to decrease. The pilot reported to air traffic control (ATC) that a blocked pitot tube was the likely cause of the issue and requested clearance for a climb to FL 230. The pilot believed that this altitude would allow them to establish the aircraft clear of cloud and therefore avoid the worst of the icing conditions.

Figure 1: PC-12/47E exemplar cockpit layout

Source: Pilatus, annotated by the ATSB

Figure 2: ADS-B^[6] track of the incident flight

Source: FlightRadar24 and Google Earth, annotated by ATSB

During the climb, the pilot observed the airspeed displayed on the left PFD increasing. This continued throughout the climb with the pilot observing V_mo^[7] and M_mo^[8] exceedances on the left PFD and receiving audible overspeed alerts from the aircraft’s avionics. Noting that due to this indicated exceedance the aircraft would need to be grounded for inspection, they elected to discontinue the planned flight and return the aircraft to Jandakot (Figure 2).

Climbing through FL 210, on the return to Jandakot, the pilot reported icing conditions and poor visibility and decided to discontinue the climb. In a further attempt to exit the icing conditions and obtain visual reference, the pilot requested a descent to 8,000 ft. The pilot was advised by ATC, who had been in contact with the Bureau of Meteorology (BOM), that this was the approximate lower limit of cloud. On descent the indicated airspeed on the left PFD reduced to zero, however, the pilot did not observe or hear a stall warning. At 8,000 ft, the pilot indicated to the controller that they had not obtained visual conditions and were encountering moderate turbulence. The pilot requested, and was granted, a further descent to 6,000 ft. During this descent the turbulence increased to severe, and consequently the pilot elected to climb the aircraft back to 8,000 ft.

Throughout the descent to 8,000 ft and then 6,000 ft the pilot noted a difference in the heading data as displayed on the left and right PFDs. The pilot observed that this led to a heading miscompare^[9] indication on the left PFD, with the letters ’HDG’ appearing in a yellow box at the top of the compass display. The miscompare continued to increase until there was reported 50‑60° of indicated heading difference between the two PFDs. Further, the pilot also reported that during this sequence the left PFD displayed an incorrect attitude, indicating that the aircraft was level when the nose was approximately 3° below the horizon. This was less than the 5° difference required to trigger a pitch miscompare.

The pilot continued to track to Jandakot, at 8,000 ft with a further climb to 10,000 ft. Approaching Jandakot, the pilot reported that all indications for airspeed, heading and attitude had returned to normal and continued that way until the aircraft was on final approach. During the final approach, the pilot reported a 60 ft mismatch in altitude between the left PFD and the ESIS and a low airspeed warning on the left PFD.

The aircraft was landed and taxied back to the RFDS apron without further incident. The pilot then completed the incident log due to the indicated V_mo and M_mo exceedances.

Context

Aircraft information

The PC-12/47E is a single-engine, turboprop, pressurised aircraft, designed and built by Pilatus Aircraft Ltd in Switzerland. OWI was manufactured as serial number 1232 in 2010 and registered in Australia in January 2011. At the time of the occurrence the aircraft had over 12,600 hours in service and 11,100 flight cycles.

The PC-12/47E pitot tubes^[10] are fitted with an electric anti-ice system that uses heating elements to prevent ice build-up. The aircraft is also fitted with an alerting system that activates when the temperature is less than 10 °C and there is visible moisture in the air. In addition, if either system is non-operational a warning will be displayed on the crew alerting system. The pilot did not report receiving any alerts related to the anti-icing system and no errors were recorded in the aircraft data provided to the ATSB.

Post‑flight maintenance

Due to the overspeed reported by the pilot the aircraft was grounded for inspection on its return to Jandakot. RFDS personnel examined the aircraft and reviewed the recorded data.

The initial aircraft examination revealed that a small amount of foreign material was blocking the left pitot tube drain. Following removal of the pitot tube, this material, and a small amount of water, was expelled using compressed air. The composition and source of the material could not be determined as it was not retained for further analysis.

The pitot static and anti-ice systems were inspected, and relevant checks were conducted in accordance with the aircraft’s maintenance manual requirements. No further defects were identified, and the aircraft was returned to service.

The data review performed by RFDS maintenance personnel determined that the overspeed was an instrumentation issue and the aircraft had not actually exceeded its V_mo or M_mo limits. However, several data anomalies were identified. The aircraft was returned to service and RFDS maintenance personnel sent relevant data to the avionics manufacturer for further assessment. The manufacturer identified a number of instances of miscompare in the data. They recommended that the air data attitude heading reference system (ADAHRS) unit be replaced and returned for more detailed examination (see the section titled ADAHRS examination).

Pre-flight inspection procedure

The PC-12/47E standard pre-flight checks required a check of the pitot probes. The requirement was for the pitot cover to be removed and for the pitot tube to be ‘Checked’. There was no stated requirement for the pitot drain to be checked for obstruction.

The operator advised that they had no additional specific requirements relating to the pitot inspection. They advised that the pitot drain hole is visible during the pre-flight inspection, however, a blockage would not be easily identified unless it was external to or protruding from the drain.

Meteorological information

At 1843 on the evening of the incident the Bureau of Meteorology (BOM) issued a SIGMET^[11] for severe icing conditions between 1900 and 2300 over a large portion of south‑west WA, for altitudes between 8,000 ft and FL190 (Figure 3). The conditions were predicted to move to the east at approximately 30 kt throughout the forecast window.

A grid point wind and temperature forecast was issued by BOM at 1417 on the day of the incident. The forecast indicated that from 2000, temperatures between Jandakot and Albany would drop to or below 0^o C between 7,000 and 10,000 ft.

The relevant graphical area forecasts (GAF) indicated the potential for showers of rain and moderate turbulence. In addition, isolated thunderstorms were forecast with associated severe turbulence and icing.

The terminal area forecasts (TAF) indicated the likely presence of severe turbulence below 5,000 ft at both Jandakot and Albany from the start of the flight reducing to moderate at Jandakot by 2200.

Figure 3: Overlay of SIGMET identified icing area

Source: Bureau of Meteorology and Google Earth, annotated by the ATSB.

Recorded data

The ATSB was provided with aircraft maintenance files (ACMF) data which recorded a range of aircraft parameters for multiple flights, including the incident flight. Only the data feed to the left PFD was recorded. Figure 4 shows the aircraft’s calibrated airspeed^[12] and altitude for the incident flight. Also shown on the plot is a red line indicating the V_mo speed of the aircraft.

The indicated airspeed, displayed to the pilot, is calculated by comparing the dynamic air pressure, sensed through the pitot tube, on the aircraft’s wing, with the static air pressure sensed at the static ports on the aircraft’s tail. A blockage of the pitot tube will cause the pressure in the tube (dynamic air pressure) to remain constant while static pressure changes with altitude. This will cause the indicated airspeed to over read during a climb and under read during a descent.

Figure 4: Recorded aircraft altitude and airspeed

Source: ATSB

Air data attitude heading reference system

OWI was fitted with a Honeywell KSG7200 air data attitude heading reference system (ADAHRS). The ADAHRS unit reads data from a range of sensors and inputs throughout the aircraft including aircraft attitude, GPS, magnetometer, air pressure and temperature.

The processed data is then displayed on the relevant PFD. The system consists of two separate units, channel A taking inputs from the sensors on the left of the aircraft for display on the left PFD and channel B, which receives inputs from sensors on the right of the aircraft for display PFD (Figure 5).

Figure 5: ADAHRS unit system schematic

Source: Pilatus, annotated by the ATSB.

The unit has two systems detecting anomalies between channel A and B data. The first system monitors and reviews the input data from the two sources. It identifies differences that fall outside of a certain threshold, flagging these in the maintenance fault log as miscompares for later action by maintenance personnel. This information is not visible to the flight crew.

The second system monitors and reviews the data being displayed on the PFDs. It identifies differences that fall outside of a certain threshold and flags these visibly on the PFD’s for the flight crew. In the case of an identified difference, if the crew identify which data source is incorrect (channel A or B), both PFDs can be selected to the same valid data source.

ADAHRS examination

The ADAHRS unit examination at the manufacturer’s facility did not identify any faults with channel A. Three parameters were identified within the fault log as having miscompared in the manufacturers review, these were pitot pressure, heading and total air temperature (TAT). The pitot pressure miscompare was identified as corresponding with the pilot’s report. The recorded heading miscompare, while significantly smaller than that reported by the pilot, aligned with the timing reported by the pilot. The TAT miscompare that was identified was not deemed to be an issue as TAT data is not used in any calculations within the ADAHRS unit and is not displayed on either PFD.

Crew comment

The pilot advised the ATSB that one of the key things that assisted them in working through the incident was training they had undertaken as part of an operational proficiency check (OPC). As part of the OPC, carried out about a month before the incident, the pilot, under the guidance of a check and training pilot, observed the aircraft’s performance at various engine power setting and aircraft attitude combinations. Their assessment was that this check flight had given them more confidence in the assessment that it was likely a pitot tube blockage and that the right PFD and ESIS were showing the correct information.

Analysis

Pitot tube blockage

Foreign material identified after the occurrence in the left pitot tube drain likely prevented water draining effectively. Consequently, water that entered the pitot tube during flight either as the aircraft was flying through rain, or as water vapour condensing in the tube as it flew through cloud, probably accumulated and blocked the pitot tube.

Both the weather forecasts and the pilot’s report indicate that the aircraft was operating in icing conditions at the time the miscompares and spurious warnings were received. However, as the pitot tubes were fitted with an anti-icing system and the aircraft data indicated that the system was operational anytime the aircraft was operating below 10 °C with visible moisture, it was unlikely that icing contributed to the blockage.

The result of this blockage was that air was unable to flow freely through the pitot tube artificially changing the dynamic pressure recorded by channel A of the ADAHRS unit.

Airspeed miscompare

The incorrect air pressure being fed into the ADAHRS unit from the blocked pitot tube resulted in the airspeed displayed on the left PFD being incorrect. The airspeed over read during climb and under read during descent. The miscompare monitoring functionality of the ADAHRS unit identified the difference between the two displayed airspeeds, triggering miscompare indications on the PFDs.

The manufacturer’s inspection and analysis of the ADAHRS ruled out any technical issues with channel A of the unit causing the erroneous data.

Heading miscompare

Following the airspeed miscompare indication, the pilot detected, and the aircraft’s fault log showed, a heading miscompare. Based on the review of the data and the results of the ADAHRS unit examination no technical reason for the miscompare could be determined.

The miscompare occurred during the aircraft’s descent into increasing turbulence. Based on advice from the avionics manufacturer it is likely that the motion of the aircraft in turbulence caused the unit to miscompare. When the aircraft climbed from 6,000 ft, and exited the worst of the turbulence, the pilot reported that the heading data returned to normal.

Findings

From the evidence available, the following findings are made with respect to the unreliable airspeed indication involving Pilatus PC-12/47E, VH-OWI which occurred on descent to Albany Airport, Western Australia on 22 June 2020.

Contributing factors

• Water trapped in the left (pilot’s) side pitot system by a blocked pitot drain likely obstructed the airflow through the pitot lines during the flight. This resulted in inaccurate dynamic air pressure information being received by channel A of the air data attitude heading reference system.
• Incorrect air pressure data received by channel A of the air data attitude heading reference system resulted in the calculation and display of false airspeed data on the left primary flight display. This triggered an airspeed miscompare, erroneous alerts and resulted in the pilot returning to Jandakot.

Other findings

•  The heading miscompare detected by the pilot was likely a result of the movement of the aircraft through moderate to severe turbulence.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• pilot of VH-OWI
• Bureau of Meteorology
• aircraft operator/maintainer and avionics manufacturer.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• pilot of VH-OWI
• Bureau of Meteorology
• aircraft operator/maintainer and avionics manufacturer.

Submissions were received from:

• Bureau of Meteorology
• avionics manufacturer.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1.  Western Standard Time (WST): Universal Coordinated Time (UTC) +8 hours.
2.  Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 180 equates to 18,000 ft above mean sea level, not the ground level.
3.  Icing conditions are atmospheric conditions that can lead to the formation of ice on an aircraft.
4.  An airspeed miscompare is displayed when the aircraft’s monitor warning system detects a difference in the airspeed between the left and right primary flight displays of more than 10 knots.
5.  A protective covering for an aircraft’s radar or other aerials located at the most forward part of an aircraft’s fuselage.
6.  ADS-B: Automatic Dependent Surveillance–Broadcast is a surveillance technology in which an aircraft periodically broadcasts it position based on satellite navigation information.
7.  Vmo is the aircraft’s maximum operating speed, expressed in knots, that may not be exceeded at any time.
8.  Mmo is the aircraft’s maximum operating limit speed, expressed as a Mach number, that may not be exceeded in normal flight operations.
9.  Heading miscompare is received when the aircraft’s monitoring and warning system detects a difference in the heading between the pilot and co-pilot primary flight displays of more than 6°.
10.  A pitot tube is an open ended tube facing into the airflow used to measure dynamic air pressure as tan aircraft moves through the air.
11.  Significant meteorological information (SIGMET): a weather advisory service that provides the location, extent, expected movement and change in intensity of potentially hazardous (significant) or extreme meteorological conditions that are dangerous to most aircraft, such as thunderstorms or severe turbulence.
12.  Calibrated Airspeed: Indicated airspeed accounting for system errors and subsequent corrections in the airspeed indicator.

Safety summary

What happened

On 15 June 2020, wagon RKOX4055Y was unloaded at the BlueScope Steel Coopers Plains facility, south of Brisbane, Queensland. The forklift operator experienced difficulty unloading the welded beams and sought assistance from a second forklift operator. Footage from security cameras within the Coopers Plains facility showed the corner of wagon RKOX4055Y lifting during the unloading before dropping back down.

Following unloading, wagon RKOX4055Y was shunted and attached to other wagons to form train 2BW4. This train underwent a full train examination and departed Brisbane bound for Port Kembla, New South Wales.

At around 0430 on 16 June, station staff at Grafton found damage to the platform. Train 2BW4 was identified as passing through Grafton and the train crew were directed to inspect their train at Kempsey. The inspection did not identify any faults with wagon RKOX4055Y and the train continued.

At 1040, workers at Dungog noticed a wagon on train 2BW4 contact the platform. The train was directed to stop at Wallarobba. On inspection, the wagon body on RKOX4055Y was found to have dislodged and was resting on the bogie. Wagon contact damage was also found on, Coffs Harbour, Taree, Wingham and Dungog platforms. There were no injuries as a result of the occurrence.

What the ATSB found

During the unloading of wagon RKOX4055Y the wagon body was likely lifted off the centre pin and dislodged as the load became stuck. The forklift operators did not notice that the wagon body had lifted and continued unloading other wagons. The underframe of train 2BW4 was not inspected as required by Pacific National’s train examination procedure. The likely dislodged wagon body was not identified and train 2BW4 departed with a rolling stock irregularity.

During the journey to Port Kembla, further inspections occurred after reports of platform damage were made by station staff. The out of gauge wagon was detected when the train crew inspected the train at Wallarobba.

Additionally, the risk of a wagon lift off event had not been identified or controlled by BlueScope Steel or Pacific National.

What has been done as a result

Following the occurrence BlueScope Steel and Pacific National completed the following actions:

• Communicated the details of the occurrence and contributing factors to the unloading and maintenance personnel.
• Revised the unloading procedure to include the risk of lift off events and reinforced the requirement to unload welded beams from both sides.
• Reviewed the safety interface agreement and risk assessments to ensure all risk controls were current and included the risks associated with lift off events.

Safety message

Procedures and practices for loading and unloading rolling stock must ensure risks are identified, controlled and that the practices do not affect the safe operation of rolling stock.

Maintenance inspection regimes must be completed in accordance with engineering practices to identify conditions that might contribute to accidents.

The investigation

The occurrence

On 15 June 2020, a total of 14 loaded steel wagons were shunted into the BlueScope Steel (BSS) Coopers Plains facility,^[1] south of Brisbane, Queensland.

At around 0600,^[2] a forklift operator began unloading wagon RKOX4055Y which had a load of three stacks of welded beams.^[3] The forklift operator had difficulty unloading the welded beams and made a number of attempts to move and lift the beams. The operator unloaded two of the three stacks and sought assistance from a second forklift operator as the last stack of beams had become stuck. The last stack was lifted from the wagon using both forklifts. Unloading then continued on other wagons.

Once unloaded, the wagons were shunted and attached to other wagons to form Pacific National (PN) train 2BW4. Train 2BW4 consisted of three locomotives and 53 wagons which underwent a full train examination without incident. 

Train 2BW4 departed the Brisbane Freight Terminal (BFT) around 2145, bound for Port Kembla, New South Wales (NSW) (Figure 1). A roll-by inspection^[4] was completed on departure with no abnormalities detected. 

At 0222 on 16 June, train 2BW4 passed through Grafton station and Coffs Harbour station at 0343. NSW Trains station staff identified damage to Grafton station platform at around 0430. This was reported to the network controller and the train crew of 2BW4 was directed to inspect their train on arrival at Kempsey.

At around 0615 a roll-by inspection was performed by one of the train crew as train 2BW4 entered the loop line at Kempsey. The driver then walked along the opposite side to inspect the train. A couple of loose straps were found on some wagons which were rectified and 2WB4 departed Kempsey.

A crew change was performed south of Taree station with the outgoing train crew performing a roll-by inspection. Following this the train continued the journey.

As train 2BW4 passed through Dungog platform at 1040, nearby workers noticed that a wagon on 2BW4 made contact with the platform. Network control was advised and train 2BW4 was diverted into the loop at Wallarobba for inspection.

The train crew inspected the train and identified that the wagon body on the 35th wagon (RKOX4055Y) was detached and resting on the bogie bolster at the A-end of the wagon. The bogie had shifted towards the middle of the wagon with the centre bearing sitting forward of the centre plate (Figure 2). It was the trailing bogie on the wagon. Two huck bolts^[5] from the centre bearing mount were sitting within centre plate, limiting further movement of the bogie.

Arrangements were made to remove wagon RKOX4055Y from the consist and the wagon was recovered the following day.

Minor damage was found on Grafton, Coffs Harbour, Taree, Wingham and Dungog platforms believed to be a result of contact with the detached wagon RKOX4055Y. Closed-circuit television (CCTV) footage from Coffs Harbour, Taree and Dungog showed this wagon contact the platforms with dust, smoke and sparks visible (Figure 1).

Figure 1: Train path 2BW4 and platform footage of wagon RKOX4055Y
 

Map showing the path of train 2BW4 and platform locations. Footage from Taree and Dungog platforms inset showing wagon RKOX4055Y contacting the platforms.

Source: Geoscience Australia and Sydney Trains, modified and annotated by OTSI

Figure 2: RKOX4055Y A-end bogie detached
 

Image showing the bogie as found with inset image showing the centre bearing from the opposite side.

Source: Pacific National, modified and annotated by OTSI

Context

Wagon and bogies

Wagon RKOX4055Y was a bulk steel wagon with tare mass of 27 t and a maximum capacity of 50 t. The wagon body had three openings along the side walls to allow access for loading and unloading (Figure 1 – Taree platform footage). Timber dunnage^[6] (blocks) was positioned horizontally (side wall to side wall) along the base of the wagon to support loaded material. If there are gaps between the dunnage and side wall loads can become stuck.

Each end of the wagon rested on a bogie with the centre bearing, centre plate and centre pin permitting bogie rotation. Seated correctly the bogie maintains the gauge of the rolling stock within the kinematic outline.^[7] The mass of the wagon body retains the bogie in position.

The design of the wagon body and bogie interface makes them susceptible to lifting if a load becomes stuck and can lift off the centre pin. Lift off events do occur periodically.

Loading

BSS Port Kembla (NSW) loaded wagon RKOX4055Y on 13 June 2020 with three stacks of welded beams totalling 48 t.

PN required loading to be completed in accordance their freight loading manual (Fabricated Steel (Welded Beam) Sections – Web Horizontal, FLM 05-19_09). This specified the minimum requirements for loading including:

• welded beams are loaded with the web^[8] horizontal
• inspection of dunnage, including gaps between dunnage and wagon side wall
• load is distributed evenly as possible (horizontally and longitudinal).

Welded beams are not required to have restraints securing the load due to their length and mass.

Unloading

BSS unloading procedure (Rail SOP Rail Wagon Discharge, QLD-PR-T-008) required welded beams to be unloaded from both sides to maintain weight distribution (prevent leaning or tipping of the wagon). If both sides could not be accessed the rail coordinator was to be notified to allow for appropriate arrangements to be organised. 

It was common practice to unload welded beams from one side in the same manner as other wagons. On the morning of the occurrence, there were wagons positioned on the adjacent road preventing access to both sides of wagon RKOX4055Y and this wagon was unloaded from one side only.

The unloading was conducted pre-dawn under artificial lighting within the BSS facility and the forklifts had additional lighting to assist with visibility during loading or unloading.

Both forklift operators had approximately 20 years’ experience unloading rail wagons. The forklift operators reported that welded beams could be difficult to unload if the welded beams were placed close together, touching or if the beams fell between the dunnage and side wall.

Train examination

Prior to departure PN required trains to undergo a full train examination in accordance with Train Inspection Manual’s (TIM 01-01_03 and TIM 01-02_04). These manuals specified the inspection requirement for the mechanical integrity (including underframe and bogie centre pin interface), load security and brake system and brake testing.

The full train examination was performed by two terminal operator personnel who held the required qualifications. One had 16 years’ experience and the other 27 years’ experience.

Interface agreement

PN and BSS had a safety interface agreement (SIA) as required by the rail safety national law (RSNL). The purpose of interface agreement was to:^[9]

• identify and assess risks that may arise from operations at the interface
• determine measures to manage those risks
• establish the processes for the evaluation, testing and where necessary, revision of those measures
• identify how each party will monitor compliance with its obligations under the agreement
• define the roles and responsibilities of each party to the SIA
• establish a process for keeping the SIA under review.

Safety analysis

Wagon RKOX4055Y was unloaded from one side and the forklift operator had difficulty unloading the beams. The BSS unloading procedure did not address loads that became stuck. The operators attempted to free the load using two forklifts, as the last stack of beams (approximately 15 t) became stuck between the dunnage and the side wall of the wagon. While attempting to lift the beams, the A-end of the wagon was likely lifted off the centre pin (Figure 3). Footage from the BSS Coopers Plains facility showed the corner of wagon RKOX4055Y lift before being placed down again. Neither forklift operator identified the likely lift off event and dislodged wagon body.

Figure 3: Unloading wagon RKOX4055Y
 

The upper diagram shows the unloading of wagon RKOX4055Y with the welded beams stuck between the dunnage (blue) and the wagon side walls. The lower diagram shows the wagon body and centre bearing lift off the centre pin (green) during attempts to lift the beams. Screenshots from CCTV footage showing the corner of RKOX4055Y lifted before being placed down.

Source: Pacific National footage, diagrams and annotation by OTSI

Unloading welded beams from one side likely increased the risk of a wagon lift off event, in particular, if the last stack of beams become stuck. At that point, the mass of the load is at the lightest and the capacity of a single forklift (35 t) could lift the wagon body and load.

Following the unloading, wagon RKOX4055Y was shunted to form train 2BW4. The train underwent a full train examination by PN two terminal operators. The personnel conducting this inspection did not inspect the underframe of the wagons on 2BW4. The deviation from the train examination procedure had not been identified through PNs compliance monitoring prior to the occurrence. It is likely that the dislodged wagon body on RKOX4055Y would have been identified if the underframe was inspected as required.

A roll-by inspection was completed as train 2BW4 departed the BFT. There were two additional roll-by inspections during the journey. These inspections did not identify the likely dislodged wagon body on RKOX4055Y. The manner in which the wagon body rested on the bogie would make it difficult to identify there was a rolling stock irregularity. Additionally, there were only minor scrape marks on the A-end of wagon RKOX4055Y which could be missed when inspecting three locomotives and 53 wagons (1099 m long).

The inspection of 2BW4 at Kempsey following reports of platform damage at Grafton was conducted pre-dawn. The inspection identified loose strapping which was corrected but found no faults with wagon RKOX4055Y.

The risk of a lift off event had not been identified or controlled within the SIA or within the BSS unloading procedure. The monitoring associated with the SIA and BSS unloading practices had not identified that wagons were being unloaded from one side only.

The risk controls preventing rolling stock entering service after a lift off event were:

• unloading personnel detecting the lift off event and reporting it.
• Terminal operators or maintenance personnel identifying the rolling stock irregularity prior to departure.
• roll-by inspections on departure and during the journey.

The two forklift operators reported that neither had experienced a lift off event prior to the occurrence and unaware what to look for. The PN terminal operator personnel did not inspect the underframe of 2BW4 as required and the roll-by inspections were ineffective at detecting the rolling stock irregularity.

In this instance, the wagon body was partially restrained by the huck bolts resting within the centre plate. The A-end of wagon RKOX4055Y travelled intermittently out of gauge for approximately 739 km in a trailing direction, likely reducing the consequences of this occurrence. On each occasion the wagon body contacted an obstruction such as a platform, the wagon body glanced rather than catching the obstruction.

Findings

From the evidence available, the following findings are made with respect to the out of gauge wagon on freight train 2BW4 on 16 June 2020.

Contributing factors

• The body on wagon RKOX4055Y was likely lifted and dislodged during unloading of the wagon as the welded beams had become stuck. The dislodged wagon body was not identified at the time of unloading, during subsequent inspections prior to departing as 2BW4 or during the journey.
• The underframe of train 2BW4 was not inspected prior to departing the Brisbane Freight Terminal as required by Pacific National's train examination procedure.
• The risk of a wagon lift off event and potential consequences had not been identified or controlled in the Pacific National and BlueScope Steel safety interface agreement or within BlueScope Steels unloading procedure.  

Other factors that increased risk

• Wagon RKOX4055Y was unloaded from one side contrary to the requirements of the unloading procedure, likely increasing the risk of a lift off event.  

Safety actions

BlueScope Steel

BlueScope Steel advised that the following safety actions was taken:

• The requirement to unload welded beams from both sides was reinforced with terminal personnel.
• Unloading procedure (SOP QLD-PR-T-008) was reviewed to ensure appropriate controls are in place and to highlight the risk of a wagon lift off event.
• Lift off events were included into BlueScope Steels incident management system as a reportable incident.

Pacific National

Pacific National advised that the following safety action was taken:

• Communicated the occurrence and contributing factors to the BFT terminal operators and maintenance personnel and reinforced the requirement for underframe inspections prior to trains departing the terminal.
• Required BFT terminal operators and shunting personnel to undertake an underframe inspection on each wagon before shunting from the BlueScope Steel Coopers Plains facility.
• Reviewed the safety engagement schedule to include engagements relating to full train examinations at BFT.
• Reviewed the verification of competency (VOC) assessments at BFT for full train examinations by driver trainers and train crew including inspection of the wagon body and bogie interface.

Pacific National also advised that an engineering review is currently underway to review the design of the RKOX wagons to prevent welded beams becoming stuck between the dunnage and wagon side wall.

Pacific National and BlueScope Steel

In addition to the above, the following combined actions were undertaken:

• Reviewed the Wagon Corrective Action Report (WCAR) process to include wagon lift off events as a defect requiring attention.
• Reviewed the safety interface agreement and risk assessments to ensure all risk controls are current and include risks associated with lift off events.
• Routine combined audits to be established to assess the effectiveness of the risk controls as per the safety interface agreement.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• BlueScope Steel
• BlueScope Steel Coopers Plains forklift operators
• NSW Trains
• Office of National Rail Safety Regulator
• Pacific National
• Sydney Trains.

References

BlueScope Steel (2019). Rail SOP Rail Wagon Discharge, QLD-PR-T-008, V6.0, 10 October 2019

Pacific National (2015). Train Inspection Manual, Train Inspection, TIM 01-01_03, 26 November 2015

Pacific National (2015). Train Inspection Manual, Full Train Inspection Procedure, TIM 01-02_04, 18 December 2015

Pacific National (2019). Freight Loading Manual, Fabricated Steel (Welded Beam) Sections – Web Horizontal, FLM 05-19_09, 20 June 2019

Pacific National (2020). Safety Interface Agreement, Pacific National Pty Ltd and BlueScope Steel (AIS) Pty Limited, 24 January 2020

Rail Industry Safety and Standards Board (2020). Glossary of Terms. Accessed at: https://www.rissb.com.au/glossary/

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• BlueScope Steel
• BlueScope Steel Coopers Plains forklift operator
• Office of the National Rail Safety Regulator
• Pacific National
• Transport for NSW

Submissions were received from:

• Office of the National Rail Safety Regulator
• Pacific National.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

______________________ 

1. The BlueScope Steel’s Coopers Plains facility and Pacific National’s Brisbane Freight Terminal are both located within the larger Acacia Ridge Freight Terminal.
2. Times shown in 24 hour time as Australian Eastern Standard Time (AEST).
3. Welded beams also known as fabricated steel sections are manufactured by welding plate and bar to form H or I beam sections.
4. Roll-by inspections are a visual inspection of moving rail traffic to identify equipment, loading security or other defects or failures.
5. A hulk bolt is a specialised bolt to provide a permanent mounting, in this case, permanent mounting of the centre bearing to the underside of the wagon.
6. Dunnage is packing material used to support loads and allows for loading and unloading using forklifts or lifting slings.
7. Kinematic outline - A two-dimensional cross-section of the shape of a vehicle that consists of the static outline plus the maximum permitted allowance for vertical bounce upwards plus lateral and roll movements in response to a steady-state cant deficiency force at maximum permitted cant deficiency (or the maximum permitted installed cant) and dynamic movements in response to track irregularity. Rail Industry Safety and Standards Board (2020). Glossary of Terms.
8. Web refers to the centre plate in a H or I beam. Welded beams shown with the web horizontal in Figure 3.
9. Pacific National (2020). Safety Interface Agreement, Pacific National Pty Ltd and BlueScope Steel (AIS) Pty Limited, 24 January 2020

On 16 March 2020 a Bombardier DHC-8-402 registered VH-QOE, departed Jacksons International Airport, Port Moresby, Papua New Guinea. Shortly after take-off, the flight crew detected fumes in the cockpit. Passing FL 100 on climb, the fumes became stronger and the cabin crew also reported detecting a fume smell in the cabin.

The flight crew donned oxygen masks and levelled off at FL 180. The first officer then made a PAN call and requested a return to Port Moresby. After switching off the number one bleed air, as per the quick reference handbook for smoke and fumes, the flight crew observed smoke emanating from the air vents. The crew switched off the number 2 bleed air and depressurised the cabin once the aircraft had descended below FL 100, and the smoke dissipated.

The Papua New Guinea Accident Investigation Commission (AIC) investigated the incident and requested assistance from the Australian Transport Safety Bureau (ATSB).

To facilitate this work the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003. 

The ATSB has now concluded its involvement in the investigation. 

The AIC is responsible for and will administer the release of the final investigation report into this incident.

Any enquiries relating to the investigation should be directed to the Papua New Guinea Accident Investigation Commission.

This investigation was conducted under the Transport Safety Investigation Act 2003 (Commonwealth) by the Office of Transport Safety Investigations (NSW) on behalf of the ATSB in accordance with the Collaboration Agreement. Released in accordance with section 25 of the Transport Safety Investigation Act 2003.

What happened

On the evening of 3 June 2020, two Aurizon banking locomotives assisted a loaded coal train, WH512, up the Ardglen bank in the Hunter Region of New South Wales (NSW). On completion of the banking assist at Ardglen yard, the train crew prepared the lead locomotive 5031 to become the trailing locomotive, then transferred to locomotive 5034.

The two banking locomotives started to move while the train crew were walking from 5031 to 5034. The train crew boarded 5034 and attempted to take control of the locomotives without success. As the locomotives rolled back down the Ardglen bank, the train crew attempted to stop the locomotives with a series of brake applications. The locomotives reached speeds of up to 114 km/h before derailing and overturning on their side and coming to rest 13 m apart.

The train crew sustained minor injuries in the crash and were able to exit the cabin. The locomotives were significantly damaged and approximately 100 m of rail track was also damaged.

What the ATSB found

During the process of changing ends, the driver likely depressed the Independent Brake Handle accidently, at the same time as placing locomotive 5031 into Trail Cut-out mode. This released the automatic air brake application on both locomotives.

The park brakes were ineffective in holding the locomotives on the grade at Ardglen and the banking locomotives started to roll away after the train crew left the cab of locomotive 5031. The train crew were then unable to establish control once the locomotives started rolling and the banking locomotives rolled approximately 3 km before derailing at 366.529 km near Kankool.

Aurizon did not ensure that the train crew had a consistent understanding of how to safely change ends on banking locomotives. Further, the train crew had not been trained to use the forced lead function which would have likely allowed the train crew to regain control of the locomotives.

Aurizon had not fully considered emergency egress from a locomotive overturned on its side. This increased the risk of further injury to the train crew and could also have prevented emergency services accessing personnel within the locomotive in a timely manner.

What has been done as a result

Aurizon completed their internal investigation and advised the following actions were commenced and completed to prevent recurrence:

• Completed modifications on the locomotive classes involved in the derailment to improve alignment in the braking system, resulting in improved park brake force.
• Modified the procedure clarifying steps for changing ends and when to use forced lead function and monitoring the correct application of the procedure through regular analysis of locomotive downloads.
• Developed training resources to enable more effective training in emergency situations.

Safety message

Rail transport operators should ensure, parking brake systems on locomotives are effective, regularly inspected and maintained. Their safety management systems should contain operational work instructions with sufficient detail on how to carry out safety critical tasks, such as forced lead function. Additionally, rail transport operators’ competency management systems should assess all safety critical competencies, including emergency operational instructions and emergency egress and ensure train crew are trained and assessed.

The occurrence

Preparation of locomotives and banking operation

At approximately 1750^[1] on 3 June 2020, the two-person train crew (driver A and driver B) arrived at Chilcotts Creek siding and commenced preparing the banking locomotives^[2] (5031 and 5034) for the planned assist of train WH512 up the bank between Chilcotts Creek and Ardglen in the Hunter Region of NSW.

Driver A prepared locomotive 5031 and driver B prepared locomotive 5034. Driver B joined driver A on locomotive 5031 after preparing locomotive 5034. Driver A then attempted to move the locomotives under power and noticed they were not moving as easily as they should have.

Driver B then got back down from the cab and checked the brakes on locomotive 5034. Driver B found the park brake on 5034 number 2 bogie was not releasing. The train crew cycled through applying and releasing the park brake in an attempt to make it release.

Driver B contacted the Rollingstock Defect Coordinator (RDC) to help resolve the sticking park brake. Driver B and the RDC worked through the problem and resolved the issue by manually releasing the park brake. Driver B then returned to locomotive 5031 and updated the locomotive 5034 logbook writing down the park brake issues experienced on number 2 bogie.

At approximately 1910, train WH512 arrived at Chilcotts Creek and stopped in the loop at signal CC12L. After receiving confirmation of the train being stopped, Network Control (NC) authorised the banking locomotives to depart Chilcotts Creek engine siding.

Driver A moved the banking locomotives to the rear of WH512. The train crew undertook a test attach/detach of the banking locomotives to the rear of train WH512 and conducted an independent brake test on locomotive 5034 to confirm it was operational. Both attach/detach and the independent brake were verified as working.

Between 1918 and 1945, WH512 was assisted up Ardglen bank by banking locomotives 5031 and 5034. The banking locomotives stopped prior to signal 09-12M on the main line at Ardglen and WH512 continued its trip in the Up^[3] direction towards Newcastle.

Driver A recalled reducing the power on the banking locomotives from notch 8 to notch 4 to allow the banking locomotives to come away from the rear of the train WH512.

At 1946 driver A applied the independent brake on locomotive 5031 to bring the locomotives to a stop.

Changing ends of banking locomotives

Driver B told driver A that locomotive 5031’s park brakes were on and driver A said that they turned to see the lights indicating the park brakes were on. Driver A then started the process of changing 5031 from the Lead locomotive to the Trail locomotive.^[4]

Driver A firstly moved the throttle/dynamic brake handle to idle and the reverser handle to neutral. They then moved the automatic brake handle to the Handle Off (HO) position which activated the Electronic Brake Valve (EBV) to release the air pressure in the train brake line to zero.

When the air pressure had dropped to zero, driver A turned the locomotive headlights off and released the independent brakes. Driver A then used the locomotive Smart Display Interface Screens (SDIS) to place locomotive 5031 into Trail Cut-out mode which electronically isolated the EBV and the independent brake. After completing this task Driver A stepped off locomotive 5031 and started to walk towards locomotive 5034. Earlier, Driver B had exited the cabin and made their way towards the hut to activate the level crossing.

Runaway and derailment

At 1948, with both drivers outside the locomotive and in the process of changing ends, the banking locomotives began to slowly roll in the Down direction back towards Chilcotts Creek. Driver A had just reached locomotive 5034 when they noticed the locomotives slowly moving. Driver A called out to driver B, and driver A then boarded the moving locomotive and got into the driver’s seat. Driver B boarded locomotive 5034 shortly after.

Figure 1: Runaway

This figure shows the path of the runaway and the speed of the locomotives as they progressed from Ardglen towards Kankool.

Source: SIX maps and ARTC trip report, modified by OTSI

Driver A attempted to activate locomotive 5034 as the Lead locomotive using the SDIS but the screen did not respond. Driver A pressed the vigilance reset button and turned the locomotive headlights on.

Driver A then moved the automatic brake handle from the HO position into the service zone, which had no effect in stopping the locomotives. The locomotives had increased speed to approximately 6 km/h. Driver B also attempted to activate locomotive 5034 as the Lead locomotive on the SDIS screen but could not get the system to acknowledge commands.

Driver B told driver A to apply the emergency brake, then driver B leaned across driver A and placed the automatic brake handle into emergency but this had no effect in stopping the locomotives. Driver B sounded the horn as the locomotives passed the level crossing, one minute and 45 seconds had elapsed from when the locomotives started to move and they were travelling at approximately 29 km/h.

At 1950, Driver B made an emergency call to Network Control and reported that they were a runaway train. The Upper Hunter Network Control Officer (NCO) asked for clarification of their situation. Driver B remained in communication with the NCO over the next 2 minutes.

Driver A moved the automatic brake handle to the release position, the locomotives were travelling at approximately 73 km/h. Driver A moved the automatic brake handle to the emergency position again but there was no effective application of the brakes. Driver B was still on the radio with the NCO and reported they had no effective brakes and were travelling at 87-88 km/h. The NCO confirmed that the track ahead was clear through to Chilcotts Creek.

About four minutes had elapsed and the locomotives were travelling at approximately 114 km/h when the data logger on locomotive 5031 stopped recording at 1952. At the same time, Network Control observed the locomotives disappear from the Phoenix display^[5]. The locomotives had derailed.

The NCO attempted to contact the train crew two times unsuccessfully. On a third attempt, the train crew responded advising the NCO that the banking locomotives had tipped over on their side and come to rest.

Driver B reported that they were okay and were trying to get out of the locomotive cabin. They also made a call to Aurizon Control to inform them of their situation.

The locomotives had derailed at 366.529 km by overturning to their left side and parting in the process, sliding along the ballast, before coming to rest approximately 13 m apart at 366.619 km.

Post derailment and recovery

Driver A attempted to push the front windscreen of the locomotive open but was unsuccessful. As the locomotive was lying on its left side, the designated emergency escape was through the open side window on the right side of the cabin, which was now approximately 1.2 m above head height. Driver B managed to climb up and out of the cabin and driver A followed shortly after.

When driver B exited the cabin, they made another phone call to the NCO to advise them they were out of the locomotive cabin and was informed by the NCO that NSW ambulance and Fire and Rescue NSW personnel were on their way.

Driver A heard fluid leaking and smelt diesel fuel and found it was coming out of locomotive 5031. Driver A was able to locate a rag and stem the flow of the fuel until emergency services could arrive.

At approximately 2030 emergency services arrived. The train crew were treated for their injuries which included bruising to the left elbow and a cut to the head of driver A and injury to the right ear and other cuts and abrasions to driver B.

Both locomotives sustained significant damage and approximately 100 m of rail track was damaged as a result of the derailment.

Figure 2: Derailed locomotives

Source: OTSI

__________

1. Times shown in 24-hour time as Australian Eastern Standard Time (AEST).
2. A locomotive provided to assist rail traffic on a steep grade (bank).
3. Up direction refers to trains travelling towards Sydney, Down direction refers to trains travelling away from Sydney.
4. ASee pages 14 and 15 for further details for changing ends and for changing between lead and trail.
5. Phoenix is Australian Rail Track Corporation (ARTC) centralised train control system.

Context

Location

Kankool is a locality in the Hunter Region of NSW approximately 200 km north-east of Newcastle. The banking locomotives derailed and came to rest approximately 2 km from Kankool.

Figure 3: Location map

Source: Geoscience Australia, modified by OTSI

Ardglen bank

The section between Chilcotts Creek and Ardglen is where WH512 required assistance from the banking locomotives. This section of track is more commonly referred to as the Ardglen bank and freight services generally require banking locomotives to assist them up the hill towards Ardglen.

The ruling grade^[6] on the Ardglen bank between Ardglen and Kankool is 1:40, between Chilcotts Creek and Kankool the ruling grade is 1:38 (Figure 4).

Figure 4: Ardglen bank

This figure shows the gradient between Chilcotts Creek and Ardglen. Figure is not to scale.

Source: ARTC NSW Curve and Gradient Diagrams: Section 1 – North and Hunter Valley, modified by the OTSI

Organisations

Australian Rail Track Corporation

The Australian Rail Track Corporation (ARTC) was the rail infrastructure manager. ARTC was an accredited operator^[7] and since September 2004 held a 60-year lease of the interstate and Hunter Valley rail lines of NSW.

Aurizon

Aurizon was the rollingstock operator responsible for WH512 and the banking locomotives that assisted WH512 up Ardglen bank. Aurizon (previously known as QR National) was also an accredited operator and has had above rail operations in the Hunter Valley since 2005. QR National was rebranded Aurizon in December 2012.

Environmental information

Weather observations from Murrurundi Gap Station (approximately 6 km south-east from Kankool) recorded the temperature at 3 pm at 11.5 °C. There had been no recorded rain on the day and 1.2 mm was recorded the day before.

The first light at Ardglen was at 0623 and the last light was at 1727. The incident occurred at 1750, in darkness.

The Ardglen Yard is open with good visibility. The ARTC curve and gradient diagram (Figure 4) indicates the rail line is on a 1:147 grade prior to the Ardglen tunnel entry. The diagram also indicates the rail line through the yard is on a 1:107 grade and transitions to a 1:44 grade.

Train crew

The train crew both worked from the Quirindi depot.

Driver A

Driver A had been a train driver with Aurizon since September 2012 working in Central Queensland and NSW. Driver A joined the Quirindi depot in February 2017. Driver A had acquired the Aurizon competency as a main line driver prior to joining Quirindi depot and qualified for the relevant Aurizon accreditation to undertake banking operations on 26 August 2017.^[8]

The roster for driver A in the week prior to the incident is shown in Table 1.

Table 1: Actual duty times for driver A^[9]

Driver B

Driver B had transferred to Quirindi depot from Antiene in September 2019. Driver B was the co-driver or second qualified driver on the locomotives. Driver B had acquired the Aurizon competency as a main line driver in May 2019 and qualified for the relevant Aurizon accreditation to undertake banking operations on 12 May 2020.

The roster for driver B in the week prior to the incident is shown in Table 2.

Table 2 Actual duty times for driver B

Based on the duty times worked by the train crew and the time the incident occurred, fatigue was not considered a contributing factor.

Rollingstock information

Locomotives

Both locomotives (5031 and 5034) involved in the incident were 5020 class locomotives (Standard Gauge, 180 tonne, 3184 kW tractive power, model C44acHi). The locomotives were built in 2010 by United Group Limited (Rail) at Chullora NSW.

The locomotives were set up to run as an end-to-end configuration which allowed the locomotives to be operated from the front cabin of whichever locomotive was in the Lead for the direction of travel (Figure 5).

Figure 5: Banking locomotives

This figure shows the end-to-end setup of the banking locomotives. Locomotive 5034 faced the Up direction.

Source: C44acHi Locomotive Vol.1 Rev 00 Operator’s Manual, modified by the OTSI

The Air Brake System

FastBrake® Electronic Air Brake is a microcomputer based electro-pneumatic braking system developed by Wabtec Corporation. It is the braking system used on the 5020 class locomotives.

The system consists of two major components, the Electronic Brake Valve (EBV) and the Pneumatic Operating Unit (POU).

Electronic Brake Valve

The EBV consists of two handles that are used to operate the locomotive and train air brake system. The handles are the Automatic Brake and Independent Brake.

Figure 6: Electronic Brake Valve

This figure shows the EBV, with the Automatic Brake Handle in HO position and the Independent Brake Handle in REL position. This is the positioning the handles should be in when a locomotive is set up as a Trail unit

Source: OTSI

Automatic Brake Handle

The Automatic Brake handle is used to apply brakes to a consist that is being hauled by the locomotive. The Automatic Brake handle operates through six control positions:

1.         Release (REL)
2.         Minimum reduction (MIN)
3.         Full service (FS)
4.         Suppression (SUP) 
5.         Handle off (HO) or Continuous service (CS) 
6.         Emergency (EMER).

The service zone is between MIN and FS. A brake application in the service zone will reduce brake pipe pressure by 43 kPa with a MIN application and up to 193 kPa with a FS application.

As stipulated in the Operator’s Manual^[10] the Automatic Brake handle should be moved to HO position when the locomotive is a Trail unit in a multiple-unit configuration or is being towed as an unpowered unit.

Independent Brake Handle

The Independent Brake handle is used to apply brakes to the locomotive only.

It has two positions:

1.         Release (REL)
2.         Apply (FULL).

When the handle is in the REL position the brakes are released. As the handle is moved towards the FULL position, the brake application is gradually increased.

The Operator’s Manual stated that, the independent brake handle should always be in the REL position when set up as a Trail unit in a multiple-unit configuration or when it is being towed as an unpowered unit (Dead).

Pneumatic Operating Unit

The POU responds to the electrical signals from the EBV to control (apply/release) the train air brakes. There are four major components:

1.         Brake Pipe control
2.         Brake Cylinder control
3.         Independent application and release
4.         Power supply.

The train driver sends commands to the braking system through the EBV. When the automatic brake handle is moved to a position other than REL, the Brake Pipe pressure will reduce and result in the application of the automatic train brake including the locomotives.

When an automatic brake application has been made, the independent brake handle can be used to make an independent release of the automatic brake application on the locomotives (bail-off). This is to minimise the effect of hauled rollingstock bunching into the rear of the locomotives.

Bail-off is achieved by pushing the independent brake handle down towards the floor of the locomotive. The spring action in the handle returns the handle to its original position when released and stops the bail-off. The brakes return to the service application level a few seconds after the handle is released.

When the independent brake is applied, positive air pressure is placed in the No.3 Control Pipe and brakes apply. When the independent brake is released, positive air pressure is placed in the No.4 Independent Release Pipe and brakes release. Figure 7 shows the end air pipe connections at the rear of locomotive 5031 which were connected to the rear of locomotive 5034. With these pipes connected, commands to the braking system from the Lead locomotive pneumatically triggered the same braking control functions in the Trail locomotive.

Figure 7: Air pipe connections

This figure shows the end air pipe connections of locomotive 5031

Source: OTSI

Spring Applied Park Brake System

The locomotives had spring applied, air pressure released, park brakes mounted on each bogie. Each park brake cylinder unit operated two brake shoes to actuate braking on two axles of each bogie.

The park brakes were applied and released using push buttons situated on a panel located behind the driver’s seat (Figure 10). When a park brake button was pressed on, an electrical signal was sent to apply all park brakes in the locomotive consist.

When the park brakes were sticking on locomotive 5034, driver B manually released the park brake. The worm screw spindle located on the rear of the park brake cylinder was wound in an anticlockwise direction to release the park brake.

If required, the spring park brake could be manually applied by rotating the worm screw spindle in a clockwise direction.

Figure 8: Park brake system

This figure shows the park brake mechanism which is located on one of the bogies of a 5020 class locomotive.

Source: OTSI

To reset and reapply the spring park brake, air pressure must be reapplied to the park brake; this releases the park brake and resets the manual override feature. An application of the park brake can then be made using the push buttons, which vents air pressure from the park brake.

The braking system also contained an anti-compounding air brake circuit which prevented simultaneous application of the service brake and the spring park brake. The combined force of the spring park brake and the service brake is additive and would be excessive without the anti-compounding brake circuit.

Smart Display Interface Screens

There are three Smart Display Interface Screens (SDIS) that allow the train crew to set up, control, and monitor locomotive operation. The SDIS receives touch screen input from the train crew and displays the operating conditions of the locomotive. Two screens are located at driver A’s control position and another is located at driver B’s position.

The SDIS could only be used when the locomotives were stationary. Screen parameters could not be changed when the locomotive was moving faster than 0.8 km/h.

Figure 9: Locomotive cabin

This figure shows the SDIS screens and train crew positions. Two images were merged to display full cab layout.

Source: OTSI

Master Controller

The Master Controller comprised of two handles: the Reverser handle and the Throttle/Dynamic brake handle. These interlocked handles are used by the driver to set direction, regulate locomotive speed, and apply dynamic braking.

The Reverser handle

The Reverser handle is a removable handle that when removed, disables the Master Controller.

When the Reverser handle is inserted, it can be used to set the direction of travel of the locomotive. The handle can be set to forward mode by moving the handle forward, neutral by centring the handle or reverse by moving the handle rearwards.

A mechanical interlock with the Throttle/Dynamic brake handle prevents the Reverser handle from being moved from the neutral position unless the Throttle/Dynamic Brake handle is set to notch 0.

The Throttle/Dynamic Brake handle

The Throttle/Dynamic Brake handle is used to control locomotive speed and dynamic braking.

As a dual-purpose handle, it is spring loaded to maintain separation between throttle and dynamic brake operations. The default position is in throttle operations.

To operate as a throttle handle, the Reverser handle has to firstly be placed in either forward or reverse and then the throttle handle can be moved between the nine throttle notch positions (0  to  8).

To use Dynamic Brake operations the handle must be pushed to the right against the spring, through a mechanical interlock, and forward to the Dynamic Brake setup position.

Once the Dynamic Brake handle is in the setup position, the Dynamic Brake handle can be moved forward to increase braking, and rearward to decrease braking.

Figure 10: Driver’s controls

This figure shows the layout of the driver’s controls
Source: OTSI

Other controls situated next to the Master Controller are the Horn control switch and the Vigilance reset push-button. The Horn control switch initiates the operation of the town and country horns. The Vigilance reset button was the interactive point of the random non-predictive-type vigilance control system fitted to the locomotive.

Banking operations

Aurizon conducted its banking operations utilising the train crew from the Quirindi depot. Up to four trains could be bank assisted between Chilcotts Creek and Ardglen in a 24-hour period.

A local work instruction for the Quirindi depot detailed the procedure for bank working between Chilcotts Creek and Ardglen.^[11] Specifically, requirements when departing from Chilcotts Creek Siding, attaching and detaching with the train to be assisted, the banking operation, the change of operating cabins and the return of the locomotives to the Chilcotts Creek Siding.

Banking operations were conducted with two train crew members. Both crew members travelled in the cabin of the Lead locomotive in the direction of travel.

According to the procedure, banking operations commenced once the train to be banked had stopped in the siding and made a full-service automatic brake application. The driver of the banking locomotives was required to request permission from the driver of the train to be banked to attach to the rear of the train. Once attached, a test was conducted to ensure the anti-coupling device operated correctly by remaining released.^[12] 

The driver of the train being banked notified the banking locomotive train crew of the signal to proceed and banking commenced. Communication of signal indications was provided by the driver of the train being banked and had to be acknowledged by the banking locomotive train crew. At Ardglen, the banking locomotive driver reduced throttle power to allow the train to detach and continue its journey while the banking locomotives came to a stand prior to the Up home starting signal (09-12M) at Ardglen.

Once the banking locomotives stopped at Ardglen the train crew on the banking locomotives completed the process of changing ends.

Figure 11: Phoenix display

This figure shows the separation of banked train (WH512) from the banking locomotives (AZBK) prior to reaching the Up home starting signal (09-12M) at Ardglen.

Source: ARTC, modified by OTSI

Changing ends

The banking locomotives were operated as a multiple-unit configuration. In this configuration one locomotive is deemed the Lead and the other locomotive/s are set to Trail or un-powered (Dead). This allows the train crew to operate the consist from the cabin of the Lead locomotive only, with commands passing to the Trail locomotive through the MU cable^[13] and the connected pneumatic hoses.

To change ends so control can be passed from the cab of one locomotive to the cab of the other locomotive, the C44acHi Locomotive Volume 1 Operator’s Manual provided instructions on how to set up the locomotive as Lead, Single, Trail or Dead.

Locomotive setup as Lead

According to the manual the following procedure sets the locomotive as the Lead:^[14]

1. Set all applicable circuit breakers on the Engine Control (EC) panel ON or OFF for Lead or Trail. All circuit breakers should be ON for Lead operation.
2. Verify the Master Controller handles are in the following positions in the Lead locomotive:
   • Dynamic Brake handle is in OFF position.
   • Throttle handle is in IDLE.
   • Reverser is in the centre position.
3. Verify the Electronic Air Brake (EAB) system is properly set up for Lead operation.
4. Ensure that the Electrically Controlled Pneumatic (ECP) Brake system is set up for operation.
5. SDIS ELECTRONIC AIR BRAKE, in this publication for additional information.
6. Set the appropriate headlight switches ON or OFF for short hood (No. 1 end) Lead or long hood (No. 2 end) Lead.
7. The EOT [End of Train] devices (if used) must have an identification code and be armed to function.
8. The Lead locomotive is identified on the SDIS for EAB operation. Set up all Trail locomotives in the consist before identifying and setting up the Lead locomotive.
9. Set the Engine Run circuit breaker, Generator Field circuit breaker, Control circuit breaker, and the Dynamic Braking control circuit breaker to ON in the Lead locomotive. Start all locomotive engines in the consist and ensure the MU lines [cables] are connected before setting the circuit breakers to OFF in the Trail units.

Locomotive setup as Trail

According to the manual the following procedure sets the locomotive as a Trail locomotive:^[15]

1. Set all applicable circuit breakers on the Engine Control (EC) panel ON or OFF for Lead or Trail. In a Trail configuration, follow the labels or all Railroad Operating Procedures for proper settings.
2. Move the Reverser handle to the centre position and remove the handle. The Throttle handle is in IDLE.
3. Verify the Electronic Air Brake (EAB) system is properly set up for Trail operation.
4. Move the EBV Automatic Brake handle in the HANDLE OFF (HO) position and Independent handle in the RELEASE (REL) position for Trail operation.
5. Set the appropriate Headlight switches ON or OFF. Follow all Railroad Operating Procedures.
6. The EOT devices (if used) must have an identification code and be armed to function.
7. The Lead locomotive is identified on the SDIS for EAB operation. Set up all Trail locomotives in the consist before identifying the Lead locomotive in SDIS.
8. Set the Engine Run circuit breaker, Generator Field circuit breaker, Control circuit breaker, and the Dynamic Braking Control circuit breaker to OFF in the Trail locomotives. Start all locomotive engines in the consist and ensure the MU lines [cables] are connected before setting the circuit breakers to OFF in the Trail units.

Competency for banking operations

Train crew deemed competent to operate banking operations were required to have successfully completed training.^[16] The knowledge and practical assessment for bank engine working was conducted on train crew that have successfully completed ‘Engine and Air’ school as a pre-requisite.

The questions contained in the assessment document^[17] asked of the person being tested to either demonstrate or explain parts of the procedure.

There were 11 questions in the assessment document, but none specifically asked the person being tested to demonstrate or explain the process for changing ends.

The assessment was completed on the job. The assessor was required to only sign off a person as competent, if they were confident the person had a thorough understanding of the location and operation of the various items of locomotive equipment. The ‘on job’ assessment was used to assess banking operations in various locations across the network.

Driver A was assessed on a route from Ardglen to Murrurundi and return on 29 August 2017. This route included the Ardglen Bank. Driver B was assessed on a route from Werris Creek to Drayton Junction and on a route from Murrulla to Werris Creek on 20 May 2020.These routes included the Ardglen bank. Both driver A and driver B were assessed as competent.

Inspections and maintenance of locomotives

Prior to operation, train crew were required to undertake a series of inspections of the locomotives. These included a ground inspection, inspection after boarding and inspection after engine start up. These were conducted by driver A and driver B of locomotives 5031 and 5034 respectively.

The train crew encountered a problem with the park brake on 5034 not releasing which was rectified with the aid of the RDC. The locomotives were certified okay to operate as per Aurizon’s pre-start locomotive checks and inspections work instruction^[18].

A review of the locomotive maintenance records over the previous two years indicated both locomotives had been serviced regularly and consistent with the requirements of the maintenance schedule. The locomotives were required to be inspected at 122, 366 and 732-day cycles.

Brake functionality tests were required during each inspection. Additionally, brake functionality tests were conducted when a locomotive required additional out of sequence inspection and maintenance.

A review of the planned work for the previous two years revealed one park brake problem on locomotive 5031. The park brake was reported as intermittently not applying and was scheduled for inspection on 6 December 2019. During the inspection, testing of the park brake cylinder found it was functioning correctly and the fault could not be replicated, and the locomotive was cleared to return to service.

__________

6. Ruling grade is the steepest point between two points on a given section of track. The steepest grade dictates the motive power required to successfully move a train up the hill. A 1:40 grade means there is 1 metre of vertical rise over 40 m.
7. The purpose of accreditation by the ONRSR is to demonstrate that a Rail Transport Operator (RTO) has the competence and capacity to manage safety risks associated with its railway operations by implementing its safety management system and to safely manage changes to its operations.
8. Train Driver Route Accreditation NSW 40008218 WCK > MURRURUNDI BANK ENGINES & RTN.
9. Table 1 and Table 2 Duty start and end times provided by Aurizon, Duty time and Time off calculated by OTSI
10. UGL Rail C44acHi Locomotive Volume 1 Revision 00 Operator’s Manual
11. 14-WI-124-SDCNSW Bank Locomotive Working Chilcotts Creek to Ardglen
12. The anti-coupling device prevented the banking locomotives hard coupling to the train being banked. The device had to be checked regularly for damage and conformity.
13. MU cable is the Multiple Unit cable that provided electrical commands from a leading to trailing locomotive.
14. GEJ-7045 Operating Manual C44-ACi Locomotive Apr 2010, pp.127-128
15. GEJ-7045 Operating Manual C44-ACi Locomotive Apr 2010, p 128
16. Train Driver Route Accreditation NSW 40008218 WCK > MURRURUNDI BANK ENGINES & RTN.
17. AURIZON On Job Bank Engine Working Assessment Version 1.0
18. 14-WI-004-SDCNSW Train Start-up Inspection – Interim ECP Brake Test (v1.4)

Safety analysis

Uncontrolled runaway of banking locomotives

Inadvertent depression of the Independent Brake Handle

The location of the independent brake handle leaves it susceptible to possible depression by the driver when the driver is interacting with the SDIS. The independent brake handle sits approximately below the driver’s elbow. A review of the activities undertaken by the train crew, as recalled from interviews and from the event recorder log, suggests that this was the most likely scenario to have occurred.

Driver A was interacting with the SDIS to change the locomotive from Lead to Trail. As they leant forward to do this, driver A likely inadvertently depressed the independent brake handle (Figure 12) causing the brake cylinder to vent air to atmosphere. At 1947:45, when driver A placed locomotive 5031 into Trail Cut-out mode, they were unaware brake cylinder air had also started to vent and continued until the brake cylinder pressure reached 0kPa.

Figure 12: Independent brake handle and SDIS

Source: OTSI

Post-incident testing to re-create a continuous air pressure release from the brake cylinder was conducted.

Continual air pressure release from the brake cylinder could only be achieved when the independent brake handle was depressed towards the floor (bail-off) at the same time the locomotive was set to Trail. These combined actions instructed the locomotive to maintain the release of air from the brake cylinder after downwards pressure is released from the independent brake handle and return springs move it to its regular position. Continual air pressure release from the brake cylinder could also be interrupted by venting the No.4 pipe. This results in the system resetting and re-applying the air brake.

Ineffective park brakes

Post-incident testing and stripping of the locomotive park brake cylinders was conducted by the operator in the presence of the Office of the National Rail Safety Regulator (ONRSR). This process verified the cylinders were operational and working to standard.

The standard for braking systems for locomotive rollingstock AS7510.1:2014 states:

A park brake shall hold the locomotive stationary on a 1:30 gradient under all conditions of loading of the uncoupled locomotive.

However, further investigation into the performance of the park brake system found previously undetected misalignment of the brake rigging on the vertical and horizontal planes and friction levels were contributing to a significant decrease in effective park brake force (Figure 13 and Figure 14).

Figure 13: Brake cylinder connection to top lever

This figure shows the misalignment of the top lever with the brake cylinder.

Source: Aurizon

The misalignment and friction in the brake rigging likely resulted in a reduced efficiency transfer of brake cylinder force, approximately 55 to 65 per cent efficiency. This resulted in a reduced force being applied at the interface of the brake pad and the wheel (brake shoe force).

The investigation into the performance of the park brake system found the locomotive park brake hold force was not effective on gradients steeper than 1:40.

Figure 14: Pivot plate and shackle

This figure shows points of friction and horizontal misalignment.

Source: Aurizon

Gradient of track at Ardglen

The gradient of the track at Ardglen was stated in the ARTC Curve and Gradient Diagrams as 1:107. However, further consultation with ARTC confirmed the gradient of the track at Ardglen was between 1:39.4 and 1:43.1 at the location the locomotives were stationary during the change of ends.

While the gradient of the track was steeper than the published gradient of 1:107, it was not as steep as the specified 1:30 gradient that applied park brakes were required to hold locomotives stationary.

In the context of the locomotives running away, the gradient of the track was between 1:39.4 to 1:43.1 and the locomotive park brake hold force was not effective on gradients steeper than 1:40.

It is likely the locomotives started to move when the release of air from the brake cylinder decreased the brake shoe force.

Anti-compounding air brake mechanism

Operator testing after the incident showed that the brake shoe force dips below the applied park brake force when the independent brakes are released (Figure 15).

Figure 15: Brake shoe force over time

This figure shows the brake shoe force over time with a transition of independent brake to the park brake.

Source: Aurizon

It is likely this dip in brake force was caused by the arrangement and components used in the anti-compounding air brake mechanism. This acts to prevent excessive or compounded pressure being applied at the brake shoe and wheel interface. The brake force from the independent brake and the park brake applied together was greater (92.44kN) than when the park brake was applied alone. Additionally, when the independent brake was released, the resulting brake force dipped briefly before the park brake force settled at 65kN. It is most likely the locomotives started to roll when the resultant brake shoe force decreased during the brake force dip.

Change of ends process

Work Instruction

Aurizon had a work instruction for bank locomotive working between Chilcotts Creek and Ardglen^[19] that specified the process for changing ends. The detail in the work instruction for changing ends was brief with the primary instructions including, the park brake must be applied before cutting out the Lead locomotive and changing of ends should happen in Ardglen Yard.

Work instructions in quality management systems^[20] explain ‘how’ things need to be done. They are the step-by-step guide to implementing what an organisation expects and provides focus for those who are doing the actual work.

The work instruction lacked specific detail about how to safely change ends. This information was included in the Operator’s Manual and also detailed in the Training documentation.

Without the step-by-step information being detailed in the work instruction, Aurizon’s system did not provide a clear ‘how to’ for safely changing ends. Rather it provided what needed to be done which was then left to the train crew to conduct as they could recall from their training.

Training documentation

Aurizon had a training and assessment program that included instructions on how to change driving positions in multiple-unit configurations^[21]. Comparisons between the steps in the training documentation and those in the work instruction revealed that there was no step in the training documentation to apply the park brake.

The steps taken by the driver on the day of the incident were consistent with the steps required in the training documentation.

Training and competency assessment

The training and assessment program also included an ‘on job’ assessment for banking operations.^[22] This was the bank engine working knowledge and assessment undertaken by driver A and driver B. As mentioned in ‘Competency for banking operations’ (p16), there was no question specifically requesting the person being assessed to demonstrate how to change ends.

While it is probable the assessor may observe this in the course of an assessment, there was nowhere for the assessor to record this on the documentation. Without a record of the assessment there was no way of assuring that the competency of safely changing ends had been assessed for all train crew.

With inconsistencies between the work instruction and the training documentation and no method of assuring assessment of the change of ends competency had been completed, Aurizon’s system for safely changing ends in Ardglen Yard did not ensure train crew had a consistent understanding of the process.

Banking locomotives derailed

Control of the locomotives

The train crew had moved from the cabin of locomotive 5031 into 5034 with both locomotives in Trail Cut-out mode and the last instruction to the locomotives was to release air from the brake cylinder (bail-off).

With equalising reservoir pressure exhausted, brake pipe pressure zero and cut out, and all air released from the brake cylinders, the air brake system was rendered ineffective.

Shortly after sitting down in the driver’s seat, driver A attempted a brake application by moving the automatic brake handle to full service. This had no effect in stopping the locomotives as the locomotive was still in Trail Cut-out mode.

A few seconds later the automatic brake handle was placed into emergency, also to no effect in stopping the locomotives as the locomotive was still in Trail Cut-out mode. This application appears to have released a slight build-up of air in the brake pipe (see blue line in Figure 16). The cause of the slight build-up of air in the brake pipe (to 34 kPa) could not be determined. The brake pipe pressure did not increase again from 0 kPa after this first emergency application.

Figure 16: Analysed event recorder log

This figure provides an explanation of activities coinciding with recorded data on locomotive 5034.

Source: Aurizon

As the locomotives approached a speed over 70 km/h, driver A moved the automatic brake handle to the release position and then attempted another emergency application. There was no effective application of the brakes due to the locomotive already being in emergency braking status with brake line pressure at 0 kPa.

At an increasing speed, the locomotives approached a series of left- and right-hand bends with a signposted track speed of 55 km/h. The locomotives remained upright travelling at approximately 93.5 km/h through a left hand 360 m curve radius bend. They managed to continue upright into the start of a right hand 220 m curve radius bend as they accelerated towards 114 km/h. As the locomotives reached the exit transition of this 220 m right-hand curve, centrifugal force lifted the right hand wheels and overturned the locomotives to the left side of the track. The locomotives separated and slid approximately 100 m before coming to rest 13 m apart.

The brake cylinder pressure remained at 0 kPa until the locomotives derailed and separated. When this happened, the brake cylinder pressure recovered as a result of No.4 air pipe being separated between the locomotives and air releasing from this pipe. This was evidenced by the brakes re-applying on the locomotives when they came to rest (purple line in Figure 16).

In the train crew’s attempts to gain control of the locomotives, the SDIS interface did not allow the train crew to change locomotive 5034 to Lead as the locomotives were already moving faster than 0.8 km/h. The inability to change locomotive status through the SDIS was a mechanism to prevent conflict once locomotives were moving.

At this point in time, there was only one way the train crew could have re-established control of the locomotives. However, the train crew were not aware of the forced lead function which would have allowed them to take control of the locomotives.

Forced lead function

This was a known method of placing locomotives into Lead status. In Lead status the driver has operational control of the locomotive and any other locomotive when in a multiple-unit configuration. The forced lead function could be applied by placing the generator field switch to on and moving the reverser handle in any direction. The instructions on how to do this were in some of Aurizon’s procedures however, the train crew were not aware of it.

The forced lead function was not included in the bank working instruction, however it was contained in Aurizon’s locomotive training material for 5020 class locomotives, specifically, Aurizon’s C40aci Locomotive Module 3, Section 2 Participant’s Handbook (v1.0).

While it was contained in the training material, there was no written or practical assessment that ensured the train crew would be tested on it.

It is likely that had the train crew had knowledge of and been trained in the forced lead function, it would have prevented the runaway from escalating. The train crew could likely have regained control of the locomotives shortly after the start of the runaway. As a control mechanism to allow the train driver to regain control of the locomotive, it would be reasonable to have this function taught to train crew as an emergency response mechanism.

The ONRSR released a safety message: Wabtec Air Brake System – advice to Rail Transport Operators on 18 February 2021. It required Rail Transport Operators to ensure their crew were aware the Wabtec Air Brake System installed on locomotives did not allow the cab setup to change from Trail to Lead once the locomotive is moving. Also that this feature could be overridden using the forced lead function.

Emergency egress

The Operators’ Manual for 5020 class locomotives provides a section on emergency egress which states:

Emergency egress from the Operator’s cab is by sliding open either of the side windows of the cab. This means of escape should only be used in an emergency where safe exit via the vestibule cab and the platform side doors is not available.

When the locomotives derailed, they tipped to their left side, and came to rest.

The egress options available to the train crew at this time were via the vestibule cab and platform side doors or via the right-side window which was now directly overhead. The train crew attempted to break open the front windscreen to exit the cabin but were unable to do so. The windscreens of the 5020 class locomotive were a high impact resistance tinted glass.

There was a similar scenario in the Derailment of freight train near Julia Creek, Qld on 27 December 2015. A 2800 class locomotive tipped on the right side. The train crew attempted to exit through the front windscreen but were unable to break it open with an emergency hammer. The crew decided to exit the cab through the side window. The emergency hammer was not intended for breaking the front windscreen, it was to break the side windows in the event they did not slide open.

The option to exit through the vestibule cab and platform side doors was not used at the time. Driver B exited through the side window as it was the most direct path out.

At interview, driver A expressed the desire to get out of the cab after it had tipped. After repeated unsuccessful attempts to break the front windscreen with the heel of their boot, driver A chose to follow the path out the side window that driver B had taken earlier.

With the locomotive on its side, exit via the vestibule and by the side window required the train crew to climb up using internal structures. Exiting via the vestibule also required passing through doors, which to open, likely added further complexity and risk to the escape route.

In an emergency, when a person has a heightened level of stress, activities that require complex thought or action only increases stress. Leaving the cab after an accident should be as easy as possible.^[23] The most direct and simple path is likely the path the person will choose to escape.

With the width of a 5020-class locomotive at 2.94 m, the train crew climbed upwards and out through the side window. This increased their risk of injury of fall both while climbing out of the cab and then coming down from the side of the locomotive to the ground.

Had the train crew been seriously injured and unable to egress the cab without assistance, emergency services would also have had difficulty accessing the cab. In situations where a critically injured person requires attention in a timely manner, the access/egress provisions to the locomotive cab while on its side were not suitable.

The Rail Industry Safety and Standards Board (RISSB)^[24] developed rollingstock standard AS 7522 Access and egress. It was first released on 23 August 2012 with the latest edition published on 23 March 2021. The standard provides the following information with regarding emergency evacuation from locomotive rollingstock:

‘Enclosed cabs of rollingstock shall be fitted with sufficient emergency exits to provide escape paths to the vehicle exterior when the vehicle is upright and when overturned on the side.’

The 5020-class locomotive was built prior to these standards being released when consideration of emergency egress when the locomotive is overturned on the side was not an Australian Standard. However, the risks to the train crew attempting to exit a cab that has overturned on its side warrants a review of the emergency egress provisions.

__________

19. Aurizon 14-WI-124-SDCNSW Bank locomotive working Chilcotts Creek to Ardglen
20. ISO 9001 is the international standard for Quality Management Systems, published by ISO (the International Organisation for Standardisation)
21. Aurizon C40aci Locomotive Module 4 Participant’s Handbook, section 5: Multi Unit Operation
22. Aurizon On Job Bank Engine Working Assessment v1.0
23. Human Factors Guidelines for Locomotive Cabs, US Department of Transportation, Federal Railroad Administration
24. Human Factors Guidelines for Locomotive Cabs, US Department of Transportation, Federal Railroad Administration

Findings

From the evidence available, the following findings are made with respect to the Uncontrolled runaway and derailment of banking locomotives near Kankool on 3 June 2020

Contributing factors

• During process of changing ends, the driver likely inadvertently depressed the Independent Brake Handle, at the same time as placing locomotive 5031 into Trail Cut-out mode. This released the automatic air brake application on both locomotives
• The park brakes were ineffective in holding the locomotives on the grade in Ardglen Yard (Safety issue)
• The banking locomotives started to roll away after the train crew left the cab of locomotive 5031. The train crew were then unable to establish control once the locomotives started rolling and the banking locomotives rolled approximately 3 kms before derailing at 366.529 km near Kankool
• Aurizon did not ensure train crews had a consistent understanding of how to safely change ends on banking locomotives (Safety issue)
• The train crew had not been trained to use forced lead function which would likely have allowed the train crew to regain control of the locomotives (Safety issue)

Other factors that increased risk

• Aurizon had not fully considered emergency egress from a locomotive overturned on its side. This increased the risk of further injury and could also have prevented emergency services from accessing personnel within the locomotive in a timely manner

Safety issues and actions

The park brakes were ineffective

Safety issue number: RO-2020-008-SI-01

Safety issue description: The park brakes were ineffective in holding the locomotives on the grade in Ardglen Yard

Change of ends process is unclear

Safety issue number: RO-2020-008-SI-02

Safety issue description: Aurizon did not ensure train crews had a consistent understanding of how to safely change ends on banking locomotives

Unaware of forced lead function

Safety issue number: RO-2020-008-SI-03

Safety issue description: The train crew had not been trained to use forced lead function which would likely have allowed the train crew to regain control of the locomotives 

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Train crew on board incident locomotives
• Aurizon
• Australian Rail Track Corporation
• Wabtec
• Office of the National Rail Safety Regulator

References

Australian Standard 2014, AS7510.1:2014 Braking Systems Part 1 Locomotive Rollingstock.

Australian Standard 2021, AS7522:2021 Access and egress.

General Electric Company 2010, GEJ-7045 Operating Manual C44-ACi Locomotive for Queensland Rail National Coal

Rail Industry Safety and Standards Board 2021, Glossary of Terms. Accessed at: www.rissb.com.au/glossary

UGL Rail 2010, C44acHi Locomotive Operator’s manual, Volume 1 Revision 00.

US Department of Transportation Federal Railroad Administration 1998, Human Factors Guidelines for Locomotive Cabs DOT-VNTSC-FRA-98-8

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Aurizon
• Australian Rail Track Corporation
• Transport for NSW
• Office of the National Rail Safety Regulator.

Any submissions from those parties will be reviewed and, where considered appropriate, the text of the draft report will be amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.