Safety summary

What happened

On 9 February 2020, an Airbus A380 aircraft, registered 9V-SKQ was being operated by Singapore Airlines on a scheduled passenger service from Singapore to Sydney, New South Wales.

During the approach to runway 16 right at Sydney, the aircraft encountered windshear and in response, the flight crew commenced the windshear recovery procedure and missed approach. During this time, air traffic control (ATC) instructed the flight crew to turn right onto a heading of 270°. The flight crew read back the heading, however, did not include the direction of the turn. Air traffic control did not correct the incomplete readback and the flight crew commenced turning the aircraft left instead of right.

Air traffic control issued a safety alert to the flight crew, advised them of a Bombardier DHC-8 aircraft about 6 NM (11 km) on final for runway 16 left, and instructed them to turn right and climb immediately. Air traffic control then instructed the flight crew of the DHC-8 to make a right turn in order to maintain separation with the A380. This resulted in a loss of separation between the DHC-8 and a Boeing 737 aircraft on approach to runway 16 right.

What the ATSB found

The ATSB found that the flight crew were likely experiencing high workload as a result of conducting the windshear recovery and published missed approach procedure. This, in combination with an expectation that they would be turning left, contributed to them mishearing the ATC instruction to turn right. As a result, the aircraft was turned left. In addition, the flight crew omitted information from their readback and ATC did not correct the flight crew’s incomplete readback, which was a missed opportunity to correct the misheard instruction.

What has been done as a result

Singapore Airlines issued a notice to flight crew, highlighting strategies to manage high workload situations, as well as reiterating the importance of correct readbacks and acknowledgement from ATC.

Safety message

Compliance with ATC published procedures, such as readback procedures, provides assurance that instructions are correctly understood, which is especially important during high workload periods and/or in times of high traffic density. This incident highlights the importance of flight crew completing full readbacks, as well as controllers correcting any readback discrepancies immediately. The ATSB’s aviation research and analysis report Radiotelephony Readback Compliance and its Relationship to Surface Movement Control Frequency Congestion (20060053) provides further information regarding readback compliance.

The investigation

The occurrence

On the morning of 9 February 2020, an Airbus A380 aircraft, registered 9V-SKQ, was being operated by Singapore Airlines, on a scheduled passenger service from Singapore to Sydney, New South Wales. The captain was the pilot flying and the first officer (FO) was the pilot monitoring.^[1] Prior to, and during the flight, the flight crew had noted the deteriorating weather conditions in Sydney and briefed on conducting a missed approach, following the published missed approach procedure.

On arrival at Sydney, the flight crew was cleared by air traffic control (ATC) for an instrument landing system^[2] approach to runway 16 right (16R). At about 1122 Eastern Daylight-saving Time,^[3] while on approach and descending through about 1,000 ft, the A380 encountered windshear. The flight crew actioned the windshear recovery procedure and in response, commenced a missed approach, which included applying take‑off/go‑around thrust, flaps extended and a rate of climb of 3,000 ft per minute. At 1123:00, the flight crew advised ATC that they were ‘going around due to windshear’. Air traffic control acknowledged the flight crew and at 1123:29, ATC instructed them to turn right onto a heading of 270° and to maintain 3,000 ft.

The FO gave an incomplete readback of the instruction, omitting the direction of the turn. Air traffic control did not correct the incomplete readback.

The flight crew believed that they heard ATC instruct them to turn left. They were also expecting ATC to issue instructions to turn left, once they had completed the published missed approach procedure, to avoid significant weather and aircraft traffic to the west of Sydney. The flight crew therefore commenced turning the aircraft left, crossing the approach path of the parallel runway (runway 16 left (16L)).

Air traffic control noticed the aircraft turning in the opposite direction to the instruction and 30 seconds after issuing the turn instruction, queried the flight crew as to whether the aircraft was turning right. The FO responded that the aircraft was not turning right. During this time, ATC had continuous communications with another aircraft. At 1124:17, ATC instructed the flight crew to turn the aircraft onto a heading of 060° and 19 seconds later, issued a safety alert. The safety alert advised the flight crew about a Bombardier DHC-8 aircraft in their 12 o’clock position,^[4] bout 6 NM (11 km) away and on approach to runway 16L. At 1124:40, ATC instructed the flight crew of the DHC-8 to make a right turn in order to maintain separation with the A380. This subsequently resulted in a loss of separation ^[5] between the DHC-8 and a Boeing 737 aircraft on approach to runway 16R. The minimum distance between the two aircraft reduced to 2.6 NM (4.8 km) laterally and 1,300 ft vertically. Figure 1 shows the representative aircraft tracks at the time of the incident.

Figure 1: Aircraft tracks at the time of incident

Source: Google Earth, modified by the ATSB

Context

Weather

The Sydney Airport automatic terminal information service ^[6] issued at 1118 and current at the time of the incident, reported wind from an east-south-easterly direction at 20-40 kt, with a maximum crosswind of 29 kt. There was rain present, and a warning for windshear and turbulence on final approach was also current. A previous automatic terminal information service stated that severe windshear had been reported on final approach for runway 16R by the flight crew of another aircraft.

The Bureau of Meteorology^[7] defines windshear as ‘a wind direction and/or speed change over a vertical or horizontal distance. It is significant when it causes changes to an aircraft’s headwind or tailwind such that the aircraft is abruptly displaced from its intended flight path and substantial control action is required to correct it’. Although windshear can occur at any level, windshear below 2,000 ft can be particularly problematic to aircraft approaching stall ^[8] speeds, predominantly seen in the take-off, initial climb, approach or landing phases of flight. This is even more so the case in larger jets, where there is a significant lag between applying and achieving thrust.

Aircraft operations

Published missed approach procedure

A missed approach procedure is to be followed if an approach to land cannot safely continue. It specifies a point where the missed approach begins, and a point or an altitude where it ends. In this case, the missed approach procedure was to initially track on a heading of 155°, when at 600 ft above mean sea level turn right onto a track of 170° and climb to 3,000 ft, or as directed by ATC.

Windshear recovery procedure

A windshear recovery procedure is an operational abnormal manoeuvre used by flight crew to escape a windshear encounter. The Singapore Airlines recovery procedure involved applying take-off/go-around thrust and following the speed reference system until the aircraft was clear of windshear. Such manoeuvres are high in workload due to their dynamic nature, increasing an already high workload of the approach phase of flight.

Air traffic services

Summary of radio calls

The table below (Table 1) summarises the radio calls made by the flight crew of 9V-SKQ (Singapore 231) and ATC.

Table 1: Summary of radio calls

Readbacks

A readback is a procedure whereby the receiver of a message repeats the message or an appropriate part thereof back to the transmitter, in order to obtain confirmation of correct reception and compliance. In aviation, flight crew are required to read back to ATC, safety-related parts of ATC clearances and instructions that are transmitted by voice. These items include, but are not limited to, altitude, direction of turn, heading and speed instructions. Specifically, the Airservices Australia Aeronautical Information Publication, section GEN 4.4, stated that this should include level instructions, direction of turn, heading and speed instructions. In response, the controller will listen to the readback to ascertain that the clearance or instruction has been correctly acknowledged and will take immediate action to correct any discrepancies revealed by the readback.

Safety alert

The Airservices Australia and Department of Defence Manual of Air Traffic Services stated that, ATC will issue a safety alert to flight crew when they become aware that an aircraft is in a position that is considered to place it in unsafe proximity to other aircraft. This is to notify pilots of information that is of a time-sensitive and safety-critical nature. It is important pilots understand the critical nature of these instructions and respond in a timely manner to ensure the safe conduct of flight.

Separation standards

Separation standards are used by ATC to manage air traffic safely. They refer to the minimum horizontal and/or vertical distance, or time apart, that aircraft operating in controlled airspace must maintain. When the separation between two or more aircraft is less than the standard, there is a loss of separation event.

A surveillance separation standard is used when aircraft position information is derived from air traffic services’ surveillance systems (including radar). The Manual of Air Traffic Services stated that, for two aircraft on independent parallel visual approaches, the required separation was 3 NM (5.6 km) horizontally or 1,000 ft vertically. However, Airservices Australia advised that, in accordance with section 9.7.5.2 of the manual, when determining whether an aircraft has passed a level on descent, a 400 ft tolerance was required to be made to the aircraft’s altitude shown on the controller’s situation display. Based on the 400 ft tolerance, a loss of separation occurred when the Boeing 737 and DHC-8 were within 3 NM laterally and less than 1,400 ft vertically.     

Analysis

Workload and misheard instruction

Workload is considered to be ‘the relation between the function relating the mental resources demanded by a task and those resources supplied by the human operator’.^[9] Considering the amount of information flight crew can deal with at any one time is limited, particularly during high workload phases of flight, it is possible to exceed individual processing capacity,^[10] increasing the risk of errors.

The approach phase of flight is associated with high workload for flight crew during normal operations. The flight crew of the A380 were experiencing a significantly higher level of workload than what is typically experienced during a normal approach, due to the weather and conducting a windshear recovery procedure, following the published missed approach procedure for runway 16R at Sydney. This involved managing a high-energy aircraft state, which included applying take‑off/go‑around thrust, flaps extended, and a rate of climb of 3,000 ft per minute. In addition, the published missed approach requirement for runway 16R at Sydney to level off at 3,000 ft, requiring the flight crew to the reconfigure the aircraft in under a minute. The flight crew also did not expect to receive an instruction from ATC before completing the published missed approach procedure and the instruction to turn right was contrary to their expectations. This, combined with significantly increased workload, likely contributed to them mishearing the ATC instruction.

Readbacks

The flight crew omitted the direction of the turn during readback of the ATC instruction and ATC did not correct the flight crew’s incomplete readback. An uncorrected, incomplete readback may lead to an unintended deviation from ATC instruction and may not be detected until the controller visually observes the deviation. In addition, the absence of ATC correcting a readback is perceived by most flight crews as an implicit confirmation of the readback.^[11] Research suggests that ‘errors of omission largely associated with diverse aspects of concurrent task management, when not detected or corrected, are a major threat to aviation safety’.^[12] In this incident, the incomplete readback by the flight crew and the absence of a readback correction by ATC was a missed opportunity to identify and correct the misheard instruction. This ultimately resulted in the flight crew turning the aircraft in the opposite direction to that instructed.

Findings

From the evidence available, the following findings are made with respect to the operational non‑compliance involving an Airbus A380 aircraft, registered 9V-SKQ, on 9 February 2020.

Contributing factors

• The flight crew misheard an air traffic control turn instruction, likely due to a combination of the high cockpit workload associated with the missed approach and their expected turn direction.
• The flight crew omitted the direction of the turn during the readback, which was not corrected by air traffic control. The absence of the readback correction by air traffic control, combined with the misheard turn instruction, resulted in the aircraft being turned in the wrong direction.

Safety actions

Singapore Airlines

After an internal investigation into the incident, Singapore Airlines issued a notice to flight crew, highlighting strategies to manage high workload situations, as well as reiterating the importance of correct readbacks and acknowledgement from ATC.

Sources and submissions

Submissions

The sources of information during the investigation included the:

• Singapore Airlines
• Airservices Australia.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Pilot flying (PF) and pilot monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances, such as planning for upcoming stages of the flight. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. A precision instrument approach system, which normally consist of the following electronic components: VHF localiser, UHF glideslope, VHF marker beacons.
3. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
4. The clock code is used to denote the direction of an aircraft or surface feature relative to the current heading of the observer’s aircraft, expressed in terms of position on an analogue clock face. Twelve o’clock is ahead while an aircraft observed abeam to the left would be said to be at 9 o’clock.
5. An occurrence in which the spacing between two or more aircraft is less than prescribed separation minima in airspace where the aircraft is subject to an air traffic service.
6. The provision of current, routine information to arriving and departing aircraft by means of continuous and repetitive broadcasts during the hours when the unit responsible for the service is in operation.
7. Bureau of Meteorology (2014). Hazardous Weather Phenomena Windshear.
8. Occurs when airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically 16° to 18°, and results in reduced lift.
9. Parasuraman, R., Sheridan, T. B., & Wickens, C. D. (2008). Situation Awareness, Mental Workload, and Trust in Automation: Viable, Empirically Supported Cognitive Engineering Constructs. Journal of Cognitive Engineering and Decision Making, 2(2), 140–160. https://doi.org/10.1518/155534308X284417.
10. Civil Aviation Safety Authority (2006). Civil Aviation Advisory Publication Navigation using Global Navigation Satellite Systems (GNSS) (CAAP 179A-1(1))
11. Eurocontrol (2006) European Action Plan for Air Ground Communications Safety Edition 1.
12. Loukopoulos, L. D., Dismukes, K., & Barshi, I. (2009). The multitasking myth: Handling complexity in real-world operations. Farnham, England: Ashgate Pub. Ltd.

Investigation summary

What happened

On 29 January 2020, Pacific National freight train 4MC2 was approaching Barnawartha in northern Victoria when several wagons derailed and the train parted into 3 sections. It had been traveling toward Albury, New South Wales on the interstate rail network managed by the Australian Rail Track Corporation (ARTC). 

The front section, which included 3 derailed wagons, continued until V/Line passenger train 8630 became visible, approaching from the opposite direction, traveling on the adjacent track. The drivers of the freight train reported that they observed a brake pipe airflow indication at about the same time as the passenger train came into view and their train had begun slowing. The driver of the passenger train observed dust ahead and the approaching freight train and responded by applying the brake on their train.

The trains could not be stopped prior to passing which resulted in passenger train 8630 impacting a shipping container on a derailed wagon of 4MC2, sustaining minor damage. There were no injuries to passengers or crew. The passenger train stopped about 50 m short of another container that had fallen from the freight train and was obstructing both tracks.

What the ATSB found

Mid-consist wagons of freight train 4MC2 derailed in response to the geometry of the track. A vertical track geometry defect was present immediately prior to the derailment location and a lateral track misalignment probably formed under train 4MC2.

The vertical track geometry defect was associated with a mud hole. The defect was not identified in the exceedance report generated from ARTC code of practice criteria due to track geometry being assessed against incorrect limits. When assessed against the correct limits, the geometry exceeded defect levels and required a maintenance response. 

A lateral misalignment was present in the track following the derailment although not prior to the passage of the train. The most likely scenario is that a lateral misalignment formed under the train. However, the factors contributing to this probable misalignment could not be fully determined. The extent that rail stress condition may have contributed could not be assessed as ARTC was not monitoring rail stress at this location. 

ARTC was applying a system for reducing the risk of track misalignment. This system and its associated procedures did not lead to locations at or adjacent to the derailment being identified as special locations potentially vulnerable to track instability.

What has been done as a result

ARTC has made several changes to procedures and standards relating to track misalignment, track geometry defects and mud hole management. These safety actions seek to improve ARTC’s capacity to identify locations that may become vulnerable to track instability. In addition, ARTC has undertaken to review available technology to improve its stress‑free temperature testing capability. ARTC has also changed its processes relating to the selection of track speed used to set the appropriate limits for track geometry assessment.

Safety message

This and other occurrences highlight the potential roles of track geometry and instability in derailment. Track managers are encouraged to ensure standards and processes are effective at identifying and rectifying geometry and stability issues to ensure derailment risk is managed. 

The occurrence

Introduction

On 29 January 2020, Pacific National freight train 4MC2 was operating on the standard gauge interstate rail network traveling from Melbourne, Victoria to Griffith (via Cootamundra), New South Wales. It had departed Melbourne at 1355 and passed through Wangaratta, Victoria at about 1716 travelling towards Albury, New South Wales (Figure 1). On the same afternoon, V/Line passenger train 8630 departed Albury at 1720 travelling to Melbourne.

Figure 1: Freight train route from Wangaratta (Victoria) to Albury (NSW)

Source: Google Earth, annotated by the Office of the Chief Investigator (OCI)

Derailment of freight train 4MC2

Train 4MC2 was operated by 2 drivers and consisted of 4 locomotives hauling 46 container wagons. From Wangaratta, 4MC2 was travelling on the East Track. At about 1740, it was approaching Barnawartha travelling on tangent (straight) track and descending a moderate downgrade. 

On the descent, the driver in control was managing the train’s speed between about 114 km/h and 117 km/h with a series of brake applications. Neither member of the locomotive crew recalled observing any track misalignment ahead of their train and front-of-train camera footage similarly did not show any signs of track misalignment. 

Several wagons of 4MC2 derailed commencing at about 277.8 track km.[1] The train parted into 3 sections: the locomotives and wagons 1 to 29 (front), wagons 30 to 40 (middle), and wagons 41 to 46 (rear). The trailing wagon in the rear section came to a stand about 120 m past the derailment location. A schematic of the sections of the separated freight train, derailed wagons and the passenger train is provided in Appendix A.

Figure 2: The middle and rear separated sections of freight train 4MC2

Source: ATSB

The locomotives with wagons 1 to 29 attached initially continued for over a kilometre. In this front section of the train, the trailing bogie of wagon 26 and the leading bogie of wagons 28 and 29 were derailed to the left in the direction of travel. It is likely that the trailing bogie of wagon 29 also derailed to the left before it then separated from its wagon at Frying Pan Creek bridge and the rear container from this wagon subsequently fell across both tracks (Figure 3).

Figure 3: Separated trailing bogie from wagon 29 and dislodged container in distance

Source: OCI

The locomotive drivers on 4MC2 reported that they were alerted to an issue by a brake pipe airflow indication. At about the same time they observed the approaching passenger train 8630. They recalled that they made attempts to contact the passenger train by radio.

Passenger train 8630 impact with derailed wagon of 4MC2

Train 8630 had departed Albury on schedule. The train consisted of an N-Class locomotive (N474) and 4 passenger cars. Train crew comprised 2 locomotive drivers and 2 conductors, and there were a reported 17 passengers on board. 

Approaching Barnawartha, train 8630 was travelling on the parallel West Track at about 104 km/h. The driver in control recalled observing dust ahead and then train 4MC2. They responded by applying the brake on their train at about 1742 and reported attempting to contact the freight train by radio. The driver estimated their train impacted one derailed container wagon at about 25 to 35 km/h. 

When both trains stopped, at about 1743, the container connected to the last wagon of the front section of 4MC2 was against the end carriage of 8630 and the fallen container was about 50 m in front of the locomotive (Figure 4). The impacted container did not penetrate the passenger compartment and there were no injuries. 

Communication was established between the trains, although it is not clear which communication attempt was ultimately successful, or when it occurred as the radio communication was not recorded. 

Figure 4: Train 8630 passenger car in contact with container of derailed wagon of 4MC2

Source: ATSB

Context

Track information 

Overview

The derailment occurred within the Seymour to Albury section of the standard gauge interstate rail network managed by the Australian Rail Track Corporation (ARTC). In the area of the derailment, there were parallel tracks, referred to as the East and West Tracks, both bidirectional. Freight train 4MC2 was travelling on the East Track northbound towards Albury.

The maximum permitted train speeds in the area of the derailment were:[2]

• 115 km/h for freight trains (with axle load up to 20 t)
• 130 km/h for passenger trains (with axle load up to 19 t)

There were no Temporary Speed Restrictions (TSR) in force proximate to the derailment location, nor any speed restrictions activated due to heat.

The East Track, in the direction of travel for train 4MC2, leading up to and through the derailment area was tangent (straight) with a moderate downhill grade.[3] There was a turnout about 300 m prior to the derailment location and a 2,400 m radius curve to the left about 200 m beyond it. The curve was about 650 m long, after which the track was straight. There were no other significant track features near to the derailment location. 

Track construction

The East Track utilised continuously welded[4] 60 kg/m rail affixed to concrete sleepers with resilient fasteners. For track with concrete sleepers, ARTC used a nominal sleeper spacing of 667 mm.[5] The engineering code specified 300 mm wide ballast shoulders to either side of the sleeper and ballast height in line with the top of the sleeper (Figure 5Figure 6).[6] Ballast shoulders that conformed to these dimensions were considered ‘full’. Ballast provides support for the sleepers and distributes the loads from the sleepers to the formation to maintain track geometry under vertical, lateral and longitudinal loads.

Figure 5: Ballast shoulder dimensions

Source: OCI

Track inspection

The track at the derailment location was inspected the day after the derailment. A mud hole was observed within about 10 m of track between 277.780 track km to about 277.790 track km where there was contamination of ballast, a loss of ballast between sleepers, and loss of ballast profile at sleeper ends (Figure 6). A lateral track misalignment was also present, beginning at about the same location as the northern extent of the mud hole (277.790 track km). The visible length of misaligned track was about 65 m although the full extent of the misalignment was likely obscured by subsequent damage from derailed wagons. The misalignment was predominantly toward the left in the direction of travel and the greatest measured lateral deviation was about 0.7 m. Several sets of witness marks from the passage of wheels were identified on the rail head in the section of misaligned track.

Figure 6: Overview of derailment area

Source: ATSB, annotated by OCI

The witness marks consistently indicated that left wheels had ridden up and over the left rail (Figure 7). Related marks were also observed where the corresponding right wheels had dropped between the rails, and where both wheels began contacting sleepers. It was not possible to ascertain which marks were associated with the first derailed wheelset.

Figure 7: Witness mark from a wheel flange climb 

Source: OCI

Within the length of the track misalignment, the ballast had been disturbed by sleeper movement and the impact of derailed wheels. Therefore, the condition of the ballast shoulder could not be assessed. Undisturbed track was inspected at about 277.770 track km. In this area sleeper ends were visible, suggesting that ballast shoulders were less than full (Figure 8).

Figure 8: Sleeper ends protruding from ballast (about 277.770 track km)

Source: ATSB

Track condition monitoring

Track patrols and inspections

ARTC specified that track patrols were to be conducted every 7 days or as specified in a Track Maintenance Plan. Unscheduled inspections were also carried out in response to ‘defined or abnormal events’ and included those required at special locations where defects were more likely.

ARTC conducted a range of other general and detailed track inspections to monitor the condition of track infrastructure, ranging in frequency from 6 to 24 months. ARTC standards specified that a general inspection of track stability was required as temperatures started to increase after the cold season, normally the end of August, and as close as possible to, or in conjunction with, the ballast general inspection.

A mud hole had been identified during inspection and was recorded in ARTC’s Ellipse maintenance system. It was first identified in 2014 when it was 1 m long and was monitored intermittently through track inspection. The most recent update was on 8 February 2019, at which time the mud hole was listed as a P4 priority defect between 277.780 track km and 277.790 track km (10 m). A defect assigned a P4 priority was to be addressed within 12 months.[7] At the time of the derailment the defect was less than 2 weeks from exceeding this but had not yet been addressed.

Track geometry measurement

Background

The AK car inertial measurement system[8] was utilised by ARTC to measure track geometry without obstructing normal railroad operations. The AK car utilised various sensors to record the lateral and vertical position of the rails at locations along the track. The system processed the information to produce track geometry data for assessment against applicable limits.

ARTC’s Code of Practice (CoP) for track geometry[9] contained the limits applicable for track geometry measurements. It specified that measurements be conducted at least every 4 months by the geometry car (the AK car). The measurements were to be assessed against the CoP limits and the type, size and location of any defects recorded (defects referred to locations where measured track geometry exceeded the relevant limit).

An initial review identified that the measured vertical geometry contained significant variations around the derailment location. Other geometry parameters measured by the AK car were also reviewed but the maximum values proximate to the derailment location were well below CoP defect limits. In some cases, vertical geometry defects may result in elevated track twist.[10] However, that did not occur at the defect location. The vertical geometry values for both rails increased evenly, therefore, no significant twist was present.

Assessment of vertical geometry

Top is a term commonly used to describe variations in the vertical position of an individual rail. The CoP specified three different top parameters, 20 m inertial, Long 20 m chord and Short 4 m chord (Table 1). Notes accompanying the CoP indicated that only the 20 m inertial parameter was applicable to geometry measured by the AK car.

The maintenance response required when a defect level was exceeded changed depending on the speed permitted in a track section. The permitted speeds on this track section were 115 km/h for freight trains and 130 km/h for passenger trains. Therefore, the appropriate speed band reference for geometry limits and corresponding response categories was referred to in the CoP as the 115/160 (freight/passenger) band. This was the highest speed band listed by the CoP and correspondingly had the strictest requirements for defect response.

Table 1: Vertical geometry defect limits and maintenance response categories

Where the measured geometry exceeded a limit, it was considered a defect and a response category was assigned that determined what response was required. The responses for each defect response category were provided in the CoP (Table 2).

Table 2: Defect response category and action

ARTC provided 2 exceedance reports for a section of the East Track that included the derailment location. They were generated from track geometry data recorded on 9 October 2019. The exceedance reports identified locations where the measured geometry had exceeded the relevant limit and were therefore considered defects.

Geometry exceedance report 1

Exceedance report 1 was the result of an assessment of measured data against the CoP ‘20 m inertial’ limits. It did not identify any defects close to the identified derailment site (277.795 track km). Information contained within the report indicated that the measured geometry had been assessed against the 100/115 km/h speed band. However, the speed band that should have been applied in this assessment was 115/160 km/h, consistent with the permitted track speeds and as used in a previous assessment.

ARTC advised that the speed band used for assessment had been manually adjusted on the AK car in order to produce reports required for a track upgrade program.[11] This change was still in place when the assessment for geometry exceedance report 1 was undertaken, resulting in the wrong speed band being used.

ARTC also provided an extract from the measured data. It advised that the surface (top) parameter provided in the extract was directly comparable to the ‘Top 20 m inertial’ limits prescribed in the CoP. The local maximum values (at 277.792 track km) were 25.9 mm on the left rail and 24.3 mm on the right rail. Both values exceeded the P2 limit for the 115/160 km/h speed band and were therefore defects at the time of the measurement on 9 October 2019. The CoP required inspection within 7 days and repair within 28 days for a P2 level defect.

Geometry exceedance report 2

A second exceedance report identified a vertical geometry defect at about 277.792 track km. The report was an assessment of the measured data against a 6 m chord top criteria that was not listed in the CoP. ARTC advised that this criteria was to be actioned by local teams as agreed with their managers. Although the defect was recorded in ARTC’s Ellipse maintenance system, there were no records of actions taken in response.

Defect growth

ARTC provided an extract of measured vertical geometry data from the previous AK car measurement run that occurred on 12 June 2019. Local maxima were present at 277.792 km on both rails, albeit that these maxima were less than the lowest defect limit for the 115/160 speed band in the CoP.

The data from the 12 June 2019 measurement was compared to the 9 October 2019 measurement (Figure 9). The comparison showed consistent waveforms between the two sets of measurements and significant growth (38% on the left rail and 48% on the right rail) at the 277.792 km location.

Figure 9: Surface (top) deviation, between June and October 2019 measurements

 Source: ATSB, generated from ARTC data

The growth of the irregularity in the preceding 4 months (120 days) suggested that it was likely that the defect would have continued to grow in the subsequent period up to the occurrence date (113 days). However, the size of the defect at the time of the occurrence cannot be inferred from this as the growth rate is unlikely to be linear, instead dependent on several factors including prevailing weather and traffic density.

Other geometry standards

The measured vertical track geometry was assessed against the defect severity and maintenance response criteria of other track geometry standards. The standards assessed were:

• Rail Industry Safety Standards Board (RISSB) AS 7635[12] 
• RailCorp engineering manual TMC 203[13] 
• V/Line network infrastructure standard NIST-2706.[14] 

Unlike the CoP, the 3 standards did not use an inertial measurement-based criteria. Instead, they prescribed defect limits for surface geometry irregularities using chord offset measurements. The length of the chord and the offset varied between the standards. 

The inertial vertical geometry measured on 9 October 2019 was reprocessed into the chord offsets relating to each standard. Each result was compared to the defect limit and maintenance response criteria of the applicable standard. Further detail is provided in Appendix B. In all cases this resulted in a defect at the 277.792 track km location with a required response that was more urgent than that required by the ARTC CoP (inspection within 7 days and repair within 28 days). The responses required by each standard are listed below:

• The long chord criteria in AS 7635 required action (repair or further assessment) within 24 hours.
• The short chord criteria in AS 7635 required action (repair or further assessment) prior to the passage of the next train.
• The RailCorp standard required action (repair or further assessment) within 24 hours for both long and short chords.
• The V/Line standard required an immediate speed restriction and repair within 7 days.

Since the derailment occurred, an updated (2023) version of RISSB AS 7635 has been issued. The new edition emphasised that the table of geometry limits was informative rather than a requirement of the standard. The standard suggests that infrastructure managers:

Should develop appropriate geometry defect limits and intervention thresholds that are appropriate for the class of traffic, infrastructure, configuration, and risk appetite.

Track lateral stability 

Introduction

Track lateral stability is the general term used to describe whether a track is sufficiently restrained against moving sideways under an applied load. The load may be applied in various ways, one significant source being by thermally induced stress in the rails. In ballasted track, the resistance to lateral movement is provided by the ballast, including the shoulder ballast at the ends of the sleepers. A track buckle[15] occurs when stress in the rail overcomes the track structures’ resistance to lateral movement. Therefore, managing track lateral stability involves both the management of rail stress, and the maintenance of track support structures that resist buckling, including ballast.

Rail stress and buckling resistance

Rail stress and stress‑free temperature

Steel rails expand when heated and contract when cooled. In the vertical and lateral directions these changes are small and without consequence. However, in the longitudinal direction, expansion and contraction of continuously welded rail (CWR) is restricted. Instead, changes in temperature cause stress within the rail. If the stress becomes excessive it can cause buckled rail (compressive stress when the temperature is high) or broken rail (tensile stress when the temperature is low). 

At a certain temperature the rail is neither in tension nor in compression, this is its stress‑free temperature (SFT). Rail stress is managed by controlling the temperature at which the rail is stress‑free. ARTC specified a rail SFT of 38°C in track with CWR. The SFT may change with time due to lateral, longitudinal and vertical movement of the track structure. Train forces such as braking and traction create longitudinal movements (creep) in the rail which may also change the in-service SFT (Kish and others 2013). 

The ARTC CoP specified that rail creep monitoring and control measures would not usually be necessary at locations with CWR, concrete sleepers and resilient fastenings. The CoP noted that this type of track structure was known to provide good resistance to longitudinal rail movements, but that ‘practices for the measurement of rail creep should be considered and take into account the influence of fixed points in the track’. There were no creep monitoring facilities through the Barnawartha location.

Changes in a rail SFT are not easily observed in CWR.[16] ARTC did not measure changes to the SFT in CWR affixed to concrete sleepers unless it was identified during inspection that there was a risk that the SFT may have lowered. When identified as being required, ARTC measured rail SFT using VERSE testing.[17] This testing involved unfastening 30 m of rail and lifting it by hydraulic jack. The force required to lift the rail, and the rail temperature at the time was used to calculate the SFT. ARTC had not conducted VERSE testing at the derailment location at any time since it had been rerailed (circa 2010-2011). Subsequently, the SFT of the rails at the time of the derailment and any change in SFT were unknown.

Buckling resistance (ballast)

The Code of Practice (CoP) for ballast[18] specified the required ballast profile, and the corrective action where it was deficient. The response code table notes[19] stated that ‘in concrete sleepers the responses apply where height and width deficiencies occur over 10 m or greater’.

The track proximate to the derailment had not been identified by ARTC as a location requiring ballast rectification. A mud hole was observed in post‑derailment inspections that included sections with deficient ballast (Figure 10). The mud hole was about 10 m long, sufficient length for the CoP to require a response due to ballast deficiency.

Figure 10: Extent of mud hole and light-coloured ballast

Source: ATSB

System for managing track lateral stability

Overview

The system ARTC used for managing track lateral stability was described across multiple documents. Relevant documents included:

• the ARTC Code of Practice for track lateral stability 
• related procedure ETM-06-08 – Managing track stability
• reference document ETGN-06-01 – Track stability handbook

Code of Practice for track lateral stability

The Code of Practice (CoP) for track lateral stability[20] specified the design, maintenance, and inspection actions required in order to provide sufficient lateral stability of the track.

The only applicable design requirement was to install (or adjust) the rail at the target stress‑free temperature. There were no requirements for maintaining concrete sleepered track, though the CoP did suggest that measurement of rail creep should be considered.

The CoP requirements for inspection included:

• identification of special locations
• scheduled inspections
• unscheduled inspection, including:
  • when a temperature threshold was exceeded
  • when a defect was suspected or reported
• assessment and actions following inspection to verify the track’s capacity to provide adequate lateral stability

The CoP described reasons why track sections should be managed as special locations, including where:

• reduced lateral stability had been identified (through inspection)
• a history of lateral track instability existed.

The requirements for assessment and actions included that identified conditions affecting track stability were to be controlled with practices described in other sections of the CoP including ballast (Section 4) and track geometry (Section 5).

Procedure for managing track stability

A procedure for managing track stability[21] contained further requirements and related contextual information. It identified that maintenance of track stability required both management of buckling force (through management of rail stress) and buckling resistance (through maintenance of ballast profile). It described that management of buckling force involved monitoring of changes to stress‑free temperature. The guidance relating to management of buckling resistance focused on identification and assessment of failure or poor condition of components which impact on lateral resistance.

The procedure required a track stability management plan (TSMP) for ‘each section of track’. TSMP’s were to be reviewed at least twice annually (once prior to the onset of hot weather season and once after its conclusion). A TSMP was described as a concise plan of all activities associated with inspecting and managing track to ensure lateral stability that included:

• requirements for managing buckling force
• requirements for managing buckling resistance
• a register of identified special locations.

The procedure described special locations as areas potentially vulnerable to instability, with a history of instability or where stress‑free temperature was suspect. It gave a list of examples that could be special locations that included areas with non-conforming ballast profile and mud holes. A separate list gave examples of mandatory special locations, it included sites with multiple concurrent initiator defects and sites that had previously buckled (where risk of further instability remained).

Information relating to inspection and assessment were contained in the procedure and were largely aligned with the CoP. Inspection to identify and assess localised initiators, including vertical geometry and pumping sleepers[22] (that occur at mud holes) was required at locations that had been identified as special locations. Though not required by either document, the CoP had indicated detailed inspection ‘may be necessary’ for sections of track where reduced lateral stability had been identified. The procedure described that detailed inspections could include measurement of stress‑free temperature or rail creep.

Track stability handbook

The track stability handbook[23] was referenced within the procedure for managing track stability and contained related guidance material. While the handbook addressed special locations, it did so in the context of things to do at identified special locations. It did not provide guidance on the identification of special locations.

The handbook identified that inspection and assessment of track with continuously welded rail, including measurement of stress‑free temperature, could reduce the likelihood of buckles occurring in the hotter months of the year.

Track stability management plan

A track stability management plan (TSMP) existed for the 2019–2020 high temperature season and was last reviewed in November 2019. The TSMP covered multiple track sections including a section of the East Track that contained the derailment location.

The list of stress‑free temperature test locations within the TSMP did not include any within 2 km of the derailment. Several included locations listed vertical geometry or mud holes as reasons for inclusion, but only where lateral geometry, ballast deficiency, or generic ‘rough track’ were also listed.

The TSMP identified that no creep measurements were planned ‘as there is no creep monuments currently installed’. This was justified on the basis that ‘there has been little or no evidence of creep found’ and that tracks ‘have been consolidated and been stable for several years… stress‑free temperature measurements are taken in suspect locations each year’.

With regard to ballast condition, the TSMP required locations with ballast deficiency to be monitored during track patrol for evidence of movement. It instructed inspectors to refer to the Ellipse defect management system for a list of ballast deficient locations. Although a 10 m mud hole had been recorded in the management system, the entry did not reference a ballast deficiency and it was not included in a list of ballast deficient locations provided by ARTC.

Several mud holes and ballast deficient locations were included on the special locations register associated with the TSMP. However, the mud hole proximate to the derailment location was not. The only locations listed with a vertical geometry defect had other defects in combination (e.g. vertical and lateral geometry together, or with an associated ballast deficiency).

Related inspections

Several inspections of the track were conducted in the 6 months prior to the derailment including:

• inspection for conditions affecting stability (August 2019)
• 3‑monthly mud hole inspection (October 2019)
• a 40°C heat patrol inspection (November 2019)
• a heat patrol inspection after three consecutive 38°C days (December 2019)
• a front of train inspection (15 January 2020)
• a track patrol (28 January 2020).

No inspections identified the derailment location as being vulnerable to track instability.

Train information

Freight train 4MC2

Train 4MC2 consisted of 4 locomotives and 46 wagons. The leading locomotive was NR71, followed by a G class locomotive, then 2 further NR class locomotives. 44 of the wagons were single platform container wagons each capable of carrying three 20 ft shipping containers. Wagons in positions 15 and 46 were multi-platform well wagons that had 5 wells each. Each well was able to carry two 20 ft shipping containers on this corridor.

Most wagons were lightly loaded, with axle loads between 5 t and 7.2 t. The wagons with higher loading were well in front of the first derailed wagon. The axle loading for 5 wagons either side of position 26 (the forward-most derailed wagon) was between 6.7 t and 7.2 t.

Empty or lightly‑loaded wagons positioned between fully‑loaded wagons within a train consist can increase derailment risk (ATSB 2020). However, as the wagons close to position 26 were all lightly‑loaded, the marshalling of wagons (their order) was unlikely to have contributed to this derailment.

Recorded information

Key events

Information from the event recorders on the leading locomotive of train 4MC2 and the locomotive of train 8630 was reviewed. A table of events in chronological order is provided in Appendix C. Key events included:

• The driver of freight train 4MC2 briefly released and reapplied the dynamic brake as the train transitioned the derailment area. Observation of the train speed during this period suggests they were using the dynamic brake to control the train’s speed down a grade.
• Wagon 26, the forward-most derailed wagon, transitioned the derailment location about 10 s before the first reduction in brake pipe air pressure, this was consistent with a loss of brake pipe air as a result of brake lines parting during the derailment.
• In response to the speed of train 4MC2 decreasing, the driver of the freight train released the dynamic brake and applied the throttle in an effort to maintain speed.
• The brake application on passenger train 8630 occurred at about 280 track km. This is before the location where 8630 and 4MC2 crossed and is consistent with the driver of 8630 applying the brakes promptly after observing dust from the freight train in the distance.

Freight train dynamic braking

The driver of train 4MC2 was utilising dynamic brake applications to control train speed on a descending grade. The dynamic brake slows only the locomotives, therefore when it is used, buff (compressive) force is induced between the locomotives and the trailing wagons slowing them in turn. In the vicinity of the derailment, the dynamic brake was released then reapplied 13 seconds later.

Repeated application and release of dynamic brake may contribute to in-train forces[24] that vary in magnitude along the length of the train. However, there was insufficient evidence to support this having contributed to the derailment.

Freight train emergency braking

When a brake pipe parts on a train the pressurised air rapidly vents. It is expected that this reduces brake pipe pressure and results in an automatic emergency brake application. However, in this instance the brake pipe pressure at the lead locomotive did not reduce sufficiently to cause an automatic brake application.[25] This was possibly due to the air volume available from the compressors and main reservoirs on all 4 locomotives being able to supply a sufficient volume of air into the brake pipe to maintain the pressure at the lead locomotive above the automatic brake application pressure while air was venting further along the train. This allowed the front section of the train to continue, and for the driver to apply traction power, after sections of the train and the brake pipe parted.

When the air brake system supplies air to the brake pipe, an airflow meter measures and displays to the driver the amount of airflow. However, the airflow measurement was not recorded by the NR class locomotive event recorder. Therefore, it was not possible to assess whether airflow into the brake pipe was the reason that an emergency brake application did not occur when the brake pipe parted in the derailment.

Wagon inspections

Overview

Wagons 26 and 28 were identified for further inspection. The inspected wagons used the ‘three‑piece’ bogie which is the standard freight bogie in Australia. It consists of 2 side frames and a bogie bolster spanning them. Two side bearers are located on the bogie bolster roughly half-way between the centre and each end. Side bearers provide a degree of control over wagon roll motion (side-to-side tilt) and bogie rotational movement. The inspected wagons utilised constant contact side bearers (CCSBs). As the name implies, when correctly configured, CCSBs are in contact with the wagon body at all times.

Wagon 26

Wagon 26 was found to be in good condition with no items identified that might have contributed to the derailment. There was no indication of improper maintenance, excessive wear or signs of hunting oscillation (cyclic lateral motion).

Wagon 28

The inspection of wagon 28 identified that there was a gap between the side bearer on the left side (in the direction of travel) and the wagon body of the leading bogie. Shims were missing from above the side bearer wear plate creating the gap. Missing side bearer shims could reduce the speed at which the wagon was susceptible to hunting. However, it was not determined whether the shim was missing before the derailment and other indicators of hunting were not present, such as wear on gib[26] contact surfaces (Figure 11).

Figure 11: Wagon 28 lead bogie gib condition

Source: OCI

Environmental conditions

Around the time of the derailment, the air temperature measured at the Bureau of Meteorology weather station at Wangaratta, Victoria, was about 36°C. It was clear and dry with SSW wind speeds of around 17 km/h. It is probable that conditions at Barnawartha, located about 45 km from Wangaratta, were similar.

When exposed to direct sunlight rail reaches temperatures considerably higher than the ambient. Published literature suggests that rail temperature can be 50% above the air temperature in direct sunlight (Wu and others, 2010). Using this relationship and the ambient temperature recorded at Wangaratta, the rail temperature was probably about 54°C. This is 16°C above the nominal design stress‑free temperature. 

Similar occurrences

Several investigation reports have been published into occurrences relating to track lateral stability and vertical alignment on Australian railways. Key information from selected reports relevant to this occurrence, including other events on this corridor, is presented below:

On the ARTC network

• Creighton, Victoria, 21 January 2019: Track lateral instability contributed to a lateral misalignment resulting in a derailment. Mud holes present at the derailment location reduced the track’s resistance to movement. Additionally, the investigation identified that ARTC’s systems for managing track lateral stability did not lead to the location being managed as a special location potentially vulnerable to instability (ATSB investigation RO-2019-003).
• Locksley, Victoria, 12 February 2013: Track disturbing maintenance activities and a track structure that had reduced capacity to withstand lateral forces (due to ballast fouling) probably contributed to a track misalignment and subsequent derailment. Additionally, the investigation found that despite the location having characteristics consistent with the criteria for a ‘Special Location’ no action had been taken to manage the increased risk (ATSB investigation RO‑2013-006).
• Ararat, Victoria, 28 November 2003: A small buckle became progressively worse as a train passed over it, resulting in the derailment of 2 wagons. Track disturbing works that had occurred a week prior had probably reduced the lateral resistance provided by the ballast and likely reduced the stress‑free temperature of the rail, although this was not monitored. Additionally, the investigation recommended that ARTC review track maintenance procedures to ensure track geometry and stress‑free temperature were within specified standards (ATSB investigation 2003-006).

On other networks

• Duaringa, Queensland, 24 January 2018: The driver of a loaded coal train observed a track buckle form as their train approached. It subsequently derailed multiple wagons as it passed over the buckle. Several factors were identified that contributed to the buckle, including track disturbing works and local fixed points. The report also found that a Hazard Location Register was being used as a record of past occurrences rather than as a tool to proactively identify hazard locations (ATSB investigation RO-2018-005)

Summary of similar occurrences

Although each reviewed occurrence investigation report involved unique aspects, thematic similarities included:

• the formation of lateral track misalignments under (or in one case immediately in front of) the passage of a train
• locations not being identified on relevant hazard registers
• track disturbing works occurring prior to the lateral track misalignment occurring 
• an absence of stress‑free temperature monitoring.

Safety analysis

Introduction

Pacific National freight train 4MC2 was travelling north on the interstate rail network when it derailed at about 277.8 track km near Barnawartha in Victoria. The trailing bogie of wagon 26 was the forward-most derailed bogie. Several wagons behind this position completely or partially derailed and the train separated into three sections.

Initially, the front section of the freight train continued for over a kilometre before being slowed by its driver when alerted to an issue. Concurrently, passenger train 8630 was approaching Barnawartha from the opposite direction on a parallel track. The driver of 8630 observed dust and the headlights of 4MC2 and applied their train’s brakes in response. The trains came together at slowing speeds, with the passenger train impacting a container on derailed wagon 29 of the freight train.

This analysis discusses:

• factors associated with the derailment of freight train 4MC2
• management of track geometry
• management of track lateral stability 
• the passenger train collision with the derailed freight train.

Derailment of freight train 4MC2

Background

Post‑derailment inspection identified several locations of wheel flange climb over the rail head of the left rail in the direction of travel. Subsequent damage to sleepers was consistent with full wheelset derailment, the furthest south location identified was at 277.795 track km, about 5 m past an observed mud hole. The flange climb marks were consistent with the derailed states of wagons 26 (trailing bogie), 28 (leading bogie) and 29 (both bogies) being toward the left in the direction of travel. While it was not possible to conclusively determine which marks were associated with which wheel derailments, the observation of flange climb marks on the rail head indicate that the initial derailment was probably by the action of a flange climb. 

Flange climb occurs when lateral forces between the wheel and the rail exceed the capacity for vertical forces to restrain, either through excessive lateral force alone, or a combination of increased lateral force and reduced vertical force. 

The presence of wagon hunting was considered as it may affect wheel to rail forces. While higher speed generally increases the potential for hunting, and the derailed train was traveling at or near the maximum speed for this track, there was insufficient evidence to conclude that hunting was occurring in this case.

The features identified that could contribute to flange climb in this instance were:

• the vertical geometry defect at 277.792 track km
• the lateral track misalignment.

Derailment mechanism

Contribution of vertical track geometry defect

The vertical geometry defect was in close proximity (and prior) to the derailment location. When a wagon’s wheels pass over an upward vertical geometry defect at speed there is initially an increase in the vertical force between wheels and rails, above the static load value. The load then decreases to below the static force once the wheel is past the highest point of the track geometry defect. This may induce a vertical dynamic response of the wagon body, which in turn can cause further fluctuation in the vertical force between wheels and rails. Therefore, the vertical geometry defect contributed to locations of reduced vertical force in the vicinity where the derailment occurred.

There was no evidence identified that indicated that wheels passing over the vertical geometry defect contributed to an increased lateral force between wheel and rail. The recorded track geometry did not include significant lateral (when both rails move to one side) or twist (where one rail is higher than the other) defects present alongside the vertical defect to initiate lateral motion of the wagons. Therefore, the evidence did not suggest that the wagon transitioning the vertical track geometry defect was sufficient to initiate the derailment on its own but contributed by reducing the vertical force present between wheels and rails.

Contribution of lateral track misalignment

A lateral track misalignment was present after the derailment. It was not present in footage obtained from the forward-facing camera on train 4MC2. The misalignment therefore either occurred during the passage of the train or as a consequence of the derailment. Lateral track misalignments often occur under, and in response to, the passage of a train, as supported by the findings of previous occurrence investigation reports.

When a train is in normal straight running, there is a gap present between the wheel flanges and the side face of the rails. This and the guidance afforded by conical railway wheelsets (steering of the wheels) mean that small lateral misalignments of the rail are overcome without flange contact and large lateral forces. However, when the lateral misalignment is large, the wheel flange contacts the rail. Although other factors are involved, the magnitude of the resulting lateral force is related to the size of the misalignment.

As a lateral track misalignment forms under a train, it creates increasing lateral wheel to rail forces as it grows. It may also induce a lateral (roll) response of the wagon bodies which can contribute to further high lateral forces as well as affecting vertical force between the wheels and rails.

While it is possible that the lateral track misalignment formed as a consequence of the derailment, there was an absence of evidence of other mechanisms for generating lateral force or otherwise initiating the derailment. Therefore, it was probable that the lateral track misalignment formed under the passage of the train and contributed to the derailment by increasing the lateral force present between wheels and rails.

Examining possible causes of lateral track misalignment

Severe lateral track misalignments (commonly referred to as track buckles) occur when longitudinal compressive forces in the rails cause lateral buckling forces to exceed the restraint offered by the track structure. Managing the risk of lateral misalignment therefore requires both the management of longitudinal compressive forces in rails and the maintenance of track ballast that provides restraint.

The hot, sunny condition at the time of the derailment meant that it was almost certain that some longitudinal compressive force was present in the rails at the derailment location. However, the severity of the force and the increase in risk of lateral misalignment are not known as ARTC was not monitoring changes to the stress‑free temperature (SFT) of the rail at the derailment location.

ARTC’s procedure for managing track stability listed locations with increased risk of lateral instability, including locations with:

• a history of instability
• bunching points
• areas with non-conforming ballast profile
• track disturbing works (such as tamping)
• localised initiators (including mud holes).

There was no recent history of instability in the vicinity of the lateral track misalignment or record of recent track disturbing works.

Rail bunching occurs when the rails move toward fixed points in the track, typically as a result of train braking and acceleration forces. Bunching results in rails having a reduced SFT. In such circumstances, higher than anticipated longitudinal compressive stresses occur during hot weather at bunching points, which increases the risk of track instability. Turnouts, road crossings and bridge decks are commonly identified as bunching points. The closest turnout was about 300 m south of the derailment and the closest bridge deck was 1075 m to the north, making them both unlikely to have contributed to the misalignment. The mud hole near the derailment was also unlikely to have been a bunching point relevant to this occurrence given the down grade of the track and the location of the buckle after the mud hole (in the direction of travel of train 4MC2). 

Although the mud hole was identified as having deficient (non-conforming) ballast profile, it did not shift laterally. It is possible that some of the section of track that moved laterally had less than full shoulder ballast, consistent with observations of track further south. However, this had not been recorded by ARTC as deficient prior to the derailment, nor was it to the extent of the deficiency present at the mud hole location.

ARTC described localised initiators as ‘additional conditions present that will increase the locations vulnerability to instability’. Track geometry defects and pumping sleepers (that occur at mud holes) were identified as potential localised initiators. However, the mud hole and track geometry defect present at the time of the derailment were at one end of the lateral track misalignment, rather than within the section that had substantially moved. It is therefore unclear whether these contributed to the initiation of lateral track misalignment in this case.

The high rail temperature on the day of the derailment did contribute to the probable lateral track misalignment, by inducing a level of compressive force in the rails. However, if the rails had the nominal SFT and were in track with normal levels of lateral stability, this increased temperature would not have been sufficient to induce misalignment on its own. Whether the SFT had reduced was not known and, of the factors that had been associated with increased risk of lateral instability, several were not present. The presence and contribution of other factors was not known. Therefore, the factors contributing to the track misalignment could not be comprehensively determined based on the available evidence.

Train condition

Wagon 26 was the furthest forward in the train consist to have derailed, with the trailing bogie derailed to the left side in the direction of travel. Its position within the train suggested that it was probably the first wagon to derail. The wagon was inspected post-derailment and no indication of improper maintenance, excessive wear or signs of cyclic dynamic motion (hunting) that may have contributed to the derailment were observed.

The train consist indicated that this wagon was lightly loaded. Wagons adjacent to it were similarly loaded indicating that derailment risk due to in-train forces that exists for lightly loaded wagons adjacent to heavily loaded wagons was not present in this occurrence.

Track geometry

Mud hole

Ballast fouling, associated with a mud hole was present immediately before the derailment location, the northern extent was at 277.790 track km. The ballast profile in the area of the mud hole was deficient, with sleeper ends protruding, indicating that the track support was reduced.

A vertical geometry defect existed at 277.792 track km on both rails. The defect was within 2 m of the northern extent of the mud hole, which indicated that it was associated with the mud hole. The defect was a result of the track level within the mud hole being lower, then rising up at the defect location. The magnitude of the measured geometry rise had grown in 4 months preceding the October 2019 measurement and would have likely continued to grow up to the occurrence date.

Identification of vertical geometry defect

Vertical track geometry defects existed in both rails at 277.792 track km in October 2019 that exceeded ARTC’s P2 level. However, they were not included in the exceedance report generated for this date as it was based on an assessment against limits applicable for a lower speed track. Had this been detected, additional management would have been required as the ARTC CoP required that a P2 severity defect be inspected within 7 days and repaired within 28 days.   

A second exceedance report was generated from the track geometry recorded on the same day. It identified a defect at about 277.792 track km. However, this exceedance report was generated from an assessment against a parameter that was not listed in the CoP. There was no requirement for inspection or maintenance to be performed other than at the discretion of the maintenance team.

Comparison with other geometry standards

The measured vertical track geometry was evaluated against other standards. The standards chosen for assessment were the Australian Standard, New South Wales RailCorp standard, and Victorian V/Line standard. The standards used for assessment were those versions current at the time of the derailment. In all cases, the response required was more urgent than required by the ARTC CoP.

Based on the assessment of this defect, the limits prescribed in the CoP for inertial measurement permitted larger defects than comparable chord-based standards for vertical geometry defects. None of the standards provide a methodology detailing how their limit or response levels have been established, nor does the CoP.

A broader assessment of a large sample of possible and actual track recordings against objective safety criteria would be required to establish whether the limits and responses prescribed in the CoP provide a suitable level of safety. Such an assessment would be broadly aligned with the guidance offered by the 2023 update of the Australian Standard.

Management of track lateral stability

ARTC’s system for managing track lateral stability was being applied at the time of the derailment. A track stability management plan had been created for the relevant track section. Inspections and stress‑free temperature measurements were occurring at identified special locations and additional general inspections were also occurring. However, no location at or adjacent to the location of the probable lateral track misalignment were identified as a special location or had stress‑free temperature measured. In other words, a location that was potentially vulnerable to track instability was not identified.

The proximity of the mud hole to the derailment appeared to provide the greatest opportunity for the location to be identified as a special location. It is unclear why the mud hole was not identified as a special location given that it had been recorded in ARTC’s maintenance system and had ballast deficiency. Other locations of mud holes and ballast deficiency were identified as special locations.

A vertical track geometry defect also provided an opportunity for identification as a special location. However, both the error that caused it not to be detected, and the lack of other examples of isolated vertical geometry defects (where no lateral defect, ballast deficiency or general rough track were present) being included as special locations, limited the likelihood of this mechanism being useful for the identification of a special location.

The inclusion of a location proximate to the derailment location on the special location register would not guarantee that lateral track misalignment would be prevented. However, it would have provided the opportunity to carry out stress‑free temperature measurement, providing information that was otherwise missing relating to the risk of track instability.

The investigation into a derailment at Creighton, Victoria in 2019 identified that ARTC’s systems for managing track lateral stability did not lead to the location being managed as a location potentially vulnerable to instability. Safety action taken by ARTC at the time did not include changes to improve the system’s ability to prospectively identify vulnerable locations.

Passenger train impact

At about the same time that the driver of freight train 4MC2 reported observing a brake pipe airflow indication, V/Line passenger train 8630 approached Barnawartha from the other direction, heading toward Melbourne on the West Track. The driver of 8630 applied the brakes promptly after observing dust from 4MC2 in the distance. Despite this, the distance remaining when the brake application occurred was less than the stopping distance required.

The drivers of both trains described attempting to provide advanced warning by radio to the opposing train. However, it is not clear which communication attempt was ultimately successful, or the exact timing of communication attempts, as the radio channel used was not recorded. It was consistently described that all communication attempts occurred after the trains were first in view of each other and the brake applied on the passenger train. In this scenario, radio communication would not have influenced the outcome as the brake application had already occurred.

The passenger train could not stop in time and impacted a shipping container on derailed wagon 29 of train 4MC2 at a low speed. The passenger train stopped about 50 m short of another container that had fallen from wagon 29 and was obstructing both tracks. There was very little opportunity for any further actions to reduce the risk to safety in this occurrence by stopping passenger train 8630 prior to collision.

Findings

From the evidence available, the following findings are made with respect to the derailment of freight train 4MC2 and subsequent impact with passenger train 8630, at Barnawartha, Victoria on 29 January 2020. 

Contributing factors

• The dynamic motion of wagons as they transitioned a vertical track geometry defect and a probable lateral track misalignment led to the derailment of train 4MC2. The factors contributing to the probable lateral track misalignment could not be fully determined.
• A mud hole resulted in a vertical track geometry defect and localised reduction in track support immediately prior to the derailment location.
• ARTC did not identify and manage the vertical track geometry defect in accordance with its Code of Practice for track geometry. For the October 2019 measurement, track geometry was assessed against limits for the wrong speed band.

Other factors that increased risk

• ARTC’s systems for management of track lateral stability did not lead to identification of the location as a special location potentially vulnerable to track instability. (Safety issue)

Other findings

• For the track geometry that existed at 277.792 track km, ARTC’s Code of Practice for track geometry was less restrictive in managing vertical geometry than other comparable standards. The suitability of the limits and responses prescribed in the ARTC Code of Practice was not established.

Safety issues and actions

Special location not identified

Safety issue number: RO-2020-001-SI-01

Safety issue description: ARTC’s systems for management of track lateral stability did not lead to identification of the location as a special location potentially vulnerable to track instability.

Safety action not associated with an identified safety issue

Additional safety action taken by ARTC

ARTC has made several changes in response to this derailment including:

• The Code of Practice for track geometry has been updated to include a 6 m chord top criteria in addition to the 20 m inertial criteria. If assessed against the 6 m chord criteria in the updated standard, the vertical geometry identified in this investigation would have been classified as an E2 level defect (requiring inspection within 2 hours and rectification within 24 hours, or a significant reduction in speed).
• The mud hole management guideline has been updated to incorporate significant guidance on the identification, assessment and management of mud holes.
• In response to the use of an incorrect speed band for geometry assessment, ARTC has changed its process regarding the creation of additional reports. This is now achieved as a post-process rather than changing the speed in configuration files used on the AK car. In addition, ARTC is transitioning to a process that automatically assigns speed bands based on a linear referencing system, removing the need for manual configuration of speeds and allowing cross-checking by AK car operators. The automatic assignment of speed bands has been implemented in South Australia, Western Australia and Victoria and is scheduled to be completed in New South Wales by December 2025.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Australian Rail Track Corporation 
• Pacific National
• V/Line
• the drivers of both involved trains (4MC2 and 8630)
• data from locomotive event recorders. 

References

• ATSB. (2020). Derailment and collision between coal trains, Ravenan (25km from Muswellbrook), New South Wales, on 26 September 2018 (RO-2018-017)
• Wu Y., Munro P., Rasul M.G., Khan M.M.K., A review of Recent Developments in Rail Temperature Prediction for use in Buckling Studies, RTSA Conference on Railway Engineering, Wellington, 2010
• Kish A, Mui W, Track Buckling Research, John A. Volpe National Transportation Systems Centre (U.S.) 2013., https://rosap.ntl.bts.gov/view/dot/11985.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to directly involved parties and other relevant organisations. Submissions received were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Post derailment location of trains

Appendix B – Comparison of standards for vertical geometry

Introduction

Maintenance response criteria for vertical geometry from the Rail Industry Safety Standards Board (RISSB) AS 7635, RailCorp Engineering Standard ESC 210 and the V/Line Network Infrastructure Standard NIST-2706 were compared with the criteria in the ARTC Code of Practice. 

The length of the chord and the offset used in evaluation (including whether it was symmetric or asymmetric) varied between the standards. The chord offsets[27] used by the selected standards were: 

• 10 m / 1.8 m (AS 7635 and RailCorp)
• 5 m / 2 m (AS 7635)
• 6 m / 3 m (RailCorp)
• 10 m / 5 m (V/Line)

As the limits nominated for vertical geometry (top) in the 3 standards relate to specific nominated chord lengths, these limits couldn’t be directly compared to ones used with other measurement systems.[28] While it is possible to calculate the geometry for one chord offset from a measurement using a different chord offset, some information is lost in this process meaning it may not closely reflect the results of a direct measurement. However, the inertial measurement generated by the AK car is an estimate of the ‘true’ vertical geometry. Therefore, chord offsets can be calculated from the inertial measurement data without loss of information (providing the chord is of a reasonable length). It is understood that ARTC used this method to generate their 6 m exceedance report.

Results

Results for the vertical geometry using each of the 4 chord offsets were generated from the inertial data provided for the measurement undertaken on 9 October 2019 (Figure B1) The calculation used ARTC supplied formulae. The results vary substantially from the inertial value.  

Figure B1: Comparison of vertical geometry results – Left rail

Source: ATSB, generated from ARTC data

Results obtained using a symmetric chord offset (10 m / 5 m and 6 m / 3 m) are independent of orientation. In practice, when a real measurement system is used, the same result will be recorded regardless of the direction travelled over the defect. However, for the asymmetric chord offsets (10 m / 1.8 m and 5 m / 2 m) the recorded values are dependent on direction of travel. The orientation implied in the formulas ARTC provided was with the offset closer to the leading end of the chord (in direction of travel) and is therefore the orientation presented. 

The local maxima that occurred near the existing defect location at 277.792 track km were identified for each chord offset approximation. Table B1 presents the maximum value obtained for each rail and the corresponding defect response level based on the limits prescribed in the relevant standard. The defect response level may be different for each rail; when this occurred, the higher response was applied at the location.

Table B1: Summary of maximum value and corresponding response category

Summary 

The method used for categorisation of responses varied between the standards. However, the response actions associated with the categories could be compared. The response categories and actions are listed below:

• The ARTC standard categorised the vertical geometry as P2 level defects on both rails, requiring action in 28 days. 
• The V/Line standard (class 2 and 2M) categorised the vertical geometry as class A-H defects for both rails, requiring immediate application of an 80 km/h speed restriction and repair within 7 days. 
• The AS 7635 10 m / 1.8 m method categorised the vertical geometry as an E2 defect on the left rail and a P1 defect on the right rail. This required action within 24 hours and 7 days respectively or application of appropriate speed restrictions. 
• The RailCorp standard 10 m / 1.8 m method categorised the vertical geometry as an E2 defect on the left rail and a P1 defect on the right rail. This required action within 24 hours and 7 days respectively or application of appropriate speed restrictions.  
• The RailCorp standard 6 m / 3 m method categorised the vertical geometry as E2 defects on both rails, requiring action within 24 hours. 
• The AS 7635 5 m / 2 m method categorised the vertical geometry as E1 defects on both rails, requiring action or application of appropriate speed restrictions prior to the passage of the next train. 

There is difference in the maintenance responses triggered by the same vertical geometry when assessed against the different standards. Assessment against the three chord-based standards (V/Line, RailCorp, and AS 7635) all resulted in a more urgent response than required by the ARTC CoP. Based on the assessment of this defect, the limits prescribed for the CoP permit larger defects than comparable chord-based standards for vertical geometry defects. 

Appendix C – Analysis of recorded information

Introduction 

Information recorded on the event recorders from the leading locomotive of train 4MC2 and the locomotive of train 8630 was reviewed. The times recorded on both were compared to times recorded for key events recorded by the ARTC signalling system. Corrections were applied to align the recordings. 

No correction was applied to the recorded speed or distance. All positions (track km values) were calculated based on the distance from the position that each train stopped relative to Havelock Street level crossing at 279.490 track km.

Table of events

Table C1 below provides contextual events identified from both trains in chronological order.

Table C1: Recorded events in chronological order

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 2 December 2019, an Aeroprakt A22 Foxbat, recreational registration 24-4239, collided with terrain while conducting mustering 111 km SSW of Isisford, Queensland. The pilot sustained serious injuries.

In response to this accident, Recreational Aviation Australia (RAAus) commenced an investigation. As part of its investigations, RAAus requested technical assistance from the ATSB to download flight data from a Garmin GPS.

To protect the information supplied by RAAus to the ATSB and the ATSB's investigative work to assist RAAus, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003.

The ATSB has concluded the examinations of the Garmin GPS and has provided the results of that work to RAAus on 7 February 2020.

Any enquiries relating to the accident investigations should be directed to RAAus at: www.raa.asn.au

Safety summary

What happened

At 1322 Eastern Standard Time, on 29 January 2020, a Cessna Aircraft Company U206G, registered VH-AEE and operated by Air Fraser Island with two pilots onboard, was being used for landing emergency procedure training on a beach aircraft landing area (ALA) on Fraser Island, Queensland.

Just after touching down, the aircraft veered significantly to the left, toward the sea. The training pilot took control of the aircraft and conducted a go-around. Once airborne it was identified that the rudder was jammed in the full‑left position and the pilot had to apply full opposite aileron to maintain control. The engine subsequently stopped and the aircraft collided with water. The pilots escaped the aircraft and swam to shore. The aircraft was destroyed.

What the ATSB found

The ATSB found that, following touchdown, a section of the nose landing gear attachment failed, resulting in the rudder becoming jammed in the full‑left position. Due to the aircraft’s significant deviation towards the water, a go-around was initiated. While there was only a short timeframe to make the decision to abort the landing, it resulted in flight over water with significantly reduced aircraft controllability that required uncoordinated flight control inputs to control the aircraft.

It was also identified that fuel starvation, due to either the uncoordinated flight or damage associated with the nose gear failure, led to the engine losing power at a height too low for recovery and the aircraft collided with water.

The ATSB also identified two safety issues associated with the Cessna 206 that, while not contributory to this accident, can lead to fatal consequences in the event of a ditching.

Firstly, the Cessna 206 procedure for ditching and forced landing stated that the flaps were to be extended to 40°. While that permitted the aircraft to land at a slower speed, it also significantly restricts emergency egress via the cargo door. However, there is no warning about that aspect in the ditching or forced landing pilot’s operating handbook emergency procedures.

In addition, the Cessna 206 with the cargo door does not meet the aircraft certification basis for the design of cabin exits, due to the complexity associated with opening the cargo door if it is blocked by the flaps. This significantly hampers emergency egress and has previously resulted in fatalities.

What has been done as a result

The ATSB has recommended that Textron Aviation take safety action to address the procedure for ditching and forced landing in the pilot operating handbook for the Cessna 206, to ensure pilots are aware that extending the flaps beyond 10° will significantly restrict emergency egress via the cargo door.

The ATSB also recommends that the United States Federal Aviation Administration and the Civil Aviation Safety Authority take safety action to address the certification basis for the design of the cargo door in the Cessna 206, as wing flap extension beyond 10° will block the forward portion of the rear double door, significantly hampering emergency egress. 

In addition, and as a result of this accident, the operator has changed their procedures to specify that during emergency procedure training on the beach, no non-company vehicles are permitted to operate within the runway complex. They have also reassessed the company hazard register and included brake failures.

Safety message

This occurrence highlights the issue of evacuation through the cargo door when the flaps are extended in the Cessna 206. Pilots should be aware that lowering the flaps will block this exit and significantly increase the difficulty of opening the door. Consequently, all passenger pre‑flight briefings should include a practical demonstration of how to open a partially‑obstructed cargo door. Additionally, in the event that a ditching is required, pilots should consider not extending the flaps.

Furthermore, in 2009, research by the Transport Safety Board of Canada found that in the previous 20 years, where an aircraft had collided with water, 70 per cent of fatalities were caused by drowning. That statistic reflects the inherently disorientating nature of underwater exit from an often-inverted aircraft.

Transport Canada released TP 2228E-18 (04/2003), an ‘underwater egress’ safety guide which was forwarded to all Canadian operators of passenger carrying operations operating on water. This guide was to be provided to passengers before flight to increase their likelihood of survival in the event of a ditching.

The occurrence

At 1322 Eastern Standard Time,^[1] on 29 January 2020, a Cessna Aircraft Company^[2] (Cessna) U206G aircraft, registered VH-AEE (AEE) and operated by Air Fraser Island, was being used for emergency procedure training at a beach aircraft landing area (ALA), south of Happy Valley, Fraser Island, Queensland (Figure 1). There were two pilots onboard, including a trainee pilot (trainee), who had just commenced flying with the company. The trainee was seated on the left and was flying the aircraft.

Figure 1: Accident location

Source: Google Earth annotated by ATSB

The crew were simulating failure of the left main wheel brake during the landing phase. Just after the aircraft touched down, the trainee heard a snapping noise and the aircraft immediately veered left, towards the sea. The training pilot reported that, on taking control of the aircraft, their^[3] rudder pedals were ‘lying on the floor’. However, there was no change in the aircraft’s pitch or bank attitude, as would be expected if a major component of the landing gear had failed.

The training pilot immediately applied full power to conduct a go-around. The aircraft lifted off just before the water’s edge and struck a number of waves as it began to climb. The trainee advised that full aileron deflection was required to keep the wings level. The aircraft continued to climb to a height where the training pilot felt comfortable. They then lowered the nose to gain airspeed and reduced the flap, one stage at a time, to 20˚. The training pilot advised that as the airspeed increased above 70 kt they encountered difficulties controlling the aircraft’s roll, despite having full aileron deflection, so they reduced the power to maintain around 65–70 kt. About 150 m from the shore, they turned the aircraft north to parallel the beach. At that stage, the aircraft was maintaining a height of 150–300 ft above the water.

Both pilots then began to troubleshoot the control issues and identified that the flaps had raised symmetrically, and the rudder was jammed and fully deflected to the left. That control position resulted in significant uncoordinated flight (sideslip) to maintain control of the aircraft.

The training pilot advised the trainee that they were going to land back on the beach however, a short time later, estimated to be about 1.5 minutes after commencement of the go‑around, the engine stopped. The trainee advised there was about 5–6 seconds before the aircraft contacted the water. The training pilot had time to lower the nose and change fuel tanks from the right to the left tank, but not enough time to attempt to restart the engine.

After hitting the water, the aircraft remained upright, and the cabin quickly began to fill with water. Both pilots undid their seatbelts and the trainee tried unsuccessfully to open the single front pilot door (see the section titled Emergency egress in the U206). When the door could not be opened, the training pilot climbed over the seats into the rear cabin, kicked the cargo door to force it open, and then tried unsuccessfully to locate the trainee pilot in the aircraft. The training pilot then exited the aircraft via the cargo door.

Once outside, the training pilot could not locate the trainee so they re-entered the aircraft, which was then three quarters submerged. As the trainee could not be located, they exited a second time taking hold of a life jacket as it floated past. During this time, the trainee had opened and climbed out the pilot door window.

The training pilot then observed the trainee on the other side of the aircraft and after making them swim around the aircraft, put the life jacket on them. The training pilot subsequently put their arm through the life jacket and they both started swimming back to shore. They were met by a paramedic from the Happy Valley ambulance station who had entered the water to assist them to shore. Both pilots suffered minor injuries and the aircraft was destroyed (Figure 2).

It was reported that the aircraft’s nosewheel leg was found on the beach on the afternoon of the accident, approximately half-way between where the go‑around commenced and where the aircraft collided with water. The aircraft, without the engine, washed up on the beach the morning after the accident. At the time of writing, the engine had not been recovered (Figure 2).

Figure 2: VH-AEE on the beach at Fraser Island

Source: Operator

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. The current type certificate holder is Textron Aviation.
3. Gender-neutral plural pronouns are used throughout the report to refer to an individual (i.e. they, them and their)

Context

Flight crew

The training pilot held a Commercial Pilot (Aeroplane) Licence with a Class 1 Aviation Medical Certificate. They had accrued over 10,200 hours of which around 5,000 hours were accumulated in the Cessna 206. At the time of the accident, they had been awake for around nine hours and advised feeling ‘fine’ on the day.

The trainee held a Commercial Pilot (Aeroplane) Licence with a Class 1 Aviation Medical Certificate. They had accrued around 500 hours flying. At the time of the accident, they had been awake for about nine hours and had self-assessed their fatigue level at ‘2: very lively’.^[4]They advised that as part of their training they had completed the theory section of the emergency procedures training detailed in Civil Aviation Orders 20.11. They had previously been operating as a ground crew member on Fraser Island for the operator for several months and were proficient in the emergency procedure briefing for the aircraft and the use of life jackets.

Aircraft information

General details

The Cessna U206G is a single engine, six seat, high wing aircraft with fixed undercarriage. It is powered by a Teledyne-Continental Motors six-cylinder, horizontally opposed, fuel-injected piston engine with a constant speed propeller. The aircraft had modifications to improve the short take‑off and landing (STOL) capabilities.

AEE was manufactured in the United States in 1979 and first registered in Australia in the same year. The aircraft was maintained in accordance with the Civil Aviation Safety Authority (CASA) maintenance schedule, which required a periodic inspection every 100 hours or twelve months, whichever came first. It had undergone a periodic inspection on the 14 January 2020 and had a valid maintenance release. At the time of this inspection, the aircraft had accumulated about 13,725 hours in service. The operator advised they had purchased the aircraft two weeks prior to the occurrence.

Fuel system

The fuel system consists of left and right wing-mounted fuel tanks, which feed into separate fuel reservoir tanks. The pilot uses the fuel selector to select fuel from either the left or right reservoir tank. The fuel then passes from the selected reservoir tank into the engine through an auxiliary fuel pump, fuel strainer, engine driven fuel pump and fuel control unit.

The pilot operating handbook stated that, with a quarter tank or less, ‘prolonged uncoordinated flight such as slips or skids can uncover the fuel tank outlets, causing fuel starvation and engine stoppage’. This can occur with uncoordinated flight in excess of one minute.

The pilots reported they had departed Sunshine Coast Airport that morning with full fuel tanks. The trainee reported they had conducted approximately 1.5 hours flying before arriving at Hervey Bay Airport. The training pilot advised they had departed Hervey Bay Airport at approximately 1200. The accident occurred at approximately 1322. The training pilot reported that they had been changing fuel tanks every half hour. While the specific amount of fuel at the time of the accident could not be determined, based on the described flight sequences it is likely that each tank was about one third full.

Weight and balance

The aircraft was within the weight and balance limits at all stages of the flight.

Steering and brake system

The rudder pedals of both control positions are interconnected by torque tubes. The nose wheel steering system links the rudder pedals to the nose wheel steering arm, through a spring‑loaded steering bungee. This allows steering control on the ground using the rudder pedals and brakes. The steering bungee limits the turning of the nose wheel to 15-20°. Additionally, the nose wheel is locked straight ahead when there is no weight on the wheel.

The rudder system is also connected to the rudder pedals through the torque tubes. The torque tubes connect directly to the rudder via cables, and to a steering bellcrank, via pushrods, to form a closed loop system.

The brake system consists of a single disc, which has a hydraulically actuated brake, on each main landing gear wheel. The brake is operated by pressing the top of the rudder pedal. The right‑seat brakes are connected to the left-seat brakes by torque tubes located inside the rudder pedal torque tubes. Hence, applying the right brake on the right-seat pedal moves the right brake on the left-seat pedal, which then actuates the right brake master cylinder.

Stowable right-side pedals were an option on some models however, AEE had standard rudder pedals installed.

Damage to aircraft during accident sequence

While the ATSB did not attend the accident site, a review of supplied images identified the following damage to the nose landing gear area (Figure 3 and Figure 4):

• the nose wheel assembly had detached at the upper strut assembly and the steering bungee had separated
• the drag link had fractured at both ends
• both lower trunnion braces had fractured at their attachments
• the fuel line to the fuel strainer had fractured and fuel strainer bowl was missing.

From the photographs of the aircraft, all fractures appeared to be overstress failures with no evidence of pre-existing damage. However, it could not be determined which failure occurred first.

The rudder cables were also found to be intact and connected at both the forward and aft cable ends.

Figure 3 : Nose landing gear area (image rotated 180˚) and exemplar C206 nose landing gear area

Source: Supplied, annotated by ATSB

Figure 4: Nose landing gear leg and front of aircraft showing the main fuel line (image rotated 180˚)  

Source: Supplied, annotated by ATSB

Recorded information 

The aircraft was not fitted with a recording device, nor was it required to be. A witness supplied video footage of the final portion of the flight. It showed that the aircraft was maintaining level flight before it suddenly lost altitude, which was consistent with both pilots’ recollection of events. It also showed the aircraft initially floated upright on the sea surface, which most likely assisted the pilots to evacuate the aircraft.

Weather conditions

The graphical area forecast for the area indicated visibility was greater than 10 km with scattered^[5] cloud above 2,000 ft. The terminal area forecast for Hervey Bay, about 31 km west of the Happy Valley ALA, indicated the wind was from the east-north-east at 8 kt. The supplied video footage showed clear skies with a light sea chop. The training pilot advised the ocean was flat, with 1.2 m sets of waves with no wind. The current was running along the beach, from north to south.

Beach landing area

The operator used the criteria specified in Civil Aviation Advisory Publication 92-1(1) Guidelines for aeroplane landing areas to establish ALAs at various locations on the eastern beach on Fraser Island. These were set up, on the day, by trained ground crew. The pilots reported that the ALA was low on the beach with firm, hard sand. The ATSB did not attend the ALA after the accident and could not verify its condition.

Operator training

The operator regularly conducted sightseeing and passenger transfer flights from different locations along the eastern beach at Fraser Island. Their operations manual required that a passenger briefing be conducted prior to every passenger flight. This was to include the use of life jackets along with the location of, and the procedure to operate the emergency exit.

The operations manual had a section which outlined the training for the ground handling personnel. This section required that ground personnel be proficient in the use of all emergency exits in aircraft used in beach operations.

Newly employed pilots were required to complete pilot induction training, which included at least 15 hours of training in operating on the beach. In addition, pilots were required to undergo a beach-operations check every 90 days and a six-monthly route check.

The operator had a section in their operations manual which outlined their pilot training syllabus, covering all aspects of training. In the pilot induction training section, the syllabus specified that, along with other competencies, brake failure and asymmetric braking would be covered during the theory training, with no mention of simulated brake failure training in the practical syllabus. Despite this, the operator advised they always conducted simulated brake failures on the beach during the practical flying training. There was no information in the operations manual on how the brake failure simulation was to be conducted.

The operator advised they had devised their own method for brake failure training. To simulate the brake failure, after landing and with all three wheels on the ground, the flying pilot would apply full rudder on the side they were simulating as failed and then use the opposite brake to maintain directional control. That is, a simulated left brake failure required full deflection of left rudder pedal and the use of right brake to slow the aircraft and control direction and vice versa for simulation of right brake failure. The training pilot advised that they used this method, as the turning force associated with full brake application on one side was greater that the turning force created by the rudder and could result in the aircraft running off the side of the runway.

CASA had approved the operator’s operations manual, which included the operator’s pilot training syllabus. When questioned about the brake failure training being conducted by the operator, CASA stated ‘all pilots are taught basic “asymmetric brake failure recovery techniques” from an early stage in the flying training…’ but advised they had not observed the operator’s brake failure training method in the aircraft. They advised that brake failure training is normally conducted while taxiing rather than the landing phase of flight. CASA also advised that:

Due to the safety risks associated with the simulation of an asymmetric brake condition different training techniques may be used to simulate the failure that mitigate the safety risks, in the same way CASA expects flight training operators to manage the safety risks associated with flight training activities. As there was no guidance in the aircraft flight manual on the simulation of asymmetric brake failure the operator should have included clear guidance and procedures on how such activities were to be conducted.

The operator used Mahindra Airvan 8 (formerly GippsAero GA8 Airvan), Cessna 206 and 172 aircraft and advised that they conducted simulated brake failure training in all three aircraft types.

The ATSB sought Textron Aviation’s (type certificate holder for the Cessna 206) views on this type of simulated brake failure training. In response, they advised that they did not have an opinion about training.

A search of the ATSB database and CASA defect reporting service, between 2000 and 2020, did not identify any brake failures having been reported by the operator.

Effect of simulated brake failure training on nose wheel

In the Cessna 206 and 172, the nose gear steering is designed so the nose wheel is held with zero steering deflection while the gear strut is fully extended, regardless of rudder pedal deflection. Nose wheel steering is only available once the nose strut deflects and then it is only influenced by the steering bungee loads. The application of full rudder pedal deflection on the ground will only result in 15–20° of nosewheel deflection. However, for aircraft with direct nose gear steering linkages, such as the Airvan 8,^[6] this could mean that the steering angles on the nose wheel could be much higher.

Aircraft design requirements account for fore/aft and side loads on the nose gear based on towing and tyre friction over a variety of hard surfaces. The friction properties of sand are likely to be low initially. However, if ploughing were allowed to develop the side loads on the nose wheel could be relatively high. For a wheel that can only turn 15–20°, this effect is not likely to develop to any great extent. However, for aircraft with direct steering linkages, the loads may increase significantly.

Differential braking is permitted and designed into the braking system. It does not produce any additional loads on the airframe other than side load on the nose gear, but this would be proportionally low. Therefore, stopping the aircraft with brakes from one wheel of the aircraft would not be damaging.

It was difficult to determine whether the side loads on the nose wheel would exceed the design requirements in the Airvan 8. As this was not the aircraft type involved in the accident, further consideration of this aspect was outside the scope of the investigation.

Operator training on accident flight

The training being conducted at the beach landing area consisted of flapless landings and simulated brake failures during landing. The crew advised that, as there was very little wind, they were taking off and climbing to 500 ft before conducting a teardrop turn to land back on the ALA in the opposite direction. They were conducting flapless landings when landing to the north and simulating a brake failure during the landing to the south. They advised they had conducted at least five simulated brake failure landings that day, with no problems encountered.

Operator’s safety management system

While not required by CASA, the operator had begun to introduce a safety management system (SMS) into their organisation in about 2013. This was incorporated into their operations manual which was divided into sections including one on the SMS and a section on specialised operations. The SMS section included procedures for a hazard identification process and included the statement ‘hazards can only be mitigated and controlled if their existence is known’.

The specialised operations section included information and procedures for beach operations. It identified that, due to operation in the harsh beach environment, special attention should be paid to the brakes in the pre-flight inspection. Despite this special attention and additional regular brake failure training, the operator had not identified brake failures as a hazard in their hazard register. CASA had approved the operations manual incorporating the SMS in 2015. However, they had not identified that the hazard register did not identify this aspect.

Go-around decision

The approach and touch down on the incident landing were reported to have been normal. The trainee pilot advised that, as they applied left rudder, but before applying the right brake, there was a snapping noise and the aircraft veered left. The training pilot advised that the aircraft veered left between 15–20˚.

They immediately called out ‘taking over’ and assumed control of the aircraft, with the trainee pilot removing their hands and feet from the flight controls. The training pilot assessed that their rudder pedals had collapsed forward, so they had neither rudder nor brake authority. They decided that, as they were heading for the water, which was about 40‑50 m away, and the aircraft was still moving at approximately 50–60 kt, the safest option was to apply full power and conduct a go‑around.

The trainee pilot stated that if they had continued on the ground ‘it would not have been a smooth impact’.

Federal Aviation Administration guidance

The Federal Aviation Administration’s (FAA) publication The art of aeronautical decision-making advises that aviation decision making can be broken down into three parts - to perceive, process and perform.

The FAA publication Airplane flying handbook Chapter 17 Emergency procedures advises that a pilot takes about 4 seconds to perceive and react to an emergency situation. In addition, ‘there are several factors that may interfere with a pilot’s ability to act promptly and properly when faced with an emergency’. These are listed as:

• reluctance to accept the emergency situation
• desire to save the airplane
• undue concern about getting hurt.

It goes on to advise:

A pilot who is faced with an emergency landing in terrain that makes extensive airplane damage inevitable should keep in mind that the avoidance of crash injuries is largely a matter of: (1) keeping the vital structure (cabin area) relatively intact by using dispensable structure (i.e., wings, landing gear, fuselage bottom) to absorb the violence of the stopping process before it affects the occupants (2) avoiding forceful bodily contact with interior structure.

Emergency egress in the U206

The U206^[7] has a door adjacent to the left pilot’s seat and a double clamshell cargo/cabin door in the passenger compartment on the right, adjacent to the second and third seat rows (Figure 5).

Figure 5: Cessna U206 showing location of pilot door and double clamshell cargo/cabin door

Source: TSB investigation report A18W0129, adapted by ATSB to match occurrence aircraft 

Operation of rear cargo doors

The forward door of the rear double cargo doors must be opened first to allow the aft door to open (Figure 7). The forward door handle is accessible for passengers in the middle row seats and is difficult to reach by passengers in the back-row seats. The forward door handle has three positions:

• when the lever is horizontal (with the lever facing forward), the door is locked
• turned clockwise 90° to the vertical position, the door is closed
• turned clockwise another 30°, the door is open.

When the flaps are extended, the front half of the clamshell cargo door is blocked by the flap and can only be opened approximately 8 cm (Figure 6).

Figure 6: Cessna U206 with door unable to be opened more than 8 cm when flap is extended

Source: TSB investigation report A18W0129, annotated by ATSB 

A red lever, mounted in the aft door leading edge, is used to unlatch the aft door (see Figure 7: Cessna 206 forward cargo door open showing red lever activated on the leading edge of rear door). However, this lever is in line with the backrest of the right middle row seat. As such, it is difficult to reach for the passenger occupying the middle seat and is again difficult to operate by passengers in the back-row seats.

In addition, when the red lever in the leading edge of the aft door, is lowered to the open position, it strikes the slightly open forward door, which prevents the aft door from opening. The lever must therefore be restowed before opening the aft door, being mindful that the aft door latch does not re-engage.

A service bulletin was subsequently released by Cessna to improve the red lever operation so that the lever automatically restowed (see Cessna service bulletin SEB91-4 Cargo door latch improvement in Australian requirements). Having to keep the forward door open to operate the lever in the forward edge of the aft door, adds to the difficulty of the procedure, especially when attempting to open the doors from the rear seats.

Figure 7: Cessna 206 forward cargo door open showing red lever activated on the leading edge of rear door

This image shows an aircraft where service bulletin SEB91-4 has not been incorporated and the red handle does not retract automatically. Before the door can be opened, the red lever is required to be restowed without the door relatching. This is not indicative of the accident aircraft.
Source: TSB investigation report A18W0129, annotated by ATSB

In addition, when the doors on the aircraft are locked from the inside, neither the front nor the rear cargo door can be opened from the outside.

Emergency Procedures

The pilot operating handbook (POH) emergency procedures section provided checklist and amplified recommended actions to be taken in the event of an abnormal situation. In the ‘forced landings’ section, the procedure for ditching stated that flaps were to be extended to 40˚. In addition, it noted ‘evacuate through the cabin doors. If necessary, open window and flood cabin to equalise pressure so doors can be opened’.

There was no reference in this section to warn that the cargo door will be blocked if the flaps are extended. The procedures for other forced landings, with or without engine power, also stated that the flaps were to be extended to 40°. Again, there was no reference in that section to warn that the cargo door will be blocked if the flaps are extended.

The amplified procedures section contained a brief description of the ‘cargo door emergency exit’, which included:

if the wing flaps are extended, open the doors in accordance with the instructions shown on the placard (Figure 8) which is mounted on the forward cargo door.

Figure 8: Cargo door emergency exit placard

Step 4 is not required in aircraft where Cessna service bulletin SEB91-4 has been incorporated.

Source: Cessna 206 pilot operating handbook

Federal Aviation Administration certification requirements

The Cessna 206 was first certified in 1963 under the United States (US) Federal Aviation Administration (FAA) Civil Aviation Regulation Part 3. Section 3.387 which stated:

Closed cabin airplanes carrying more than 5 persons shall be provided with emergency exits consisting of movable windows or panels or of additional doors which provide a clear and unobstructed opening….The exits shall be readily accessible, shall not require exceptional agility of a person using them….The method of opening shall be simple and obvious, and the exits shall be so arranged and marked as to be readily located and operated even in darkness.

There have been a number of revisions made to this standard over the years however, once an aircraft has been certified, the design standard under which it was certified continues to apply.

Australian requirements

In 1988, the Civil Aviation Authority (CAA),^[8] released an airworthiness directive AD/Cessna 206/47 that required improved placarding of Cessna 206 emergency exits. Cessna subsequently released service bulletin SEB91-4 Cargo door latch improvement in March 1991, which recommended modifying the handle in the rear door half to include a spring to ensure that the handle would return to the stowed position.

That same year, the CAA issued AD/Cessna 206/47 amendment 2, which allowed SEB91-4 to be an alternate means of compliance to the required placards. In 2011, CASA subsequently issued amendment 3 to AD/Cessna 206/47 which clarified which 206 models the AD applied to, as SEB91-4 had been incorporated at manufacture in some models and other models did not have the cargo door, however, SEB91-4 remained as an alternate means of compliance. AEE complied with this AD.

Transport Safety Board of Canada

In 2018, the Transport Safety Board of Canada (TSB) investigated a collision with water involving a float-equipped U206 (A18W0129). In this occurrence, the aircraft inverted upon impact and became submerged. The pilot and one passenger escaped through the forward door window. Three other passengers survived the impact and were found with their seatbelts undone, however, they did not escape the aircraft and subsequently drowned.

The TSB report noted ‘the rear double cargo doors have been identified as a risk to passengers in emergency situations for many years’. Further, the report documented some of the work which had been conducted to address the risk associated with the design of the cargo door, including:

• In 1991, Cessna issued Service Bulletin SEB91-4 which provided a service kit to incorporate a spring assembly to automatically retract the handle on the leading edge of the rear half of the door to allow it to pass the front half of the door. It also included improved placarding to clarify the instructions on how to open the door in an emergency.
• In 1998, Cessna resumed manufacturing the 206 with the 206H. This was certified under the US Federal Aviation Regulations^[9] 23.807 legislation. Transport Canada determined that the 206H did not meet the requirements of the legislation, as the rear cargo door could not be considered an emergency exit as the means of opening was not ‘simple and obvious’. As a result of that assessment Transport Canada reduced the number of occupants permitted in the aircraft to five.
• Between 1999 and 2003, Transport Canada, the FAA and Cessna worked on a design change to address this issue, which could be applied to the 206H, and retrofitted to the previous 206 models. No acceptable solution was found, and the matter was discontinued.
• In 2005, Transport Canada proposed an airworthiness directive to address the issue of different models allowing different numbers of occupants, despite having the same design. However, following industry consultation, the proposal was withdrawn.

In response to the 2018 Canadian occurrence, TSB released an Aviation Safety Advisory A18W0129-D1-A1 Cessna 206 emergency exit – blocked double cargo door with flaps extended, ‘to bring attention to the significant safety issue involving Cessna 206 series aircraft fitted with double cargo doors’.

Other action taken by regulatory bodies

November 1996

As a safety action in response to an accident in a Cessna U206 where a pilot and three passengers drowned when they could not escape the aircraft after it capsized during the take‑off run (A96Q0114), Transport Canada (TC) wrote to the FAA to express concern about the adequacy of the emergency exit in the Cessna U206 aircraft. In the letter, TC strongly recommended that should production of the U206 resume:

…the FAA require Cessna to incorporate a solution which eliminates the interference problem between the flaps and the emergency exit…

No action was taken by FAA in response to this letter.

March 2020

FAA released an Airworthiness Concern Sheet NOTC0041 asking for information from people who had experience using the 206 cargo door. They subsequently advised that 95 per cent of the respondents did not want action taken on the issue. They also advised that their research had shown that the biggest positive impact to safety was ensuring that pilots briefed their passengers on how to use the door. No further action was planned.

April 2020

Transport Canada released Airworthiness Directive CF 2020-10 which limited the number of seats in Cessna 206 aircraft to five, in other than the 206H and T206H models,^[10] and aircraft which had not been modified to FAA supplemental type certificate (STC) SA1470GL (see Right side door below). Additionally, if passengers were seated in the rear row, they must have demonstrated the capability to operate the cargo door on the day of the flight. They must also have been briefed that the cargo doors were only to be used in an emergency if the front left cabin door was obstructed.

The same month, the Civil Aviation Authority of New Zealand released Continuing Airworthiness Notice 25-003 to alert operators of Cessna 206s in New Zealand to CF 2020-10. 

August 2020

The European Union Aviation Safety Agency (EASA) released a Safety information bulletin 2020‑16 to alert European operators of Cessna 206s to CF 2020-10.

Cessna 206 exit modifications

Several organisations have developed solutions to ensure the cargo door can be opened easily in the event of an emergency. Some of these solutions have received approvals from the FAA and are commercially available. Some of these include:

Right side door

FAA STC SA1470GL approves a right-side door in the front cabin, which allows both egress for the front right passenger and emergency egress from the centre row seats in the cabin.

Installation of the Split Forward Cargo Door Window

Transport Canada have approved supplemental type certificate SA20-34. This allows for the forward cargo door to be split allowing the door to open when the flap is extended (Figure 9). This has also been approved in Europe under EASA STC 10074631 and the FAA under STC SA04550NY.

Figure 9: Cessna 206 split cargo/cabin door

Source: Coast Dog Aviation, annotated by ATSB

PDQ emergency egress system

At the time of writing this report, the manufacturer reported that the FAA were in the final stages of approval for supplemental type certificate ST02309AK. Under this approval a handle is installed which, when activated, allows the front cargo door to be released (Figure 10). This allows access to the red lever and the aft cargo door can then be opened.

Figure 10: Cessna U206 with emergency egress system

 Source: Airframe Innovations

Similar occurrences

The ATSB conducted a search of aviation investigation databases, and other sources, to identify accidents involving Cessna 206 aircraft, where the impact was likely survivable however, difficulties opening the cargo door resulted in significant delays during the emergency egress, or the cargo door had not been opened. The following accidents were identified: 

Table 1: Similar occurrences

In March 1999, at Pitt Island, New Zealand, a Cessna 206 had an engine failure and ditched in the sea. The pilot was aware of the issue with deployed flap blocking the rear doors and ditched the aircraft with the flaps retracted. Consequently, all the occupants escaped from the aircraft and swam to shore. (Transport Accident Investigation Commission New Zealand 99‑001)

__________

4. The ATSB uses the Samn-Perelli fatigue scale from 1 (Fully alert. Wide awake. Extremely peppy) to 7 (Completely exhausted. Unable to function effectively. Ready to drop).
5. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – scattered indicates that cloud is covering between a quarter and a half of the sky.
6. During the operator’s described simulated brake failure training, it was assumed that the initial touchdown was conducted using the rudder inputs required to keep the aircraft straight.
7. The U206, TU206 and 206H models are designed with the rear double cargo door.
8. In July 1995, the Civil Aviation Authority separated into the Civil Aviation Safety Authority and Airservices Australia.
9. The United States Civil Air Regulations were replaced with the Federal Aviation Regulations on 1 February 1965.
10. Transport Canada had previously reduced the number of passengers permitted in the 206H and T206H models to 5.

Safety analysis

Introduction

On 29 January 2020, at about 1322, the flight crew of a Cessna U206G aircraft, registered VH‑AEE, were conducting simulated brake failure training on a beach at Fraser Island, Queensland. During the landing roll, directional control was lost, and the training pilot conducted a go-around. While the aircraft was flying parallel to the beach, with flight control issues, the engine stopped, and the aircraft collided with the water. Both pilots escaped the aircraft and swam to shore with minor injuries.

This analysis will examine the sequence of failure in the nose landing gear system, the decision to conduct a go-around and the engine stoppage. Further, it will analyse the brake failure training conducted by the operator and the interaction between the landing flaps and cargo door in the context of emergency egress.

Accident sequence

Both pilots reported having conducted several landings involving simulated brake failure, without incident. On this landing, just after touchdown, and as the left rudder was applied the trainee pilot heard a snapping noise, immediately followed by loss of directional control. Examination of the rudder control system after the occurrence established its continuity. As such, it is likely that a partial failure in the nose gear assembly compromised the interconnected rudder and steering controls. The training pilot reported the rudder was jammed in the full left position and use of the brakes was not possible as the right-seat pedals had collapsed.

Despite the nose landing gear being found on the beach between where the aircraft took off and where the collision occurred, it is likely the nose gear leg did not detach from the aircraft while the aircraft was on the ground as this would probably have resulted in the propeller striking the sand and stopping the engine.

Additionally, as the rudder probably jammed due to the partial failure of the nose gear assembly, if the nose gear detached during the take-off or initial climb, control of the rudder would likely have been restored. However, based on the account of the pilots, this did not happen.

Supplied images showed that the fuel strainer was missing, and the fuel line that fed the strainer was fractured. These components were in the nose gear bay and directly fed the engine fuel system. Loss of fuel supply at this location would have resulted in almost immediate engine stoppage. As the engine continued to provide power for approximately 1‑1.5 minutes after take-off, it is highly probable that the nose gear separated and fractured the fuel line, as the aircraft collided with the water.

Examination of the nose gear fracture surfaces revealed they were consistent with the attachments failing in overstress, with no indication of a pre-existing fault. It could not be established which part of the nose landing gear failed first nor why the training pilot’s rudder pedals were affected as described.

Engine failure and collision with water

The engine, and associated components, were not recovered for examination. However, as neither pilot reported issues with the engine before the accident, it is unlikely there was a coincidental mechanical issue with the engine.

The aircraft departed the Sunshine Coast Airport with full fuel and had been flying for approximately three hours, leaving less than half fuel remaining at the time of the accident. The fuel system could only be operated on one tank at a time. As the aircraft collided with water, the exact quantity of fuel in each tank at the time of the accident could not be confirmed, however if the fuel management had maintained roughly equal quantities of fuel, each tank would have been about one third full.

Following the go-around, the training pilot applied full right aileron to prevent the aircraft from rolling. This resulted in the aircraft being flown in a significantly uncoordinated state (sideslip), with right wing low. The pilot operating handbook stated that, with a quarter tank or less, ‘prolonged uncoordinated flight such as slips or skids can uncover the fuel tank outlets, causing fuel starvation and engine stoppage’. The aircraft was flown in an uncoordinated state for between 1‑1.5 minutes before the engine failed. If the fuel usage had not been equalised then it is possible the right tank contained quarter or less fuel, resulting in fuel starvation to the engine. It is also possible that the magnitude of the required sideslip permitted unporting of the fuel tank outlet at greater than one quarter capacity.

It is also possible, although considered less likely, that the damage to the landing gear in turn damaged the fuel strainer/fuel line during the final stages of the flight, again leading to fuel starvation.

Go-around decision

According to the United States Federal Aviation Administration, the typical time taken to realise there is a problem and react to it, is about 4 seconds. In that time frame, the pilot must perceive the problem, process the alternatives, and perform the selected action.

On this occasion, the decision to commence a go-around was influenced by the aircraft’s deviation towards water with little to no directional control or brake function. Taking into consideration that the flight crew were conducting training for emergency procedures (including multiple go-arounds), there may also have been a greater inclination to commence a go-around. While opting for a go‑around on this occasion was understandable, it resulted in flight over water with significantly reduced aircraft controllability.

The FAA’s guidance for emergency procedures advised that accepting there will be an accident may be the safest option and using the aircraft’s dispensable structure to absorb the ground/water impact forces will most likely reduce injuries. In this case, there was about 40‑50 m from when the pilots perceived they had no braking or directional control, to the water’s edge. Allowing the aircraft to continue to slow and using the aircraft structure to absorb the impact would, in hindsight, most likely have been the safest option.

Operator’s safety management system

The operator had determined that their aircraft were susceptible to brake failures because they were operated regularly on the beach. To mitigate this safety concern the operator ensured the brakes were inspected during the pre-flight inspections and conducted regular simulated brake failure training. However, the concern had not been formally documented in the operator’s hazard register.

The CASA booklet: SMS for aviation-a practical guide stated that if an operator identified a specific risk to their operation, appropriate mitigators should be identified and assessed. A risk analysis should be conducted to ensure the risk, after mitigators are applied, has been reduced to a level that is ‘as low as reasonably practicable’. Not documenting the brake failure hazard in the register was a missed opportunity to both:

• assess the magnitude of the risk, taking in to account that apparent low likelihood of brake failure actually occurring
• identify any hazards that simulated brake failure training introduced, including the potential for nose wheel damage.

ATSB assessment of the brake failure training, did not identify excess stresses on the Cessna U206 or 172 nose wheel. However, analysis of the stresses on the nose wheel in the Mahindra Airvan 8, also used by the operator, indicated if the nose wheel were fully deflected and the aircraft encountered soft sand, the additional side loads on the nose wheel system may induce damage.

Emergency egress

When the aircraft collided with the water, the extended flap prevented the front cargo door from opening fully. On this occasion, it is likely that when the training pilot kicked the doors open, the edge of it deformed the partially‑extended (20°) flap sufficiently to allow egress.

More generally, the Cessna U206 pilot’s operating handbook (POH) stated that 40° of flap were to be selected during ditching (and forced landings), creating a greater cargo door obstruction than occurred during this accident. Having the flap extended allows the aircraft to land at a slower speed, which has been shown to improve the chances of surviving a ditching. However, the POH emergency procedures did not identify that such a flap selection also prevents the forward cargo door from fully opening.

That situation may leave pilots unaware of the significant consequences of flap deployment. By contrast, at least one accident report shows that where the pilot has understood this issue and has not extended the flap during a ditching, the passengers have been able to readily exit the aircraft.

The aircraft’s certification criteria required that emergency doors be clear, unobstructed and capable of being opened with a simple and obvious method. This is particularly important in the event of ditching, due to the inherently disorientating nature of underwater egress. The Cessna U206 cargo door requires a number of sequential steps to open, and when the flaps are extended, this process is even more complicated. The inability to open the cargo door in this aircraft type has been shown in numerous accidents to have contributed to passengers being unable to exit the aircraft, resulting in fatalities.

Therefore, although the Cessna U206 with cargo door was certified, the method for opening the cargo door is not simple and in some flap configurations the forward door cannot be opened and therefore does not meet the emergency egress requirements.

Steps have been taken by regulators in an attempt to address the hazard presented by the rear double cargo door design, but to date, they have been ineffective at eliminating it. However, approved modifications are now available that remove the flap/door interference issue, despite this, to date no regulatory action has been taken to mandate the application of one of these modifications or remove the hazard by another means.

Findings

From the evidence available, the following findings are made with respect to the collision with water involving a Cessna Aircraft Company U206G aircraft, VH-AEE, near Happy Valley, Fraser Island, Queensland, on the 29 January 2020.

Contributing factors

• Following touchdown, during a simulated brake failure exercise, a section of the nose landing gear attachment failed, resulting in the rudder becoming jammed in the full‑left position.
• A go-around was initiated after directional control was lost on the ground. While there was only a short timeframe to make the decision to abort the landing, it resulted in flight over water with significantly reduced aircraft controllability.
• It is most likely that fuel starvation led to the engine losing power at a height too low for recovery and the aircraft collided with water.

Other factors that increased risk

• The 20° flap setting blocked the forward portion of the rear double cargo door, delaying the training pilot’s exit via the cargo door.
• The Cessna 206 procedure for ditching and forced landing states that the flaps are to be extended to 40°. While that permits the aircraft to land at a slower speed, it also significantly restricts emergency egress via the cargo door. However, there is no warning about that aspect in the ditching or forced landing pilot’s operating handbook emergency procedures. (Safety issue)
• Cessna 206 aircraft, that feature a rear double cargo door, do not meet the aircraft certification basis for the design of cabin exits. Wing flap extensions beyond 10° will block the forward portion of the rear double cargo door, significantly hampering emergency egress. This has previously resulted in fatalities. (Safety issue)

Safety issues and actions

Cessna 206 emergency procedures 

Safety Issue number: AO-2020-010-SI-01 

Safety issue description: The Cessna 206 procedure for ditching and forced landing states that the flaps are to be extended to 40°. While that permits the aircraft to land at a slower speed, it also significantly restricts emergency egress via the cargo door. However, there is no warning about that aspect in the ditching or forced landing pilot’s operating handbook emergency procedures.

Cabin exit design criteria (Issue owner: United States Federation Aviation Administration) 

Safety issue number: AO-2020-010-SI-02

Safety issue description: Cessna 206 aircraft that feature a rear double cargo door do not meet the aircraft certification basis for the design of cabin exits. Wing flap extensions beyond 10° will block the forward portion of the rear double cargo door, significantly hampering emergency egress. This has previously resulted in fatalities.

Cabin exit design criteria (Issue owner: Civil Aviation Safety Authority)

Safety issue number: AO-2020-010-SI-02

Safety issue description: Cessna 206 aircraft that feature a rear double cargo door do not meet the aircraft certification basis for the design of cabin exits. Wing flap extensions beyond 10° will block the forward portion of the rear double cargo door, significantly hampering emergency egress. This has previously resulted in fatalities.

Additional safety action by Air Fraser Island

As a result of this accident, the operator has changed their procedures to specify that during emergency procedure training on the beach, no non-company vehicles are permitted to operate within the runway complex (the marked section of beach using bollards and witches hats identifying the area which has been identified as a suitable aircraft landing area.)

The operator has also reassessed the company hazard register and included brake failures.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew
• Air Fraser Island
• Civil Aviation Safety Authority
• United States Federal Aviation Administration
• Cessna Aircraft Company – Textron Aviation
• the insurance company
• video footage of the accident flight and other photographs
• Transport Canada
• Transport Safety Board of Canada.

References

Federal Aviation Administration, Airplane flying handbook FAA-H-8083-3B. US Department of Transportation, Federal Aviation Administration. Available on the FAA website www.faa.gov

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew
• Air Fraser Island
• Civil Aviation Safety Authority
• Federal Aviation Authority
• United States National Transportation Safety Bureau
• Transport Safety Board Canada
• Textron Aviation

Submissions were received from:

• Air Fraser Island
• Civil Aviation Safety Authority
• Transport Safety Board Canada
• Textron Aviation

The submissions from those parties were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 16 December 2019, a BRM Aero Bristell aircraft, recreational registration 24-8555, collided with terrain in Kanangra-Boyd National Park, near Oberon, New South Wales. The pilot was fatally injured.

In response, Recreational Aviation Australia (RAAus) commenced an investigation into the occurrence and requested technical assistance from the ATSB in the recovery of flight data from two instrumentation units – a Dynon SV-D1000 and Garmin aera 795; both of which were subsequently provided by NSW Police.

The ATSB successfully downloaded data from both devices, including flight path information and aircraft operational parameters. Figures 1 and 2 summarise this information.

Both instrumentation units were returned to NSW Police on 23 June 2020 and a technical report and all recovered data provided to RAAus on 24 June 2020.

With the completion of this work, the ATSB has concluded its involvement in the investigation of this accident. Any further enquiries in relation to the investigation should be directed to Recreational Aviation Australia.

The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003.

Figure 1: Flight paths from Garmin and Dynon units

Source: Google Earth, GPS points by ATSB

Figure 2: Selected flight parameters

Source: ATSB

Safety summary

What happened

On 22 January 2020, a Boeing 777 was being operated by United Airlines as regular public transport flight UA870 from Sydney, Australia to San Francisco, United States.

At about the same time, a GIE Avions de Transport Régional ATR 72 was being operated by Virgin Australia as regular public transport flight VOZ1153 from Sydney to Tamworth, New South Wales.

Sydney Airport was configured for parallel runway operations, including simultaneous independent departures. VOZ1153 departed from runway 34R to an assigned heading of 350º, just prior to UA870 departing from runway 34L. UA870 was required to maintain runway heading (335º) until reaching 1,500 ft, at which point the aircraft was cleared to turn left and track towards Richmond, northwest of Sydney. However, UA870 climbed straight ahead through to about 2,100 ft and then the aircraft turned to the right about 45º from the required heading, resulting in a loss of separation with VOZ1153. At their closest point of approach, the two aircraft were separated by 1,843 m (about 1.0 NM) laterally and 60 m (about 200 ft) vertically.

Air traffic control detected the loss of separation and issued interventional instructions to both aircraft. The required separation was re-established and both flights continued without further incident.

What the ATSB found

The ATSB found that the UA870 pilot flying was expecting a more simplistic procedure often provided to foreign crew departing Sydney for an oceanic route. The pilot flying then became confused regarding aspects of the flight management computer (FMC) coding generated to represent the actual departure clearance provided. This may have been due to an unfamiliarity with radar transitions from a standard instrument departure to an en route track. This led the pilot flying to incorrectly adjust the FMC prior to engine start, and resulted in the aircraft turning right after departure, bringing it into conflict with VOZ1153.

The pilot flying probably did not effectively communicate the changes made to the FMC to the crew. The FMC departure specific coding was also not effectively cross-checked by the pilot monitoring or relief pilots prior to take-off.

Safety message

The ATSB’s SafetyWatch program highlights broad safety concerns that come out of ATSB investigation findings and from the occurrence data reports by industry. One of these safety concerns is data input errors.

This occurrence illustrates the importance of procedural correctness, effective communication and crew coordination towards the conduct of safe flight operations. Any amendment to the flight management computer, particularly those applicable to the more critical phases of flight (departure and arrival procedures) should always be announced, and then carefully and independently verified by at least one other crew member. The incident also outlines that, when possible, air traffic controllers can potentially further assist foreign crew by proactively factoring the crew’s unfamiliarity when providing airways clearances.

The investigation

Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of findings that affect safety and possible safety actions.

The occurrence

On the early afternoon of 22 January 2020, a Boeing 777-300ER (777), registered N2333U, was being operated by United Airlines as regular public transport flight UA870 from Sydney, New South Wales to San Francisco, United States.

At about the same time, a GIE Avions de Transport Régional ATR 72-600 (ATR72), registered VH-FVQ, was being operated by Virgin Australia as regular public transport flight VOZ1153 from Sydney to Tamworth, New South Wales.

The Sydney Airport automatic terminal information service (ATIS)^[1] indicated to all crews that parallel runway operations were in progress, including simultaneous independent departures^[2] from runways 34L and 34R. The weather was fine, with excellent visibility, no cloud below 10,000 ft and a light wind from the northwest.

The flight crew for flight UA870 consisted of a captain and three first officers. The captain was the pilot flying (PF) and one of the first officers was the pilot monitoring (PM).^[3] The remaining first officers occupied the two observers’ seats positioned directly behind the PF and PM on the flight deck.

Sydney air traffic control attempt to facilitate expeditious departures to all aircraft, particularly aircraft transiting over extended distances (oceanic crossings). This regularly involves a clearance via the SYDNEY ONE RADAR (SYD1) standard instrument departure (SID).^[4] The PF had operated from Sydney Airport on a number of other occasions. While preparing for departure at the gate, after receiving the ATIS, but prior to receiving their pre-departure clearance, the PF configured the flight management computer (FMC)^[5] for the SYD1 based on an expectation from prior experience.

At about 1330 Eastern Summer Time (ESuT),^[6] Sydney clearance delivery (SCD) air traffic control (ATC) provided a different pre-departure clearance via VHF radio:

United eight seventy (UA870), delivery, cleared to San Francisco via DIPSO,^[7] flight planned route, runway three four left (34L), Richmond five departure, radar transition, climb via SID to five thousand (5,000)…

The PM provided a truncated read back of the clearance to ATC, inadvertently not repeating the radar transition^[8] component.

At the same time as the UA870 crew were preparing for their departure, VOZ1153 was cleared to depart via the SYD1 radar SID via runway 34R. This procedure required the ATR72 to maintain a heading of 350º after take-off, until directed otherwise by ATC.

The UA870 crew reviewed the RICHMOND FIVE (RIC5) SID chart (Figure 1). That chart included two distinct caution notes about the initial climb. The more detailed caution stated:

Parallel runway operations - DO NOT TURN RIGHT. Track 335⁰. At 1500 [ft] turn LEFT, track direct RIC NDB [Richmond], then follow transition instruction.

Figure 1: RICHMOND 5 Standard Instrument Departure (SID) from runway 34L

Source: Jeppesen (via United Airlines flight safety). Annotated by the ATSB.

The PF then re-programmed the FMC, replacing the SYD1 procedure with the RIC5. At this point, the PF reported being unsure regarding the coding specific to the two transition options (radar or Richmond) presented by the FMC.

The radar transition option in the FMC included a deliberate discontinuity^[9] (gap) in the waypoint^[10] sequence (coding). The discontinuity represented the point where air traffic control would provide radar vectors to facilitate a re-join to the oceanic track (to San Francisco) after the aircraft passed 12 NM from Sydney (see Figure 1).

The PF then closed (removed) the discontinuity.^[11] In effect, the PF had removed the pre-programmed radar transition procedure, which meant that after the 1,500 ft left turn, the next waypoint on the route was DIPSO, not 12 NM Sydney. The PF recalled communicating removing the discontinuity to the PM, but it was not acknowledged by the PM. The PM did not recall hearing about the coding change.

Later in the pre-departure preparation, the PM reported verifying the new departure in the FMC using the summary route (RTE) page. However, the PM did not review it using the more detailed LEGS page (see Flight management computer discontinuities).

While taxiing to the runway for take-off, the PM recalled that when completing the departure review^[12] with the PF, they noted the FMC RTE page read:

Runway 34L, Richmond Five (RIC5), no transition

At 1421:41 the tower controller for runway 34R cleared VOZ1153 for take-off, and 42 seconds later, the tower controller for runway 34L cleared UA870 for take-off.

At 1422:29, VOZ1153 departed runway 34R. About 35 seconds later, as VOZ1153 was climbing through 1,500 ft, UA870 departed runway 34L. (The runway 34L threshold is about 1,000 m north [ahead] of the runway 34R threshold [see Figure 1].)

At about 1424:06, climbing through 1,417 ft, the UA870 crew were instructed to contact Sydney departures control.

At 1424:33, as UA870 was climbing through 2,120 ft, the Sydney departures controller detected that the aircraft was turning right and instructed the crew to immediately turn left, to a heading of 270°. The flight crew had also identified the incorrect turn to the right. The departures controller then issued a separate interventional instruction to VOZ1153 to turn right immediately, to a heading of 090°.

On receiving their instruction, the two UA870 pilots in the observers’ seats identified the traffic (VOZ1153) visually (right-hand observer) and via the traffic alert and collision avoidance system (TCAS)^[13] display (left-hand observer).

Recorded flight data showed that the UA870 autopilot was disengaged about 3 seconds after the interventional instruction to UA870 was received, at an altitude of 2,160 ft. Due to the momentum of the 777, the aircraft continued turning right through a further 5 degrees to heading 018º, prior to the PF manually reversing the turn back to the left. The minimum distance between the two aircraft was 1.0 NM laterally and 200 ft vertically (Figure 2).

Both aircraft continued flight to their respective destinations without further incident.

Figure 2: Aircraft tracks showing closest point of approach

Source: Google Earth overlaid with United Airlines and Virgin Australia data. Annotated by the ATSB.

Context

Flight crew

The flight crew of UA870 was augmented^[14] with two cruise in-flight relief pilots (also first officers), due to the duration of the flight and the operator’s flight crew fatigue management framework. Neither the PM or PF reported being fatigued or tired at the time of the incident. Both relief pilots reported minor tiredness at the time of the incident. All the flight crew reported having achieved two separate periods of sleep during their layover in Sydney. UA870 flight crew experience is summarised in General details.

Transition routes

SIDs are designed to allow pilots to navigate away from an airport with minimal radio communication with ATC (departures control). Charted transition routes facilitate the transition from the end of a basic SID to a location in the en route airways structure. In this case, the radar transition allowed for UA870 to join their route to San Francisco at waypoint DIPSO after departing Sydney via the RIC5 procedure.

Normally a transition route includes a course, altitude requirements and distances between waypoints along the transition. Some SIDs have multiple transitions. The Richmond 5 SID had two transition routes.

The radar transition segment relied on the Sydney departures controller providing radar vectors for the aircraft to follow back to the east, after the aircraft passed the ‘12 NM Sydney’ point, but prior to Richmond. The aircraft would then re-join their flight planned (oceanic) route to San Francisco. In the event that a radar vector was not provided by 12 NM northwest of Sydney, the autopilot would simply maintain the aircraft’s heading from that point, until a vector was provided to the crew, or the crew amended the FMC route. The procedure required the aircraft track to initially track to the west to allow for separation with aircraft departing simultaneously from the parallel runway (34R).

The presence of a route discontinuity is unusual in a departure or arrival procedure, but it serves to highlight to the flight crew that at the point of discontinuity, a further clearance or direction is required from ATC.

Flight management computer discontinuities

The PF uploaded the flight plan to the FMC via satellite datalink. Procedurally, the crew (usually the PF), then manually entered the SID based on the departure clearance provided, which is contained within the FMC memory.^[15] The majority of procedural SIDs could then be joined to the uploaded route by removing the discontinuity created between the end waypoint defining the departure procedure and the first waypoint of the main route to their destination. This was the normal process dictated by the operator’s procedures, where it was emphasised that for most departures the remaining FMC discontinuities should be rectified (removed) using the FMC legs (LEGS) page (Figure 3).

Guidance was also provided that this should not be completed in isolation from the rest of the crew.

The PF reported some confusion with the coding specific to the radar transition component of the RIC5 SID. That is, misunderstanding the necessity for the pre-programmed discontinuity as it was depicted by the FMC, which represented the radar transition segment during which ATC would provide radar vectors.

A discontinuity can be viewed by either the FMC LEGS page or route (RTE) page. The RTE page is a summary page generated displaying significant waypoints and airways (routes) that, in sequence, define the coded route the aircraft is programmed to fly via either the autopilot, if engaged or the flight director, if flying manually. The RTE page does not contain the same level of detail contained via the FMC LEGS page (Figure 3).

The operator’s supplementary procedures regarding the FMC setup prior to departure also included the following warning:

Do not use the RTE page to repair discontinuities resulting from SID entries. Critical changes in departure ground track may result.

Figure 3: Example of a route discontinuity displayed via the B777 FMC LEGS page

Source: Boeing B777 supplementary procedures (via United Airlines)

United Airlines procedures

The operator’s procedural documentation included guidance and direction specific to departure preparation. They detailed the PF and PM tasks and responsibilities, including the requirement to conduct a pre-departure briefing. The crew were also required to conduct a comprehensive departure review, immediately prior to take-off, which included a final confirmation of the FMC departure route setup. These procedures highlighted the importance of verbalisation, independent review and cross-checking.

The operator also provided guidance specific to Sydney Airport departures, including tailored charts illustrating the RIC5 SID (detailing the radar transition procedure), specifically the requirement to not turn right.

The operator’s procedures also mandated that relief pilots were to remain at their designated stations (observer’s seats) on the flight deck from the commencement of the departure briefing until the aircraft was above flight level 180.^[16] More generally, a number of important support duties were also defined for relief pilots including active participation in crew briefings (departure briefing and review) and a specific requirement to ensure compliance with clearances.

Air traffic control information

Separation standards^[17] are used by air traffic controllers to manage air traffic safely. They refer to the minimum horizontal and/or vertical distance, or time apart, that aircraft operating in controlled airspace must maintain. When the separation between two or more aircraft is less than the standard, there is a loss of separation.

A surveillance separation standard is used when aircraft position information is derived from air traffic services’ surveillance systems (including radar). When aircraft are operating inside terminal area airspace, such as Sydney, controllers must maintain a minimum separation between aircraft of 3 NM (5.6 km) laterally or 1,000 ft vertically.

A runway separation standard is applied for aircraft taking off from parallel runways. Following take-off, separation is facilitated visually until a surveillance (radar) or vertical separation standard exists. Aerodrome controllers (ADCs) may reduce the radar separation minima in the vicinity of aerodromes when adequate separation can be provided using visual observation and each aircraft is continuously visible to the ADC. However, ADCs are not permitted to provide visual separation if the projected flight paths of the aircraft conflict.

When a significant loss of separation occurs, air traffic control is required to issue a safety alert^[18] to notify pilots of information that is of a time-sensitive and safety-critical nature. It is important pilots understand the critical nature of these instructions and respond in a timely manner to ensure the safe conduct of flight.^[19]

Traffic alert and collision avoidance system

Modern high-capacity transport aircraft such as the 777 and ATR72 are required to be equipped with an advanced traffic alert and collision avoidance system (TCAS).^[20] TCAS is designed to prevent mid-air collisions between aircraft. TCAS operates independently of ATC by using on-board surveillance capability to detect other transponder-equipped traffic and provides:

• Traffic display (proximate traffic) and traffic advisories (TA) for situational awareness of relatively close aircraft
• Resolution advisories (RA) for very close aircraft with vertical guidance to resolve the threat.

Both TA and RA are generated based on the projected closest point of approach (CPA) or miss distance and the time to co-altitude (TAU). In general, the thresholds (time and distance) for CPA and TAU increase as altitude increases.

All RA are inhibited when below 1,000 ft (+/- 100) above ground level (AGL) and all TCAS aural alerts are inhibited when below 500 ft (+/- 100).^[21] This is to ensure that alerts are not generated during the initial take-off climb for two reasons: to avoid distracting the crew and, because the aircraft is already flying close to the performance limit (body angle/attitude and thrust).

Safety analysis

Flight management computer – departure setup

The foreign captain was expecting to receive a clearance via the SYD1 standard instrument departure and had pre-programmed the FMC in anticipation of this and briefed the other crew accordingly. However, the pre-departure clearance provided by air traffic control was different (RIC5). This was likely due to the captain’s limited exposure to the varying Sydney-centric departure procedures (SYD1 versus RIC5). In addition, the clearance included the radar transition procedure, with which the captain was unfamiliar, due to the predominant use of procedural-based transitions in the United States. Anything non-standard in departures or arrivals can add additional complexity, but particularly for crew that have very limited experience with the location, such as long-haul foreign crew. Air traffic controllers have an opportunity to take into account the likelihood of a crew’s familiarity with the airport when issuing clearances to foreign crew.

The clearance meant the FMC needed to be re-programmed for the RIC5 procedure. During this process, the PF removed the discontinuity that was automatically generated in the FMC flight path, that is, the waypoint sequence to the cleared oceanic route. This would have been appropriate for many procedural transitions but not for a radar transition. The predominance of procedural transitions in the United States likely meant that the PF was focussed on removing the discontinuity (gap) in the FMC coding.

In this case, the purpose of the discontinuity was to represent controller-issued vectors as the aircraft tracked beyond 12 NM northwest of Sydney. In effect, the aircraft was cleared to 12 NM. From that point they were required to wait for a controller initiated radar vector to re-join their cleared oceanic route to San Francisco commencing at waypoint DIPSO (to the east). In removing the discontinuity, the aircraft was re-programmed to track directly to DIPSO after reaching the initial waypoint at 1,500 ft where the aircraft should have turned left (before they reached the 12 NM point). Ultimately, this resulted in a right turn and, therefore, the loss of separation.

Crew coordination

Effective crew coordination is fundamentally dependent upon effective communication. In order for cockpit crew members to share a ‘mental model’, or common understanding of the nature of events relevant to the safety and efficiency of the flight, communication is critical.^[22] The operator’s procedures were clear and provided an established framework for the flight crew to communicate and coordinate their activities to ensure a safe and expeditious departure.

A number of opportunities existed not only for the PM, but also the crew positioned in the observers’ seats (in-flight relief pilots), to verify the FMC setup between the departure briefing and entering the runway prior to take-off. The operator’s procedures included a comprehensive process by which crew use different pages (information sources) within the FMC to ensure the departure clearance is reflected accurately by the computer coding (waypoint sequence).

The PM was not aware of the amendment to the radar transition (deletion of the route discontinuity), which indicated that the PF may not have clearly verbalised the change and/or ensured the PM heard and understood the change, in accordance with the operator’s procedures. By not clearly verbalising this misunderstanding or the amendments to the departure route setup, the PF did not provide an opportunity for the rest of the crew to contribute effectively.

However, there were further opportunities for the PM or relief pilots to discover this error. The PM verified the FMC set up, but only used the summary RTE page rather than the LEGS page with greater detail, and therefore the waypoint sequencing error was not detected. Further, in the departure review just before take-off, both the PF and the PM noticed the ‘no transition’ on the FMC RTE page, but no-one recognised this was not in accordance with the radar transition segment of the clearance.

Communication

Effective communications also includes with external sources such as air traffic control. Readbacks of clearances and instructions to crew in the aviation context serves two main purposes; acknowledgement of both the intent and content of the clearance, and to reinforce the message has been acknowledged and understood. In this case, the PM provided a truncated readback to ATC, which did not provide this assurance. The truncated readback was not challenged by the controller. As such, the controller did not have any assurance that the flight crew heard and understood that they were cleared for a radar transition. This increased the risk of errors to the FMC setup and could have led to further confusion during the initial climb.

Findings

Contributing factors

• The pilot flying incorrectly amended the flight management computer (FMC) for the cleared departure.
• The amended FMC setup was probably not effectively communicated to the crew or effectively cross-checked by the pilot monitoring or relief pilots.

Other factors increasing risk

• The pilot monitoring did not complete a full readback of the radar transition component of the pre-departure clearance, nor did the Sydney clearance delivery controller insist on a full readback.

Other findings

• The Sydney departures controller observed UA870 turning right and towards VOZ1153 and quickly issued unambiguous and immediate instructions to both aircraft to rectify the situation and re-establish the required separation.

Crew details

United Airlines 870

*Note: In United Airlines, crew resource management (CRM) and threat and error management (TEM) is incorporated into training and evaluation events, or simulator checking activities.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Automatic terminal information service (ATIS): continuous broadcast of recorded aeronautical information. ATIS broadcasts contain essential information, such as current weather information, active runways, available approaches, and any other information required by flight crew.
2. Simultaneous independent departures refers to the delegation of controlling responsibilities to two tower controllers simultaneously, each responsible for either runway 34L, via very high frequency (VHF) 120.5, or the parallel runway (34R) via VHF 124.7.
3. Pilot flying (PF) and pilot monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for upcoming stages of the flight. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
4. Standard instrument departure (SID): an air traffic control (ATC) defined procedure, usually coded via the FMC, that simplifies departure tracking while also balancing terrain/obstacle avoidance, noise abatement and airspace management considerations.
5. Flight management computer (FMC): is a specialised computer system that automates multiple in-flight tasks reducing the workload of the flight crew. The system is able to combine multiple inputs to generate a blended solution regarding the aircrafts position and key flight parameters.
6. Eastern Summer Time (ESuT): Coordinated Universal Time (UTC) + 11 hours.
7. DIPSO: the first navigational waypoint beyond the Sydney terminal area, on the aircraft’s flight planned (oceanic) route from Sydney to San Francisco.
8. See Context – Transition routes.
9. Discontinuity: exists or is created when two waypoints are not connected by a segment within the FMC route. That is, when a gap exists.
10. Waypoint: a defined position of late and longitude coordinates, primarily used for navigation.
11. See Context - Flight management computer discontinuities.
12. Departure review: is an operator process whereby the crew verbalise and verify key items prior to take-off including; aircraft weight, thrust setting, configuration and the FMC departure setup (cleared runway, SID and transition). Procedurally, the PM verbalises while checking the setup, the PF then ‘verifies’ by also checking the setup.
13. See Context – Traffic alert and collision avoidance system.
14. Augmented flight crew: refers to a flight crew complement that comprises more than the minimum number of pilots required to operate the aircraft type. The 777 requires a minimum of two pilots, one being designated the pilot-in-command (PIC) or captain. The additional pilots are referred to as relief pilots.
15. FMC databases are updated every 28 days in order to capture any changes to any of the data (e.g. airport infrastructure, permanent obstacles, magnetic variation etc.).
16. Flight level: at altitude above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL180 equates to about 18,000 ft.
17. These are outlined in the Manual of Standards for Air Traffic Services (MATS).
18. Safety alert: information issued by ATC that is considered time-sensitive or safety-critical.
19. Source: Airservices Australia Safety Bulletin, Safety alerts and avoiding action advice, 7 March 2014.
20. ICAO Annex 6 Part I mandates traffic alert and collision avoidance system type II (TCAS II) be fitted to all aircraft capable of carrying more than 30 passengers. TCAS II includes the capability of generating; ‘proximate traffic’ and both ‘traffic advisory’ and ‘resolution advisory’ if necessary.
21. Source: Eurocontrol ACAS Guide – Airborne Collision Avoidance, December 2017, p 46.
22. Sexton, B.J. & Helmreich, R.L. (2000). Analyzing cockpit communication: the links between language, performance, error, and workload. In Human Performance in Extreme Environments, p 63-68.

Executive summary

What happened

On 23 January 2020, the crew of a Lockheed Corporation (now Lockheed Martin) EC-130Q large air tanker, registered N134CG, were conducting bushfire control operations in the Snowy Mountains region of New South Wales. After assessing the initial fire-retardant drop site at Adaminaby as not suitable, the crew accepted an alternate tasking to the Good Good (Peak View) fire-ground.

After conducting a partial retardant drop at Peak View, the aircraft was in a left turn and climbed for about 10 seconds to about 170 ft above the drop height. Following this, the aircraft was then observed descending. The aircraft was seen at a very low height above the ground, in a slight left bank, immediately followed by a significant left roll just before ground impact. The 3 crew were fatally injured and the aircraft destroyed.

What the ATSB found

The ATSB found that the forecast and actual weather conditions present in the Snowy Mountains region were hazardous, with strong gusting winds and mountain wave activity, producing turbulence. This was likely exacerbated by the fire and local terrain. Subsequently, the ATSB determined that the conditions were conducive to windshear and downdraft development at a time when the aircraft was most vulnerable, with a low airspeed and at a low altitude.

Despite an awareness of these conditions and that all other fire‑control aircraft (including a Boeing 737 large air tanker) were not operating in the area at the time due to the weather conditions, the New South Wales Rural Fire Service (RFS) continued with their tasking of N134CG to Adaminaby without aerial supervision (birddog). In addition, they relied on the pilot in command to assess the appropriateness of the tasking but did not provide them all the available information to make an informed decision on flight safety. That information for the tasking to Adaminaby should have included details about actual hazardous environmental conditions, resulting in the cessation of local aerial operations, the birddog pilot declining the tasking due to the forecast weather conditions, and a report from the Boeing 737 crew that conditions precluded them from returning to the fire-ground.

The crew of N134CG were therefore very likely not aware that the birddog pilot had declined the tasking to the Adaminaby fire-ground, nor that the smaller fire-control aircraft had ceased operations in the area, due to the hazardous environmental conditions. While this was only one risk factor among others that would be considered by the crew when accepting a task, having this information would have allowed them to make a more informed decision about the weather conditions.

Nonetheless, the pilot in command of N134CG accepted the tasking to the Adaminaby fire‑ground, which was subject to hazardous environmental conditions. After assessing the conditions as unsuitable at Adaminaby, the crew accepted an alternative tasking to continue to the Good Good fire-ground, which had the same weather conditions. The acceptance of these taskings was consistent with the operator’s practices to depart and assess the conditions to find a workable solution rather than rely solely on a weather forecast, which may not necessarily reflect the actual conditions at the fire-ground.

At the Good Good fire-ground, following a partial retardant drop and left turn, the aircraft was very likely subjected to hazardous environmental conditions including low-level windshear and an increased tailwind component. From a combination of witness video, and real-time position and flight path data, it was established that the aircraft’s climb performance degraded. Subsequently, while at a low height and airspeed, it was likely the aircraft aerodynamically stalled, resulting in a collision with terrain. In the limited time available, the remainder of the fire-retardant load was not jettisoned prior to the aircraft stalling.

The ATSB established that, while a safety management system was not required under Australian regulations at the time of the accident, Coulson Aviation's safety risk management processes did not adequately manage the risks associated with large air tanker operations. In particular, they had not conducted formal risk assessments of the hazards identified in their operations manual, and did not maintain a tool, such as a risk register, to track risk acceptance levels. Further, incident reports submitted through the safety reporting system were mainly related to maintenance issues, and therefore operational risks were less likely to be considered or monitored. This limited their ability to identify and implement control measures to manage the risks associated with their aerial firefighting operations.

It is critical that crews can differentiate between a low-risk and high-risk flight during the planning stage to establish the overall risk profile. While identifying it as a high-risk activity, Coulson Aviation had not identified a need for a pre-flight risk assessment for their firefighting large air tanker crews. This would have provided crews with predefined criteria to ensure consistent and objective decision-making with accepting or rejecting tasks, and include factors relating to crew, environment, aircraft and external pressures and factors.

There are a number of mitigators for windshear, including pilot training and procedures, and airborne detection systems. However, Coulson Aviation did not include a windshear recovery procedure in their C‑130 Airplane Flight Manual. Further, it was noted that a briefing on windshear recovery was incorporated into the training syllabus, but there was no requirement to conduct a simulator-based low-level windshear recovery scenario. Combined, these strategies could provide crews with the experience needed to recognise the symptoms of windshear and practice a recovery procedure. In addition, Coulson Aviation had not assessed their fleet of C-130 aircraft for fitment with a windshear detection system. This increased the risk of a windshear encounter and/or delayed response to an encounter.

While the New South Wales RFS was not an aviation organisation or directly responsible for flight safety, they were closely involved in the aerial operation, being responsible for determining the task objectives and selecting aircraft for the task. The ATSB found that the RFS had limited large air tanker policies and procedures for aerial supervision requirements and no procedures for deployment without aerial supervision. In addition, they did not have a policy or procedures in place to manage task rejections, nor to communicate this information internally or to other pilots working in the same area of operation. Such policies and associated procedures would provide frontline personnel with the required steps to effectively and safely manage taskings, and provide guidance for decision-making.

It was also identified that, while not applicable to the accident crew, the RFS procedures allowed aircraft operators to determine when pilots were initial attack capable. This was inconsistent with their intention for pilots to be certified by the United States Department of Agriculture Forest Service certification process.

While not contributing to the accident, the aircraft's cockpit voice recorder did not record the accident flight. This resulted in a valuable source of safety information not being available to the investigation, which not only increased the time taken to determine contributing factors to the accident but also limited the extent to which important safety issues could be identified and analysed.

What has been done as a result

As a result of this investigation, Coulson Aviation have incorporated a windshear recovery procedure into their C-130 Airplane Flight Manuals and plan to introduce simulator-based recurrent windshear training. Related to the consideration of risk in aerial firefighting operations, they have also implemented a pre-flight risk assessment to be completed by the pilot in command prior to the first tasking of the day. They will also be introducing a three-tier risk management approach, of organisational risk, operational risk, and tactical/mission risk, to be utilised during the upcoming fire season in Australia. Further, Coulson Aviation have updated their pre-flight procedures to incorporate a cockpit voice recorder system check before each flight. Lastly, the Retardant Aerial Delivery System software was reprogrammed so that the system will not require re-arming between partial load drops where less than 100% was selected.

The ATSB has issued 2 safety recommendations to Coulson Aviation. These are to further consider:

• fitment of a windshear detection system to their C-130 aircraft to minimise the time taken for crews to recognise and respond to an encounter particularly when operating at low-level and low speed
• incorporating foreseeable external factors into their pre-flight assessment tool to ensure the overall risk profile of a tasking can be consistently assessed by crews.

The New South Wales Rural Fire Service advised the ATSB that they intend to take the following actions in response to this accident:

• Commissioned an independent report into the management of airspace in which aircraft are operating in support of fire-fighting activities.
• Formalise and establish a ‘Large Air Tanker Co-ordinator’ role description, to be positioned on the State Air Desk during heightened fire activity.
• Undertake an immediate audit, in conjunction with operators, of pilots qualified as initial attack capable and ensure appropriate records are accessible by RFS personnel.
• Undertake detailed research to identify best practice (nationally and internationally) relating to task rejection and aerial supervision policies and procedures as well as initial attack training and certification.
• Undertake a comprehensive review of RFS aviation doctrine to incorporate outcomes of the above-mentioned research into existing policies and procedures.
• Promulgate the revised doctrine detailing the task rejection policies and procedures and aerial supervision requirements to all operational personnel, pilots/aircrew and other key stakeholders. This is to be reinforced at the aviation operators briefing held annually prior to the bushfire season.
• Provide the National Aerial Firefighting Centre and national fire-fighting agencies with copies of the updated doctrine relating to these issues.

While the ATSB acknowledges the commitment to undertake reviews and research, at the time of publication, the New South Wales Rural Fire Service had not yet committed to adopting any safety action that would reduce the risk associated with the 3 identified safety issues to an acceptable level. As such, the ATSB has issued three safety recommendations to the RFS to take further action:

• to address the absence of policies and procedures for personnel to effectively manage and communicate task rejections on the basis of operational safety concerns
• to address the absence of policies and procedures regarding minimum aerial supervision requirements and the use of initial attack to assist frontline staff with making acceptable risk‑based tasking decisions
• to address the ambiguity with the interpretation of ‘initial attack’ in the NSW and ACT Aviation Standard Operating Procedures with the intent of this requirement.

Safety message

As noted by the National Aerial Firefighting Centre, aerial firefighting has become a critical capability for the management and suppression of bushfires in Australia. To effectively achieve this, aircraft are flown at low altitudes and low airspeeds, often in challenging environmental conditions. This creates a high-risk environment, which requires a continued focus on risk mitigation.

Previous research conducted by the ATSB emphasised that any decisions made by tasking agencies during the management of an aerial campaigns (firefighting) could influence the level of risk of the operation. Therefore, if safety was to be maintained, this responsibility had to be shared between the tasking agency and the aircraft operator. This accident highlights the importance of having effective risk management processes, supported by robust operating procedures and training to support that shared responsibility.

While the identification of hazards is the initial step in safety risk management, conducting risk assessments, implementing risk mitigators, and having effective oversight of the process through a tool such as a risk register are critical aspects of this process. This provides the mechanism for organisations to consider the specific challenges associated with firefighting operations such as hazardous environmental conditions, and ensure they have the appropriate risk controls in place to support crew decision-making when conducting high-risk activities.

Further, the adoption of good systems for managing risk by the tasking agency could provide an effective additional layer of defences over and above that provided by each aircraft operator to protect against an incident or accident. This also ensures that one aspect of the operation does not compromise another aspect. This may include the development of procedures to support decision-making processes rather than personnel having to exercise judgement to the best of their abilities, based on their experience, skills and knowledge. This would include aspects such as tasking decisions, task rejection policies and procedures, and minimum aerial supervision requirements.

The occurrence

Overview

During the Australian ‘black summer’ of 2019-2020, the east coast experienced many severe bushfires. As part of the firefighting efforts, small and large aircraft were used for aerial fire suppression and intelligence gathering. The larger aircraft included large air tankers (LATs),^[1] located at the Richmond Royal Australian Air Force (RAAF) Base, New South Wales (NSW). This included a United States-registered Lockheed Martin EC-130Q,^[2] registered N134CG, operated by Coulson Aviation. On 23 January 2020, the aircraft was applying retardant for property protection in the Good Good fire-ground (near Peak View) in the Snowy Mountains region of NSW. While attempting to climb away after a partial fire-retardant drop, the aircraft collided with terrain. The 3 crew were fatally injured and the aircraft was destroyed.

Daily briefings at Richmond Base

On 23 January 2020, at about 0900 Eastern Daylight-saving Time,^[3] the NSW Rural Fire Service (RFS) Richmond airbase manager (ABM)^[4] had conducted a briefing with the crews of the air tanker and birddog^[5] aircraft based there. The briefing included the current and anticipated fire activity and discussed fire-related weather conditions across the state. Following the briefing, the crews then remained on standby until they received a tasking from the RFS, with a contracted 15‑minute departure time following the completion of retardant loading.

The operator of two LATs at Richmond, Coulson Aviation, reported^[6] that they had also conducted their daily safety management system call between management and crews, which would typically discuss the operations to be conducted on the day, and any reported issues encountered in the previous 24 hours. However, as there were no notes taken for the call, the details of the conversation were unknown.

Fire situation in the Snowy Mountains region

On the day, the Snowy Mountains region in NSW had a severe fire danger rating,^[7] due to high temperatures, strong winds and forecast thunderstorms. This region included the Adaminaby and Good Good fire-grounds, which were both under the control of the RFS Cooma Fire Control Centre (FCC).^[8]

At about 1100, the Cooma FCC incident controller^[9] made a phone call to the RFS State Operations Centre.^[10]A number of senior personnel from the State Operations Centre were involved in the conference call. They discussed the escalating fire danger at the Adaminaby fire‑ground, with rural properties under threat and concern the town would be impacted if containment lines did not hold. During that call, RFS personnel stated that there were strong winds, severe fire weather conditions, and that the smaller fire-control aircraft were not operating in the area due to the winds and poor visibility. There was also discussion as to whether a birddog aircraft had already departed to assess the conditions. However, a senior RFS officer stated they should send the Boeing 737 LAT aircraft irrespective, ‘as it can bomb by itself if need be’ and ‘not wait for the birddog assessment’.

Consequently, the State Operations Centre tasked 2 LATs^[11] and a birddog to the Adaminaby fire‑ground: a Boeing 737 aircraft, registered N137CG, call sign ‘Bomber 137’ (B137); a Lockheed Martin C-130 aircraft, registered N134CG, call sign ‘Bomber 134’ (B134); and a Rockwell International 690-B aircraft (operating as a birddog). All 3 aircraft were based at the Richmond Base, about 316 km north-east of the Adaminaby fire-ground.

‘B137’ tasking to Adaminaby

Following the 1100 call, the tasking was communicated by the state air desk (SAD)^[12] to the Richmond ABM. At 1120, the Cooma aerial operations manager log recorded that LATs were inbound, with no birddog. At about 1121, the crew of B137 had commenced taxiing at Richmond for another task to the north^[13] when they were re-tasked to the Adaminaby fire-ground by the ABM.  After the initial coordinates, location details, and information regarding the expected direction of the fire were provided, the pilot in command (PIC) of B137 requested details for the fire common traffic advisory frequency. The Richmond ABM was unable to provide these details immediately, but indicated the SAD  ‘want to get them in the air and down there’. The ABM also advised the crew of the objective to ‘keep the fire out of Adaminaby’, that ‘the fire is burning towards the north-west’, that there were no other aircraft in the area, and that it ‘is very windy down there….take care’. The ABM further advised ‘the birddog won’t be down there’.^[14] Therefore, the PIC was aware they would be operating as initial attack.^[15] The aircraft subsequently departed at about 1127.

While en route, the crew contacted various fire centres to determine the correct ground-based contact, eventually communicating with the Cooma aviation radio operator (ARO), located at the Cooma FCC. At about 1155, B137 arrived overhead the Adaminaby fire-ground, but the crew were unsure of the actual planned location for the drop. After further discussion with the ARO, it was determined they were overhead the intended location.

Due to the weather conditions and ground-based fire-fighters in the planned drop area, the crew orbited for about 25 minutes. At interview, the PIC reported that, while assessing the conditions in the Adaminaby area, the aircraft encountered uncommanded rolls up to 45° angle of bank (due to wind) and they received a windshear^[16] warning from the aircraft’s onboard systems.^[17] The PIC elected to operate on the upwind side of the hills to avoid lee side mechanical turbulence.^[18] They also reported that the wind speed at the Adaminaby fire-ground was 50 kt at 800 ft above ground level (AGL) and about 37 kt at the fire‑retardant drop height of 200 ft AGL. At about 1225, B137 departed the Adaminaby fire‑ground, having successfully deployed a retardant load.

After completing the retardant drop, the PIC reported that they advised the Cooma ARO to cancel all the aircraft operating in the area, although it was not clear if the ARO had received that message. They also sent a text message to the birddog pilot assigned to the Adaminaby fire‑ground indicating that the conditions were ‘horrible down there. Don’t send anybody and we’re not going back’. During B137’s return flight to Richmond, at about 1232, the PIC contacted the Richmond ABM and stated they were going ‘to put themselves on hold’, but would be available for other taskings. The ABM requested that they reload the aircraft with fire retardant in Canberra and return to Adaminaby. The PIC replied that they would not be returning to Adaminaby due to the weather conditions, as the ‘winds were getting too strong and the visibility is down’, and continued to Richmond. Subsequently, when the ABM communicated B137 PICs decision to the SAD, they indicated the weather was ‘fairly dicey…probably won’t go back’. There was some discussion as to the availability of other LATs to task to Adaminaby, however, the decision was made to wait for a report from B134 before any further tasking.

Birddog rejection of tasking

Meanwhile, at about 1137, the Richmond ABM contacted the SAD to confirm the dispatch of a birddog to Adaminaby. The birddog crew consisted of the birddog pilot and the LAT air attack supervisor.^[19] The ABM had also noted in their log at 1130 and 1140 that they were intending to send the birddog to Adaminaby. The 1130 log entry also indicated that the incident air attack supervisor was not operating ‘due to extreme wind conditions’. By the time of the 1137 phone call, B137 had already departed Richmond as initial attack and B134 was being prepared for departure, with the expectation from the RFS that both LATs would do multiple retardant drops. The ABM and SAD discussed that the 2 LATs would beat the birddog to the fire‑ground, but it was considered unlikely ‘they will get through as [it] will be too windy for them’.^[20]

The birddog pilot reported having experienced moderate to severe turbulence in the Snowy Mountains region about 2 weeks prior, which resulted in an uncommanded roll up to 30–40° angle of bank. This, combined with a downdraft, required the pilot to execute an escape manoeuvre. On receipt of the tasking to Adaminaby, the birddog pilot reviewed the weather and concluded that the conditions were forecast to be worse than previously experienced, and therefore declined the task. The RFS reported the SAD log recorded the birddog declining the task to Adaminaby at 1204.

At about 1209, the ABM had a conversation with the SAD and discussed that the birddog pilot was ‘questioning the weather conditions’. The SAD instructed the ABM to ‘get them on their way, and then turn them around’ (that is, rather than accept a rejection based on the forecast, they would prefer they re-assess the conditions in-flight). When the ABM communicated this to the birddog pilot, the pilot indicated to the ABM that B137 would arrive overhead Adaminaby shortly, and they could then report the actual conditions. At about 1235, following a report of the conditions from the PIC of B137, the ABM reportedly agreed that the birddog pilot had made an appropriate assessment to reject the task to Adaminaby.

The birddog pilot reported that they had not spoken to the crew of B134 following the receipt of the tasking on the day of the accident as they were both focussing on their pre‑flight planning, which was normal practice. Subsequently, the birddog pilot accepted an alternate tasking at 1259.

Figure 1 provides a timeline of the key communications regarding tasking allocation for B134, B137 and the birddog.

Figure 1: Timeline of tasking communications

Source: ATSB

‘B134’ tasking to Adaminaby

At about 1205,^[21] while B137 was overhead the Adaminaby fire-ground, and about the same time the SAD logged the birddog rejection, B134 departed Richmond as initial attack. On board were the PIC, the copilot and flight engineer.

In response to the draft report, the RFS provided excerpts from the state operations controller (SOC) log.^[22] entry was written in the log by the SOC following the accident.^[23] The SOC noted having been advised that the birddog had indicated it was ‘not safe to fly’ and that B137 was not returning to the area until the conditions had eased. However, B134 would continue with the PIC to make the ‘decision of safety of bombing operations’. The RFS advised the ATSB that the SOC had the authority to cancel B134’s tasking, but instead allowed it to proceed, with the intention of gathering additional intelligence to assist in determining whether further aerial operations would proceed. The RFS further reported that this indicated an ongoing intelligence gathering and assessment process by the SOC.

At about 1235, while returning to Richmond, the PIC of B137 heard the PIC of B134 on the Canberra approach frequency and contacted them via their designated operating frequency.  At that time, B134 was about 112 km north-east of Adaminaby, en route to the fire-ground (Figure 2).  In this conversation, the PIC of B137 informed them of the actual conditions and that they would not be returning to Adaminaby. The PIC of B137 reported that they could not recall the specific details of the call, but that the conversation included that they were ‘getting crazy winds’ and ‘you can go take a look’ ’but I am not going back’. It was also noted that the PIC of B134 had asked several questions. It was reported by the majority of the operator’s pilots that, despite receiving information from another pilot, they would have also continued with the tasking under these circumstances, to assess the conditions themselves.

At about 1242, the crew of B134 contacted air traffic control to advise them of the coordinates they would be working at, provide an ‘ops normal’^[24] call time, and confirm there was no reported instrument flight rules^[25] aircraft in the area. About 5 minutes later, the Richmond ABM also attempted to contact the crew of B134 to confirm ‘ops normal’, firstly by radio, and then by text to the PIC’s mobile phone, but did not receive a response.

The automatic dependent surveillance broadcast (ADS-B) data showed that, after arriving at the Adaminaby fire-ground at about 1251, the crew of B134 completed several circuits at about 2,000 ft AGL.^[26] At about 1255, the crew advised the Cooma ARO that it was too smoky and windy to complete a retardant drop at that location. The Cooma ARO then provided the crew with the approximate coordinates of the Good Good fire, about 58 km to the east of Adaminaby. The ARO further indicated that they had no specific requirements, but they could look for targets of opportunity, with the objective of conducting structure and property protection near Peak View.

Figure 2: Flight track of B134 (white line), timing and location of external communications, and key locations, with an inset detailing the circuits at Adaminaby

Source: Google earth, ADS-B data and radio calls, annotated by the ATSB

‘B134’ tasking to the Good Good fire-ground

At about 1259, the crew of B134 contacted air traffic control to advise that they had been re‑tasked to the Good Good fire-ground and provided updated coordinates. At about the same time, the RFS ground firefighters at the Good Good fire-ground, near Feeney’s Road in Peak View, contacted the Cooma FCC and requested additional assets for property protection. They were advised that a LAT would be passing overhead in about 10 minutes. The firefighters acknowledged the intention of a LAT retardant drop and advised the Cooma FCC they would wait in open country on Feeney’s Road, clear of any properties targeted for protection.

At about 1307, B134 arrived overhead the drop area (Figure 3). The drop area was located to the east of a ridgeline, with the fire on the western side of the ridgeline. The aircraft’s recorded track data (SkyTrac) showed that the crew conducted 3 left circuits, at about 1,500 ft, 500 ft and 1,000 ft AGL respectively, prior to commencing the drop circuit (Figure 4). At about 1312, after conducting about 2 circuits, they advised the Cooma ARO of their intention to complete multiple drops on the eastern side of the Good Good fire, and that they would advise the coordinates after the first delivery.

Figure 3: B134’s approach and circuits overhead the drop location; the inset shows the track from the Adaminaby to the Good Good fire‑ground

Source: Google earth and SkyTrac data, annotated by the ATSB

At 1315:15,^[27] a partial retardant drop was conducted on a heading of about 190°, at about 190 ft AGL (3,600 ft above mean sea level). During the drop, about 1,200 US gallons (4,500 L) of fire retardant was released over a period of about 2 seconds. A ground speed of 144 kt was recorded at the time of the drop.

A witness video taken by ground fire-fighters captured the drop and showed the aircraft immediately after the drop in an initial left turn with a positive rate of climb, before it became obscured by smoke^[28] While being intermittently obscured by smoke, the aircraft climbed to about 330 ft AGL (3,770 ft above mean sea level). At about this time, ATSB analysis of the video showed that the aircraft was rolling from about 18° left angle of bank to about a 6° right angle of bank. Following this, the aircraft descended and about 17 seconds after the completion of the partial retardant drop, it was seen at a very low height above the ground, in a slight left bank. Video analysis and accident site examination showed there was no further (emergency) drop of retardant. Throughout this period, the recorded groundspeed increased slightly to a maximum of 151 kt. Shortly after, there was a significant left roll just prior to ground impact.

Figure 4: Accident circuit and location of the firefighters and retardant drop

Source: Google earth and SkyTrac data, annotated by the ATSB

At about 1315:37, the aircraft collided with terrain and a post-impact fuel-fed fire ensued. The 3 crew were fatally injured, and the aircraft was destroyed.

A review of the Airservices Australia audio recording of the applicable air traffic control frequency found no distress calls were received by controllers prior to the impact.

________

1. A large air tanker (LAT) is an aircraft with a minimum suppressant/retardant capacity of 3,000 US gallons (11,356 L).
2. The aircraft was initially built as an EC-130Q, however, all specialised military equipment had been removed, and it was considered to be the equivalent of a C-130H. Throughout the report, the aircraft is referred to as a C-130.
3. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours
4. The airbase manager was responsible for the supervision and coordination of airbase personnel, and the layout and operation of an airbase. There were 2 airbase manager’s operating at Richmond on the morning of the accident.
5. Birddog aircraft were used to lead large air tanker aircraft across the fire-ground and provide guidance on the release of the water or fire suppressant (retardant or gel).
6. Provided by Coulson Aviation in response to the draft report on 10 July 2022.
7. The NSW RFS fire danger ratings provide an indication of the possible consequences of a fire and are based on predicted conditions including but not limited to temperature, humidity, wind, and the dryness of the landscape.
8. A FCC forms the administrative and operational base of the rural fire district or zone. The coordination and management of local brigade responses to fire and other incidents was undertaken through the FCC.
9. The incident controller was responsible for all aspects of an emergency response, including the objectives, operations, and application of resources of the FCC.
10. The State Operations Centre coordinated the NSW multiagency state-wide response and provided a variety of specialised resources to the FCC.
11. The tasking of B137 and B134 to Adaminaby was annotated in the Richmond ABM’s log, which specifically noted that the birddog was not accompanying either aircraft, the conditions were ‘windy’, and for the crews to ‘only do what they can do safely’. However, this log entry was at 1049, shortly before the phone call between the Cooma FCC incident controller and the RFS State Operations Centre where it was questioned if the birddog had already departed. These time discrepancies could not be resolved by the ATSB.
12. The state level multiagency team located in the State Operations Centre responsible for coordination of aircraft operations.
13. B137 was to be accompanied by a birddog for the tasking to the north. Where there was an urgency to dispatch aircraft due to the rapid spread or the impending impact of the fire, it was standard practice to launch the LATs at the same time, or ahead of, tasking the associated birddog.
14. Where there was an urgency to dispatch aircraft due to the rapid spread or the impending impact of the fire, it was standard practice to launch the LATs at the same time, or ahead of, tasking the associated birddog.
15. An air tanker initial attack certification allowed a pilot to conduct fire retardant drops without aerial supervision.a>
16. Windshear is defined as a wind direction and/or speed change over a vertical or horizontal distance.
17. B137 was fitted with both predictive and reactive windshear warning systems, and it could not be determined, based on the evidence available, which system provided the warning (refer to section titled Windshear risk control systems).
18. Mechanical turbulence occurs due to frictional forces on the surface wind creating turbulent eddies. The intensity of the turbulence is largely dependent on the wind speed, surface roughness, and atmospheric stability near the surface.
19. The air attack supervisor was a tactical command position, which ensured that aerial operations were consistent with the procedures and incident controller’s intent.
20. From this conversation, it was unclear whether the term ‘they’ referred to all 3 aircraft, that is, B134, B137 and the birddog.
21. The ABM log recorded the departure of B134 at 1140. This time discrepancy could not be resolved by the ATSB.
22. The SOC maintains an overall awareness of the firefighting effort across the state ensuring information and warnings are being distributed and resources are being allocated where needed.
23. The SOC’s note was entered into the log following another note written at 1327. The log was provided to the ATSB at the time of the RFS response to the draft investigation report.
24. ‘Ops normal’ call time provided the next expected transmission time from this aircraft to indicate operations were normal.
25. Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements. a>
26. When conducting initial attack operations, crews complete several circuits to assess the hazards and drop conditions.
27. All times in the report are referenced to the ADS-B data, with adjustments based on the recorded locations.
28. From the witness video, it was unclear if the aircraft flew behind the smoke, or entered the smoke.

Context

Crew information

Pilot in command

Experience

The pilot in command’s (PIC) logbook, combined with the operator’s records for the accident aircraft showed that the PIC had a total flying experience of about 4,010 hours, which included 3,010.3 hours in the C-130 aircraft and 994 air tanker drops. The PIC had also accrued a further 1,616.8 hours as a flight navigator.

The PIC commenced work in Australia on 1 December 2019. In the 30 days prior to the accident, the PIC had flown about 32 hours. In the 72 hours prior, the PIC had flown 4.5 hours, all of which were in B134. The accident flight was the first flight of the day.

The PIC was initially trained as a navigator and pilot in the United States (US) Air National Guard. During this time, the PIC gained experience in firefighting operations through the modular airborne firefighting system (MAFFS)^[29] program. The PIC joined Coulson Aviation in 2015 on a part-time basis, before being employed full-time in 2017.

Qualifications

The PIC held a current airline transport pilot certificate with ratings for multi-engine land airplane including the EC-130Q, issued by the US Federal Aviation Administration (FAA) on 13 October 2017. The PIC’s most recent flight instructor certificate with ratings for multi-engine and instrument aircraft was issued by the FAA on 6 April 2019. On 18 April 2019, the PIC’s latest ‘airplane pilot qualification card’ was issued from the US Department of Agriculture, Forest Service,^[30] for the C-130 aircraft, which included the authorised missions of:

• low level (below 500 ft above ground level)
• mountainous terrain
• airtanker initial attack.

An air tanker initial attack certification allowed a pilot to conduct fire retardant drops without the supervision of a birddog or air tactical (attack) supervisor.

At interview, other flight crew reported the PIC was ‘methodical’, ‘conservative’, who ‘always did his due diligence’ and was not considered to take unnecessary risks. It was also reported that Coulson Aviation pilots were not being paid per flight or by flying hours, and therefore that was not a motivational factor to accept a tasking. In addition, the PIC had recently resigned from the operator and accepted a US-based position.

Training

The PIC last completed training with Coulson Aviation in March and April 2019,^[31] which included annual C-130 simulator training, controlled flight into terrain awareness and crew resource management courses. In addition, the PIC completed 2 assessed training flights in the C-130 on 14‑15 April 2019. The flight on 14 April included approach to aerodynamic stalls^[32] in the circuit (with 50% flap) and drop (with 100% flap) configurations, and go-arounds with a full load (water). The flight on 15 April included drop planning (hazards, tactics, ingress, egress, and dry run) and an emergency on the drop run. The drop run emergency was a simulated ‘down air’ [downdraft]. All the assessed sequences, which included jettison of the load during a (simulated) emergency condition,^[33] were recorded as satisfactory.

Copilot

The copilot had joined Coulson Aviation in September 2019, after 20 years in the US military, including experience flying the C-130. The copilot’s logbook combined with the operator’s records showed a total flying experience of about 1,744 hours, of which about 1,364 hours were on the C‑130. This was the copilot’s first fire season, and they commenced work in Australia on 1 December 2019. Since the start of the fire season, the copilot had flown about 85 hours, with about 28 hours in the last 30 days and about 4.5 hours in the 72-hour period prior to the accident.

The copilot held a current airline transport pilot certificate and ratings for multi-engine land aircraft, including the EC-130Q (second-in-command privileges only), issued by the FAA on 7 November 2019. The copilot also held a flight instructor certificate with ratings for single, multi‑engine and instrument aircraft, issued by the FAA on 14 August 2019.

The copilot’s C-130 check flight with the operator was completed on 12 September 2019, and was assessed as satisfactory against the qualification standards for second‑in‑command. On 13 September 2019, the copilot completed the crew resource management and controlled flight into terrain awareness courses and reviewed the US Department of Agriculture Forest Service’s air tanker pilot training video.

On 16 September 2019, the copilot was issued with an ‘airplane pilot qualification card’ from the US Department of Agriculture Forest Service for the C-130, which included the authorised missions of:

• low level (below 500 ft above ground level)
• mountainous terrain
• airtanker SIC (second-in-command).

Flight engineer

The flight engineer joined Coulson Aviation in November 2019, after about 25 years in the US military. This was the flight engineer’s first fire season. The flight engineer held a flight engineer certificate with a rating for turbo-propeller powered aircraft, issued by the FAA on 20 November 2019. On the flight engineer application form, the flight engineer reported accruing about 4,050 hours on the C‑130. The flight engineer also held a mechanic certificate with ratings for airframe and powerplant, issued by the FAA on 2 June 2019.

The flight engineer’s check flight was completed with the operator on 20 November 2019. In addition to this flight, the flight engineer completed 2 air tanker drops under supervision in Australia on 12 January 2020. The flight engineer commenced work in Australia on 13 January 2020.

72-hour prior history

In Australia, each crew member’s roster cycle was 14 duty days followed by 2 rest days. The accident flight occurred on the PIC’s 9th day, and the copilot’s and flight engineer’s 11th day of their respective current duty periods.

Table 1, based on the operator’s records, details the crew’s sign-on and sign-off times for the 3 days before the accident. On 23 January 2020, the crew signed on at 0900.

Table 1: B134 crew working hours

Information from the crew’s telephone and hotel records, in addition to work and flying duties, were used to determine their activities in the previous days. There were no indications of fatigue for the 3 crew members. However, there was insufficient information available to the ATSB about their sleep and non-duty activities to estimate fatigue levels with confidence.

Aircraft information

General information

The C-130 is predominantly an all-metal, high-wing aircraft, designed for military operations. The accident aircraft (Figure 5) was manufactured by the Lockheed Corporation (now Lockheed Martin Corporation) in 1981 and was powered by 4 Allison T56-A-15 turbopropeller engines, fitted with Hamilton Sundstrand 54-H60-91 4-blade propellers. The T56‑A‑15 is a constant speed engine, with a variable pitch propeller. 

Previously owned by the US Navy, the aircraft was transferred to the US National Aeronautics and Space Agency in 1992 and later placed in storage. It was then re‑purposed for firefighting activities by Coulson Aviation and registered in the restricted category.^[34] At that time, Coulson Aviation became the type certificate holder and assumed the responsibilities of the aircraft manufacturer for the entire aircraft and any modifications made.

Initially registered as N130CG in 2018, this was later changed to N134CG in April 2019. Modifications to the aircraft included the installation of an avionics package and firefighting tank system, known as the Retardant Aerial Delivery System XXL (RADS).

Figure 5: N134CG

Source: Coulson Aviation

Retardant Aerial Delivery System XXL

The RADS included a 4,000 US gallon (15,000 L) tank system located within the aircraft’s fuselage. The system was designed to deliver discrete quantities of retardant, dependant on the coverage factor^[35] selected and the duration the doors remained open. This was controlled from the cockpit, with drop controls located on both the PIC and copilot yokes.

The drop quantity was manually controlled by the crew by setting the coverage factor and either selecting a pre-set percentage or setting 100%. The latter option allowed the crew to control the amount of retardant released by holding a button on the yoke until the desired amount was dispensed. The RADS system was designed that, if less than 100% volume was selected, the system would disarm after a partial load drop and the crew would need to re‑arm the system to complete further releases. It was reported that the crew on B134 normally selected 100%.

The system also included a guarded emergency dump (’e-dump’) switch, located in reach of all 3 crew members, which would fully open the doors and jettison the load in a period of about 2 seconds. Following an emergency dump, the doors would remain open until the RADS was reset by the crew.

Maintenance history

The aircraft had a total time-in-service of 11,888 hours and had accrued 683 hours of firefighting operations since the tanker conversion in 2018. The aircraft had a current certificate of airworthiness and was maintained in accordance with an FAA approved program.

N134CG arrived in Australia in November 2019. The last daily inspection conducted on 22 January 2020, at the end of flying activities the day before the accident, identified the propeller anti-icing system on engine number 2 was unserviceable, and rectification had been deferred in accordance with the minimum equipment list.^[36]

In addition to a maintenance requirement to perform engine power efficiency checks at 150-hour intervals, the operator reported pilots were required to perform power checks before every take‑off. Operations were only permitted if a minimum performance requirement of 95% was met.

Weight and balance

The last weight and balance report for the aircraft, in April 2019, showed its basic empty weight was 75,794 lb (34,380 kg) and according to the RADS Airplane Flight Manual (AFM) supplement, the maximum take-off weight was 150,718 lb (68,365 kg). The aircraft flight and maintenance log indicated the PIC had the aircraft refuelled to a total of 34,000 lb (15,422 kg) at the completion of flying on 22 January 2020. The operational load monitoring system^[37] indicated there was 35,514 lb (16,109 kg) of retardant on board prior to the accident drop, in addition to a 2,000 lb (907 kg) pallet of gel. This resulted in a take-off weight of about 147,308 lb (66,818 kg) and the centre of gravity being at the aft limit on departure from Richmond.

Using the operator’s reported fuel consumption for air tanker drop missions of 5,000 lb/h (2,268 kg/h) for a 70-minute flight, and the retardant drop of 10,764 lb (4,882 kg), the estimated post-drop weight was 130,656 lb (59,265 kg). The centre of gravity remained close to the aft limit. This was consistent with reports from the operator’s other crews that the location of the RADS tank in the aircraft meant there was no appreciable change in the centre of gravity following a retardant drop.

Aerodynamic stall

Stalling

An aircraft’s wing is said to be ‘aerodynamically stalled’ when the airflow over the wing separates from the wing; that is, the airflow no longer follows the contour of the top surface of the wing. This results in a rapid loss of lift, which balances the weight of the aircraft, and the aircraft will rapidly descend. An aerodynamic stall will also normally result in the nose of the aircraft pitching down, often with a left-wing drop.

The aerodynamic characteristics of an aircraft wing are such that the airflow will separate and the wing stalls when the angle of attack, the relative angle between the wing and the airflow, reaches a critical value. The C-130H did not have an angle of attack instrument, however, this could be referenced to an equivalent airspeed. The airspeed at which a stall occurs is not fixed to a single value, and varies depending on the flap setting, aircraft weight, and load factor.^[38] The stall speeds are typically presented in the AFM (refer to section titled Aircraft performance).  

The C-130 aircraft has 4 wing mounted engines driving propellers. The placement of the propellers forward of the wings results in the propeller slipstream providing a relative airflow over each of the wings in addition to the forward speed of the aircraft, which varies in strength with the power produced. This is known colloquially as a ‘blown lift’ wing and results in the stall speed lowering as power is increased. For the C-130, the published power-on stall speed with 50% flap is based on maximum power. Therefore, the stall speed will be higher when less than maximum power is applied. The higher power-off stall speeds are based on idle engine power.

Stall characteristics of the C-130

A  C-130 discussion paper (Mizell, 2009), based on data obtained during US Air Force testing, described the aircraft as having a ‘very good natural stall warning... However, once in a stall, the plane becomes much less predictable’. In a clean (no flap) power-off stall:

The flying characteristics of the plane are very benign all the way up to full stall. A significant buffet was experienced 10 knots prior to stall. 3 knots above stall, a deterring buffet was experienced, giving a clear signal to the crew that stall was imminent. Immediately before stall, a yaw acceleration was detected by the data, but nearly imperceptible to the crew.

However, the 50% flap and 100% flap power-on stall ‘present a much larger hazard..’. Specifically, the paper noted that:

Similar to 0% flap, but with less buffet warning, the left-wing stalls first resulting in large, uncontrolled bank excursions and subsequent nose low attitudes. In some cases, the aircraft remained uncontrollable until the bank exceeded 100 degrees and the nose approached 75 degrees down. This caused massive altitude loss and overspeed of airframe components.

The approach to stall at 50% and 100% configurations also exhibited high descent rates.

The accident aircraft was not fitted with a stall warning system, nor was one required or available. However, according to the C-130 pilots consulted during the investigation, the aircraft had a noticeable pre-stall buffet through the rudder pedals and control column, and this was reported as being distinct from a turbulence-induced buffet, which could be felt throughout the aircraft. In addition, the flight controls become less effective at these lower speeds, described by pilots as ‘sluggish’ and ‘unresponsive’. The Lockheed Martin AFM also indicated that:

With flight idle power, stall warning buffet initially occurs at 4% to 15% above stall speed, depending upon configuration, and progresses to moderate or heavy buffet at the stall. The greatest stall warning airspeed margin exists in the take-off and approach configuration and less margin exists in the landing and cruise configurations. The stall of the C-130 is characterized by either a mild pitch down or a mild roll-off to the right or left depending on slightly unequal power settings.

Stall recovery

The Lockheed Martin AFM described the recovery actions for a stall as:

If in climbing or bank attitude, immediately drop the nose, level the wings, and apply power to limit loss of altitude. Move controls smoothly and avoid abrupt actions. Avoid diving the airplane and avoid abrupt or accelerated pull-up after recovery.

While the ATSB did not find a published procedure in the operator’s AFM (refer to section titled Operating documents) for stall symptoms and recovery actions, their C-130 pilots all reported that approaches to stall (start of the buffet) training^[39] was conducted in the aircraft on an annual basis in various configurations. According to the operator’s Company Operations Manual (COM),^[40] training for approaches to the stall were conducted in the clean, take-off and landing configurations.^[41] The recovery procedure referred to both low altitude (ground contact imminent) and higher altitude (ground contact irrelevant) scenarios.

The C-130 pilots’ descriptions of the symptoms and recovery actions were consistent with the manufacturer’s published material, with some additions specific to their operation. These included the addition of load jettison and flying the aircraft towards their pre-briefed escape route from the release point. Although their recovery descriptions for a pre-stall buffet, following a fire-retardant drop, was to apply maximum power by pushing the power levers full forward, this was not a procedure that could be practically trained in the aircraft. The engine power was managed manually, therefore, pushing the power levers full forward during training could result in an over‑torque or over‑temperature condition for the engines. However, they reported they would apply as much power as needed and as quickly as possible in a real low-level stall situation.

Aircraft performance

Stall speeds

The aircraft stall speeds were contained in the respective performance charts in the Lockheed Martin AFM. The ATSB calculated the power-on and power-off stall speeds for an aircraft weight of 131,000 lbs (59,420 kg), in level flight and with 50% flap at 83 kt (IAS)^[42] and 101 kt (IAS) respectively. This configuration and attitude were considered most representative of the aircraft state just prior to the observed descent (refer to sections titled Weight and balance, Wreckage and impact information, and Recorded information sections), noting that a pitch-up attitude, any bank angle above 0° and a decreasing flap setting would increase the stall speed. It was a standard operating procedure for the crew to calculate the power-off stall speeds at the take-off weight for 0-flap, 50% flap and 100% flap, for 0° and 45° angle of bank for each flight. A 25,000 lb (11,340 kg) weight reduction from a jettison of the remaining fire retardant would have reduced the power‑on stall speed to 76 kt.

Turbulence will also affect an aircraft’s stall speed. According to the Bureau of Meteorology, moderate turbulence is associated with a load factor increase of 0.5 to 0.99 G^[43] with appreciable changes in attitude and/or altitude, while severe turbulence is associated with a load factor increase of 1.0 G to 1.99 G with large abrupt changes in attitude and/or altitude. Turbulence was forecast (refer to section titled Bureau of Meteorology forecasts) and likely experienced (refer to section titled Bureau of Meteorology analysis) at the accident location. Applying the moderate turbulence load factors as boundary conditions to the 50% flap power-on stall speed at 59,420 kg produced a range of 101-117 kt (IAS). Similarly, for severe turbulence, this produced a power-on stall speed range of 117-143 kt (IAS) at 59,420 kg.

Regarding turbulence, the airspeeds limitation section of the operator’s AFM stated that:

The aircraft should not be operated in conditions of severe turbulence [actual conditions] because gusts can be encountered that may impose excessive loads. However, if flight in severe turbulence cannot be avoided, flight should be in the range of 65 knots above the power-off stall speed (not to exceed 180 KIAS) for the operating gross weight.^[44]

Emergency climb performance

The aircraft’s emergency climb performance with maximum power at 131,000 lb (59,420 kg) and 50% flap was about 1,500 ft/min. With a reduced weight from a jettison of the remaining fire retardant, the emergency climb performance would have increased to about 2,250 ft/min, representing a 50% improvement. This was the absolute best rate of climb that could have been achieved.

Meteorological information

Bureau of Meteorology forecasts

A Bureau of Meteorology graphical area forecast was issued at 0924 and was valid for the time of the flight. It forecast moderate mountain wave activity^[45] above 3,000 ft above mean sea level (AMSL) and severe turbulence below 8,000 ft AMSL in the area of operation from Richmond to Cooma. This included the Adaminaby and Good Good fire-grounds. In addition, a SIGMET^[46] issued at 0947, and valid for the flight, forecast severe turbulence^[47] below 10,000 ft AMSL for the area. Of note, when commenting on the general nature of forecasts, some of the operator’s pilots indicated that they could be broad and cover a large area of the state, which may not accurately reflect the actual conditions over the fire-ground. The only operational limitation cited at interview by the pilots were related to thunderstorm activity.

The aerodrome forecast for the Cooma-Snowy Mountains Airport,^[48] located 50 km south-west of the accident site was amended at 0948. It indicated wind speeds of 25 kt, gusting to 48 kt, with a mean wind direction of 300° from 1100 and visibility reduced to 8,000 m in light showers. Severe turbulence below 5,000 ft AGL was forecast from 0900-1500. A PROB30^[49] for visibility reduced to 2,000 m in blowing dust and a broken^[50] layer of cloud at 1,000 ft AGL was forecast for the period 1100–1700.

At 1012, the Richmond airbase manager (ABM) sent a text message to the air tanker and birddog pilots to advise them of an airport warning at Richmond for wind gusts in excess of 35 kt between 1000 and 1700.

Observations of the weather in the area

Other fire-control aircraft

On the day of the accident, several fire-control aircraft, primarily consisting of fixed-wing Air Tractors (single-engine air tankers) and Bell 206 helicopters, were operating from the Polo Flat airstrip, located 33 km south-west of the accident site. The Cooma Fire Control Centre (FCC) aviation radio operator (ARO) received reports of strong winds in the area from the fire-control pilots in the early morning. This included winds of 30-40 kt at 0839, 40-50 kt at 0902, and 52 kt at 0937. The ARO recorded in their operations log that, due to the weather conditions, all fire‑control aircraft had departed the area or landed by 1030.

In addition, the crew of B137 reported that the wind conditions at Adaminaby at about 1200 were 50 kt at 800 ft AGL and about 37 kt at 200 ft AGL.

Witness reports

Following the accident, the ATSB received multiple witness reports of the weather conditions at Peak View. They all consistently reported very strong winds from the north-west, with gusts up to 43 kt recorded at ground level. One resident noted that, although the prevailing wind was from the north-west, the direction and strength at ground level were also being influenced by the local terrain.

Glider pilots familiar with the area commented that, due to the local terrain, the area was often subject to turbulence and rotor conditions (refer to section titled Mountain wave activity). It was also a well-known area for mountain wave activity and that on the day of the accident it was a ‘terrible wave day’.

Weather station recorded conditions

About 12 minutes prior to the accident, the Cooma-Snowy Mountains Airport weather station indicated a wind speed of 25 kt, gusting to 39 kt, from a direction of 320°. The visibility was 6,000 m, with a QNH^[51] of 1002 hPa, and temperature of 26 °C.

A personal weather station at Peak View, located about 1.3 km from both the drop and accident sites (Figure 6), recorded the conditions twice per hour. At about 1309 (7 minutes prior to the accident), the station recorded a mean wind of 15 kt from the west and a peak gust of 32 kt from the north, a temperature of 30 °C, and a QNH of 995 hPa.^[52] At about 1330 (14 minutes after the accident), the station recorded a mean wind of 16 kt from the west and a peak gust of 42 kt from the north-west.

Figure 6: Accident circuit with predominant wind direction, direction of travel (DOT), and terrain

Source: Google earth, Peak View weather station and SkyTrac data, annotated by the ATSB

Bureau of Meteorology analysis

The Bureau of Meteorology analysed the conditions on the day and indicated that a cold front was approaching the accident location, with hot and strong north to north-westerly winds ahead of the front. High resolution weather model data indicated the winds at 5,000 ft AMSL were about 45 kt from the north-west, increasing in strength with height up to 80 kt from the north-west at 10,000 ft AMSL.

Gusting winds had produced some areas of blowing dust, which likely reduced visibility. Bushfire smoke in the area had also affected visibility. While nearby observations at the Cooma-Snowy Mountains Airport showed intermittent reductions in visibility, it was noted that measuring equipment may not have accurately reported visibility in smoke conditions. Therefore, it was likely that the actual visibility was lower than that reported by the instruments.

The strong winds over the terrain likely resulted in severe turbulence and mountain wave development. Satellite imagery of cloud formations confirmed the presence of mountain wave activity during the day. The conditions in the area at the time were generally favourable for mountain wave development, however, the Bureau of Meteorology were unable to determine the severity of this from the data available.

The Bureau of Meteorology considered that the conditions at the Cooma-Snowy Mountains Airport were likely representative of the general conditions experienced at the accident location. Further, their analysis of the weather conditions in the area was consistent with what was forecast on the day.

Accessing meteorological information

For operations in NSW, following the briefing with the Richmond ABM each morning, the crews would return to their own operational areas until they received a tasking from the RFS. On receipt of a tasking, crews would conduct their flight planning. It was reported that the operator’s crews used an electronic flight bag (their company issued iPad including the Foreflight app) to submit their flight plan to Airservices Australia, which also provided access to the required weather forecasts. While specific weather data access could not be confirmed, as the flight plan had been submitted, it was considered very likely that the crew of B134 would have also accessed the relevant weather information at that time.

In addition, the operator outlined that conditions at a fire could change rapidly, and when the fire was an hour or more flight time away, reported weather conditions were likely to be inconsistent with the actual conditions on arrival.

Weather systems: Mountain waves and windshear

Mountain wave activity

Mountain waves^[53] are the result of flowing air being forced to rise up the windward side of a mountain range, then as a result of certain atmospheric conditions, sinking down the leeward side (ATSB, 2009). Immediately downwind of the range there is a strong downdraft followed quickly by an updraft, which produces the wave motion. According to Underdown and Standen (2003), mountain waves can develop when the wind direction is near perpendicular to a continuous mountain range and at a speed of 15 kt or more^[54] at the summit, and increasing with height in a stable atmosphere. Aircraft may encounter severe turbulence in mountain wave systems.

Rotors or eddies can also be found embedded in mountain waves. Their formation usually occurs where wind speeds change in a wave or where friction slows the wind near to the ground. Often these rotors will be experienced as wind gusts or windshear (ATSB, 2009). According to the FAA (1997), localised gusts of 50 kt, with downdrafts greater than 1,500 ft/min, are not unusual in mountain wave systems. Although this phenomenon is usually forecast reasonably well by the Bureau of Meteorology, many local factors may also affect the formation of mountain wave activity.

When discussing the consequence on aircraft performance, the ATSB’s safety publication Mountain wave turbulence noted that (ATSB, 2009):

Many dangers lie in the effects of mountain waves and associated turbulence on aircraft performance and control. In addition to generating turbulence that has demonstrated sufficient ferocity to significantly damage aircraft or lead to loss of aircraft control, the more prevailing danger to aircraft in the lower levels in Australia seems to be the effect on the climb rate of an aircraft.

Study of mountain waves associated with bushfires

According to the Bushfire and Natural Hazards Cooperative Research Centre,^[55] one of the most challenging situations in fire management was when relatively benign weather conditions were expected, but a severe fire eventuated. In December 2016, the centre released Hazard note issue 24: Fire escalation by downslope winds. The note, authored by specialists from the Bureau of Meteorology, investigated the meteorology of unexpected severe fire behaviour associated with mountain wave activity and identified 3 relevant bushfires. A detailed case study of the New South Wales (NSW) Blue Mountains fires of October 2013 was undertaken, focussing on 17 October at 1300. Of interest was the behaviour of the winds in the vicinity of the State Mine fire.

Figure 7 shows a cross-section of the horizontal wind speeds (left image) and vertical wind speeds (right image) along a section passing from the north-west to the south-east through the State Mine fire‑ground. The red circled region in the left image shows strong horizontal winds extending downwards towards the surface in the vicinity of the fire. Downwind (to the right) of the fire are oscillations (left image) in the wind speeds and alternating bands of ascending and descending air (right image), both of which are characteristic features of mountain waves. The note described mountain waves as:

Mountain waves are oscillations that can occur when the wind blows across a mountain or hill. They are somewhat similar to water flowing over a rock in a stream, but are much more complex because their existence and amplitude is sensitive to the atmospheric temperature structure (stability) and vertical variation of the wind (wind shear). They often lead to strongly accelerated flow attached to the lee slope of the mountain or hill, known as downslope winds…

Figure 7: North-west to south-east cross section of fire, illustrating horizontal (left image) and vertical (right image) wind speed changes, with the fire located near the number 6 on the horizontal axis

Source: Bushfire and Natural Hazards Cooperative Research Centre

While the purpose of the note was to consider the wind effect on the severity of a fire, this has potential implications for firefighting aircraft, particularly if low-level windshear was present. As a comparison, at position 1 on the horizontal axis (left image), the wind speed band of 45–55 kt would not be encountered until reaching a height greater than 8,000 ft (2,450 m) above the surface. However, at the fire-ground at position 6, these wind speeds could be encountered within a few hundred feet above the surface. The note also highlighted that this research revealed features at the location of the fire-ground that might not have been captured or possibly filtered out of broader‑scale forecasts.   

Windshear

Windshear is defined by the Bureau of Meteorology (2014) as a ‘wind direction and/or speed change over a vertical or horizontal distance’. It is always present in turbulent air but can also occur without turbulence being present. This phenomenon becomes particularly significant when an aircraft is abruptly displaced from its intended flight path and substantial corrective action is required by the pilot. This is more so at lower levels and low speed, such as during take-off and landing. The hazards are a rapidly changing headwind and tailwind, strong side gusts, and a change in lift on the wings, all during a time when an aircraft is most vulnerable (Minor, 2000). Specifically, the Bureau of Meteorology (2014) noted that:

During the climb-out and approach phases of flight, aircraft airspeed and height are near critical values, rendering the aircraft especially susceptible to the adverse effects of wind shear.

Aircraft taking-off may be significantly affected by changes in headwind and tailwind components which create changes in the amount of lift experienced. A decrease in the vertical headwind component, or an increase in the tailwind component, will result in a reduction in airspeed, and in extreme cases the resulting loss of lift may be enough to cause the aircraft to stall or fly into the ground.

Likewise, the adverse effects on aircraft performance from low-level windshear was also discussed by Bowles (1990), when analysing airborne forward-looking windshear detection systems:  

The hazard of windshear arises principally from its deceptive nature: In a windshear situation, from a microburst^[56] or any other source, the pilot may be confronted with a performance-increasing headwind, followed a few seconds later by a powerful, performance-decreasing tailwind. To cope with the headwind, the pilot may take actions to prevent the plane from climbing. These actions are then compounded by performance loss caused by the tailwind and downdraft, so that it may be impossible to avoid ground impact.

Depending on crew action, a typical low altitude windshear may result in reduced airspeed and rate‑of-climb, which often result in significant altitude loss and possible ground impact. Full performance capability depends on two key factors: timely recognition and appropriate response.

Windshear controls

Aviation specific windshear research

In 1985, the FAA contracted a consortium of aviation specialists to study windshear. As a result of that work, a windshear training aid was developed. The aid provided an effective means of training crews to minimise the windshear threat through avoidance, cockpit recognition, and recovery techniques. This included the 1988 publication Pilot windshear guide (FAA advisory circular 00‑54). This outlined the limitations in pilot avoidance, with a reliance on visual indications, which can be complicated by marginal weather, and reports from other aircraft in high density traffic areas.

According to the advisory circular, between 1964 and 1986, there were at least 32 air transport accidents and incidents in which windshear was identified as a contributing factor, resulting in over 600 fatalities. There was also evidence to suggest that this figure was underestimated as it did not include undocumented ‘close calls’ and general aviation statistics.

Generally, the research showed that only 5 to 15 seconds may be available for the crew to recognise and respond to a windshear encounter. In describing a typical encounter shortly after take-off, with windshear encountered prior to a stabilised climb (Figure 8), for the first 5 seconds the take-off appeared normal, with early trends in airspeed, pitch attitude, vertical speed and altitude appearing normal. However, as airspeed decreased, pitch attitude was reduced, limiting performance capability, and resulting in a loss of altitude.

Figure 8: Effect of a windshear encounter on the aircraft flight path during take-off

Source: US Federal Aviation Administration

The timeframe mentioned above was consistent with windshear research reported by Tsukagoshi (1999) conducted following a 1993 Douglas DC-9-41 hard landing accident in Japan following windshear during the landing approach (while crossing the runway threshold in Japan). Following the occurrence, the Japan Federation of Flight Crew Unions established a project to obtain objective and quantitative data on flight crews’ reactions to windshear. The research was supervised by Dr Sado Horino from Kanagawa University, Japan, and was conducted on a DC-9 flight simulator at Northwest Aerospace Training Corporation near Minneapolis, US.

Eight DC-9 pilots completed 35 test approaches to land on the simulator. Windshear was encountered at random heights, from 50 ft to 900 ft. Of particular note, the results demonstrated that the average recognition time for a windshear encounter was about 5.5 seconds. Recognition time was defined as the time between the windshear encounter and when the pilot first moved the elevator control.

Windshear risk control systems

Windshear avoidance, based on pilot awareness and training, cannot be 100% effective. There are also limitations in recognition and recovery procedures, as this requires the aircraft to have entered the windshear condition, which can potentially exceed the aircraft’s performance capability, regardless of pilot actions. Therefore, ground-based and airborne detection systems have also been introduced to reduce the hazard of an inadvertent windshear encounter (Bowles, 1990).

Ground-based low-level windshear alerting systems were developed and introduced at selected airports, predominantly in the US. However, there were 2 prominent windshear accidents in the 1980s (a Pan Am Boeing 727 on 9 July 1982; and a Delta Airlines Lockheed L-1011 on 2 August 1985), which prompted the FAA, in 1988, to mandate the use of airborne windshear detection systems for passenger aircraft.

The initial airborne windshear detection systems were reactive systems, which relied on the aircraft performance instruments, combined with attitude, angle of attack and accelerometer inputs. According to FAA advisory circular 25-12, Airworthiness Criteria for the Approval of Airborne Windshear Warning Systems in Transport Category Airplanes, even reactive systems ‘provide a valuable service in the detection, timely annunciation, and confirmation of a potentially hazardous windshear condition generally in advance of human pilot recognition time’. With the development of digital signal processors in the 1990s, weather radar with forward-looking (predictive) windshear detection became possible and the first system was certified by the FAA in 1994. The requirement was to provide at least 10 seconds advance warning to the crew of a microburst. These systems used doppler weather radar and the moisture in the atmosphere to collect wind velocity data. Therefore, drier air would reduce the reflectivity and windshear warning time.

An article published by Honeywell Aerospace (2019), Radar Corner: Understanding Airborne Windshear Detection Systems, Part One, emphasised that ‘It is the advanced warning time that saves the aircraft’. This time allowed the pilot to increase engine power, and retract the flaps and landing gear, thereby increasing the aircraft’s energy state and climbing, so that the windshear encounter would occur at a higher, ‘more survivable altitude’. The article further indicated that, during studies evaluating windshear recovery manoeuvres, it was found that when a windshear recovery manoeuvre was delayed by 5 seconds, the average altitude loss increased by 300 ft.

Another study on Wind-Shear System Cost-Benefit Analysis (Hallowell and Cho, 2010) reviewed the effectiveness of various detection systems, as the FAA considered the options for managing aging systems and evaluating new systems. The study also considered windshear mitigation strategies, which were categorised into 3 groups: pilot recognition and recovery training, airborne (aircraft systems), and ground‑based systems.^[57] While noting the difficulties in determining the effectiveness of pilot training in recognition and avoidance, for comparative purposes, this was estimated to be effective about 25% of the time. Conversely, while only measured in simulated environments, the effectiveness of predictive windshear (airborne) systems had often exceeded 95%, although this may be reduced in dry environments.

Notably, Hallowell and Cho (2010) identified that each of these categories provided their own advantages, with the greatest benefit achieved when multiple categories were combined. It also noted that air taxi and aerial work operations, which included firefighting aircraft, operated at low‑level and low‑speed outside the ground-based protection areas more frequently than air transport. Further, airborne systems including both reactive and predictive windshear systems, were not routinely available on air taxi, aerial work or general aviation aircraft.

While there are limitations to reactive and predictive systems, where these systems were fitted to firefighting aircraft, and warnings had activated in the low-level environment, several pilots reported at interview this had a positive effect on their management of the situation. In addition, in 2018, Lockheed Martin developed a civil-certified firefighting air tanker, which was a variant of the C-130J. The LM‑100J ‘FireHerc’ had numerous advanced features that provided increased situational awareness and modern safety features to protect and guide crews through challenging flight conditions. Of most relevance to this investigation was the inclusion of warning systems with visual and aural alerts for windshear detection.

The accident aircraft was not fitted with a windshear detection system as it was built in 1981, prior to such technology becoming available. Likewise, the operator’s other C-130 aircraft did not have this system. Retrofitted systems suitable for the C-130 have since become available.^[58] However, the operator advised that they had not considered installing these systems into their C-130 fleet. Further, it was not required by regulation or contract to be installed.

On 10 July 2022, in response to the draft report, Coulson Aviation advised that aerial firefighting operate in very dry environments conducive to active fires. Therefore, with minimal or nil moisture present in the atmosphere it could be concluded that a forward-looking windshear detection system would provide little to no advance warning of a windshear event. They further indicated that their crews were highly experienced in recognising windshear events and crew reaction times would be as timely, if not quicker than a reactive-based system. The operator further advised that this statement was based on ‘rational conclusion’ based on experience supported by informed opinion. The ATSB was unable identify any research that supported this comment.

Lockheed Martin Airplane Flight Manual

The Lockheed Martin AFM contained a section on adverse environmental conditions, which defined windshear as ‘any rapid change in wind direction or velocity that results in an airspeed change of more than 10 knots’. Severe windshear was defined as ‘a rapid change in wind direction or velocity causing airspeed changes greater than 15 knots, or vertical speed changes greater than 500 fpm [ft/min]’.

The AFM also warned pilots that severe windshear, particularly those with downdrafts, could exceed aircraft performance capability. It was considered to be most dangerous at low levels when encountering a decreasing headwind (or increasing tail wind) such as during take-off and approach. At these times, the aircraft is at low-level and low speed, and the initial reaction of the aircraft will be a drop in indicated airspeed and a decrease in pitch attitude, resulting in a loss of altitude.

By 2010, the Lockheed Martin AFM had introduced a recovery procedure for severe windshear encountered during approach to land as:

1. Announce a go around.

2.Set maximum power and select a go around (G/A) flight director mode, if applicable. Best initial pitch attitude will be a function of the conditions. If ground impact is a concern, rotate above the G/A flight director cue, as necessary, to target threshold speed until safe altitude above the ground is reached.

3.The co-pilot will monitor and call sink rate (VVI/VSI) and airspeed as appropriate.

4.The navigator/engineer will monitor and call out radar altimeter.

5.If flaps are at 100%, transition to 50% flaps after assuring continued positive rate of climb at no lower than Obstacle Clearance Speed.

6.Do not retract the landing gear until recovery is complete with positive climb rate and increasing terrain separation.

7.When clear of the wind shear, adjust pitch and power for normal climbout.

8. When conditions permit, report the encounter with ATC.

Coulson Aviation’s Airplane Flight Manual and Company Operations Manual

On 10 July 2022, in response to the draft report, Coulson Aviation stated that the precursors that generally defined windshear would be routinely encountered in normal aerial firefighting operations due to the hot, dry, and windy conditions that lead to most bushfires. Therefore, the procedures, experience, and training to deal with, and respond to these conditions were in-built for their aerial firefighting operations. However, the ATSB noted that there was no windshear recovery procedure published in the operator’s AFM, nor did it contain a section on adverse environmental conditions.

The manual did contain a warning associated with the go-around procedure, which was described by the operator’s pilots as similar to the post-retardant drop climb out:

Retracting flaps from 100 percent to 50 percent will increase stall speed. Without proper power and attitude corrections, sink rate will also increase. This is particularly noticeable at lower than normal airspeeds. If safe altitude and airspeed are not attained, inadvertent touchdown and/or stall may occur.^[59]

The COM contained information on windshear in the departure procedures section, which stated:

…wind shear may create a severe hazard for aircraft below 1,000 ft…the best defence is to avoid downdrafts altogether as it could be beyond you or your aircraft’s capability… If wind shear is encountered, prompt action is required. In the EC-130Q/L382G, the recovery requires full power and pitch attitude consistent with the maximum angle of attack for the aircraft.

The majority of the crew interviewed provided accounts of personal experiences with either a real or simulated windshear event in the low-level airdrop environment. It was noted that in-aircraft training was conducted by the operator for emergency scenarios with a focus on jettisoning the retardant. These descriptions were consistent with the manufacturer’s procedures for windshear recovery, with additional consideration of jettisoning the load if aircraft performance did not improve after maximum power was applied.

Coulson Aviation windshear training

A review of the operator’s C-130 simulator training syllabus noted there was no specific training item for a low-level windshear recovery scenario. The syllabus only noted that a briefing on recovery from windshear was to be conducted.

The operator conducted yearly training that consisted of ground school, simulator training, and in-aircraft flight training. Included in the ground school training were ‘consider the load’ discussions, where if there was an emergency or performance concern, they could jettison the load to improve aircraft performance. Further, in-aircraft training was conducted where each PIC completed a ‘consider the load’ scenario, with a focus on jettisoning the retardant. Any applicable emergency or non-normal event could be used for this purpose, which at times included a simulated ‘down air’ (downdraft) scenario.

At interview, it was noted by at least one pilot that the air drop^[60] scenario was quite different between the firefighting and military scenarios, and that standardisation for completing these operations occurred through the operator’s yearly training sessions.

On 10 July 2022, in response to the draft report, Coulson Aviation indicated that the response to a downdraft was consistent with the windshear escape manoeuvre for most large aircraft, with the added protection of being able to jettison the load to increase aircraft performance. In addition, the operator emphasised that the majority of their C-130 crews were current or former military pilots, where windshear recovery training was conducted on a bi‑annual basis. Therefore, the operator considered their pilots to be ‘extremely familiar’ with the procedure.

Wreckage and impact information

Accident site

The accident site was located on slightly sloping, partially wooded terrain, near Peak View, 50 km north-east of the Cooma-Snowy Mountains Airport. The wreckage trail (Figure 9) was approximately on a heading of 100°, with the initial impact at an elevation of about 3,440 ft AMSL. The debris trail began at the lower end of the slope, with the wreckage distributed linearly over about 180 m.

Figure 9: Accident site overview showing the wreckage trail

Source: ATSB

Wreckage examination

The ATSB’s on-site examination of the wreckage, damage to the surrounding vegetation, and ground markings, all indicated that the aircraft initially impacted a tree in a left wing down attitude of about 55°, before colliding with the ground. An intense post-impact fuel-fed fire destroyed the aircraft. The ATSB’s on-site examination also found (Figure 10):

• no pre-existing airframe issues
• all major sections of the aircraft’s structure were identified and there was no evidence of an in‑flight break-up or pre-impact structural damage^[61]
• the cockpit and associated avionics were identified about two-thirds of the way along the wreckage trail
• the cockpit and forward section of the airframe had separated from the fuselage, was inverted, and had been destroyed in the impact and fire
• sections of the wing skin, leading edge spar, wing tips and portions of the wings were identified along the wreckage trail, having fragmented during the impact sequence, and sustained further damage during the fire
• all flight control surfaces were identified, however, flight control continuity could not be established due to the impact and fire
• the vertical and horizontal stabilisers had remained attached to the aft section of the fuselage
• the 4 engines and 16 propeller blades were located on-site and some of the propeller blades remained attached to the propeller hubs, while others had detached through impact forces
• there were varying degrees of damage observed across the 4 engines, likely due to the impact sequence of each engine, with the damage indicating the engines were rotating at impact.

The RADS tank remained upright, with no fire retardant identified between the drop area and the initial impact location. However, a large amount of retardant was located in the wreckage near the tank. The system was badly damaged, with the doors fragmented throughout the wreckage, and its operational state could not be established. 

Figure 10: Main aircraft wreckage components

Source: ATSB

Aircraft configuration

The aircraft was equipped with 4 trailing edge flaps. All flaps had separated from the aircraft during the impact sequence. On-site measurements of the flap screw jacks indicated the flaps were set at 50% at impact. This was consistent with the expected setting following a retardant drop. Due to the extent of damage, the elevator, aileron, and rudder trim settings could not be established.

Fuel testing

Fuel samples were retained from the 2 fuel tankers that last serviced the aircraft and from the refuelling storage tank at Richmond. The fuel samples were independently tested by a commercial fuel company for correct specifications, with nil abnormal indications found. In addition, there were no reports of fuel quality concerns with any other aircraft using the same fuel source.

Engine and propeller examinations

With the assistance of the Australian Army, the engines, partial remnants of the reduction gearboxes, and propeller assemblies and blades were transported to a secure hangar at Richmond Royal Australian Air Force (RAAF) Base for further examination. The engine manufacturer attended the inspections, where it was confirmed that all engines were rotating at impact, and there were no noted pre‑existing issues. As power changes were controlled by changes to the propeller blade pitch while maintaining a constant engine speed, the engine power levels were determined from the blade pitch angle at impact.

During the propeller hub assembly inspection, measurements of the internal components were recorded. The ATSB consulted the propeller manufacturer to determine the propeller blade angles at impact, and establish engine power levels. The propeller manufacturer concluded the following:

The calculations indicate that, based on the operating conditions estimated by the ATSB,^[62] all the propellers were absorbing power from their respective engines and were producing positive thrust. The horsepower computed for each of the four engines are within the normal operating range for the T56 engine installed on this aircraft.

Recorded information

General information

The aircraft was not fitted with a flight data recorder, nor was it required to be by Australian or US regulations. However, there were devices on board that recorded information relevant to the flight path, as well as data that was transmitted in real time. Further, 2 firefighters located near the accident had videoed the aircraft. An analysis of these sources are presented below.

Witness video

Two firefighters were located on Feeney’s Road (800 m from the accident site), and both videoed the aircraft during the retardant drop. One video was taken in the landscape orientation and had a duration of 18 seconds. This video captured the drop and stopped as the aircraft was descending). The other video was taken in the portrait orientation and was 37 seconds in duration. It captured the aircraft descending into the drop zone and ended after the aircraft impacted with terrain. Collectively, the videos captured the aircraft from 10 seconds prior to the retardant drop, the drop, and the 5 seconds after the drop when the aircraft became obscured by smoke and was only intermittently visible (Figure 11). From the witness video, it was unclear if the aircraft flew behind the smoke, or entered the smoke. Seventeen seconds after the drop, the aircraft was seen at low-level, followed by the collision with terrain and post-impact fire.

The videos were analysed by the ATSB using commercial camera tracking software^[63] to estimate the aircraft’s flight path and attitude. The RAAF Aircraft Research and Development Unit also analysed the video to evaluate the aircraft attitude. These analyses indicated that:

• at 1315:15 (commencement of the drop), the aircraft was at a left bank angle of 10°, with a pitch of 0°
• at 1315:17 (end of the drop), the aircraft was at a left bank of 17° and a pitch-up of 6°
• at 1315:21, the aircraft reached its maximum left bank of 31°and maximum pitch-up of 12°
• at 1315:22 and 1315:23, the aircraft was obscured by smoke and the attitude could not be determined
• at 1315:25, the aircraft was at a left bank of 18° and a pitch-up of 8°
• at 1315:26, the aircraft was at a left bank of 5° and a pitch-up of 6°
• at 1315:27, the aircraft was at a right bank of 6° and pitch-up of 5°.

From 1315:27 the aircraft was obscured by smoke, and the attitude could not be determined using SynthEyes. The general attitude could be determined from basic photogrammetry at limited points from this time.

Figure 11: Aircraft attitude and approximate flight path at key times

Source: Google earth and SkyTrac data, annotated by the ATSB

For about 10 seconds after the completion of the drop, a positive rate of climb was achieved, with the aircraft climbing about 170 ft (to 3,770 ft AMSL) from the drop height. Following this, the aircraft was then observed descending. At 1315:34, the aircraft was seen at a very low height above the ground, in a slight left bank, immediately followed by a significant left roll just before ground impact. The elevation of the terrain, while undulating, also increased by about 40 ft from the drop site to the accident site.

The footage was also used to review aircraft control and configuration changes, such as flap positions and aileron movement. Shortly after the drop, the flap position was assessed as being 100%, consistent with the operator’s AFM supplement drop procedure. However, further assessments could not be made due to limitations with the video quality, visibility, and aircraft attitude. At various points in the video, both left and right aileron movement could be seen, but actual deflections could not be determined.

The videos also provided a general understanding of the low-level wind conditions at the time, with significant audible and visual movement of the surrounding trees and smoke, and blowing dust at ground level. It was also noted that there was no video evidence of any retardant being dropped between the initial drop location and the impact site.

Operational load monitoring system

Aerial firefighting contract requirements in the US required the aircraft be fitted with an operational load monitoring system (OLMS), predominantly for monitoring aircraft loading during operation. The OLMS was located behind the centre wing section in the fuselage and recorded data at a rate of 32 Hz (32 times per second). This recording device had no impact or fire protection, and was destroyed in the accident sequence.

Six months of historical data for B134 was made available to the ATSB, to allow for a comparison of the available accident flight data with previous flights. This review identified that the pitch and angle of bank data was not recorded correctly by the OLMS. Therefore, only the flap retraction timing and duration, and the vertical speed (rate of climb/descent) could be compared. While there was no comparable data available for flights with the entire accident crew, a review of the PIC’s recent flights and comparison with other crews indicated that the flap retraction was generally initiated between 2.5 and 5.5 seconds (with an average of 3 seconds) after the drop was completed. It also showed that the actual flap retraction from 100% to 50% flap took about 4-5 seconds and was completed, on average, about 7-8 seconds after the drop.

The rate of climb post‑drop varied between 500 ft/min and 2,400 ft/min, with the majority of the flights between 1,100‑1,500 ft/min. These variations were possibly related to weather patterns, terrain limitations, and the operational requirements, which were unique to each drop. 

SkyTrac and automatic dependent surveillance broadcast (ADS-B) data

Aerial firefighting contracting requirements in Australia required the aircraft to be fitted with a tracking capability. The aircraft was fitted with SkyTrac, a system that could transmit the aircraft’s position in real-time, and was monitored by the NSW Rural Fire Service (RFS). The SkyTrac unit was recovered from the wreckage and transported to the ATSB’s technical facility for examination and download. The Canadian Transportation Safety Board assisted in the conversion of the downloaded data.^[64] The SkyTrac unit recorded data at 5 second intervals.

Data broadcast by the automatic dependent surveillance broadcast (ADS-B) equipment fitted to the aircraft for air traffic control purposes was also obtained from various providers. This system determined the aircraft’s position using GPS and then broadcast this information, along with pressure altitude,^[65] ground speed,^[66] and other data, at regular intervals. ADS-B data was transmitted every 0.5 seconds, however, not all transmissions were available, with gaps of up to 5 seconds during the accident flight. Aside from the difference in recording intervals, the data provided for the common parameters across both sources was identical.^[67] Table 2 shows the parameters recorded by SkyTrac and ADS-B.

Table 2: SkyTrac and ADS-B recorded parameters

Airspeed calculations

Using the ground speed from the SkyTrac and ADS-B data, and the weather observations from Peak View, the wind speeds of 15, 30 and 40 kt from the north-west were used to estimate the aircraft’s true airspeed.^[68] These values were consistent with a review of the aircraft ground speed in the drop planning circuits. These circuits showed a periodic variation consistent with the aircraft flying into, and then with, the wind, and indicated that the wind speed was likely of a magnitude of 20-40 kt from a north‑westerly direction during their drop planning circuits.

The calculated true airspeed values were then converted to a computed calibrated airspeed (CAS)^[69] using temperature and pressure data also from Peak View. The airspeed calibration charts in the operator’s C-130 AFM showed that there was a negligible difference between the CAS and indicated airspeed at the airspeed range being considered. Therefore, the CAS was equivalent to the indicated airspeed that would have been presented to the crew on the airspeed indicator.

The data showed a limited increase in the ground speed from 144 kt at the start of the drop, to 149 kt during the post-drop climb-out period, to a maximum of 151 kt just prior to the collision with terrain. However, the CAS (Figure 12) can be seen to be significantly lower, and with a much smaller increase during the climb. In the last 15 seconds of the available data, the calculated CAS was between 100 and 123 kt.

Vertical speed

From the SkyTrac data, a positive rate of climb was recorded for the 10 seconds following the drop, with the aircraft climbing to about 170 ft above the drop height, which was consistent with the witness video. The derived vertical speed,^[70] while noting its limitations (as described above for the operational load monitoring system), increased from zero at the end of the drop to about 1,000 ft/min in the 8-10 seconds after the drop, then decreased to about 0 over the next 5 second period. At the last data point, the aircraft was descending at about 2,000 ft/min.   

Aircraft track

From both SkyTrac and ADS-B data, the retardant drop was conducted on a track of about 190°. The aircraft was then turned through 160° as the climb rate peaked, with the last recorded track of 133°, about 3 seconds prior to impact.

The recorded ground speed, calculated CAS, track, derived vertical rate, and altitude for the last 30 seconds of flight is shown in Figure 12.

Figure 12: Recorded flight path data, derived airspeed, and rate of climb for the last 30 seconds of flight

Source: SkyTrac and Geoscience Australia digital elevation data, annotated by the ATSB

Low pressure spike

Prior to the drop, the ADS-B pressure altitude was, on average, about 250 ft above the SkyTrac GPS altitude (Figure 13), which was consistent with the QNH on the day. It was noted that there was a small increase in the ADS‑B pressure altitude immediately following the drop. This was consistent with the RADS tank doors closing on previous drops, but this returned to about a 250 ft difference with the GPS-based SkyTrac altitude.

However, at about 1315:24, the ADS-B pressure altitude and the vertical rate began to diverge significantly, with a low atmospheric pressure spike at about 1315:29. This was identified by an abrupt increase in both the pressure altitude^[71] and barometric vertical speed. In comparison, the SkyTrac GPS-based derived vertical speed showed a smaller increase, which correlated with the SkyTrac altitude.

As there were several data points associated with this spike, this was considered more likely to be associated with a real event, rather than an erroneous reading. The abrupt rise and fall in these parameters suggested the aircraft encountered a region of low pressure, relative to the surrounding air, with a steep pressure altitude gradient during the climb‑out.

The reason for the localised pressure change could not be determined by the ATSB. Aircraft configuration changes (the RADS tank doors opening or closing, and flap changes) were excluded based on a review of the historical OLMS data. Several other potential factors were considered, including localised turbulence, wind gusts, terrain effects, temperature changes, and fire driven changes associated with smoke plumes. However, limitations in the available evidence prevented a determination.

Figure 13: Comparison of SkyTrac and ADS-B altitude and vertical rate data showing the low-pressure spike

Note: ADS-B pressure altitude shown as recorded references the international standard atmosphere QNH rather than actual QNH.

Source: ADS-B and SkyTrac, annotated by the ATSB

Cockpit voice recorder

The cockpit voice recorder (CVR) fitted to the aircraft was a solid-state memory Universal Avionics Model CVR-30B, part number 1603-02-03 (Figure 14). CVRs are designed on an endless loop principle, with the oldest audio continuously overwritten by the most recent audio. In this case, the CVR recorded crew and cockpit audio for a duration of at least 30 minutes. While the aircraft was not required to be fitted with a CVR under the US or Australian regulations, it was a contract requirement with the US Department of Agriculture, Forest Service (USFS). 

Figure 14: N134CG cockpit voice recorder

Source: ATSB

The CVR was recovered from the aircraft and transported to the ATSB’s technical facility in Canberra on 25 January 2020 for examination and download. Thirty‑one minutes of audio data was successfully downloaded. However, the audio was from a previous flight when the aircraft was operating in the US. No audio from the accident flight was recorded on the CVR.

Inertia switch

The power supply to the CVR was fitted with an inertia switch. Inertia switches are designed to stop the recording function by removing power to the CVR when a pre-set deceleration force was detected. The recovered audio was of crew training flights undertaken on 7 May 2019 near Sacramento McClellan Airport, California. The audio included 4 landings conducted as part of that training. The recording ceased immediately after the fourth landing, and the post-landing taxi and engine shutdowns were not recorded. It was likely that the inertia switch was activated during this landing and consequently disconnected power to the CVR.

Pre-flight testing

Following installation in an aircraft, supplemental material related to the operation of the CVR must be attached to the approved AFM. The supplement for the accident aircraft indicated that the CVR conducted a self-test at power up, and the status of the system would be presented to the crew on the CVR control unit, located on the copilot side console. A CVR system check for crew was also included in the operator’s AFM supplement, but was not included in their pre-flight checklists. None of the operator’s C-130 flight crew interviewed were aware of the need to check this system status prior to flight.

CVR maintenance

A review of the aircraft’s maintenance logs indicated that the underwater locating beacon attached to the front of the CVR was replaced on 24 December 2019. This was a self-contained, replaceable unit, and a full maintenance service check was not required with this replacement. A maintenance check was conducted yearly, and had last been performed in February 2019.

Medical and pathological information

Pilot in command

The PIC held a first-class medical certificate that was issued on 5 September 2019 by the FAA, with a limitation to wear corrective lenses. The PIC’s aviation medical records were provided for the period 2013 to 2019. Overall, these examinations reported no significant medical conditions or abnormal physical findings. Of note, the PICs last electrocardiogram (ECG),^[72] conducted as part of their annual medical examinations, showed indications of an inter-atrial conduction delay,^[73] while previous ECGs noted sinus bradycardia.^[74] Otherwise, the ECGs were considered normal and were ‘cleared’ by the FAA medical officer.

The PIC was reported to be fit and active, with no known medical conditions. On the morning of the accident flight, the PIC’s behaviour appeared normal and there was no evidence to indicate any concerns regarding their general health. While limited, the post‑mortem examination did not identify any pre‑existing medical conditions that could have contributed to the accident nor detect any commonly used drugs or alcohol. Due to limited blood samples, carbon monoxide testing could not be conducted.

Copilot

The copilot’s most recent first-class medical examination was issued on 17 July 2019 with no limitations. The copilot’s aviation medical records were provided for 2018 and 2019. The records reported no significant medical conditions or abnormal physical findings. The records noted that they were taking prescribed medication to lower blood cholesterol and reduce the risk of heart disease. The copilot’s last ECG noted several common anomalies,^[75] but it was ‘cleared’ by the FAA medical officer.

The post-mortem examination identified narrowing and areas of calcification^[76] in both the left anterior descending artery and right coronary artery of the heart. However, the muscle layer of the heart showed no identifiable scarring and there was no indication of an acute coronary artery occlusion (blockage). While no other evidence of significant natural disease was identified, the examination concluded that, the significance of the narrowing, in the absence of any evidence to indicate a blockage in the heart, was unclear. In addition, toxicology testing did not detect the presence of any alcohol, or common medications and illicit drugs. Carbon monoxide testing could not be conducted due to the lack of a suitable sample material.

Flight engineer

The flight engineer’s most recent second-class medical examination was issued on 27 August 2019 with no limitations. From their 2019 aviation medical records, there were no reported medical conditions or abnormal physical findings that could have affected aircraft operations. While limited, the post‑mortem examination did not identify any pre‑existing medical conditions that could have contributed to the accident. The toxicological analysis identified traces of a commonly used over-the-counter antihistamine. Carbon monoxide testing could not be conducted due to the lack of suitable sample material.

Aviation medical specialist

The ATSB engaged an aviation medical specialist to review the crew’s aviation medical records and post-mortem examinations. Noting the limited evidence that could be collected from the examinations due to the nature of the accident, the specialist concluded that:

• As best as could be determined, there was no suggestion of in-flight incapacitation.
• The copilot’s examination identified that 2 of the arteries in their heart showed evidence of narrowing and calcification, but there was no pathological evidence of acute coronary occlusion. The copilot had been taking prescribed medication to treat elevated cholesterol levels for several years. This medication was approved for use by flight crew in both the US and Australia. Further, the copilot’s blood pressure readings and last ECG tracing were all within normal limits.
• The detection of the antihistamine and the reported concentration could not be used to determine with any certainty if the flight engineer was using the medication at the time of the accident or during non-flying periods. This was considered an ‘incidental’ finding.
• While any exposure to carbon monoxide from the fires could not be determined in this case, limited research on a small cohort of ground fire-fighters many years earlier, determined that carboxyhaemoglobin^[77] levels of around 6% were indicative of fire-ground exposures. This level, had it been present in the crew, was not likely to have caused in‑flight incapacitation.

Test and research

Reconstruction flight

On 24 January 2021, at about 1300, the operator reconstructed the flight path from the drop location to the accident site. The intention was to record the perspective and challenges of the terrain, while acknowledging the lack of bushfire smoke and environmental conditions. The flight was in a Cessna Citation 550 (business jet), with the Director of Flight Operations on board. They flew the path twice, firstly at 3,665 ft AMSL and then at 3,610 ft AMSL (noting the accident flight path was at about 3,600 ft AMSL). They noted that, as they turned toward the drop exit and were flying towards the accident site, they experienced an airspeed decay, even as engine power was increasing. While this was not considered ‘extreme’ on the day, it was ‘a bit surprising’. Further, they stated that the path flown by the crew of B134 from the drop to the accident site was into slightly rising terrain.

At the time of the flight, the METAR^[78] for the Cooma-Snowy Mountains Airport recorded wind was 13 kt at 250°, with the direction varying between 200° and 290°. However, at 1143, a SPECI^[79] recorded winds of 15 kt gusting to 29 kt at 260°, and the aerodrome forecast issued from 1200 indicated winds of 14 kt gusting to 25 kt at 270°.

C-130 simulator testing

Purpose

A series of tests were undertaken in a simulator representative of the accident aircraft, the RAAF C-130J-30 full flight mission simulator. The purpose of the testing was to determine if, and under what conditions, wind speeds representative of the strength and prevailing direction reported on the day of the accident could potentially affect aircraft performance. In particular, if the airspeed of the simulator could decay to the power‑on stall speed given the accident flight profile, of a climbing turn from 200 ft AGL. In addition, tests were also conducted to evaluate the effect following a weight reduction of 25,000 lbs (11,340 kg), from a jettison of the remaining fire retardant.

The testing was performed by RAAF Aircraft Research and Development Unit C-130 qualified test pilots (QTPs), supported by the simulator fidelity manager, under the direction of the ATSB. There were no recordings available of the accident crew’s actions. Therefore, the testing was limited to attempting to replicate the known flight path and aircraft attitude, with crew inputs (configuration and power setting changes) described as typical by the operator’s crew. The accident site and drop location were in the simulator database, which enabled a recreation of the accident flight profile from the start of the drop to be used for the tests. The intent was not to recreate the accident flight in full, or review the crew’s potential response to the situation, but focussed on the aircraft performance in the environmental conditions.

Aircraft differences

Access to a C-130H model simulator was limited, with none located in Australia and restrictions imposed by the COVID-19 pandemic. However, a C‑130J model simulator was offered to the ATSB. The C-130H (accident aircraft) and the C-130J were both listed on the same FAA Type Certificate. A discussion of the differences and limitations was held with the RAAF’s Aircraft Research and Development Unit chief of flight test, which considered the airframe, engines, aircraft controls, wings, aircraft systems and modelling limitations. The primary differences with respect to the aircraft were that the C-130J simulator had:

• a longer airframe affecting some aircraft handling qualities
• significant upgrades to the propulsion units
• stall speeds likely to be slightly lower
• aural and visual stall warnings, tactile stall warning (stick shaker) and stall avoidance (stick pusher) systems (not installed on the H model).

As control effectiveness was not being tested, the differences in aircraft handling qualities were of little impact to the proposed assessment. Similarly, an equivalent thrust level could be used to determine the necessary power settings, and limited to the available C-130H levels. To characterise the potential differences in stall speeds, a series of tests were completed, documented in the Results below. The stick shaker and stick pusher functions were both turned off during testing.

Simulator limitations

The ATSB also considered the limitations of the simulator, noting that they are designed for flight training, with the following being of most importance:

• it had a pre-programmed stall characteristic of a 50° left wing drop
• the stall was not considered to be well modelled
• complex weather phenomena such as mountain waves and rotors could not be modelled
• pre-programmed windshear models had a tailwind of 60 kt
• wind gusts could be modelled, but the timing of the gusts could not be controlled.

As the test objectives were to characterise the flight profile with wind speeds that could reduce the airspeed to the stall speed, the pre‑programmed stall behaviour and modelling did not impose any limitations on the assessment. As the pre-programmed windshear model was in excess of the planned test conditions, the simulator fidelity manager developed a method to simulate windshear using the wind gradient tool. This resulted in the wind magnitude changing linearly, proportional to the altitude increase. This also required the test runs to commence in level flight at the drop height of 200 ft AGL, rather than from a descent profile to avoid a pre-drop windshear disrupting the climb-out test profile. A consequence of this methodology was that, on the occasions the simulator entered a pre-stall sink, it exited the windshear condition, which allowed it to recover airspeed and fly-away.

Test summary

The planned test criteria included constant winds of increasing strength, windshear of increasing strength, followed by the addition of turbulence^[80] and gusts to each of these base conditions. Three thrust settings were calculated, based on the calculated true airspeeds (refer to section titled SkyTrac and automatic dependent surveillance broadcast (ADS-B) data) and propeller blade angles (refer to section titled Engine and propeller examinations) considered to provide reasonable boundary conditions.

Fourteen test profiles were developed, which included:

• Three initial tests to establish the equivalent power settings, and comparison of the stall values against the C-130J and C130H flight manuals. It also included the development of the flight profile for the QTPs to practice using the pitch changes, bank angles and heading changes provided by the ATSB.
• Eight profiles were planned for the QTPs to fly the accident profile under various wind conditions. These conditions included constant wind speed environments of varying strengths, windshear environments of varying strength, followed by the addition of turbulence and wind gust profiles.
• Three profiles were developed to test the effect on the stall speed of a reduction of 25,000 lbs, simulating the emergency dump of the remaining fire retardant.

Multiple flight runs were then undertaken for each test profile by 2 QTPs.

Results

The RAAF simulator for the C-130J-30 demonstrated stall speeds comparable to those published for the C-130H at the approximate weight of the accident, 131,000 lb (59,420 kg), in the unaccelerated level flight condition. The power-off stall speeds were 98 kt (simulator) and 101 kt (C-130H), and power-on stall speeds were 82 kt (simulator) and 83 kt (C-130H).

The simulator provided useful insight into the potential for a significant loss of airspeed to occur when a combined maximum wind speed (mean wind plus gust) of 50 kt was used as the control variable. Although this was greater than the surface wind speed recorded at Peak View of 43 kt, it was consistent with the pilot reports from the smaller fire-control aircraft earlier on the day of the accident.

The key outcomes from the simulator testing were:

• A constant strong (40 kt) north-westerly wind resulted in a small loss of airspeed during the climb-out, with minimum airspeeds of about 113 kt IAS, and a ground speed of about 160 kt. There were no aural stall warnings activated, the pilots reported no indications of any pre‑stall buffet or other warnings, and was a notably higher ground speeds than the accident flight.
• A moderate (15 kt) north-westerly wind, combined with a 15 kt windshear, a 25 kt windshear and a 35 kt windshear during the climb-out resulted in an airspeed decay to between 98 kt and 104 kt, with intermittent aural stall warnings. The pilots also reported the controls were less responsive in the higher wind speed scenarios, indicative of approaching the stall.
• A moderate (15 kt) north-westerly wind, with +10 kt gust and +25 kt windshear during climb‑out produced similar ground speeds to the accident flight. This consistently resulted in the airspeed decaying into the stall speed region between power-on (82 kt IAS) and power‑off (98 kt IAS) with repeated stall warnings. The minimum airspeed was in the range 84–98 kt IAS and the ground speed was in the range 141–151 kt.
• When simulating an emergency dump of the remaining fire retardant, the rapid weight reduction, if made after the aural stall warning activation,^[81] but prior to aerodynamic stall, reduced the stall speed. The simulator exited the stall warning/pre-buffet stall regime and improved the performance as expected.

Aerial firefighting in Australia

Overview

The National Aerial Firefighting Centre (NAFC) was formed by the Australian States and Territories in 2003 to provide a cooperative national arrangement for combating bushfires by facilitating the coordination and procurement of specialised firefighting aircraft.

The NAFC contracted aircraft on behalf of all the states and territories, with leasing arrangements allowing for aircraft to be moved around the country to address the prevailing bushfire risk. For each aircraft, a state or territory then assumed primary responsibility, and managed the operation and deployment of that aircraft.

As detailed in the National Aerial Firefighting Strategy 2021–26 (National Aerial Firefighting Centre, 2021), firefighters operate in an escalating risk environment frequently challenged by ‘changing fuel, vegetation and vulnerabilities’. At the same time, they strive to meet the community, government, and media expectations for protecting lives, properties, and the environment. This has resulted in:

…situations where aerial assets can provide effective support are increasing, and with them, community expectations. Meeting these expectations is a risk. Aerial firefighting has grown from ‘just another tool in the toolbox’ to a point where the community expect firefighting aircraft over every fire (especially ‘their’ fire).

Consequently, aerial firefighting has become a critical capability for the management and suppression of bushfires in Australia. To effectively achieve this, aircraft are flown at low altitudes and low airspeeds, often over inhospitable terrain with reduced visibility from smoke. This creates a high-risk environment, which ‘requires an enduring focus on training, compliance, and risk mitigation’ (National Aerial Firefighting Centre, 2021).

Operating environment and limitations

In 2020, although born out of the 2019-2020 bushfires, an inquiry into Australia’s national natural disaster coordination arrangements was conducted. The final report, Royal Commission into National Natural Disaster Arrangements, was published in October 2020. The report noted that the effectiveness of aerial firefighting was dependent on a number of factors including the distance and time to travel to the fire-ground, the type of aircraft used, pilot skill, weather conditions, fire‑fuel type, intensity and size of the fire, type of suppressant use, and the tactics employed to respond to the fire. Specifically, the report identified the following limitations:   

Aircraft alone are not a solution to fighting bushfires. Interaction between aircraft and fire crews is necessary to bring a fire fully under control…

…poor weather conditions can limit and sometimes prevent the use of aircraft. For example, requirements for pilots to maintain visibility of terrain can limit the use of aircraft in severe conditions (eg low visibility in heavy smoke or cloud); and turbulence caused by strong winds and the terrain can make operating aircraft unsafe, especially at low altitude.

Poor weather conditions can also restrict the effectiveness and use of aerial firefighting. For example, during the 2019 SA [South Australian] Cudlee Creek and Kangaroo Island fires, weather conditions prevented all attempts by aircraft, including LATs, from containing the forward spread of the fires. Furthermore, extreme weather conditions experienced periodically throughout the 2019-2020 bushfire season meant there were a number of days when aerial firefighting could not be employed.

Activity

According to research conducted by the ATSB (2020), A safety analysis of aerial firefighting occurrences in Australia, the number of occurrences per financial year increased steadily between 2016–17 and the bushfire season 2019-20. However, data collected by the NAFC and presented in the Australian and New Zealand National Council for fire and emergency services’ (AFAC) 2019-20 annual report, estimated that aerial firefighting activity for the 2019-20 season was around 4 times higher than previous seasons. Given the increased activity, the rising trend in the number of occurrences could be expected and probably did not indicate a significant increase in the risk per flight.

In addition, the ATSB research report identified that half of all reported aerial firefighting occurrences and four fifths of more severe aerial firefighting occurrences were operational in nature, typically terrain collisions, with around one quarter of the more severe occurrences associated with aircraft control. Further, there were 2 fatal accidents between August 2018 and the report publication in May 2020, whereas the previous 17 years only had 3 fatal accidents.

While there have been various deployments and trials of larger aircraft over many years, the current LAT program including the use of C-130 aircraft was evaluated during the 2014-2015 bushfire season. Since commencing operations in Australia in 2015, these LATs have been operating between North America and Australia over alternate bushfire seasons.

On 1 June 2022, in response to the draft report, the RFS reported that the 2019-2020 bush fire season was unprecedented, which meant that a large contingent of aerial resources was required for firefighting, personnel and resource movement, and for surveillance and reconnaissance missions. The RFS acknowledged that aircraft were particularly valuable for fires in difficult terrain or fast-moving fires that were too dangerous for ground personnel to confront.

Over the season, there were 317 aircraft engaged in firefighting activities including 2 very large air tankers (VLATs)^[82] and 4 LATs. Together, the LATs and VLATs completed a total of 1,708 missions and dropped more than 24 million litres of fire suppressant. This represented the largest contingent of VLAT and LAT used in Australia to date.

The RFS further noted:

The season also challenged assumptions about how agencies fight fires - techniques and strategies that worked in previous seasons often did not work as well in the 2019-20 season. The scale of the fires stretched the capacity of fire authorities with many ignitions started by lightning in remote and rugged terrain, quickly spreading to the point where suppression was extremely difficult.

For the 2019-2020 season, the RFS contracted one C-130 and one Boeing 737 from Coulson Aviation via a service agreement subject to the NAFC contract.

Coulson Aviation

General information

Coulson Aircrane Ltd. was a privately-owned company based in British Columbia, Canada. The company had been involved in aviation for over 36 years, operating both fixed-wing and rotary‑wing aircraft. The company's operations included helicopter logging, forest fire suppression, power-line construction, airliner passenger, transport, and other industrial heavy lift operations. Coulson Aviation (USA) Inc. was a subsidiary of Coulson Aircrane Ltd., and contracted rotary and fixed-wing aircraft to the US and Australia.

Coulson Aviation (Australia) PTY Ltd. was formed in 2010 to support Coulson Aircrane's long-term commitment in Australia. The company provided aircraft personnel for Coulson’s rotary and fixed‑wing aircraft operating under contract in Australia for the 2019-2020 bushfire season through the National Aerial Firefighting Centre (NAFC). At the time of the accident, they had a fixed‑wing fleet in Australia consisting of two C-130 aircraft and one Boeing 737 aircraft. They also provided crews for the NSW Rural Fire Service (RFS) Boeing 737, which had previously been purchased from Coulson Aviation in 2019. Following the Australian bushfire season, the aircraft and crews returned to North America for heavy maintenance and recurrent training prior to the US season.

B134 was contracted on an absolute availability requirement. This included standing charges, paid on an hourly availability, with additional charges for flight time (to account for fuel and other costs). Flight time charges were paid regardless of the fire retardant or suppressant being used.

Operating documents

Coulson Aviation maintained a suite of documents, which provided the necessary information for conducting operations in Australia and for operating the C-130 aircraft including N134CG. These were:

• Company operations manual (COM): The COM contained the procedures, instructions and information required by CASA necessary to enable the operations personnel, including crews, to perform their duties safely and ensure the safe conduct of flight operations. The COM was for Australian operations only and applied to both fixed-wing and rotary-wing aircraft.
• Airplane flight manual (AFM): Coulson Aviation, as the type certificate holder, developed their own C-130 AFM for FAA acceptance and approval. The manual was derived from the 1989 US Naval Air System Command document for the EC‑130Q. It detailed the recommended procedures for normal and emergency operations, operating limitations, aircraft systems and equipment, weight and balance, and the aircraft performance that should be achieved when operating in accordance with these procedures. The AFM was approved by the FAA in 2013 with a supplement for the RADS later approved in 2016, and a supplement for an avionics upgrade, which included the CVR installation, approved in 2018.

The FAA advised the ATSB that, for restricted category/military surplus aircraft, the original equipment manufacturer (in this case, Lockheed Martin) did not usually provide any support to the operator, or issue amendments or offer a subscription service, as would normally occur for transport category aircraft. Rather, the source for documents and manuals was normally the military service, although Lockheed Martin may have originally prepared the manuals for the military.  

While the COM contained some procedures applicable to all aircraft operations, at least one of the operator’s C-130 PICs did not consider this manual as the reference document for operating the aircraft. Instead, they considered the AFM and checklists were the appropriate source.

Retardant drop procedures

The operator’s RADS AFM supplement outlined the operating limitations and configuration for the retardant drop procedure. This included 100% flap selection, the landing gear retracted, and airspeed lower and upper limits of 118 kt and 170 kt respectively.

At interview, the operator’s pilots reported the targeted parameters for the C-130 drop were 200 ft above ground level (AGL) and an indicated airspeed target of 120 kt. On completion of the drop, the climb-out procedure was for the PIC to increase power and request the copilot retract the flaps to the 50% position, while the flight engineer monitored and called the engine parameters (temperature and torque). The operator’s crews also reported that they typically targeted 150 kt during the climb-out, with an initial climb to at least 500 ft. The crews who had previously flown with the accident PIC, indicated there was about a 2-3 second period from the completion of the drop to the start of the flap retraction when flying with the PIC.

Where the retardant drop was conducted without a birddog or aerial supervision (refer to section title Aerial supervision), prior to conducting the drop, the LAT crew conduct a number of assessment circuits at various altitudes. These circuits were for drop planning purposes, and as outlined in the COM, would include identifying hazards, the retardant drop plan, entry and exit strategies, as well as a dry run at 500 ft AGL and 150 kt.

Safety management system

Coulson Aviation had introduced a safety management system (SMS) in 2013. At the time of the accident, it was not mandated under either the CASA^[83] or FAA regulations, although it was required under the USFS contract. The International Civil Aviation Organization (ICAO, 2018) defined SMS as:

A systematic approach to managing safety, including the necessary organizational structures, accountability, responsibilities, policies and procedures.

It is designed to continuously improve safety performance through the identification of hazards, the collection and analysis of safety data and safety information, and the continuous assessment of safety risks. The SMS seeks to proactively mitigate safety risks before they result in aviation accidents and incidents.

An SMS comprised 4 components: safety policy and objectives, safety risk management, safety assurance, and safety promotion. The component of most relevance to this investigation was safety risk management, which included hazard identification, and safety risk assessment and mitigation.

From an Australian perspective, the NAFC indicated that an operator with an SMS would be highly regarded, but it was not compulsory. If an operator had an SMS, a requirement was included in their contract, to ensure the operator maintained the same safety standard throughout the contract period. The NAFC also indicated that they would not review or evaluate the SMS, with the expectation, if required for safety regulation purposes, that this would be undertaken by CASA. A review of CASA records found that, while surveillance had been conducted on the operator, these did not include an audit of the SMS, nor was it required as the system was not mandated.

The operator’s SMS manual outlined the company’s safety policy, processes, and procedures for implementing the SMS and safety management plan. It also included information regarding safety oversight, which included their safety reporting processes.

Safety risk management process

ICAO (2018) described the safety risk management process as:

… a key component of safety management and includes hazard identification, safety risk assessment, safety risk mitigation and risk acceptance. SRM [safety risk management] is a continuous activity because the aviation system is constantly changing, new hazards can be introduced, and some hazards and associated safety risks may change over time. In addition, the effectiveness of implemented safety risk mitigation strategies must be monitored to determine if further action is required.

The process allows validation of decisions, evaluation of the results, and provides an opportunity to assess the need for further risk mitigation. Where risks cannot be reasonably eliminated, risk management enables the tasking to be accomplished by controlling risks to acceptable levels.

The operator’s safety and risk management processes were detailed in the COM and were described as:

…safety management processes provide a structure for Coulson to exercise its appropriate duty of care to minimise the risks involved.

…provide a formal mechanism that are designed to capture all aspects of safety performance, conformance with approved procedures, continued improvement of procedures, regulatory compliance and operational risks that have the potential to adversely affect the operation.

Risk management is a structured approach to managing uncertainty related to a threat or hazard through a sequence of activities including risk assessments, strategies developed to manage the threat and mitigation of risk...

Hazard identification

According to ICAO (2018), a hazard can be considered as a dormant potential for harm, which is present in one form or another within the system or its environment. Therefore, hazard identification is the first step in the safety risk management process. The intention is to proactively identify hazards before they lead to accidents, incidents, or other safety‑related occurrences. Hazard identification may also consider hazards that are generated outside of the organisation and outside their direct control, such as weather (ICAO, 2018).

The COM stated that ‘Coulson acknowledges that a certain element of risk exists in all aspects of its business’ and that ‘the implementation of a comprehensive safety system can greatly assist in reducing risk’. As part of their fatigue risk management system, the COM outlined the potential hazards crews may encounter in all types of operations (Table 3).

Table 3: Some hazards identified in the Company Operations Manual

In addition to the hazards identified above, the ATSB’s review of the COM found numerous references to other hazards. The fire-bombing procedures made references to factors such as prevailing winds (particularly with mountain flying), turbulence and downdrafts associated with either mountain or fire generated conditions, and visibility. Further, the training and checking, and standard operating procedures sections for fixed-wing aircraft also referred to windshear.

Hazards are detectable through many sources including reporting systems, inspections, audits, brainstorming sessions, and expert judgement. These sources are categorised as being either formal or informal methods and can be used to detect hazards at all levels of an organisation. The operator’s SMS used both informal and formal methods for hazard identification. This included a safety reporting system where all employees were encouraged to report issues, hazards and incidents that affected flight or ground safety. Further, the operator had a daily SMS conference call at the start of the day, which discussed the previous days operations, and the operations to be conducted that day. Present on the call were senior management, the safety manager, and the crew. They would discuss the current status of the crew and aircraft, any reported issues, and would often end with a relevant safety message or topical discussion. On 10 July 2022, in response to the draft report, the operator reported that this process allowed the group to tactically manage the risks in a dynamic environment providing an opportunity to discuss actual or emerging hazards and risks in an open and supportive environment.

Safety reporting system and daily SMS calls

The operator’s safety reports for the period 2019 and 2020^[84] were provided to the ATSB. A review of these 32 reports found that around 60% were related to maintenance issues, while only 9% were operationally focused. These operational events included aircraft separation issues and retardant overload events. While previous years’ data was unavailable, the operator had conducted yearly SMS reviews, and these summaries were provided for the earlier period. Although the individual reports were not available, based on these summaries, it was likely the previous years’ safety reports followed a similar reporting pattern, with a majority being maintenance related.

During the investigation, several of the operator’s crew provided the ATSB with accounts of previous windshear encounters they had experienced:

• In the previous firefighting season, while conducting structure protection, they encountered a windshear event, which resulted in an uncommanded bank angle of 80°. The crew recovered the situation by flying the planned exit into an area of lower terrain (valley).
• In the season of the accident, while climbing out after completing a drop, the airspeed fluctuated ‘quite a bit’ (10 kt) and the aircraft sank slightly, while being ‘tossed around’. This was while working with the birddog. After this encounter, the decision was made not to return to the drop area.
• On the day of the accident, the crew of B137 received a windshear warning and uncommanded bank angles up to 45° in the Adaminaby area.^[85]

These encounters were not recorded in the operator’s safety reporting system, nor were any other weather-related incidents found in the reports provided to the ATSB. Neither the former^[86] nor current safety manager recalled any such reports in the system. At interview, one pilot reported that the online SMS program was used for issues that were considered applicable across the company. Issues that could be resolved within the small group of fixed-wing pilots, or could be taken directly to the chief pilot, noting they spoke on a daily basis, would not necessarily be included in the system.

In addition, the ATSB reviewed the daily SMS call notes from 2018 to 2020. While limited in detail, the topics most frequently discussed were maintenance issues. In the days preceding the accident, the hot and severe weather conditions were noted. These were the only occasions where the weather conditions were noted in the calls. In response to the draft report, the operator advised that they considered the incident reporting numbers discussed above were mitigated by the daily SMS calls’ impact on flight risk awareness.

Risk assessment

A risk assessment is a process where sources of potential harm (hazards) and the chances of an adverse event happening due to the hazard were identified, analysed, and evaluated (CASA, 2021). This evaluation was expressed in terms of likelihood and consequence, and should highlight the risks to be considered before and while carrying out an operation.

Organisations should have multiple layers of controls or defences in place (CASA, 2014) to manage their identified hazards. Risk assessments should be carried out across all levels of an organisation and at different stages in the operation. These could consist of a formal, documented process or a continuous ongoing mental assessment carried out by a pilot, or a combination of both. Examples of a formal risk assessment may include an operational risk assessment conducted by the operator to consider and evaluate the risks associated with the type of work being undertaken, and pre-flight risk assessments, conducted by the PIC and associated with a specific tasking. An example of continuous processes could include in-flight tactical^[87] risk assessments.^[88]

The operator’s SMS manual stated that, if a risk assessment was required, the SMS manager would conduct and document the process by completing the risk management worksheet. The associated risk matrix categorised the risk as either acceptable, mitigable or unacceptable, although there was no guidance on how to categorise the risk. These risk assessments only applied to the safety reports and change management processes that were captured in the operator’s online SMS program. At interview, both the former and current safety managers indicated there was no formal risk assessments conducted on the identified operational hazards, such as those listed in the COM.

Prior to the accident, the operator had voluntarily initiated the International Standard for Business Aircraft Operations audit phase II,^[89] which was conducted between December 2019 and March 2020. This audit identified significant growth since the stage 1 audit completed in 2017, and that the SMS had not fully matured to be as effective as it could be. Of note, it identified that the operator could not provide a process for assessing risk potential in terms of likelihood and severity.

After the safety risks have been assessed, the appropriate risk controls can be implemented. ICAO (2018) noted that:

It is important to involve the “end users” and subject matter experts in determining appropriate safety risk controls. Ensuring the right people are involved will maximize the practicality of safety risk chosen mitigations. A determination of any unintended consequences, particularly the introduction of new hazards, should be made prior to the implementation of any safety risk controls.

In response to the draft report, Coulson Aviation stated that aerial firefighting was conducted within an ‘unforgiving, dynamic, and complex operational and meteorological environment’. Consequently, they considered aerial firefighting lends itself to a more tactical approach to risk identification and mitigation.

Risk register

Safety risk management activities should be documented, including any assumptions underlying the probability and severity assessment, decisions made, and risk controls implemented (ICAO, 2018). A tool such as a risk register could be used to ensure identified hazards were tracked and mitigated as part of a formal risk management process of prioritisation, documentation, and assessment. The register could include the hazard, potential consequences, assessment of the associated risks, and any controls put in place to manage the risk. This not only allowed for ongoing tracking and monitoring of the identified hazards, but also (ICAO, 2018):

…becomes a historical source of organizational safety knowledge which can be used as reference when making safety decisions and for safety information exchange. This safety knowledge provides material for safety trend analyses and safety training and communication. It is also useful for internal audits to assess whether safety risk controls and actions have been implemented and are effective.

At the time of the accident, the operator did not maintain a risk register, or any alternate means to track the identified hazards and associated controls, as part of their SMS.

Assessing pre-flight risk

Flight risk assessment tool

Aerial firefighting activities, like other aerial work operations, are subject to elevated risks. A 2014 National Transportation Safety Board study of agricultural (aerial work) accidents in the US found the following:

…the mission priorities…present pilots with unique hazards, challenges and constraints, some of which cannot be completely eliminated. For example, pilots must manoeuvre their aircraft at very low altitude over terrain and must therefore accept an elevated risk of terrain and obstacle collisions, as well as having limited time to safely respond to an aircraft mechanical anomaly or recover from an inadvertent aerodynamic stall.

Risk management is a decision-making process by which pilots can systematically identify hazards, assess the degree of risk, and determine the best course of action. Effective risk management involves good decision-making that allows a pilot to identify personal attitudes that are hazardous to safe flying, apply behavioural modification techniques, recognize and cope with stress, and effectively use all resources. Risk management strategies can help pilots apply a systematic process that can help them resist pressures that can adversely affect their decision-making and performance and can help them mitigate other hazards that could adversely affect the safety of flight.

The study also concluded that risk management guidelines and best practices specific to agricultural aircraft operations were necessary tools to help operators and pilots mitigate the unique risks associated with their operations. In addition to the safety risk management processes discussed above, another such tool was a flight risk assessment tool (FRAT). In 2016, the FAA Safety Team released their FRAT with the introduction:

When implementing a Safety Management System (SMS), one of the most critical components to develop is a Flight Risk Assessment Tool (FRAT). Because every flight has some level of risk, it is critical that pilots are able to differentiate, in advance, between a low-risk flight and a high risk flight, and then establish a review process and develop risk mitigation strategies. A FRAT enables proactive hazard identification, is easy to use, and can visually depict risk. It is an invaluable tool in helping pilots make better go/no-go decisions and should be a part of every flight.

This was consistent with the USFS 2016 National Aviation Safety Management System Guide, which stated that:

Every flight has hazards and some level of risk associated with it. It is critical that management and pilots are able to differentiate, in advance, between a low-risk flight and a high-risk flight using a risk assessment tool that allows pilots, managers and dispatchers to see the risk profile of a flight in its planning stages. When the risk for a flight exceeds the defined acceptable level, the flight will be further evaluated and risk decisions made by appropriate leadership.

The USFS (Forest Service Manual: Aviation Management Handbook) also recognised that risk management was a critical component of their SMS, and the identification of new hazards, determination of risk levels and effectiveness of mitigations ‘must be collaborated’ from the local level to aviation staff in their headquarters. Noting this, they discussed the different types of risk assessments, which included a ‘time critical risk assessment’:

Time critical risk assessment is the tool that pilots and managers use to assess actual risks specific to the day of flight. The product representing a time critical risk assessment is a Flight Risk Assessment Tool (FRAT)… While completing a FRAT, if an emerging hazard or higher than expected risk level is identified, the Aviation Manager (for example a helicopter manager, flight manager, project aviation manager, pilot in command), must follow up with the appropriate management level before a mission commences.

A FRAT was an efficient and structured process that allowed for a consistent and objective evaluation of flight risks, and could be adapted to manage the unique risks present for a specific operation or tasking. The tool established the risk profile for an individual flight and prompted the pilot or operator to take appropriate mitigation actions. It also allowed for better visibility by the operator, as to crew decisions made in accepting or rejecting tasks. However, it should be noted that a FRAT cannot anticipate all the hazards and corresponding risks that may emerge during a flight.

The FRAT could incorporate factors relating to the crew, such as operational experience and fatigue; environmental conditions, both at the airport and en route; aircraft factors, such as equipment serviceability; and any external pressures or factors, such as task rejection by another pilot or operator. Each of these factors was then assigned a numerical risk value and a total risk score was calculated. Based on this score, the risk profile was determined using predefined criteria for acceptable levels of risk, elevated levels of risk that required mitigation such as escalation to a more senior pilot, or task rejection.

The operator’s COM acknowledged the risks associated with their operations, stating ‘the combination of terrain, weather, fire occurrence patterns, and visibility can make firebombing extremely challenging’. The COM also required their rotary-wing pilots conducting firefighting activities using night vision goggles to complete a pre-flight risk assessment. However, the operator relied on the LAT crews to conduct their normal pre-flight planning and make their own assessment of the suitability of a tasking, without the need for a formal pre‑flight risk assessment. The former safety manager also confirmed that, while the LAT operation was considered high risk, there was no FRAT available for the crews.

Accident flight estimated risk profile

Following the change in safety managers in 2020, the operator introduced a FRAT into their LAT operations, with the criteria for an acceptable level of risk (score <30), a level of risk that required mitigation or escalation (30–39), and a ‘no-go’ level of risk (40+). Using this tool, the ATSB calculated a score within the range that required mitigation or escalation for the accident flight. However, the ATSB noted that the FRAT did not consider factors such as a weather‑related task rejection by another pilot, in this case, by the birddog pilot. Task rejection was a potential risk indicator for a FRAT, as explained in the US FAA advisory circular 135-14B for helicopter air ambulance operators:

Declined HAA [helicopter air ambulance] Flight Requests. The operator must establish a procedure for determining whether another HAA operator has declined the flight request under consideration and if so, for what reason (weather, maintenance, etc.). If applicable, the reason for the declined flight must be factored into the required risk assessment process, i.e., do not include a declined flight due to a maintenance issue or pilot not available. This could be as simple as asking the requestor whether or not this specific flight request has previously been made and declined and why. 

Similarly, the Helicopter Association International’s FRAT tool included the risk factor of ‘Flight Turned Down By Other Operators Due to Weather’, which had the highest risk score of all the example factors.

Civil Aviation Safety Authority

When operating in Australia, Coulson Aviation aircraft were operated under a short-term air operator certificate authorisation issued by CASA, involving the use of foreign aircraft under relevant legislation and national aviation authorities. The certificate permitted aerial work including aerial spotting (fire and flood), dropping (water and fire retardant), and other activities such as search and rescue and surveillance.

As part of this process, CASA required Coulson to have a Company Operations Manual (COM) for Australian operations. CASA required Coulson Aviation to comply with their COM, which included reference to the FAA approved AFM. In these circumstances, CASA relies on the FAA approval process, and has no role in reviewing the AFM.

CASA had conducted 5 surveillance events in the past 5 years across 3 different short-term AOCs for this operator. All events were level 2^[90] operational checks and no safety findings were raised. No CASA surveillance events were performed on Coulson during the 2019-2020 firefighting season. The short-term AOCs were not included in CASA’s national surveillance selection process, and therefore no level 1^[91] surveillance activities were conducted.

New South Wales Rural Fire Service

General

The NSW Rural Fire Service (RFS) was the lead combat agency for bushfires in NSW. They worked closely with other agencies to respond to a range of emergencies including bush and grass fires, bushfire mitigation, structure fires, search and rescue, motor vehicle accidents, and storms that occurred within rural fire districts. The RFS was primarily made up of volunteers, with paid staff members managing day-to-day operations, Fire Control Centres (FCCs), and operational support, among other roles. There were many roles involved in the RFS emergency management response; for simplicity, only those roles applicable on the day of the accident are discussed below.

The multiagency state-wide response to large bushfire emergencies were overseen and coordinated by the State Operations Centre, located at NSW RFS Headquarters in Sydney Olympic Park (Sydney). The State Operations Centre provided a variety of specialised resources to the FCCs, including but not limited to, aviation resources. The state operations controller (SOC), located in the State Operations Centre, maintained an overall awareness of the firefighting effort across the state, and ensured resources were allocated as needed. The State Operations Centre also contained the state air desk (SAD), which was the state level multiagency team responsible for coordination of aircraft operations.

FCCs were the administrative and operational base of each rural fire district or zone. The coordination and management of local brigade responses to fires and other incidents was undertaken through the incident management team, led by the incident controller. For each emergency response, an incident controller was responsible for that response, including the objectives, operations, and application of resources. Where necessary, an aviation unit was established to manage and support deployment of aviation resources within the rural district, including an aviation radio operator (ARO).

The LATs were based at an airbase overseen by an airbase manager (ABM). The ABM was responsible for the supervision and coordination of airbase personnel and the layout and operation of the airbase. They operated as a liaison for the RFS SAD, and could be from another organisation.

Aircraft management procedures

The RFS maintained a suite of documents, which detailed the procedures for managing aerial firefighting. The 2 primary documents for air tanker operations were the NSW and ACT Aviation Standard Operating Procedures (operating procedures), which outlined the basic procedure of all air tanker operations, and the Operating guidelines for air tanker operations (operating guidelines), which provided further details specifically for the LAT program.^[92] The preface to the operating procedures stated it was ‘produced to assist all members…in the safe, efficient, and effective management and use of aircraft for operational purposes’. This should be read in conjunction with other relevant documents, ‘which may contain more comprehensive information, specification and overarching operational and incident management procedures’. Additional procedures and forms were contained in the Operational management procedures and Incident management procedures.

While the RFS were responsible for coordinating aircraft and conducted training on various aviation aspects, they did not claim to be aviation experts. Therefore, it was possible that the frontline staff may have had a limited understanding of the operational capabilities and constraints for the varied aircraft used. The ATSB noted that there was limited information contained in any documentation provided to the frontline staff regarding the capabilities and constraints of each aircraft type within the LAT category. Where a LAT was requested by an incident management team, the asset was selected based on availability, location, and response time, rather than aircraft type. There was no distinction of capability between LAT aircraft types aside from information related to tank capacity, delivery system, and cruise capability. It did not contain any performance capability information related to operating conditions. However, the documents acknowledged that, ‘it is essential that all personnel seek specialist advice when planning or conducting air operations’. It also stated that ‘any agency members, contractors or air crew may decline to carry out tasks for which they are unfamiliar, unprepared or consider unsafe’.

On 1 June 2022, in response to the draft report, the RFS acknowledged that aerial ‘operations are risky, made more so as weather conditions deteriorated. However, when assessing tasking decisions, the RFS must balance this against the risk posed by fire to civilians and [ground] fire fighters… with the ability of aerial operations to achieve far greater gain’ than ground-based firefighting. Further, they considered that the tasking of large air tankers ‘may be sufficiently safe in circumstances that were not necessarily safe for other aircraft.’ They also indicated that ‘B134 had greater flight capability than other aircraft’ used by the RFS and was able to make a different assessment of risk. ‘Therefore, conditions that may have been unsafe for other aircraft, including B137, may not have been so for B134.’

Aerial supervision

The air attack supervisor (AAS) was a tactical command position, which ensured that aerial operations were consistent with the procedures and incident controller’s intent. This included maintaining communications with relevant incident management team personnel, and coordinating ground and air communications to achieve these objectives.

An incident AAS would be in an independent local aircraft overseeing the fire-ground, responsible for coordinating the aviation assets over an incident. They were responsible for coordinating the smaller aircraft and overall strategy, and in place when there were 3 or more aircraft operating on an incident. When LATs were involved, the incident AAS would normally communicate to another AAS onboard the birddog aircraft (LAT AAS).

A LAT AAS was located in the birddog aircraft, and coordinated the LAT movement with the incident AAS. Their role included briefing the LAT crew on the specific assignment, identify hazards, tactics and manage communications with the incident AAS. In practice, the LAT AAS established contact with the assigned LAT crews as they approached the relevant fire-ground to provide this information.

Requirements

When discussing aerial supervision for air tanker firefighting operations, the RFS operating procedures stated the following requirements:

Generally, Air Tanker Suppression operations, training flights and evaluation flights should not be undertaken without the supervision of an authorised AAS [air attack supervisor]. The AAS provides tactical aircraft coordination with the Incident AAS and/or IMT [incident management team] and directs the firebombing aircraft to critical areas of a fire for suppressant or retardant drops.

The only exception to the above may be in the event that an Air Tanker has an ‘initial’ attack’ certified crew on board who understand the mission requirements, Agency Air Tanker Procedures and there are operational advantages to the LAT commencing operations prior to an AAS arriving.

Operational advantages, while not defined or outlined in any documentation, were described at interview as including aspects such as the faster LAT transit times,^[93] when a birddog was not available due to resourcing constraints, or a crew specific concern such as fatigue or exceeded duty times. There were no further requirements or considerations in either the operating procedures or guidelines regarding aerial supervision for LATs, or its use when an AAS was not available due to an operational safety concern. It was also noted that there was no policy, procedure or guidance identified in the provided documentation for tasking air tankers with initial attack certified crew in the case where a birddog pilot, and therefore the associated AAS, had rejected the tasking.

On 1 June 2022, in response to the draft report, the RFS advised that it was always their intention to send a birddog when possible. However, due to the constantly changing circumstances on the day, this was not possible to do. The decision to deploy the LATs without the birddog was based on an evaluation of the available information at the time and the unavailability of the birddog. In addition, the RFS stated that prohibiting LATs from operating if a birddog had not assessed the conditions, or if it was considered unsafe for smaller aircraft to operate would have severe impacts on firefighting operations across the state, and the resultant safety of people and property on the ground.

Initial attack certification recognition

The ATSB was unable to find a definition for the term ‘initial attack certified’ within the RFS documentation and sought clarification from the RFS. The RFS advised that it was their intention to recognise the initial attack certification endorsed by the US Forest Service (USFS). Broadly, this certification required a minimum flight time as a PIC in the specified aircraft type; a minimum flight time conducting low-level retardant drops; ground school training on relevant aspects such as hazard identification, ingress and egress strategies, and communications; and the satisfactory completion of 25 supervised drops.

In addition, the RFS advised that they did not maintain a register of initial attack certified pilots, and did not confirm the crew were initial attack certified when issuing the tasking. Rather, they relied on the individual aircraft operators for ensuring pilots held and maintained the necessary licences and certification. When the ATSB discussed the initial attack certification with Coulson Aviation, they also noted that this had not been defined by the RFS. Therefore, they utilised their own internal training framework to determine when a PIC was capable of operating without aerial supervision. One such example cited was the PIC of the Boeing 737 (B137) who had received the requisite internal training, but had not yet completed the required number of supervised drops to gain the USFS certification.

Tasking large air tankers

The operating procedures, and more so the operating guidelines, detailed the process for the tasking and mission management of air tankers. This included what aspects were to be considered when tasking an air tanker, the request and approval process, and dispatch. The ATSB noted that some functions during this process could be completed by multiple RFS positions. However, for simplicity, only those roles applicable on the day of the accident are discussed below.

Considerations and request

The operating procedures noted that air tankers could provide large volumes of suppressant, and careful planning and supervision was needed to ensure this was used effectively. The first step involved the incident controller (incident management team in the FCC) advising the intent to consider a tanker to the SAD, and outlining a strategy in conjunction with the SAD who could provide ‘guidance on availability and suitability’.

When considering tasking air tankers, the operating procedures stated the incident controller was to consider the following:

• incident objectives
• threats (life/property, assets, forests)
• a proposed strategy
• prevailing and/or forecast weather conditions
• the likely period of deployment or loads [suppressant/retardant] required
• the terrain and fuel (grass, urban, forest) type
• possible risks and safety issues
• time of day (last light considerations)
• the mission alternatives.

A similar list of considerations was also included in the operating guidelines (for both air tanker and birddog taskings), with the addition of the elapsed time for the aircraft to arrive onsite. The operating guidelines stated that these considerations were a ‘risk assessment’. However, there was no further guidance on assessing each of these considerations.

Approval

The SAD would then brief the SOC. The SAD would provide advice on the availability, competing priorities, strategies, and load requirements for the LAT. The SOC then decided on the mission approval. Following that approval, the SAD would advise the LAT airbase manager (ABM) of the approval and mission objectives.

In this case, the Cooma incident controller did not request the tasking of the LATs. Rather, the decision to task a LAT was determined during the 1100 conference call discussing the fire situation at Adaminaby with senior personnel from the State Operations Centre (which included the RFS Commissioner and Deputy Commissioner). On that 3.5-minute conference call, while aware that the smaller fire-control aircraft were not flying due to the weather conditions, it was decided to send the LATs. They were unsure if a birddog had been launched to assess the conditions due to the known visibility and weather conditions, but determined that rather than wait for the birddog assessment, they could send a LAT ‘as it can bomb by itself if need be, if the opportunity presents’. The tasking decision was then communicated to the SAD, who then communicated the tasking for B137, B134, and the birddog from Richmond airbase to the Richmond ABM.

While the tasking on the day did not follow the RFS procedure outlined above, it was very likely that the LATs and birddog would have still been tasked if the above procedures had been followed.

Dispatch

The LAT ABM then conducted a pre-mission briefing with the crew, providing the required tasking details. The RFS operating guidelines indicated that these details would include, at a minimum, the latitude and longitude, a geographic location (referencing a map or chart), the incident air attack supervisor’s contact details, communication details for the incident controller radio channel and fire location’s common traffic advisory frequency, information on any aircraft working in the same location, and the type of load product.  

Generally, the birddog with an aerial attack supervisor would arrive at the fire-ground ahead of the LATs. Given that the smaller birddog aircraft would generally fly slower than a LAT, it was common for the birddog to depart before the LATs. However, where there was an urgency to dispatch aircraft due to the rapid spread or the impending impact of the fire, and the crew were appropriately certified, it was standard practice to launch the LATs at the same time, or ahead of, tasking the associated birddog.

Re-tasking   

Generally, re-tasking would be managed through the SAD in consultation with the incident management team and the LAT AAS, noting that the LAT crew would take on the AAS role when flying initial attack operations. On the day of the accident, the re‑tasking from the Adaminaby fire‑ground to the Good Good fire-ground was managed by the Cooma incident management team, who were in direct contact with the crew via the Cooma aviation radio operator (ARO). This re-tasking was considered within scope, as both fires were being managed by the Cooma team, and therefore, they could direct the crew as necessary at the local level.

Task rejections

The ATSB were provided with an example of a previous occasion where a task was stopped in‑flight, while operating in Australia. In that case, an aircraft had a number of warnings activated, and the crew elected not to continue. This decision was communicated among the other crews involved in the tasking, who were in continual contact with each other, and the task was subsequently stopped by the AAS.

For the tasking related to the accident, a task rejection had been made on the ground by the birddog pilot (due to weather-related safety concerns) and no communication had been established with other crews. The birddog pilot reported that they had not conveyed the decision to the crew of B134, but expected the RFS personnel would relay this information in their continued coordination of the tasking, or cancel the tasking.

A review of the available radio recordings provided by the RFS found no evidence to indicate that the birddog pilot’s rejection of the tasking had been communicated to the LAT crews (B134 and B137) by either the Richmond ABM or the SAD. In addition, the Cooma ARO, who could reasonably be expected to be in contact with the crews, reported that they were not aware of the birddog rejection. However, it was noted that not all radio communications were recorded.

At interview, mixed responses were received from pilots regarding their expectations on task rejections. All were consistent in that, there was a need to be informed of, and the reason for, the rejection decision, so this could be factored into their decision-making, in line with their company policies and procedures. Others stated that a weather-related rejection should result in cancellation of the tasking. The operator indicated that while a birddog can provide valuable risk mitigations, when the PIC is initial attack trained, they do not consider it to be a requirement. However, for a tasking without the birddog, the reason for this would need to be factored into the PIC’s pre-flight planning.

In addition, the birddog pilot had also reported that, after making the decision to reject the tasking based on the weather conditions, an air attack supervisor had advised them that the smaller fire‑control aircraft had earlier ceased operations due the wind conditions. The birddog pilot further stated that this information was generally not passed on to the pilots by the RFS.

The ATSB reviewed the available RFS documentation and procedures. No policy or procedure was in place to support the ABM or SAD’s management and communication of a task rejection by any of the crews operating in the tasking area that day or involved in the task.

In response to the draft report, the RFS stated they were of the view that ultimate responsibility for assessing risk, and accepting or rejecting a task, was the responsibility of the PIC. For the RFS to make such assessments on behalf of the PIC would constitute a shift in RFS responsibility.

United States firefighting practices

For comparison, the ATSB reviewed the aerial firefighting practices currently in place in the US. This was particularly relevant as many of the LAT operators worked in both the US and Australia, and the NSW RFS reviewed the practices from the US Department of Agriculture, Forest Service (USFS) when implementing their current LAT program.

Task rejections

The USFS placed a significant focus on managing risk exposure. They outlined their safety expectations in a statement of intent, placing emphasis on implementing:

…strategies and tactics that commit responders only to operations where and when they can be successful…[and that] understanding and acceptance that intense fire behaviour may mean we can’t protect values at risk under all circumstances…this direction also requires greater focus on identification of unnecessary exposure.

These expectations were then supported in the USFS Forest Service Manual – Aviation Management Handbook, which included the following statement:

Pilots and aviation users are expected to make sound decisions, including cancelling a flight, when conditions or circumstances may cause undue risk…

Forest Service employees perform challenging work in very high-risk and dynamic environments that are not always predictable. This responsibility can only be realized through participation of every employee. Safety is the first priority, and leadership at all levels must foster a culture that encourages employees to communicate unsafe conditions, policies, or acts that could lead to accidents without fear of reprisal...

The USFS 2019 Standards for Airtanker Operations detailed the processes and procedures to be followed by staff, supervisors, specialists, and managers when planning, administering and conducting airtanker operations. When discussing aviation safety, one aspect considered was task rejections or a ‘turn down’. Notably, the document stated:

Every individual (government and contracted employees) has the right and obligation to report safety problems affecting his or her safety and has the right to contribute ideas to correct the hazard. In return, supervisors are expected to give these concerns and ideas serious consideration. When an individual feels an assignment is unsafe, he or she also has the obligation to identify, to the degree possible, safe alternatives for completing that assignment. Turning down an assignment is one possible outcome of managing risk.

A “turn down” is a situation where an individual has determined he or she cannot undertake an assignment as given and is unable to negotiate an alternative solution. The turn down of an assignment must be based on assessment of risks and the ability of the individual or organization to control or mitigate those risks. Individuals may turn down an assignment because of safety reasons…

The standards further indicated that those individuals who turned down a task were to directly advise their supervisor. That supervisor would then communicate this information to others associated with the management of fire control activities. In addition, when a tasking had been turned down and the supervisor then asked another individual (resource) to perform the task:

…he or she [the supervisor] is responsible to inform the new resource that the assignment had been turned down and the reasons why. Furthermore, personnel need to realize that a “turn down” does not stop the completion of the assigned operation. The “turn down” protocol is an integral element that improves the effective management of risk, for it provides timely identification of hazards within the chain of command, raises risk awareness for both leaders and subordinates, and promotes accountability.

Proper handling of turn downs provides accountability for decisions and initiates communication of safety concerns within the incident organization.

Task rejections, including those related to weather, was also recognised within the Alaskan USFS Forest Service Handbook – Flight Operations Handbook: 33.1 - Forest Service Flight Operations, as follows:

If a flight is cancelled or refused by one operator or pilot because of weather or other operating conditions, the flight will be postponed until the weather improves. Forest Service employees shall not “shop” for an operator that will make the trip when another operator has refused.

Aerial supervision

The USFS Standards for Airtanker Operations outlined the circumstances and minimum supervision required based on the following situations:

• number of aircraft assigned to an incident
• drops conducted in high traffic areas
• low light conditions
• use of the modular airborne firefighting system or very large air tankers
• airtanker flight crews not initial attack carded
• combination of different types of aircraft operating simultaneously
• use of foreign aircraft
• periods of marginal weather, poor visibility or turbulence
• night operations
• if requested by the airtanker, birddog or others involved.

It also noted that initial attack certified pilots were authorised to drop retardant without the supervision of a birddog and/or AAS. However, the standard stated that:

Aerial supervision resources must be launched together with the airtanker on the initial order to maximize safety, effectiveness, and efficiency of incident operations. Incidents with 3 or more aircraft over/assigned will have aerial supervision over/assigned the incident.

Likewise, The US National Wildfire Coordinating Group^[94] document, Standards for Aerial Supervision, stated that ‘a safe aviation operation depends on accurate risk assessment and informed decision making’. It further indicated that, often, incident response flights were conducted under adverse flight conditions, and this complexity dictated the level of supervision required to conduct aerial operations safely and effectively. While noting factors similar to those listed above, it outlined:

There is no way to define an exact trigger point for adjusting, downsizing, or completely suspending aviation operations. The factors listed below [similar to those listed above] should be evaluated to determine whether additional Aerial Supervision resources are needed, or tactical/logistical missions need to be modified/suspended.

The standard further stated that, in some cases, the aerial supervisor would be required to shut down or suspend operations. In this case, ‘air operations must not proceed until risk mitigations are in place’.

Flight risk assessment tool

When considering aviation safety, the USFS 2019 Standards for Airtanker Operations, stated that a FRAT was required for every flight conducted for the USFS. They also recommended that a FRAT sheet be used when planning a mission and that this should be updated as necessary. The tool, provided as an appendix to the standards, contained the following note:

Because the overall cumulative score is a composite of individual flight, environmental, and operational values, it may not fully emphasize a heightened level of risk that may be associated with an individual category. For example, extremely adverse weather in itself, exclusive of the other categories, may alone merit the suspension of operations. Conditions also change over time and distance, therefore, this tool should be used periodically throughout a mission as conditions change to assure that individual or overall risks have not measurably increased.

Lessons learnt from aerial campaign management

In response to 3 accidents involving helicopters undertaking locust control operations in 2004, the ATSB commenced a research investigation (B2004/0337) into the practices used by Government organisations to contract aerial operators. While focused on locust control, the report findings were also applicable to fire control, other pest management, and emergency service operations. Collectively referred to as ‘aerial campaigns’, these types of operations were generally conducted in relatively hazardous environments that also had the potential to be high-risk environments characterised by:

• a significant community need for the operation, possibly urgent
• requiring the coordination of significant numbers of resources and organisations
• a degree of irregularity or unpredictability as to when the operation will be required and the size the operation
• requiring aerial operations with a relatively high hazard level
• a regularly changing operational environment throughout the course of the campaign.

The report identified that organisations that contracted aerial operators were directly involved in the management of significant parts of the aerial campaign, such as assigning tasks and briefing pilots. Therefore, decisions made in the management process had the capacity to influence the level of risk of the operations. If safety was to be maintained, that capacity had to be monitored and managed: leaving responsibility for safety to another party that was not managing the overall campaign would not be effective.

In addition, the organisational complexity of aerial campaigns and the subsequent coordination effort required may lead to a diffusion of responsibility among the parties involved. This complexity was further increased when staff from different organisations were working together towards a joint outcome.

The report concluded that, while the aerial component of the operation was provided by an aerial contractor, the campaign control organisation was in a central position to understand the big picture. The adoption of good systems for managing risk by the contracting organisation could provide an effective additional layer of defences over and above that provided by each operator to protect against an incident or accident. An effective overall management system could ensure that no one aspect of the operation compromised another aspect.

Similar occurrences

This accident was the first occurrence of a collision with terrain involving a LAT in Australia. However, the ATSB identified another C-130H firefighting weather‑related accident, and a windshear encounter during firefighting operations in the US where the retardant was not jettisoned. A summary of these reports is provided below.

US Air Force Aircraft Accident Investigation Board investigation

On 1 July 2012, the crew of a US Air Force Lockheed Martin C-130H aircraft was conducting wildland firefighting operations near Edgemont, South Dakota, US. While following a lead aircraft (birddog) and positioning for a fire-retardant drop, both aircraft encountered a microburst.

The pilot of the lead aircraft conducted a ‘show me’ run,^[95] and shortly after, the crew of the C-130 established a 0.5 NM (1 km) trail formation for the first drop. About 7 minutes later, while setting up for the second drop, the C-130 was in about a 1 NM (1.9 km) trail formation when the lead aircraft hit a ‘bad sinker’, resulting in a loss of altitude and airspeed. The lead aircraft came within 10 ft of the ground, and the pilot called ‘I got to go around’. One second later, the C-130 crew also elected to go-around, and 16 seconds after, they called ‘E-dump, E-dump’. Despite completing an emergency dump of the remaining retardant, the C-130 collided with terrain shortly after, fatally injuring 4 crew and seriously injuring 2 crew.

The investigation found that an inadequate assessment of the operational conditions resulted in the aircraft impacting the ground after flying into a microburst. In addition, it was established that there was a failure to communicate critical operational information from the lead aircraft and air attack crew to the C-130 crew, and there was conflicting guidance concerning thunderstorm avoidance.

SAFECOM report

The USFS and Department of the Interior maintained an aviation safety reporting system as part of its safety program and published a yearly safety summary. On average, it was noted there were about 8 weather-related events reported in the database yearly, with an incident of significance to this investigation described below.

On 17 June 2017, the flight crew of a British Aerospace BAe-146 aircraft were conducting firefighting operations in northern New Mexico, US. The pilot reported that, during a fire-retardant drop, they experienced significant ‘down air’, which resulted in them coming close to terrain. While slowing the aircraft through 130 kt when about 500 ft above the planned drop height, ‘the bottom fell out’ resulting in a loss of about 10 kt airspeed and 300 ft altitude. The pilot applied engine power and manoeuvred the aircraft toward lower terrain, but they did not achieve the expected climb performance and passed just above the tree line. The pilot indicated that the event took less than 10 seconds, and while they should have jettisoned the load in hindsight, they did not consider this at the time as they were focused on flying the escape manoeuvre.

________

29.  
    29. MAFFS were portable fire-retardant delivery systems that could be inserted in C-130 aircraft without major structural modifications to convert them to air tankers when needed.
    30. When operating in the US as an air tanker, the aircraft was considered a public use asset, and the US Department of Agriculture Forest Service assumed the regulatory role, and defined and issued initial attack qualifications.
    31. This was the operator’s spring training period in preparation for the North American fire season.
    32. Aerodynamic stall: occurs when airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically 16˚ to 18˚, and results in reduced lift.
    33. Although the emergency condition for the jettison was a simulated scenario, the pilot was still required to perform a live jettison of the load (water) in this training sequence.
    34. Restricted category in this instance referred to an aircraft type that had been manufactured in accordance with the requirements of, and accepted for use by, an Armed Force of the US and was later modified for a special purpose. It becomes a restricted category aircraft on entry to the civilian register.
    35. Coverage factor refers to the amount of retardant released over a specified area. The higher the coverage factor, the larger amount of retardant dropped in the specified area.
    36. A minimum equipment list is a list that identifies items, subject to specific conditions, which may have been unserviceable at the commencement of a flight, and is approved by the FAA.
    37. The operational load monitoring system transmitted various parameters in-flight, including the status of the RADS tank at the start and completion of the drop. The system was introduced to monitor the actual structural loads in the firefighting operational environment, and therefore to better manage the maintenance regime and monitor the structural elements of the aircraft. It was introduced after multiple in-flight break ups of firefighting aircraft.
    38. The load factor is the ratio of the normal acceleration to the acceleration due to gravity. All else being equal, this is equivalent to the ratio of the lift to the weight.
    39. Approach to stall training is conducted for pilots to recognise the incipient stall symptoms. Fully developed stall training was not practically trained in the aircraft due to the significant height loss and potential unusual attitudes when the C 130 entered a stall.
    40. The COM was developed to contain the procedures, instructions and information required by CASA for the conduct of operations for all the operator’s aircraft in Australia.
    41. The clean configuration refers to 0 flap and gear retracted, take-off refers to 50% flap and landing gear down, landing configuration refers to 100% flap and landing gear down.
    42. Indicated airspeed is the airspeed read directly from the airspeed indicator in the cockpit. This speed is an important value for the pilot as it is the indicated airspeeds that are specified in the AFM for important performance information such as stall speeds.
    43. G load: the nominal value for acceleration. In flight, g load represents the combined effects of flight manoeuvring loads and turbulence and can have a positive or negative value
    44. This was consistent with the limitations published by the original manufacturer.
    45. Mountain waves form above and downwind of topographic barriers when strong winds blow with a significant vector component perpendicular to the barrier in a stable environment. If air is being forced over terrain, it will move downward along the lee slopes, then oscillate in a series of waves as it moves downstream, sometimes propagating long distances downwind.
    46. Significant meteorological information (SIGMET): a weather advisory service that provides the location, extent, expected movement and change in intensity of potentially hazardous (significant) or extreme meteorological conditions that are dangerous to most aircraft, such as thunderstorms or severe turbulence.
    47. Severe turbulence can result in large abrupt changes to an aircraft’s attitude and/or altitude, and potentially a momentary loss of control..
    48. The Cooma-Snowy Mountains Airport has an elevation of 3,106 ft AMSL.
    49. PROB30 means 30 per cent chance of forecast conditions occurring.
    50. Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – broken indicates that more than half to almost all the sky is covered.
    51. QNH: the altimeter barometric pressure subscale setting used to indicate the height above mean sea level.
    52. This was the average and peak speed recorded for the previous 10 minutes.
    53. Also known as lee wave or standing wave systems.
    54. Other publications may cite higher values up to 25 kt.
    55. Formed in 2013, the Bushfire and Natural Hazards Cooperative Research Centre is a national research centre funded by the Australian Government.
    56. A small, localised severe downdraft generally associated with a thunderstorm, which induces a horizontal burst of damaging wind at the surface, as the air hits the ground and spreads out.
    57. As ground-based systems were not relevant to firefighting operations, this has not been discussed any further.
    58. These predictive systems rely on a minimum moisture level to detect windshear. The performance specifications for minimum threshold moisture on the system available to be retrofitted to the C-130 were the same as the system fitted to B137.
    59. This was in accordance with the manufacturer’s published procedure.
    60. An air drop is generally defined as a delivery of cargo, supplies or personnel by parachute from an aircraft in-flight.
    61. In July 2018, the aircraft manufacturer published service bulletin 382-57-97 to address accelerated structural fatigue for C-130 aircraft performing air tanker operations.
    62. To calculate thrust, the ATSB provided the propeller manufacturer with a true airspeed range of 110–135 kt to account for a tailwind component in the range 15–40 kt at impact.
    63. SynthEyes is a program for 3D camera tracking, also known as match-moving. It required a minimum number of visible reference point to resolve the attitude and path.
    64. The SkyTrac unit was a Canadian built device, and the intellectual property had been provided previously to the Canadian Transportation Safety Board.
    65. The ADS-B data had output the pressure altitude and barometric vertical speed, both of which were derived from the air data computer, an avionics component which calculates airspeed and altitude trend data, based on the aircrafts pitot static system. Pressure altitude is the altitude referenced to the international standard atmosphere, at 1013.25 hPa, atmospheric pressure at mean sea level.
    66. Ground speed is the speed of an aircraft relative to the surface of the Earth.
    67. ADS-B data recorded an additional ground speed of 132 kt immediately prior to impact, however, this was not used in the performance analysis.
    68. True airspeed is the airspeed of an aircraft relative to the air through which it is moving.
    69. The calibrated airspeed (CAS) is indicated airspeed corrected for installation and instrument errors.
    70. The SkyTrac vertical speed data was derived from the time and altitude information.
    71. A higher-pressure altitude results in a decrease in aerodynamic performance.
    72. An ECG detects heart problems by measuring the electrical activity generated by the heart as it contracts. ECGs from healthy hearts have a characteristic shape. If the ECG shows a different shape it could suggest a heart problem.
    73. Interatrial conduction delay is an electrical abnormality, which is very prevalent in general hospital patients with sinus rhythm (such as sinus bradycardia), and is considered a marker of an electromechanical dysfunction in the left atrium.
    74. Sinus bradycardia was a slower than normal heart rate typically resulting from good physical fitness, taking medications, or from a heart blockage.
    75. The ECG anomalies noted were commonly found in the general population and did not necessarily represent a medical condition.
    76. Calcification causes the artery walls to become more hardened.
    77. When carbon monoxide is absorbed into the bloodstream, it readily binds with haemoglobin to form carboxyhaemoglobin. This reduces the oxygen carrying capacity of the blood and in turn decreases the release of oxygen to the tissues.
    78. A METAR is a routine report of meteorological conditions at an aerodrome.
    79. A SPECI is a special report of meteorological conditions, issued when one or more elements meet specified criteria significant to aviation.
    80. The review of the data post-testing showed the maximum g load applied when modelling severe turbulence was 0.3 G. This was significantly less than the expected additional load factor (0.5-1 G). Therefore, the impact on the stall speed was lower than expected, and is not discussed in the results.
    81. The aural stall warnings generally occurred within 1-2 kt of the pre-stall buffet being felt by the QTPs.
    82. A very large air tanker refers to fixed-wing aircraft with at least 8,000 US gallons (30,283 L) tanks.
    83. Regulatory change that commenced on 2 December 2021 re-categorised this operation under Civil Aviation Safety Regulation Part 138, and aerial work operators in Australia with multi-engine aircraft over 5,700 kg will be required to have an SMS as part of these regulations.
    84. Due to a change in the operator’s SMS program, only 2 years of data was able to be provided. .
    85. It was noted that the accident occurred shortly after this incident.
    86. In 2020, after the accident, the safety manager at the time of the accident retired and was replaced.
    87. In this context, the ATSB understands tactical risk management is the continual assessment of risk in the changing circumstances of a tasking in real-time. This allows crews to perform a contemporaneous assessment of the risks and implement control measures to ensure an appropriate level of safety is maintained throughout the tasking.
    88. With the introduction of new CASA regulations in December 2021 for aerial work operations, operators such as Coulson Aviation would be required to conduct a risk assessment. This would involve a pre-operational risk assessment, the development of a flight risk management plan, and pre-flight and post-flight risk reviews.
    89. International standard for business aircraft operations was a recommended code of best practices designed to help operators achieve high levels of safety and professionalism. A phase II audit reviewed the established SMS, with the focus on ensuring the safety risks were being effectively managed.
    90. A level 2 surveillance event relates to less formal interactions with authorisation holders and may be in the form of checklist-based compliance and product check of a specific section of its systems.
    91. A level 1 surveillance event is a structured, forward-planned, larger-type surveillance event and covers systems audits, health checks and post-authorisation reviews.
    92. The NSW Large Air Tanker program is managed by NSW RFS of behalf of NSW agencies in consultation with NAFC, and included the LAT and very large air tanker (VLAT) aircraft.
    93. It was noted that the C-130 was recorded as having a loaded cruise speed of 300 kt in the operating guidelines, however, due to the limitations imposed through the aircraft manufacturer published service bulletin 382-57-97, they generally operated at about 190 kt. The birddog aircraft was listed as having a cruise speed of 285 kt.
    94. The group provides national leadership to enable interoperable wildland fire operations among coordinated operations among federal, state, local, tribal, and territorial partners in the US. The USFS was a member agency of the group.
    95. ‘Show me’ run referred to a simulated bombing run made by the birddog to demonstrate the run and identify the target for the air tanker.

Safety analysis

Introduction

About midday on 23 January 2020, a Lockheed Martin C-130 aircraft, call sign ‘Bomber 134’ (B134), departed the Richmond Royal Australian Air Force Base, New South Wales (NSW) on a firefighting tasking to Adaminaby. On arrival at Adaminaby, the crew determined that the conditions were unsuitable for a fire-retardant drop and were subsequently re-tasked to the Good Good fire near Peak View. Shortly after conducting a partial drop, and while in a left turn, the aircraft stopped climbing. The pitch attitude reduced, followed by a slight right wing down attitude. Shortly after, the aircraft was observed left wing down at low-level before colliding with terrain. The 3 crew were fatally injured and the aircraft was destroyed.

The extent of the impact damage and post‑impact fire meant the ATSB was unable to verify the operation of every aircraft system. However, there were no known defects that would have affected the aircraft’s serviceability, with the only item noted relating to the propeller anti-icing system on engine number 2, with rectification deferred in accordance with the minimum equipment list. There was no evidence of pre-impact structural damage, and detailed examination showed all engines were operational and producing power at the time of impact.

The ATSB established that the crew were appropriately qualified to perform the flight and there was no evidence of fatigue. While the post-mortem examination identified abnormalities with the copilot’s heart, there was no pathological evidence of scarring or a blockage suggesting a pre‑existing heart condition. Although elevated blood cholesterol levels increase the risk of coronary heart disease, the copilot had been appropriately treated for several years prior to the accident, and their blood pressure readings and last electrocardiogram were all within normal limits. In addition, ATSB research into pilot incapacitation occurrences (AR-2015-096) emphasised that multi-pilot operations provide a safety net if one crew member becomes incapacitated and that such events had a minimal effect on flight. Therefore, noting the medical information above and that the copilot was not the pilot flying, it was considered very unlikely that they had experienced a heart‑related condition that contributed to the accident.

This analysis will examine the environmental conditions and how this influenced the aircraft’s degraded performance and subsequent stall. The tasking process, management of task rejections, and the crew’s awareness of such on the day will also be discussed. It will also consider the risk management of large air tankers, the use of a flight risk assessment tool, and the aerial supervision and initial attack certification requirements in place. Further, the impact of limited recorded flight data and cockpit voice recordings, along with the benefits of on-board windshear systems will also be discussed.

Hazardous weather conditions

The Bureau of Meteorology graphical area forecasts for the area of operation contained strong winds, mountain wave activity and severe turbulence, which extended from Richmond to the Adaminaby and Good Good (at Peak View) fire‑grounds. The Cooma-Snowy Mountains Airport (50 km from the accident site) aerodrome forecast also indicated gusting winds nearing 50 kt and reduced visibility from blowing dust. These forecasts were consistent with the Peak View weather station recordings, witness reports, and video of the actual conditions. The ATSB’s analysis of the aircraft’s ground speed from the automatic dependent surveillance broadcast (ADS-B) data also showed that the wind speed was likely of a magnitude of 20-40 kt from a north‑westerly direction during their drop planning circuits at Peak View.

Overall, the Bureau of Meteorology concluded that the actual conditions in the accident area were consistent with the forecasts. This was reinforced by the pilot reports in the morning, which resulted in the smaller fire-control aircraft ceasing operations due to winds of about 50 kt. In addition, the pilot in command (PIC) of the Boeing 737 (B137) reported similar winds and experiencing a windshear warning and uncommanded roll when at Adaminaby. Of note, the birddog pilot had rejected the tasking to Adaminaby as the forecast conditions were worse than what they had experienced 2 weeks prior, where they were subjected to moderate to severe turbulence and downdrafts.

At Peak View, the crew had followed their procedures and conducted a number of circuits over the drop location, which was on the eastern side of a ridgeline. As the crew had elected to conduct the drop, this would indicate that they had assessed the meteorological conditions during these circuits as suitable to continue. However, the lowest circuit height of 500 ft may not have been low enough for the crew to accurately assess the conditions at the drop height and identify any localised terrain or fire effects.

The low-pressure spike recorded in the ADS-B data potentially indicated the aircraft had been subjected to localised weather effects, but due to limited information the reason for this could not be conclusively determined. The drop was located on the lee side of a ridgeline, an area prone to turbulence and potential development of mountain waves. However, while mountain waves were confirmed by the Bureau of Meteorology analysis to be present across the Snowy Mountains region at the time of the accident, the severity of this could not be ascertained from the available information. In addition, the drop was in an area noted by local glider pilots to be subject to turbulence and rotor conditions.

Strong winds and mountain waves are considered hazardous conditions due to their ability to generate strong downdrafts that may adversely affect an aircraft’s climb performance. They may also create windshear, which is of particular significance when it results in an increased tailwind component, with a subsequent reduction in airspeed. At the same time, moderate to severe turbulence would increase the stall speed.

In addition, the presence of a large fire will produce smoke and heat plumes, and potentially fire‑driven winds, that is likely to exacerbate the forecast conditions. The Blue Mountains fire case study suggested the possibility of fires drawing strong winds down closer to the surface than might otherwise be forecast.

Therefore, the environmental conditions in the accident area were conducive to windshear and downdraft development at a time when the aircraft was most vulnerable, with low airspeed and low height.

Tasking continuation by the Rural Fire Service

In the 1100 conference call between the Cooma incident controller and several senior personnel from the State Operations Centre, they discussed the severe fire weather conditions and escalating fire threat at Adaminaby. They also acknowledged that the smaller fire-control aircraft (which included the incident air attack supervisor), had stopped operations due to strong winds, with pilots reports of winds up to 52 kt and limited visibility. In that same conference call, a senior NSW Rural Fire Service (RFS) officer indicated that they should send B137 rather than wait for a birddog assessment. That is, they elected to send the LATs as initial attack to determine if they could work the fire-ground, rather than wait for an assessment prior to re-starting aerial operations. Following this, the State Operations Centre tasked 2 large air tankers (LATs), and subsequently the birddog, from Richmond to Adaminaby knowing the conditions were marginal, and that the LATs would arrive prior to the birddog.

During the initial crew tasking, the Richmond airbase manager (ABM) had mentioned the wind conditions to the crew of B137 and advised them to ‘take care’. Similarly, subsequent calls made between the ABM and the state air desk (SAD) at 1137 and 1209 discussed the adverse environmental conditions and that the birddog pilot was questioning the suitability of the weather. When the birddog pilot rejected the tasking, based on operational safety concerns, there was an expectation from them and the operator’s pilots that the tasking for the LATs would be cancelled, or at least reconsidered. This was consistent with the normal practice for a ‘turn down’ in the United States (US), and the need for aerial supervision in marginal weather conditions as outlined in the US Department of Agriculture, Forest Service (USFS) Standards for Airtanker Operations and Forest Service Handbook. However, despite an awareness of the hazardous environmental conditions, the earlier withdrawal of the smaller fire-control aircraft and the birddog pilot rejection, the tasking was continued, and this information was not relayed to either B137 or B134 crews.

Subsequently, following the drop at Adaminaby, the PIC of B137 reportedly advised the RFS Cooma aviation radio operator to cancel all aircraft operating in the area and indicated to the ABM (at about 1232) that they would not be returning due to the weather. While the crew of B134 had already been tasked and were en route to Adaminaby, this was another opportunity for the RFS to reassess the suitability of the tasking. In addition, the RFS, having received information that further operations in the Adaminaby area were unsuitable for LAT operations, did not communicate this information to the Cooma aviation radio operator or B134. In response to the ATSB draft report, the RFS noted that, while the State Operations Controller was aware of these rejections, they elected to allow B134 to continue, for further intelligence gathering purposes.

It was recognised that RFS personnel may have a limited understanding of aviation operations and therefore, there was a reliance on aircraft operators and crew to manage safety. However, in this case, the crew were not provided with a full awareness of the situation, with no knowledge of the birddog pilot rejection or that the smaller fire‑control aircraft were no longer flying. In addition, while B134 had been in contact with B137 and received advice on the conditions, this was unknown to the RFS at the time.

While some RFS personnel considered it unlikely that the LATs would be able to achieve the planned objectives due to the weather conditions, they continued with the tasking, relying on the crews to independently assess the conditions and cancel the tasking while airborne. As highlighted in the ATSB’s research into aerial campaign management, leaving the responsibility of safety to another party (the operator and crew in this instance) who are not managing the overall campaign is not effective. When there is a high-level decision to proceed with a tasking despite known elevated risk factors, providing information on those risks would allow crews and operators to make more informed decisions.

Crew awareness of task rejection

As discussed above, the smaller fire-control aircraft had ceased operations in the area earlier that day, which had been acknowledged by the RFS personnel from the State Operations Centre in the 1100 conference call. Also, the birddog pilot had rejected the tasking to Adaminaby, unaware that the smaller aircraft had stopped flying at that time. The birddog pilot indicated that it was not routine to talk to the other pilots about taskings. Therefore, they did not communicate with the crew of B134 that they had declined the tasking, but expected the RFS personnel would relay this information.

In addition, there was no indication in the available radio calls or at interview that the cessation of operations earlier that day or the birddog pilot task rejection was communicated to the crew of B134 by any RFS personnel. It was noted that this information was not required to be passed on in any of the tasking or dispatch procedures. While not directly communicated to the crew, there was the potential that they may have been monitoring the radio call between the SAD and the Richmond ABM at 1209, shortly after they had departed. However, there was no clear statement of the rejection in that call, rather, they only discussed the birddog pilot’s uncertainty about the weather conditions.

Therefore, while known to RFS personnel, it was very unlikely that the crew of B134 were aware that the birddog pilot had rejected the tasking, or that the smaller fire‑control aircraft were no longer operating in the area, due to the hazardous environmental conditions. While this was only one risk factor among others that would be considered by the crew, having this information would have allowed them to make a more informed decision about the weather conditions and task acceptance.

Nevertheless, as the tasking to Adaminaby for B134 had been provided prior to the assignment of the birddog, it was likely the crew expected to be departing as initial attack. In which case, even if they were aware of this information, it was possible that they may have still departed to self‑assess the conditions, particularly given the fire-ground was at least 45 minutes away. However, as this was an individual judgement, it could not be established how this information alone would have influenced their decision on the day.

Task acceptance by the crew

The weather forecasts applicable at the time of the flight contained mountain wave activity and severe turbulence, which extended from Richmond to both the Adaminaby and Good Good fire‑grounds. While the crew’s access to weather information on the day could not be determined, the usual practice of filing a flight plan through the operator’s electronic flight bag provided access to the required forecasts. They had also attended the morning RFS briefing with the Richmond ABM in which the weather conditions across the state were discussed. In addition, the PIC was one of the recipients of the ABM’s text message for the weather alert for Richmond in the morning prior to the tasking.

Although the PIC of B137 was made aware by the ABM at the time of the initial tasking that there no other aircraft operating at Adaminaby, they were not aware of the reason for this. Therefore, it was plausible that the crew of B134 were also not aware of this information and were not able to factor in the actual conditions to their decision when accepting the initial tasking to Adaminaby. Further, as discussed above, they were very likely unaware of the birddog pilot’s rejection of the task. Irrespective, it was reasonable to conclude that the crew of B134 were at least aware of the forecast conditions for the area of operation before departing Richmond.

While both the operator’s and manufacturer’s documents stated that flight was prohibited in known severe turbulence, this did not prevent crews from departing when severe turbulence was forecast. The only weather-related operational limitations were associated with thunderstorm activity. Therefore, it was considered normal practice to accept a tasking in these forecast conditions. Most of the operator’s LAT pilots interviewed indicated a preference to depart and assess the actual conditions to determine if they could find a workable solution rather than rely solely on a forecast, which could cover a large area and time frame, and may not necessarily reflect the actual conditions at the fire‑ground.

When B134 was en route to Adaminaby, the PIC of B137 (returning to Richmond) discussed the actual conditions with the PIC of B134, and advised they were not returning. Although B134 continued to Adaminaby, the crew discontinued the task once there as they experienced similar conditions. Despite this, knowing the decision made by the PIC of B137 and the forecast conditions for the area, the crew of B134 accepted the alternate tasking to the nearby Good Good fire‑ground, consistent with company practice. Circuits were conducted at Good Good, as per the standard retardant drop planning, to identify the asset for protection and the suitability for a drop. While the details of the assessment were unknown, the crew elected to continue with the retardant drop. Ultimately, the decisions to accept the initial and alternate tasking, and proceed with the retardant drop by the crew exposed the aircraft to a situation where it experienced degraded performance following the drop.

Degraded aircraft climb performance

Witness video, ADS-B and SkyTrac data showed that, following the completion of the drop, the aircraft climbed about 170 ft over a period of about 10 seconds, which was comparable to previous climb rates from the operational load management system. It was reported by the operator’s pilots that, at this stage of the flight, they would be targeting an airspeed increase from the drop at 120 kt indicated airspeed (IAS) to 150 kt IAS, while climbing from the drop height of 200 ft to at least 500 ft above ground level. However, during this period, the ATSB calculated a calibrated airspeed (CAS) range of between 100 and 123 kt (comparable to the IAS), which indicated the airspeed likely stagnated or reduced over this period.

Following this initial 10 seconds, the climb ceased, and altitude appeared to be maintained for about 3 seconds before the aircraft began to sink with an estimated descent rate increasing to 2,000 ft/min. The CAS also continued to stagnate after the initial 10 seconds. The reduction in vertical speed and estimated airspeed stagnation occurred at the time it would be expected that the engine power would be increasing. This increase in power would either translate to an increased height (while maintaining IAS) or maintained altitude (with an increase in IAS). Of note, the ATSB had established that there were no indications of mechanical or technical failures with the aircraft.

After the drop, the aircraft was turned from a predominant crosswind to a predominant tailwind, based on the recorded mean wind direction. This would have resulted in an initial slight decrease in the IAS. At the same time, as previously established, there were strong gusting winds, turbulence, and mountain wave activity present at the time of the accident, and these conditions were conducive to windshear.

If there was an additional increase in this tailwind component from windshear, this would have resulted in a further reduction of the airspeed. There would also be a corresponding decrease in pitch attitude and rate of climb, with a subsequent loss in altitude, as highlighted in the Lockheed Martin C-130 Airplane Flight Manual (AFM), and by the Bureau of Meteorology (2014) and Bowles (1990). These descriptions were consistent with the ATSB’s analysis of the recorded information. The witness video showed that the maximum pitch-up angle occurred 4 seconds after the completion of the drop and from this point it decreased. Likewise, the aircraft initially had a rate of climb up to 1,000 ft/min, but this also decreased, and the aircraft descended.

For comparison, the simulator testing showed that a strong constant mean wind during the climb‑out resulted in a small loss of IAS, but a significantly higher ground speed than was seen in the accident sequence. However, scenarios that used a moderate (15 kt) mean wind with gusts and windshear between 15 kt and 35 kt (similar to the total wind speeds recorded on the day), produced similar ground speeds to the recorded accident data. They also consistently resulted in the IAS decaying into the stall speed region, with minimum speeds between 84 kt and 98 kt.

In addition, observations made on the reconstruction flight noted an airspeed decay when they turned and were flying toward the accident site, even though the engine power was increasing. This was consistent with the glider pilot comments that there could be localised effects in this area due to the terrain. On the day of the accident, while the reason could not be determined, the ADS‑B data recorded a low‑pressure spike, which also had the potential to result in decreased aircraft performance.

The intensity of the environmental conditions (including mountain wave activity, strong gusting winds and turbulence) and therefore the windshear, could not be determined. However, the ATSB’s analysis of the available recorded data showed that the aircraft’s performance had degraded during the climb-out, consistent with encountering windshear, while concurrently turning into an increased tailwind, based on the mean wind direction. This was supported by the C‑130 simulator testing. With the limitations of the available recordings, and the absence of a cockpit voice recorder, it could not be determined if the crew had identified the conditions or initiated a recovery procedure. As cautioned in the Lockheed Martin AFM, severe windshear could exceed aircraft performance capability.

Stall at low altitude

About 10 seconds after the completion of the drop, the aircraft had climbed to about 330 ft above ground level but then ceased climbing, and the altitude was maintained for a few seconds. Although the aircraft was in a nose-up attitude, the aircraft was sinking and developed a high sink rate up to 2,000 ft/min. This was followed by a significant left roll just prior to impact. This was consistent with the stall characteristics as outlined in the C-130 discussion paper (Mizell 2009), where the approach to the stall in this configuration exhibited high descent rates, before the left wing stalled resulting in a large angle of bank excursion.

The ATSB calculated the power-on stall speed, with 50% flap and at the post-drop weight, as 83 kt. Consideration was also given to the potential effect of turbulence, which increased the stall speed to between 101-117 kt for moderate turbulence and 117-143 kt for severe turbulence. Noting that the ATSB derived CAS for the accident flight was between 100 and 123 kt in the last 10 seconds of the available data, this presented a significant overlap with the calculated stall speeds. It was also noted that, in the simulator test scenario that was most consistent with the accident flight, the IAS consistently decayed into the stall speed region with repeated stall warnings activated.

In the absence of the cockpit audio recording, it was unknown if the PIC, as the pilot flying, had initiated a response to the stall. Despite this, in consideration of the observed high sink rate followed by a significant left-wing roll, and the overlap in the stall speed and CAS, it was likely that the aircraft aerodynamically stalled at a height that was insufficient to recover before colliding with terrain.

Coulson Aviation risk management of large air tankers

While there was no regulatory requirement at the time of the accident, Coulson Aviation had implemented a safety management system (SMS), it was a contract requirement in the US, and which was viewed favourably by the National Aerial Firefighting Centre. However, as the system was not mandated, it was not assessed by the Civil Aviation Safety Authority or the Federal Aviation Administration. The ATSB acknowledges that any operator’s SMS will evolve and mature with time. However, significant events like accidents need to be used to explore whether their SMS is operating in a way that can assure the highest level of safety given the nature of their operations.

Acknowledging the element of risk associated with firefighting operations, the ATSB reviewed the safety risk management component of the SMS. Although the operator’s SMS manual outlined that the online SMS program would record the identified hazards, this was limited to submitted incident reports, and did not contain previously identified hazards. Although, the Company Operations Manual had detailed several operational hazards, the current and previous safety managers indicated that no risk assessments for the identified hazards associated with the LAT operations had been conducted. However, it was noted that risk assessments were included in the SMS manual, but these only applied to safety reports and change management contained within the online SMS program. While some of these hazards may have been discussed during the daily SMS conference call, this process was not formalised.

Without formal operational risk assessments of the recognised hazards applicable to the LAT operation, there was no identified risk mitigation strategies nor was there any assurance that the risks were at an acceptable level. For example, windshear and downdrafts had been recognised as a potential hazard in the Company Operations Manual. However, as no formal assessment for the C-130 aircraft had been conducted, there was no opportunity to formally identify and assess potential risk mitigators, such as those discussed by Hallowell and Cho (2010).

As noted by ICAO (2018), safety risk management activities such as operational risk assessments should be documented. Both the current and previous safety managers indicated that the operator did not have a risk register as part of their SMS, or an alternative process, at the time of the accident. This limited their ability to track, monitor, and mitigate the identified hazards, and assess the effectiveness of any risk controls.

Another important element of safety risk management was the use of reporting systems for hazard identification. The ATSB’s review of the operator’s safety reporting system found that there were few reports related to flight operations, and there were no reports of weather-related incidents. This was despite several of the crews interviewed having recalled encountering windshear during firefighting operations, which affected the aircraft. Given the operator’s draft report response comments that they considered the incident reporting numbers were mitigated by the daily SMS calls, it was likely they relied on this informal process for flight risk awareness, rather than incident reporting. Although the weather conditions were mentioned in the days prior to the accident, there was minimal detail of the discussions recorded in the daily SMS conference calls. Therefore, as there was limited information on operational issues recorded in the SMS, there was limited ability to conduct risk assessments of any identified hazards, to gain an understanding of their potential impacts on operations and mitigate the associated risks, or to perform any safety trend analysis.

As established above, aerial firefighting operations were subjected to elevated risks. Therefore, the supporting risk management practices should consider risk assessments at all levels of the organisation and all stages of the operation. Acknowledging that the risks cannot be entirely eliminated, an operational risk assessment would have provided an opportunity to identify the need to establish acceptable risk levels associated with firefighting taskings. While elevated risks were individually identified, there was no clear process for pilots to review or assess all the factors collectively and consistently. Instead, the operator’s risk management process relied predominately on crews conducting their individual, undocumented risk assessments for each task as part of their normal pre-flight planning and tactical assessment during flight. In particular, there was no identification of the need for a risk-based decision‑making framework to support pilot decision‑making when accepting potentially high-risk taskings.

The operator’s voluntary audit had identified significant growth in the company since the initial audit 2 years earlier, but it also noted that the SMS had not yet fully matured. While it was recognised there was no requirement for Coulson Aviation to have an SMS in Australia, the ATSB identified that there was very limited oversight of the identified hazards. Without operational risk assessments for the LAT operations or a method to monitor identified hazards, associated risk assessments, or risk mitigation, this limited Coulson Aviation’s ability to manage the risks related to their LAT operation.  

Pre-flight risk assessment tool

As noted by the US National Transportation Safety Board, effective risk management involves good decision-making. These skills are important in most work domains but are especially critical in high-risk settings when individuals may be functioning under time pressure and stress, such as firefighting operations.

The LAT operation was a 15-minute notice standby tasking arrangement, which could send the aircraft to any location within the bounds of the tasking authority. The retardant drop task was a response to a possibly urgent threat that involved low-level, low-speed operations in a potentially hazardous and challenging environment. This made it a comparatively high-risk activity, in addition to which pilots were also responding to an external tasking agency, a potential source of external pressure.

At the start of each day, the RFS conducted a briefing for the LAT and birddog crews, which provided an overview of the weather, likely areas of operation, and fire conditions. However, on receiving a tasking, crews were still required to conduct their own flight planning specific to the area of operation, in a timely manner, to determine what was an acceptable level of risk.

The only consideration provided at interview as no-go criteria by the Coulson Aviation crews was a thunderstorm. Consequently, there could be several flight planning factors, which individually were not a no-go criterion, but collectively elevated the risk to higher-than-normal for the LAT operation. There could also be additional external factors, such as task rejections or cancellations by other pilots, which could elevate the risk if they were known to the LAT crew.

While acknowledging that LAT operations had inherent risks, Coulson Aviation had not introduced a pre-flight risk assessment tool for their LATs. Instead, there was a reliance on the PIC to assess the acceptability of the task based on their assessment of the conditions. However, this process may not have necessarily detected the cumulative effect of several indicators of elevated risk.

On the day of the accident, there were multiple pre-flight risk indicators, which included:

• forecast strong winds, severe turbulence, and mountain waves in the area of operation
• operating in mountainous terrain
• the Richmond Airport weather warning sent to the LAT crews by the ABM prior to the Adaminaby tasking
• the cessation of the smaller fire-control aircraft due to the actual weather conditions in the Snowy Mountains
• the birddog pilot’s rejection of the task following assessment of the forecast weather conditions for the area compared with a previous experience
• the copilot and flight engineer were in their first firefighting season
• potential pressure to respond to the bush-fire risk to the town of Adaminaby.

While it could not be determined if all factors were known to the crew of B134, or their assessment of each factor, none of the above risk indicators were likely to be individually sufficient for the PIC to reject the task. However, when assessed collectively against pre-defined criteria, they would have produced an elevated score, as identified in the ATSB’s estimate of the accident flight risk profile using the operators recently introduced pre-flight risk assessment tool. However, it was noted that this tool did not include weather-related task rejections, considered one of the highest risk indicators for helicopter operations by the Helicopter Association International.

While there was no regulatory requirement at the time, the use of a pre-flight risk assessment tool was a contract requirement with the USFS. A 2014 NTSB study of aerial work accidents outlined that risk management guidelines and best practices specific to aerial work aircraft operations included a pre-flight risk assessment tool. These help operators and pilots mitigate the unique risks associated with their operations, in particular, when the operation is often conducted in high‑risk circumstances. As emphasised by both the US Federal Aviation Administration (FAA) and USFS, every flight has some level of risk. Therefore, it is critical that crews can differentiate between a low-risk and high‑risk flight during the planning stage to establish the overall risk profile. Risk management strategies, such as a pre-flight risk assessment tool, can assist pilots with applying a systematic process that helps them resist pressures that can adversely affect their decision-making and identify risks that could affect the safety of the flight.

In this case, the availability of such a tool would have assisted the PIC with making a more informed go/no-go decision for the initial tasking to Adaminaby. This almost certainly would have resulted in the PIC identifying the elevated risk associated with the tasking, and having to consider implementing risk mitigations, or escalation of the decision-making, if not rejection of the task. In addition, the PIC was reported to be conservative, therefore, the knowledge of the cessation of aerial operations due to strong winds and limited visibility and followed by subsequent weather‑related rejections due to safety concerns, would have likely increased the risk above an acceptable level.

Rural Fire Service aerial supervision requirements

Although it was acknowledged that the RFS was not an aviation operator, they were responsible for tasking a variety of aerial assets, with substantially different operating capabilities, often in high pressure situations in challenging environmental conditions. It could be foreseen that there will be community expectations that the RFS respond to fire threats, and use all available aerial assets to achieve the planned objectives. Accordingly, the tasking agency needs to define the acceptable level of risk for the overall operation, to provide an effective additional layer of defence above that provided by the aircraft operator. Such systems and policies have been implemented in firefighting operations in the US.

Operationally, the tasking-related risk assessment noted in the RFS Aviation Standard Operating Procedures (operating procedures), predominantly focused on the use of the aircraft to manage the fire threat rather than ensuring the safe use of those aircraft. The RFS had identified considerations to ensure the effective use of LATs, and acknowledged that certain task environments had higher risks. However, there was no guidance provided to frontline RFS personnel on how to assess these risks as part of the tasking process, such as those noted by the USFS and the US National Wildfire Coordinating Group.

For example, the RFS tasking considerations included weather as a potential threat, but there was no further guidance around how to assess the environmental conditions, or under what circumstances taskings should be considered acceptable or not acceptable. For the tasking to Adaminaby, it was noted in the 1100 conference call and various logs that the weather conditions were hazardous and that no aircraft were flying in the area due to the wind and visibility conditions. Despite this, there was an expectation that the LATs had greater flight capabilities and the pilots could make their own assessment of the conditions. Therefore, the decision was to send the LATs, and see if an opportunity presented itself that allowed for their assistance.

However, if the RFS had implemented policies and supporting procedures applicable to minimum aerial supervision requirements, similar to those in place in the US, this would have provided guidance to the front-line staff to assist with tasking decision making. For example, the USFS documents outlined the requirement for aerial supervision in marginal weather, including limited visibility and turbulence, and further, where the aerial supervisor suspended operations, they must not proceed with further taskings until risk mitigations are in place. If such policies were in place, it was likely that RFS personnel would have identified the higher risk environment, and therefore the need for aerial supervision on this tasking. In turn, this would have likely identified that an initial attack deployment was not suitable in the elevated risk environment.

The operating procedures indicated that aerial supervision was generally required for LAT firefighting operations unless the crew were initial attack certified and there were operational advantages to commencing operations prior to aerial supervision arriving. Those advantages included considering the speed differential between a birddog and LAT, or when a birddog was not available due to resourcing constraints, such as diversion to another tasking. However, there was no differentiation between the use of an initial attack deployment where aerial supervision was not available, in comparison to the rejection or cessation of a tasking due to safety concerns.

While the initial deployment of B137 ahead of the birddog could reasonably be accepted as meeting an operational advantage, the departure of the smaller fire-control aircraft and subsequent rejection of the birddog should have resulted in reconsidering the use of ‘initial attack’. However, there was no supporting procedure or guidance on the use of ‘initial attack’ deployment in these elevated risk circumstances, such as when the task was rejected by the birddog due to safety concerns. In the case of the accident, this rejection occurred shortly prior to B134 departing Richmond, and there would have been sufficient opportunity to reassess the task, and potentially redirect the LAT elsewhere, prior to their arrival overhead Adaminaby.

Policies and procedures on aerial supervision should include consideration of the known factors that elevate risk associated with aerial firefighting tasks, and would ensure the RFS have minimum aerial supervision requirements in place for each tasking circumstance. It would also include policies and procedures for the deployment of LATs without aerial supervision (initial attack), and in what circumstances this would be acceptable. In order to make acceptable risk‑based tasking decisions, these considerations need to be enshrined in policies and procedures, to assist with time-critical decisions during the fire season by frontline staff. The RFS personnel would have to assess that the tasking meets the minimum aerial supervision requirements prior to approaching operators with taskings, to ensure the taskings can be conducted within their defined, accepted risk levels.

Rural Fire Service management of task rejections

The ATSB’s 2004 research into aerial campaign management stated that organisations that contracted aerial operations (such as the RFS) were directly involved in the management of significant parts of the aerial campaign and were in a central position to understand the big picture. Decisions made during this process had the capacity to influence the level of risk of the operations.

It could be reasonably expected that there will be situations in which tasks are declined for safety reasons. While the RFS Aviation Standard Operating Procedures and the Operating Guidelines for Air Tanker Operations outlined some initial considerations regarding the tasking of LATs, there was no further policies or procedures following the initial tasking process to support the ongoing task. Consequently, there was no process in place to support RFS frontline personnel on managing a task rejection by crews or operators.

These policies and procedures would detail when task rejections should be considered as a risk indicator, such as when flights were declined due to weather-related safety concerns. For comparison with the USFS Standards for Airtanker Operations, this may also include communication of this information to other crews, reassessment of the tasking, incorporation of appropriate mitigations, or cancellation of the task. They should also encourage pilots and operators to communicate unsafe conditions without fear of reprisal.

On the day of the accident, neither the Richmond ABM nor the SAD communicated to either of the LAT crews or the birddog pilot tasked to Adaminaby, information regarding the smaller fire-control aircraft ceasing operations due to unsuitable weather. Nor did they communicate the task rejection by the birddog pilot to the crew of B134 shortly prior to take-off from Richmond (noting this occurred about the time B137 was overhead Adaminaby). The LAT AAS (who would have been on board the birddog) also did not communicate this to the LAT crews, as their communication role did not commence due to the birddog aircraft not departing. In addition, this rejection was not communicated by RFS personnel to the Cooma Fire Control Centre aviation radio operator, who could reasonably be expected to be in contact with the LAT crew as they were operating as initial attack, and they were the appropriate local ground contact to coordinate the task. While acknowledging the LAT’s, birddogs, and the smaller fire‑control aircraft have different capabilities and performance limitations, this was relevant information (specifically, reported strong winds and limited visibility, and the rejection based on safety concerns) that could reasonably have been communicated to the crews. As previously discussed, there was an expectation from the birddog pilot and the operator’s pilots that the RFS would either relay this information to them so it could be included in their decision-making processes, or the task would be cancelled by the RFS.

The subsequent rejection of further tasking by B137 as the conditions were worsening and reportedly unsuitable for LAT operations, was also not communicated by either the ABM or SAD to the crew of B134 nor to the Cooma incident management team. In addition, shortly after this rejection, the ABM and SAD discussed sending an alternative LAT to Adaminaby. None of these rejections resulted in a reassessment or cancellation of the tasking for B134 to Adaminaby. Rather, the RFS allowed B134 to proceed with the intention of gathering additional intelligence to assist in determining whether further aerial operations would proceed. Subsequently, the Cooma aviation radio operator was also unaware of this rejection of further tasking by B137, or their assessment of the conditions when providing the secondary tasking to the B134 crew.

As outlined above, while some crews were initial attack certified and could operate without aerial supervision, the RFS operating procedures indicated that this was only to occur when there were operational advantages prior to an air attack supervisor (AAS) arriving. However, the operating procedures did not reference any circumstances, such as in the case of the accident flight, where a tasking had been rejected due to safety concerns, such as unsuitable weather. While initial attack crews were trained to conduct operations without the AAS, continuing a tasking where the local AAS had departed or grounded due to weather concerns, and/or the birddog pilot (and therefore LAT AAS) rejected the tasking, appeared outside of the intended scope of ‘initial attack’ deployments.

As the task rejections were on the basis of weather or fire-ground safety concerns, which equally applied to B134, appropriate policies and procedures regarding task rejection should have resulted in the initial tasking to Adaminaby being cancelled following the rejections. There were 2 opportunities for this. The first was at the time of the birddog rejection when B134 was departing Richmond, which, at the very least (noting the RFS understanding of differing capabilities between the birddog and the LATs) should have resulted in communication of that information to allow the LAT pilots to make their own more informed risk assessment. The second was when B134 was transiting over the Canberra region and the RFS received advice from B137 which indicated that it was not suitable for LAT operations. Task cancellation would have also been consistent with the RFS intended use of initial attack and the general operating principles in the US.

While the RFS was not an aviation organisation or directly responsible for flight safety, they were closely involved in the aerial operation, being responsible for determining the task objectives and selecting the aircraft category for the task. Policies and associated procedures for task rejections would provide RFS personnel with the required steps to effectively and safely manage taskings, and provide guidance for decision-making. It would allow for consideration of a rejection by other crews, resulting in clear communication from RFS personnel of crew rejection decisions both internally, and to all aircraft on the tasking, and additional risk treatments being implemented up to task cancellation. A policy would also provide all RFS personnel with an objective mechanism to cancel taskings on the basis of safety.

Retardant load not jettisoned

Although the aircraft was obscured by smoke at various points, the witness video showed no further retardant dispersal after the initial drop, nor was any found between the drop area and the accident location. At the site, the operational state of the retardant aerial delivery system could not be determined due to the damage sustained, but a large amount of retardant was found in the wreckage near the tank.

However, as there was only about 10 seconds between the climb performance degrading and the likely stall, there was limited time available for the crew to identify and respond to the situation. Past research shows pilot recognition time of windshear can be expected to be about 5 seconds, and the emergency dump function would take a further 2 seconds. However, in the absence of the cockpit audio recording, it could not be determined if the crew had considered or called for an emergency dump of the remaining load. Therefore, for reasons undetermined, the remaining 11,340 kg of retardant was not jettisoned during the accident sequence.

The ATSB established that jettisoning the remaining load would have lowered the stall speed and optimised the aircraft’s climb performance. This was also confirmed from the simulator testing. Nonetheless, it was not possible to determine if jettisoning the remaining load, taking into account the time available, and typical recognition and response times, would have prevented the collision with terrain. The outcome of the US Air Force C-130 accident, where the crew did jettison the load, is an example of when this action may not be sufficient to avoid a collision with terrain.

Windshear recovery procedure and training  

It is acknowledged throughout the aerial firefighting industry that they operate in a challenging environment with elevated risk conditions. Windshear was a known phenomenon, which could be exacerbated by fire-associated winds that may be difficult to forecast and could be influenced by local terrain effects. Most of the operator’s crews interviewed reported encountering a windshear event during firefighting operations. The FAA study published in 2010 identified 3 categories of windshear mitigators: ground-based alerting systems, pilot training, and airborne detection systems.

Large air tanker firefighting operations were generally conducted away from airports often over inhospitable terrain. Therefore, it would be unlikely the ground-based systems, or weather-based monitoring from airports would be available for windshear alerting during a retardant drop.

The Lockheed Martin C-130 AFM had been updated prior to 2010 to include a section on adverse environmental conditions, which included a windshear recovery procedure. Although the FAA had approved the Coulson Aviation C-130 AFM in 2013, the operator had used an earlier version (1989) of a military document to develop the manual. This was consistent with comments provided by the FAA to the ATSB, where the documents and manuals for military surplus aircraft would normally be sourced from the military rather than the manufacturer. Therefore, the windshear recovery procedure was not included in the Coulson Aviation C-130 AFM.

While both the departures and standard operating procedures sections of the Company Operations Manual provided basic windshear recovery guidance for the C-130, it was not presented as an emergency procedure, nor did it consider any specific requirements for firefighting activities, such as the potential jettison capability offered by the retardant aerial delivery system. In addition, while this manual was applicable to all aircraft types, it was specifically developed for Australian operations only, although the company operated internationally. At least one of the operator’s C-130 pilots stated that they did not consider this manual to be the reference document for operating the aircraft, rather, the AFM and checklists were the appropriate source. This was consistent with the purpose of an AFM, which was to provide the procedures for operating the aircraft.

Although the PIC of B134 had completed an in-flight training scenario in 2019 that incorporated a simulated downdraft, the training generally focussed on responding to an emergency on the drop run, rather than specific to windshear. While a windshear encounter could be simulated airborne in the aircraft, it was not possible to replicate the effect on aircraft performance. Therefore, this would not provide pilots with the performance instrument indications that would be typically experienced. However, the operator provided their C-130 pilots with annual simulator training. While it was noted that a briefing on windshear recovery was incorporated into the training syllabus, there was no requirement to conduct a simulator-based low-level windshear recovery scenario as part of initial or recurrent training. This could provide crews with the experience needed to recognise the symptoms of windshear and practice a recovery procedure.

The operator also noted that most of their crews were former or current military pilots and would have received windshear training on a bi-annual basis when serving members. However, for those pilots no longer in the military, no recurrent training was provided by the operator to maintain proficiency in windshear recovery. Further, it was also recognised that the air drop scenario conducted in the military differed somewhat from a retardant drop. Most notably was the inclusion of the retardant aerial delivery system and capability to conduct an emergency dump to improve aircraft performance.

Research conducted on behalf of the FAA found that there was only about 5-15 seconds available for pilots to recognise and respond to a windshear encounter. Japanese research into pilot reactions to windshear on landing approach found that about 5.5 seconds was the average time to recognise a windshear event. As such, when in a low airspeed and low height scenario associated with a retardant drop, recognition and reaction to a significant windshear event must be prompt to avoid a collision. However, as no cockpit audio recording was available for the accident flight, it could not be determined if the crew had recognised that they very likely experienced a windshear event and/or had initiated a recovery. Despite this, an effective training program, using a combination of theory and practice, could provide pilots with the necessary skills and experience to recognise and respond to a low-level windshear encounter with minimal delay.

In multi-pilot operations, effective crew coordination and performance depends on the crew having a shared mental model of the task. This mental model is founded on operating procedures (ICAO, 2015). Such procedures are designed to help reduce variation within a given process and ensure operations are performed correctly. Without formal procedures, pilots are required to exercise judgement to the best of their abilities, based on their experience, skills and knowledge. Together, a recovery procedure specific to the nature of the operation supported by training, should provide pilots with a shared mental model of the symptoms and recovery actions for a windshear encounter.

Windshear system not fitted

Where it has been recognised that pilot awareness and training are not 100% effective for windshear avoidance, advanced warning systems are designed to detect and confirm the hazardous condition prior to the encounter. This provides additional time for the crew to increase the aircraft’s energy state and climb, so that any windshear encountered is at a higher, safer altitude. Alternatively, reactive systems alert the crew that they are experiencing windshear so that they can respond immediately, thereby minimising the time required for the crew to identify the situation before responding. These systems are particularly relevant to aerial firefighting aircraft, where there is an increased risk of encountering windshear, which is most hazardous in the low-level low‑speed environment where they regularly conduct operations. As noted by some pilots interviewed, the fitment of such a system was reported to have had a positive effect on their management of a windshear encounter.

While a birddog pilot could provide advanced warning of a windshear condition, there may not be enough time for the LAT crew to respond and avoid the encounter. In the 2012 US Air Force C‑130H accident, the birddog aircraft was about 1 NM (about 2 km) ahead when a warning was provided. This was insufficient for the C-130 crew to prevent a collision with terrain after experiencing low‑level windshear, despite conducting an emergency retardant jettison. It was also noted that LATs deployed as initial attack, such as in the case of the accident, will not have aerial supervision, or an aircraft providing a ‘show me’ run.

Airborne forward-looking, or predictive, windshear detection systems have been developed in response to commercial aviation accidents and have been shown to be around 95% effective (in simulator studies). It is acknowledged that the bushfire environment will be dry (low relative humidity) and the effectiveness of a forward-looking system may be reduced. However, the Lockheed Martin FireHerc aircraft, a civilian-certified aerial firefighting tanker is fitted with a windshear warning system. This would suggest these systems offer an enhanced level of safety for firefighting operations, in particular where operations are at low level in windshear prone environments, which would assist pilots in the early identification and/or potential avoidance of windshear, minimising any loss of aircraft performance. In addition, reactive systems are considered capable of confirming potentially hazardous windshear conditions in advance of human pilot recognition time. The activation of the warning on B137 at Adaminaby, and the crew’s subsequent response and adjustment of the drop location indicated a standard response to a windshear warning in aerial firefighting operations.

B134 and the operator’s other C-130 aircraft were not fitted with any windshear warning systems as these were not available at the time of manufacture and there was no regulatory or contract requirement to have them. The operator also indicated that they had not considered installing windshear detection systems into their C‑130 fleet when they were re‑purposed for firefighting activities.

Given the local weather conditions, the fact that B134 was very likely subjected to windshear, and the activation of the warning on B137 in similar environmental circumstances, it was possible that the crew of B134 would have also received a warning. If a warning had triggered, it was reasonable to expect that the crew would have responded. In addition, if this had occurred during the drop planning phase, it would have also assisted the crew in their hazard assessment and identification that the location was possibly unsuitable before committing to the drop run. If it had occurred during, or following the drop at Peak View, it would have provided immediate identification to all crew of the situation, assisting with timely recognition and response.

However, in the absence of an airborne system, windshear detection is reliant on the pilot’s assessment of the conditions based on the information available and their interpretation of that information. Without any known weather phenomena or reports from that location, detection is likely to be reactive, and dependent on the crew identifying a loss of aircraft performance. The recovery is subject to timely recognition and response, which could take 5 to 15 seconds and potentially result in further altitude loss. In this case, there was only 10-15 seconds and 330 ft between the degradation in climb performance and the impact.

Either a reactive or a predictive windshear detection system may have warned the crew of B134 of the actual or impending windshear and allowed for an earlier response. However, given the limited time and height available, it could not be determined if this would have been sufficient to have reduced the performance loss and prevent the accident. Despite this, research conducted on behalf of the FAA indicated that the risks associated with a windshear encounter would be reduced through a combination of pilot training and the use of on-board systems.

Initial attack certification

The NSW and ACT Aviation Standard Operating Procedures stated that aerial supervision was generally required for air tanker firefighting operations, except for those crew who were ‘initial attack certified’. While the RFS documentation did not define the requirements for this, their intention was to recognise the US Department of Agriculture, Forest Service (USFS) certification and for operators to ensure crews held this certification. However, without a definition, or any reference to the USFS certification in the procedures, this allowed individual operators to determine when pilots were initial attack capable, without necessarily having the official USFS certification. This was consistent with Coulson Aviation’s understanding, where they determined if a pilot was initial attack capable based on their internal training framework, rather than relying on the USFS certification. Despite this, this did not influence the development of the accident as the PIC of B134 held the initial attack certification from the USFS.

Standard operating procedures, among other risks controls, are fundamental for safe operations. They provide a common ground for users by ensuring consistency and predictability across all aspects of an operation. However, if procedures are not clearly defined, this results in a risk control not being applied as intended, lessening their effectiveness in managing safety. In this case, an individual operator may assess the capability of their pilots as satisfactory based on their own training, but it may not necessarily reflect the same requirements as that achieved through the USFS certification process.  

Lack of recorded data

While the aircraft was not required to be fitted with a cockpit voice recorder (CVR) under the Australian or US regulations, it was a contract requirement in the US.

As detailed in the AFM supplement, when power was applied to the CVR, the system conducted a self-test, and the status of that test was presented to the crew. However, the CVR did not record the accident flight as a result of the inertia switch activating on a previous flight about 8 months prior. Subsequently, the aircraft was operated on multiple flights by several crews in the intervening period with the CVR in an unserviceable condition. It was very likely that the inertia switch had not been reset during that time as the checklist being used in B134 did not include the requirement for the crew to check the status of the CVR. None of the operator’s C‑130 crew interviewed were aware of this requirement.

While this had no influence on the accident, the CVR being inoperable resulted in a valuable source of information not being available to the investigation. This increased the time taken to determine the contributing safety factors, and restricted the extent to which important safety issues could be identified and analysed. The benefits of flight recorders were further outlined in the ATSB publication Black box flight recorders, which highlighted recorders, such as the CVR, could be an invaluable tool to assist in identifying the factors behind an accident. The CVR captured more than crew communications, it also captured the audio environment in the cockpit, which could include radio transmissions, aural alarms, switch activations and engine noise.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving Lockheed EC-130Q, registered N134CG (call sign B134), that occurred near Peak View, New South Wales, on 23 January 2020.

Contributing factors

• Hazardous weather conditions were forecast and present at the drop site near Peak View, which included strong gusting winds and mountain wave activity, producing turbulence. These conditions were likely exacerbated by the fire and local terrain.
• The Rural Fire Service continued the B134 tasking to Adaminaby when they learned that no other aircraft would continue to operate due to the environmental conditions. In addition, they relied on the pilot in command to assess the appropriateness of the tasking to Adaminaby without providing them all the available information to make an informed decision on flight safety.
• The pilot in command of B134 accepted the Adaminaby fire-ground tasking, which was in an area of forecast mountain wave activity and severe turbulence. After assessing the conditions as unsuitable, the crew accepted an alternate tasking to continue to the Good Good (Peak View) fire-ground, which was subject to the same weather conditions. The acceptance of these taskings were consistent with company practices.
• Following the partial retardant drop and left turn, the aircraft was very likely subjected to hazardous environmental conditions including low-level windshear and an increased tailwind component, which degraded the aircraft’s climb performance.
• While at a low height and airspeed, it was likely the aircraft aerodynamically stalled, leading to a collision with terrain.
• Coulson Aviation's safety risk management processes did not adequately manage the risks associated with large air tanker operations. There were no operational risk assessments conducted or a risk register maintained. Further, as safety incident reports submitted were mainly related to maintenance issues, operational risks were less likely to be considered or monitored. Overall, this limited their ability to identify and implement mitigations to manage the risks associated with their aerial firefighting operations. (Safety issue)
• Coulson Aviation did not provide a pre-flight risk assessment for their firefighting large air tanker crews. This would provide predefined criteria to ensure consistent and objective decision-making with accepting or rejecting tasks, including factors relating to crew, environment, aircraft and external pressures. (Safety issue)
• The New South Wales Rural Fire Service had limited large air tanker policies and procedures for aerial supervision requirements and no procedures for deployment without aerial supervision. (Safety issue)
• The New South Wales Rural Fire Service did not have a policy or procedures in place to manage task rejections, nor to communicate this information internally or to other pilots working in the same area of operation. (Safety issue)

Other factors that increased risk

• The B134 crew were very likely not aware that the 'birddog' pilot had declined the tasking to Adaminaby fire-ground, and the smaller fire-control aircraft had ceased operations in the area, due to the hazardous environmental conditions
• In the limited time available, the remainder of the fire-retardant load was not jettisoned prior to the aircraft stalling.
• Coulson Aviation did not include a windshear recovery procedure or scenario in their C‑130 Airplane Flight Manual and annual simulator training respectively, to ensure that crews consistently and correctly responded to a windshear encounter with minimal delay. (Safety issue)
• Coulson Aviation fleet of C-130 aircraft were not fitted with a windshear detection system, which increased the risk of a windshear encounter and/or delayed response to a windshear encounter during low level operations. (Safety issue)
• The New South Wales Rural Fire Service procedures allowed operators to determine when pilots were initial attack capable. However, they intended for the pilot in command to be certified by the United States Department of Agriculture Forest Service certification process. (Safety issue)

Other findings

• The aircraft's cockpit voice recorder did not record the accident flight, which resulted in a valuable source of safety information not being available. This limited the extent to which potential factors contributing to the accident could be identified.

Safety issues and actions

Rural Fire Service task rejection management

Safety issue number: AO-2020-007-SI-01
Safety issue description: The New South Wales Rural Fire Service did not have a policy or procedures in place to manage task rejections, nor to communicate this information internally or to other pilots working in the same area of operation.Safety issue description: The New South Wales Rural Fire Service did not have a policy or procedures in place to manage task rejections, nor to communicate this information internally or to other pilots working in the same area of operation.

Rural Fire Service aerial supervision requirements

Safety issue number: AO-2020-007-SI-02
Safety issue description: The New South Wales Rural Fire Service had limited large air tanker policies and procedures for aerial supervision requirements and no procedures for deployment without aerial supervision.

Initial attack certification

Safety issue number: AO-2020-007-SI-07
Safety issue description: The New South Wales Rural Fire Service procedures allowed operators to determine when pilots were initial attack capable. However, they intended for the pilot in command to be certified by the United States Department of Agriculture Forest Service certification process.

Coulson Aviation’s risk management processes

Safety issue number: AO-2020-007-SI-05
Safety issue description: Coulson Aviation's safety risk management processes did not adequately manage the risks associated with large air tanker operations. There were no operational risk assessments conducted or a risk register maintained. Further, as safety incident reports submitted were mainly related to maintenance issues, operational risks were less likely to be considered or monitored. Overall, this limited their ability to identify and implement mitigations to manage the risks associated with their aerial firefighting operations.

Windshear procedures and training

Safety issue number: AO-2020-007-SI-06
Safety issue description: Coulson Aviation did not include a windshear recovery procedure or scenario in their C‑130 Airplane Flight Manual and annual simulator training respectively, to ensure that crews consistently and correctly responded to a windshear encounter with minimal delay.

Windshear warning systems

Safety issue number: AO-2020-007-SI-04
Safety issue description: Coulson Aviation fleet of C-130 aircraft were not fitted with a windshear detection system, which increased the risk of a windshear encounter and/or delayed response to a windshear encounter during low level operations.

Pre-flight risk assessment tool 

Safety issue number: AO-2020-007-SI-03
Safety issue description: Coulson Aviation did not provide a pre-flight risk assessment for their fire-fighting large air tanker crews. This would provide predefined criteria to ensure consistent and objective decision-making with accepting or rejecting tasks, including factors relating to crew, environment, aircraft and external pressures.

Safety action not associated with an identified safety issue

Additional safety action by Coulson Aviation

The ATSB has been advised of the following proactive safety action taken by Coulson Aviation in response to this accident:

• The Retardant Aerial Delivery system (RADS) software was reprogrammed so that the system would not require re-arming between partial load drops where less than 100% volume was selected.
• Updated their pre-flight procedures to incorporate a cockpit voice recorder system check in their abbreviated checklist before each flight.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Coulson Aviation
• Coulson Aviation current and former personnel
• other C-130 crews and maintenance staff
• New South Wales Rural Fire Service
• Lockheed Martin
• a number of witnesses
• Royal Australian Air Force
• Defence Flight Safety Bureau
• the Bureau of Meteorology
• ATSB aviation medical specialist
• Rolls Royce
• Hamilton Sundstrand
• National Aerial Firefighting Centre
• CAL FIRE
• Airservices Australia
• United States Federal Aviation Administration
• United States Department of Agriculture, Forest Service
• Canadian Transportation Safety Board
• next-of-kin
• video footage of the accident flight
• recorded data from automatic dependent surveillance broadcast (ADS-B), SkyTrac and historic data for the operational load monitoring system.

References

Australian Transport Safety Bureau (2009). Mountain wave turbulence. Retrieved from /publications/2005/mountain_wave_turbulence/

Australian Transport Safety Bureau (2020). A safety analysis of aerial firefighting occurrences in Australia (AR-2020-022). Retrieved from https://www.atsb.gov.au/media/5777923/ar-2020022_final.pdf

Australian Transport Safety Bureau (2004) Risks associated with aerial campaign management: Lesson from a case study of aerial locust control. Retrieved from /publications/2005/aerial_locust_control/

Australian Transport Safety Bureau (2015) Pilot incapacitation occurrences 2010-2014. Retrieved from /publications/2015/ar-2015-096/

Australian Transport Safety Bureau (2014) Black box flight recorders. Retrieved from /publications/2014/black-box-flight-recorders/

Bureau of Meteorology (2014) Hazardous weather phenomena – Wind shear. Retrieved from http://www.bom.gov.au/aviation/data/education/wind-shear.pdf

Bowles, R. L. (1990) Reducing Windshear Risk Through Airborne Systems Technology. Proceedings of 17th Congress of the International Council of the Aeronautical Sciences, pp 1603-1630.

Civil Aviation Safety Authority (2021) Aerial work risk management (advisory circular AC138-05 v1.1) Retrieved from https://www.casa.gov.au/aerial-work-risk-management

Civil Aviation Safety Authority (2014) SMS for aviation – a practical guide, Safety Risk Management Retrieved from https://www.casa.gov.au/search-centre/safety-kits/resource-kit-develop-your-safety-management-system

Federal Aviation Administration (2020) Safety management system, 8000.369C, FAA: Washington, DC..

Federal Aviation Administration (2016) Safety Flight Risk Assessment Tools.

Federal Aviation Administration (1997) Hazardous mountain winds and their visual indicators (advisory circular 00-57). FAA: Washington, DC.

Federal Aviation Administration (1988) Pilot Windshear Guide (advisory Circular 00-54). FAA: Washington, DC.

Federal Aviation Administration (2015) Helicopter Air Ambulance Operations (advisory circular 135-14B). FAA: Washington, DC.

Federal Aviation Administration (1987) Airworthiness Criteria for the Approval of Airborne Windshear Warning Systems in Transport Category (advisory circular 25-12). FAA: Washington, DC.

International Civil Aviation Organization (2015). Model advisory circular for air operator's: Standard Operating Procedures for Flight Deck Crewmembers, Montreal: ICAO.

International Civil Aviation Organization (2018) Safety Management Manual (4th ed). ICAO Doc 9859, Montreal.

Kepert, J, Tory, K, Thurston, W, Ching, S, Fawcett, R, Yeo, C (2016) Fire escalation by downslope winds. Retrieved from https://www.bnhcrc.com.au/hazardnotes/24

Minor, T (2000) Judgement versus windshear. The Mobility Forum: The Journal of the Air Mobility Command, 9, 27-33.

Mizell, G (2009) C-130 Discussion Items. Retrieved from http://www.baseops.net/wp-content/uploads/2015/08/C-130-Discussion-Items-2009Mar.pdf

Mosier, KL, Fischer, U, Cunningham, K, Munc, A, Reich, K, Tomko, L, and Orasanu, J (2012) Aviation decision making issues and outcomes: Evidence from ASRS and NTSB reports, Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 56(1):1794-1798.

National Aerial Firefighting Centre, (2021), National Aerial Firefighting Strategy 2021–26. Retrieved from https://www.nafc.org.au/wp-content/uploads/2021/07/NAFF_Strategy_Webversion_2021-07-30_v1.1.pdf

National Transportation Safety Board (2014) Special Investigation Report on the Safety of Agricultural Aircraft Operations. Retrieved from https://www.ntsb.gov/safety/safety-studies/pages/sir1401.aspx

Commonwealth of Australia (2020) Royal Commission into National Natural Disaster Arrangements – Report. Retrieved from https://www.royalcommission.gov.au/system/files/2020-12/Royal%20Commission%20into%20National%20Natural%20Disaster%20Arrangements%20-%20Report%20%20%5Baccessible%5D.pdf

Tsukagoshi, H. (1999) Another look at windshear accidents. Proceedings of the International Society of Air Safety Investigators annual seminar, pp 67-86.

Underdown RB, Standon J, (2003) Meteorology (3rd Ed.). Blackwell Science, Oxford UK.

United States Forest Service (2016) National Aviation Safety Management System Guide. Retrieved from https://gacc.nifc.gov/swcc/dc/azpdc/operations/documents/aircraft/safety/SMS%20Guide_2016_508compliant.pdf

United States Forest Service (2006) Forest Service Manual – Aviation Management Handbook. Alaska Region. Retrieved from https://www.fs.fed.us/im/directives/field/r10/fsh/5709.16/5709.16_30.doc

US Air Force (2012) Aircraft accident investigation, C-130H3, T/N 93-1458, Edgemont, South Dakota, 1 July 2012. United States Air Force Aircraft Accident Investigation Board Report.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Coulson Aviation
• New South Wales Rural Fire Service
• Coulson Aviation personnel
• Lockheed Martin
• Royal Australian Air Force Aircraft Research and Development Unit
• the Bureau of Meteorology
• ATSB aviation medical specialist
• National Aerial Firefighting Centre
• Civil Aviation Safety Authority
• United States National Transportation Safety Board
• the birddog pilot.

In addition, the draft report was sent to the NSW State Coroner for information.

Submissions were received from:

• Coulson Aviation
• New South Wales Rural Fire Service
• Royal Australian Air Force Aircraft Research and Development Unit
• the Bureau of Meteorology
• Civil Aviation Safety Authority
• the birddog pilot.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 22 January 2020, a Cessna 182Q, registered VH-WNR, took off from Caloundra Aerodrome, Queensland. The pilot was conducting a private sightseeing flight with one passenger on board. At 1624, the aircraft passed the northern tip of Moreton Island at about 1,200 ft in a shallow descent towards nearby Flinders Reef.

The aircraft’s descent rate began to increase with no significant changes to direction or speed. At 1626:26, the pilot made a MAYDAY call identifying the aircraft but not its position or nature of the emergency. At this time, the aircraft was east of Flinders Reef and descending at about 1,400 ft/min through 300 ft with a groundspeed of about 115 kt. The aircraft continued north-east for 15–20 seconds after the MAYDAY call before colliding with water.

On 29 January 2020, the aircraft was located on the ocean floor to the north-east of Flinders Reef, about 45 m from the estimated point of impact with water. The pilot and passenger were not located.

What the ATSB found

The nature of any in-flight emergency or abnormal situation, and any effect it had on the pilot’s ability to control and configure the aircraft for ditching, could not be established.

ATSB analysis found that the engine’s power was reducing over the last part of the flight, over a period of about 100 seconds. At the time of the accident, the weather conditions were conducive to carburettor icing. These conditions are common in the region. However, a conclusion regarding the possible influence of carburettor icing on the development of the accident could not be drawn with any certainty.

The ATSB also found that the pilot had descended over water beyond the glide range of a suitable landing area twice on a previous flight, limiting the options for a forced landing in the event of an emergency.

Safety message

Although it could not be determined whether the aircraft’s descent out of glide range was intentional, pilots are reminded that the operation of single engine aircraft over water should at all times be conducted with consideration of the aircraft’s glide distance to a suitable landing area.

The occurrence

On 22 January 2020, at about 1530 Australian Eastern Standard Time,^[1] a Cessna 182Q, registered VH‑WNR, took off from Caloundra Aerodrome, Queensland. The pilot was conducting a private sightseeing flight with one passenger on board. The flight was being conducted under visual flight rules (VFR).^[2] Weather observations and the short-term forecasts for the area indicated that good visual flying conditions existed at the time of the flight.

The aircraft flew south to the VFR route^[3] at Bribie Island, climbing to transit at 3,500 ft to Moreton Island. At 1606, the pilot reported on the Brisbane Centre air traffic control (ATC) frequency that the aircraft’s position was overhead Tangalooma at 2,500 ft. The pilot broadcast their intention to track south to the southern end of Moreton Island and then north up the eastern side of the island.

Recorded radar data at 5-second intervals indicated that, from about 1613, the aircraft flew north along Moreton Island’s eastern coastline at 1,400–1,500 ft above mean sea level with a groundspeed of 100–110 kt (Figure 1). The wind was about 19 kt from the north-north-east, meaning the aircraft’s airspeed would have been about 120–130 kt.

Figure 1: Flight path of VH-WNR on the accident flight

Source: Google Earth, modified by the ATSB

At 1623, the aircraft commenced a shallow descent (about 162 ft/min) from 1,500 ft. At 1625, the aircraft passed Cape Moreton at the northern tip of the island at about 1,300 ft and continued north-east towards Flinders Reef, at a similar airspeed and descent rate (Figure 2).

Figure 2: Flight path of VH-WNR, near Flinders Reef

Source: Google Earth, modified by the ATSB

At 1625:09, the aircraft passed through an altitude of 1,200 ft and the descent rate began to increase with a concurrent reduction in engine power. At 1626:26, the pilot made a MAYDAY^[4] call on the Brisbane Centre ATC frequency, identifying the aircraft’s callsign but not its position or the nature of the emergency. At this time, the aircraft was east of Flinders Reef and descending at about 1,400 ft/min through 300 ft with a groundspeed of about 115 kt. The air traffic controller attempted to establish contact with the pilot; however, no further transmissions from the aircraft were received.

The aircraft’s transponder continued to transmit. Analysis of the recorded radar data indicated that the aircraft continued north-east for 15–20 seconds, while still descending, after the MAYDAY call. There were no witnesses.

An aerial and marine search was immediately initiated. The aircraft was located on the ocean floor on 29 January 2020, north-east of Flinders Reef (Figure 2). The pilot and passenger were not located.

__________

1. Australian Eastern Standard Time (AEST) is Coordinated Universal Time (UTC) + 10 hours.
2. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
3. VFR routes are transit lanes for aircraft operating under VFR.
4. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.

Context

Pilot information 

The pilot was reported to have flown aircraft overseas and in Australia decades earlier. Logbook records showed that the pilot had an extended break from flying and resumed in late 2019. After conducting 13.5 hours of flight training, the pilot was issued a Civil Aviation Safety Regulation Part 61 Private Pilot (Aeroplane) Licence on 17 October 2019 with a class rating for single engine aeroplanes.

The pilot held a Class 2 Aviation Medical Certificate that was issued on 17 October 2019 and valid until 17 October 2021, with a condition requiring reading correction be available when exercising the privileges of the licence. A review of the pilot’s medical records and interview with a close family member identified no significant medical conditions.

The pilot’s logbook records showed about 1,700 hours total aeronautical experience and previous night VFR^[5] and instrument flight rules^[6] experience. The pilot was also reported to have significant experience on the Cessna 182 type and had flown VH‑WNR 6 times over the previous fortnight, including around Moreton Island (see also Previous flights in VH-WNR). Prior to the accident flight, the pilot’s last logged flight was on 19 January 2020.

Aircraft information

General

The Cessna 182Q is a high-wing, all-metal, unpressurised aircraft with a fixed landing gear. The accident aircraft had a single, Continental O-470-U reciprocating piston engine driving a constant-speed propeller. The engine ignition system comprised two magnetos that provided a self-generated charge to the engine spark plugs and was independent of the aircraft electrical system.

An engine driven alternator supplied electrical power to aircraft systems. The alternator was also used to charge the battery and was controlled by a voltage regulator. A battery supplied power for engine starting and was a reserve source of power in the event of alternator failure.

VH-WNR (Figure 3) was manufactured in 1978 and was first registered in Australia in the same year. The aircraft was privately hired by the pilot for the flight.

Figure 3: VH-WNR in 2019

Source: Aircraft operator

Maintenance history

At the time of the accident, VH-WNR had about 3,318 hours total time in service and had flown about 73 hours since the previous periodic inspection (100 hourly), which was conducted on 21 August 2019. The engine was installed new in December 2013 and had accumulated about 742 hours time in service.

During a flight on 19 January 2020,^[7] the aircraft began to experience electrical issues over a period of about 3 minutes, resulting in the loss of some aircraft systems including the radio and transponder. After landing, engineers identified that the aircraft charging system was unserviceable and the battery had discharged. The battery was charged for the return flight to Caloundra. A new voltage regulator and alternator were fitted and the battery was charged again. On the morning of 22 January 2020, 6–7 ground runs were carried out to test and adjust the replaced components before the aircraft was released to service.

Weight and balance

According to a witness, the pilot visually checked the aircraft’s fuel quantity prior to the accident flight with the aid of a dipstick, which showed there was 135 L on board. A correction was made to the fuel record, which had been incorrectly annotated as 130 L. This amount was more than sufficient fuel for the intended flight.

Based on witness observations as well as estimates of fuel and occupant weights, the aircraft was likely within its weight and balance limits for the entire flight.

Meteorological information

The nearest weather station to the flight path of the aircraft was at Cape Moreton, at the northern end of Moreton Island, 328 ft above sea level. Observations taken at 1600 and 1630 both showed the wind speed at 19 kt from 030°, gusting to 24 kt, with no recorded precipitation.

Other observations at 1630 were:

• temperature – 27.1 °C
• dewpoint – 24.9 °C
• relative humidity – 88%
• QNH^[8] – 1,009.5 hPa.

Satellite images taken at 1620 and 1630 indicated visual meteorological conditions in the vicinity of the northern end of Moreton Island. The 1630 meteorological aerodrome report for Brisbane Airport, about 53 km south-west of Cape Moreton, stated the cloud cover as ‘few’ at 2,000 ft and ‘broken’ at 27,000 ft.^[9]

Another pilot was conducting a training flight in the vicinity of Bribie Island shortly before the accident. That pilot described the conditions and visibility as good for VFR operations with some low-level turbulence. Above 1,000 ft the conditions were smoother with a north-westerly wind at about 18 kt.

Wreckage and impact information

Wreckage location

Immediately after the accident, after being advised by Airservices Australia that contact was lost with VH-WNR, the Queensland Police Service (QPS) and the Australian Maritime Safety Authority (AMSA) commenced an aerial and marine search operation. That evening, floating debris from the aircraft was found and recovered. The following day the marine search focused on a position near Flinders Reef, but the aircraft could not be located.

At the request of the QPS, the ATSB analysed the supplied radar data and refined the estimated position of the aircraft on 28 January 2020. The wreckage was located by the QPS on the morning of 29 January 2020, about 45 m from the supplied coordinates in about 30 m of water. The engine and propeller were found about 10 m north-east of the main wreckage. The QPS took underwater video of the wreckage on 29–30 January 2020.

Partial wreckage recovery

On 6 February, with assistance from the QPS, specialists from the New South Wales Police Force and the Queensland National Parks and Wildlife Service, the ATSB recovered various aircraft components including the engine, propeller and instruments for detailed examination.

Wreckage examination

ATSB examination of the underwater video identified that the aircraft was likely destroyed by collision with water at a moderately high speed (Figure 4). Damage to the aircraft cabin from the collision with water indicated that it was unlikely to be survivable. There was no evidence of fire.

All major aircraft components were accounted for, and there was no evidence of pre-impact defects or structural failure. As far as could be established, cockpit switch positions were configured as expected for normal flight.

The flap control and right flap were found in the ‘up’ position. The left flap was observed to be displaced towards the down position from disruption caused during accident sequence to the adjacent wing structure. One of the front seats was found floating some distance from the wreckage, and the other front seat was not located. The seatbelts for both front seats were found to be attached to the airframe and latched.

The carburettor heat control, used to prevent or recover from engine icing, was in the ‘off’ position. However, due to the disruption of the wreckage, this may not have been indicative of its position prior to the accident.

Figure 4: Wreckage of VH-WNR on the ocean floor

A weight, rope and buoy had been attached to the aircraft tail by the divers.

Source: Queensland Police Service

Engine examination

The engine was disassembled and examined at a Civil Aviation Safety Authority (CASA) approved overhaul facility under the supervision of the ATSB. Apart from impact and submersion damage, the engine was generally in good condition. Some components such as the magnetos, alternator and voltage regulator were extensively damaged by their immersion in seawater and their function could not be tested. No pre-existing defects were evident, and there was no evidence of fire or overheating (Figure 5).

Figure 5: Corrosion damage to the magnetos

Source: ATSB

Propeller examination

The propeller was disassembled and examined at a CASA-approved overhaul facility under the supervision of the ATSB. No pre-existing defects or irregularities were identified. The propeller could not be functionally tested because of internal damage that occurred during the accident sequence.

The propeller blades were observed to be progressively bent out of plane (Figure 6), in a manner indicative of low but non-zero power. The pitch change lugs on all three blades were sheared off, with the direction of the fracture surface smearing being consistent with the blades being forcibly rotated towards low (fine) pitch, which is an indication of low power or windmilling.

Preload plates are fitted to each propeller blade at their base, within the propeller hub. Each blade pitch change lug transverses through a cut-out in the plates. Using damage signatures made by the propeller blade pitch change lugs onto the preload plates (Figure 6, inset), and estimating the propeller speed from the known velocity of the aircraft in the moments prior to impact, an estimate of power and the blade angle at impact was made using established datums with the assistance of the propeller manufacturer. These calculations were limited in accuracy as the preload plates are not indexed (such as with a key or slot), and so during assembly there could be slight variations with their position. The results of the calculations indicated that the propeller was rotating under low power, and with a blade angle at or near the low pitch stop.

Figure 6: VH-WNR propeller blade bending and inset image of example preload plate damage signatures

Source: ATSB

Recorded data

Accident flight radar data

Airservices Australia provided radar data for the accident flight. This data combined primary surveillance radar (PSR) and secondary surveillance radar (SSR) data into a single, smoothed track. PSR has a shorter range than SSR, and is generally less reliable, but it is used to enhance the accuracy of SSR tracks and provide position information when SSR is not available.

Position data for the accident flight was generally recorded at 5‑second intervals, and occasionally at a 4- or 6-second interval. It included Mode C altitude data that was obtained from the aircraft static system referenced to the standard atmospheric pressure (1,013.25 hPa) and rounded to the nearest 100 ft. The aircraft’s average groundspeed between data points was derived from the position and time data.

The approximate position the aircraft collided with water was determined from the system track by extrapolating the estimate of groundspeed and a fitted altitude curve to sea level.

Engine monitoring recorder

The ATSB identified that the only item on the aircraft that was likely to record any data was a J.P. Instruments EDM-700 engine monitoring recorder. The ATSB recovered the instrument, however the recorded data it contained did not include the accident flight.

Additional information

Previous flights in VH-WNR

In the weeks prior to the accident, the pilot flew VH-WNR on the following 6 return flights from Caloundra Aerodrome, with available aircraft tracks shown in Figure 7:

• 1 hours on 8 January as a proficiency check with an instructor (radar data not available)
• 8 hours with one passenger on 11 January (radar data not available)
• 8 hours with two passengers on 14 January (radar data not available)
• 4 hours with two passengers on 15 January (blue line)
• 2 hours with two passengers on 17 January (orange line)
• 1 hours with two passengers on 19 January (red line).

Figure 7: Accident pilot’s previous flights in VH-WNR

Source: Google Earth, modified by the ATSB

On the 15 January flight, the pilot transited between Bribie Island and Moreton Island at about 2,000 ft and 80–90 kt groundspeed. The flight profile was broadly similar to the accident flight past Cape Moreton towards Flinders Reef (Figure 8). On the return leg, the pilot flew from Flinders Reef direct to Bribie Island at about 1,800 ft.

Figure 8: Previous flights and the accident flight compared

Source: Google Earth, modified by the ATSB

ATSB analysis indicated that two segments of the 15 January flight, including between Moreton Island and Flinders Reef, were further from land than the aircraft was capable of gliding with no engine power. Although complete analysis of glide distances was not feasible, the ATSB estimated that the aircraft was also flown near or beyond the limits of its glide range to land on other flights in this area. During the accident flight on 22 January, the aircraft similarly reached a point further from glide distance to land about halfway between Moreton Island and Flinders Reef.

On the 19 January flight, when the aircraft was approaching Moreton Island, the Brisbane Centre controller attempted to contact the pilot to advise that the aircraft was 2 NM west of Moreton Island at 3,900 ft (that is, they had entered controlled airspace by climbing above 3,500 ft in that area). After receiving assistance from the pilot of another aircraft in the area, the pilot of VH-WNR made contact with the controller, who explained the problem. The pilot apologised and stated that the entry to controlled airspace was unintentional, and they confirmed they were now at 3,000 ft approaching the eastern side of the island. The controller reminded the pilot to keep at or below 3,500 ft on the way back to Caloundra. On that flight, the pilot did not descend when travelling along the eastern side of Moreton Island.

As noted in The occurrence, during the accident flight on 22 January, the pilot contacted Brisbane Centre to report they were at 2,500 ft approaching Moreton Island. There was no requirement for the pilot to make a call on that frequency in that area while they remained at or below 3,500 ft.

Analysis of thrust required

A performance analysis was carried out on the last minutes of the accident flight based on the radar data, documented performance characteristics of the aircraft type (such as lift and drag coefficients), and estimates of aircraft weight. The analysis calculated the propulsive power that would be required for the aircraft’s estimated airspeed and altitude. For the section of flight analysed, the aircraft was flown with likely minor changes in heading and pitch, for which the radar data was considered sufficiently accurate. The analysis provided an estimate of the thrust power, not engine power, as efficiencies and other power losses were not calculated.

The analysis relied on the following assumptions:

• Thrust opposed drag along the longitudinal axis of the aircraft.
• The aircraft was not accelerating longitudinally (as indicated by the relatively constant groundspeed).
• The aircraft was not banking, slipping, or accelerating vertically (turbulence).
• Wing flaps were retracted.
• Wind did not vary.

The analysis indicated that there was a reduction in thrust during the last 100 seconds of the flight.^[10] At the end of the recorded data, due to the flight path being flown, the thrust power required by the aircraft was approximately zero.

Speech analysis

The ATSB conducted a basic speech analysis on the pilot’s ATC and Caloundra Aerodrome common traffic advisory frequency (CTAF)^[11] radio transmissions. The pilot’s response times, delay between microphone keying and speaking, microphone un-keying delay, duration to annunciate the aircraft callsign, average speech rate, and voice pitch were analysed. The analysis was inconclusive regarding whether there were any changes to the pilot’s speech during the accident flight.

Carburettor icing

According to the CASA Visual Flight Rules Guide:

Carburettor icing is of particular concern because, unlike airframe icing, the risk of ice build-up in the carburettor can be high even with no visible moisture and an OAT [outside air temperature] of up to 38°C.

Carburettor icing occurs when the air temperature adiabatically decreases sufficiently to condense water vapour and for the localised air temperature to reduce below freezing. Ice builds up as the chilled condensed water makes contact with localised surfaces, such as the butterfly valve and the venturi walls. Carburettors experience additional cooling because of the evaporation of fuel. Furthermore, the risk of carburettor icing is significantly increased at partial power settings (for example, when power is reduced during descent), because of the cooling effect of a partly-closed throttle.

The effect of carburettor icing on aircraft may result in reduced power output, poor engine performance, rough running and in extreme cases engine failure. The onset of this may be evidenced by an unexplained drop in manifold pressure.

The pilot’s operating handbook (POH) for VH-WNR was not recovered. A reviewed sample of Cessna 182Q POHs required pilots who suspect carburettor icing to apply full throttle and set the carburettor heat control to ‘on’ until the engine ran smoothly.

To assist pilots in anticipating the potential for carburettor icing, CASA published a carburettor icing probability chart (Figure 9). The temperature recorded at Cape Moreton at the time of the accident was 27.1 °C, and the dewpoint 24.9 °C. This gave a dewpoint depression of 2.2 °C. The intersection between the resulting temperature and dewpoint lines was just inside the shaded area where ‘serious’ icing under descent power is possible.

Figure 9: Carburettor icing probability chart with local observations

Source: CASA, annotated by the ATSB

An ATSB review of temperature and dewpoint observations for the south-east Queensland region showed that, over a 12-month period, carburettor icing conditions are frequent.

Previous ATSB investigations found to be, or potentially be, related to carburettor icing include:

• AO-2018-050, Wirestrike and collision with terrain involving Cessna 172RG, VH-LCZ, Parafield Airport, South Australia, on 3 July 2018
• AO-2016-059, Engine failure involving Piper PA-28, VH-IPO, Mangalore Airport, Victoria, on 16 June 2016
• AO-2014-149, Collision with terrain involving Van's Aircraft RV-6, VH-TXF near Mudgee Airport, NSW on 14 September 2014
• AO-2012-078, Collision with terrain - Robinson R44, VH-HOU, 93 km S Alice Springs Airport, NT, 10 June 2012.

Flights over water

Civil Aviation Regulation (CAR) 258 (Flights over water) stated:

The pilot in command of the aircraft must not fly over water at a distance from land greater than the distance from which the aircraft could reach land if the engine… were inoperative.

The Aeronautical Information Publication (AIP) stated in ENR 1.1 (section 11.11) that CAR 258 did not apply to charter, aerial work or private operations if each occupant was wearing a life jacket, unless they were exempted from doing so under Civil Aviation Order (CAO) 20.11 (Emergency and life saving equipment and passenger control in emergencies). CAO 20.11 paragraph 5.1.1 (a) stated that a single engine aircraft must carry a life jacket for each occupant when the aircraft was operated over water at a distance from land greater than that it could reach with its engine inoperative. In such cases, paragraph 5.1.7 also stated that each occupant shall wear a life jacket, but this was not required for occupants of aeroplanes during flight above 2,000 ft.  

The operator stated that the pilot was briefed to transit between Bribie Island and Moreton Island (a distance of about 15 km) at 3,500 ft using the VFR route. The operator also stated that, after some previous flights, it briefed the pilot that its preference for the pilot was to not operate on the northern side of Cape Moreton.

The operator stated that it encouraged the pilot to take life jackets on board the aircraft, which was done on previous flights. However, witnesses reported that no life jackets were taken on the accident flight.

Carriage of emergency locator transmitter

The aircraft was fitted with a deceleration-activated emergency locator transmitter (ELT), which was not serviceable at the time of the accident. The carriage of an ELT was not required for flights within 50 NM of the origin. A personal locator beacon was carried on board the aircraft at the time, in the glove box of the aircraft.

Cessna 182 emergency procedures

Engine failure

The POH for the Cessna 182Q contained an emergency procedure for an engine failure in flight. For this scenario, pilots were required to establish a best glide speed of 70 kt with the wing flaps retracted, and to identify a suitable landing area (Figure 10).

Figure 10: Cessna 182Q maximum glide distance chart

Source: Cessna, annotated by the ATSB

Ditching

The POH procedure for ditching included transmitting a MAYDAY message over the radio, unlatching the cabin doors, and establishing a level attitude during descent. If engine power was available, the flaps were to be set to 20–40° and the aircraft established in a 60 kt and 300 ft/min descent. In an engine failure situation, the glide speed and configuration should be 70 kt with flaps up or 65 kt with 10° of flap.

__________

5. Night VFR: flight at night that meets the visibility requirements for VFR operations.
6. Instrument flight rules: a set of regulations that permit the pilot to operate an aircraft to operate in instrument meteorological conditions, which have much lower weather minimums than VFR. Procedures and training are significantly more complex as a pilot must demonstrate competency in instrument meteorological conditions while controlling the aircraft solely by reference to instruments.
7. This flight was conducted by a different pilot to that of the accident flight.
8. QNH: the altimeter barometric pressure subscale setting used to indicate the height above mean seal level.
9. Cloud cover: in aviation, cloud cover of the sky is reported using words/abbreviations that denote the extent of the cover. ‘Sky clear’ (SKC) indicates no cloud, ‘few’ (FEW) indicates 1–2 oktas (or eighths) is covered, ‘scattered’ (SCT) indicates 3–4 oktas is covered, ‘broken’ (BKN) indicates 5–7 oktas is covered, and ‘overcast’ (OVC) indicates that 8 oktas is covered.
10. This type of analysis cannot always distinguish between an increase in drag and a decrease in thrust. However, with no evidence of in-flight damage and the aircraft’s flaps likely retracted, there would have been no significant source of increased drag.
11. A common traffic advisory frequency is a designated frequency on which pilots make positional broadcasts when operating in the vicinity of a non-controlled aerodrome or within a broadcast area.

Safety analysis

Descent and impact with water

The aircraft’s flight path was not indicative of uncontrolled flight, and no pre-existing defects with the aircraft could be identified. Other than a likely gradual loss of engine power, discussed below, there was no evidence of engine overheating, fire, loss of control, or other in-flight emergencies. However, as the entire aircraft could not be recovered, it was not possible to verify the operation of all aircraft systems.

The existence of secondary surveillance radar data for the aircraft almost to its collision with water, as well as the reception of the MAYDAY call, indicated that the aircraft’s electrical systems were receiving power. However, it was not possible to determine whether this was battery or alternator power. In any case, electrical power was not necessary for flight or ditching.

Analysis of the radar data showed there was likely a gradual reduction in thrust (and therefore engine power) during the last 100 seconds of the flight, and that this correlated with the increasing descent rate. The impact signatures on the propeller and propeller pitch change lugs were also consistent with a low level of engine power or windmilling at impact. Although the power reduction may have been due to pilot action, no reason for doing so at this point in the flight could be identified.

The aircraft maintained a moderately high speed until radar contact was lost at about 180 ft. Had the engine been inoperative, the radar data would have indicated a significantly steeper descent profile.

Regardless, a gradual reduction in engine power should not necessarily lead to very serious consequences. If detected early enough, with a suitable emergency landing area within range, a pilot could attempt to land. If no such landing area was available, a pilot could attempt a forced landing or ditching.

In this case, the aircraft maintained course away from suitable landing areas at a speed well above the aircraft’s best glide speed. The pilot may have been initially unaware of the gradual reduction in power and resulting descent. Although this would have been indicated on the aircraft’s instruments, the constant-speed propeller would maintain engine and propeller speed, and a gradual power loss would result in little or no change in sound and feel.

The MAYDAY call shortly before the impact indicated that the pilot was not totally incapacitated. However, in the absence of other evidence, a partial incapacitation could not be excluded.

The aircraft’s final position on the sea floor close to the last radar position strongly indicated that it continued along the established flight path without turning or, more critically, reducing descent rate and speed for a ditching. Furthermore, examination of the video footage of the wreckage on the sea floor showed the flaps were likely up at impact and that the aircraft had been significantly disrupted by a relatively high-speed collision with water.

In summary, the nature of any in-flight emergency or abnormal situation, and any effect it had on the pilot’s ability to control and configure the aircraft for ditching, could not be established.

Descent over water beyond glide range

On 15 January 2020, the pilot descended over water beyond the maximum glide distance of a suitable landing area for a Cessna 182Q during two segments of that flight. However, there was insufficient evidence to determine if an emergency landing on Moreton Island was possible had the pilot been able to turn the aircraft and establish the optimal glide speed. Nevertheless, flight outside of the glide range of a suitable landing area limits the opportunities for recovery in the event of an engine failure or other emergency. The same situation occurred on the accident flight, although the extent to which this was intentional could not be determined.

Carburettor icing

Carburettor icing can be insidious in its development and have serious consequences. Weather observations taken at Cape Moreton at the time of the accident, and plotted on the carburettor icing probability chart, showed that carburettor icing was possible. The plotted point was just inside the serious icing range at descent power and adjacent to the light icing range in cruise or descent power.

The likely reduction in power in the last 100 seconds of recorded flight could plausibly have been due to carburettor icing. However, carburettor icing conditions are frequently encountered in the region, and prevention and management of carburettor icing is easily done through use of carburettor heating. As the pilot had significant experience on the Cessna 182, they would very likely have been familiar with the use of carburettor heating. Due to wreckage disruption during the impact sequence, the position of the carburettor heat control during the accident flight could not be established. Overall, a conclusion regarding carburettor icing could not be drawn with any certainty.

Findings

From the evidence available, the following findings are made with respect to the collision with water involving Cessna 182, registered VH-WNR, 6 km north-west of Moreton Island, Queensland, on 22 January 2020.

Contributing factors

• After passing the northern end of Moreton Island at 1,200 ft, the aircraft continued descending away from the island at about 110 kt groundspeed, with no significant change in direction and with reducing engine power. The pilot broadcast a MAYDAY when passing 300 ft; however, for reasons that could not be determined, the flight path and speed of the aircraft did not significantly change after this point until it collided with water.

Other factors that increased risk

• The pilot had descended over water beyond the glide range of a suitable landing area twice on a previous flight, limiting the options for a forced landing in the event of an emergency.
• At the time of the accident, the meteorological conditions were conducive to carburettor icing. However, such conditions are common in the region, and able to be easily managed with the aircraft’s carburettor heat control.

Other findings

• From the limited evidence available, no pre-existing aircraft defects could be identified.

Glossary

AMSA              Australian Maritime Safety Authority

ATC                 Air traffic control

CASA              Civil Aviation Safety Authority

POH                Pilot’s operating handbook

PSR                Primary surveillance radar

QPS                Queensland Police Service

SSR                Secondary surveillance radar

VFR                Visual flight rules

Sources and submissions

Sources of information

The sources of information during the investigation included:

• another pilot who flew VH-WNR
• the aircraft operator
• Civil Aviation Safety Authority
• Queensland Police Service
• the maintenance provider
• Hartzell propeller
• Airservices Australia
• Bureau of Meteorology.

References

National Aeronautics and Space Administration 1973, Point and path performance of light aircraft, Contractor report NASA CR-2272.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the aircraft operator
• the maintenance provider
• Civil Aviation Safety Authority
• US National Transportation Safety Board
• Hartzell propeller.

Submissions were received from the aircraft operator, the Civil Aviation Safety Authority, and Hartzell propeller. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the afternoon of 12 January 2020, the pilot of an amateur-built Wittman Tailwind aircraft, registered VH-TWQ (TWQ), departed Evans Head Airport, New South Wales, with one passenger on board. The pilot was conducting a private flight under the visual flight rules from Evans Head, to Boonah, Queensland.

The pilot flew in a north-north-westerly direction towards Boonah via the Richmond River valley. At 1353, the pilot commenced a 180° turn overhead the township of Kyogle and diverted, due to the weather, south back down the valley to Casino Aerodrome, landing at 1406.

At 1454, the pilot took off from Casino and flew in a west-north-westerly direction. At 1512 TWQ commenced a series of rapid descents and climbs followed by a descending left turn. The turn and descent continued until TWQ collided with terrain. The pilot and passenger were fatally injured, and the aircraft was destroyed.

What the ATSB found

The ATSB found that the pilot departed an interim landing site for Boonah under the visual flight rules with a high risk of encountering forecast cloud. En route to Boonah, the aircraft entered an area of reduced visibility and the pilot likely became spatially disorientated resulting in a loss of control and collision with terrain.

Safety message

Weather-related accidents remain one of the most significant causes of fatal accidents in general aviation and continues to be a focus of the ATSB’s SafetyWatch initiative. SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns relates to inflight decision making, particularly involving pilots flying with reduced visual reference. SafetyWatch provides information about each safety concern, and strategies to help manage risk areas, along with links to safety resources. In relation to visual flight rules (VFR) pilots flying into areas of reduced visibility, some key messages are:

• Pilots should avoid deteriorating weather by conducting thorough pre-flight planning. They should ensure they have alternate plans in case of an unexpected deterioration in the weather and make timely decisions to turn back, divert or hold in an area of good weather.
• VFR pilots should use a ‘personal minimums’ checklist to help control and manage flight risks through identifying risk factors that include marginal weather conditions and only fly in environments that do not exceed their capabilities.
• Pilot’s should consider reducing speed and/or altering the configuration of the aircraft to allow more time for decision making and manoeuvring in areas of deteriorating or marginal weather conditions
• Pressing on into instrument meteorological conditions without a current instrument rating carries a significant risk of severe spatial disorientation due to powerful and misleading orientation sensations with reduced visual cues. Disorientation can affect any pilot, no matter what their level of experience.
• If VFR pilots find themselves in marginal weather and becoming disoriented or lost, they should seek whatever help is available. Air Traffic Services (ATS) may be able to provide assistance, especially if the aircraft is in ATS surveillance coverage. There have been a number of reported occurrences where this simple action has averted potential disaster.

The occurrence

On Friday, 10 January 2020 the pilot of an amateur-built Wittman Tailwind aircraft, registered VH‑TWQ (TWQ), departed Toowoomba, Queensland, and flew via Boonah, to Evans Head, New South Wales. The purpose of the flight was to pick up a passenger at Boonah and then attend the Great Eastern Fly-In (Fly-In) at Evans Head. The Fly-In was planned for the weekend of 11‑12 January. However, due to poor weather, the event program was significantly disrupted.

On the morning of 12 January 2020, the pilot attended the Fly-In event briefing which included the meteorology for the day. The event was cancelled at 0830 due to the cloud base at Evans Head being approximately 1,000 ft above ground level (AGL) with a reduction to 600 ft AGL forecast during the day. Due to the cancellation of the event the pilot elected to return to Toowoomba and contacted relatives there for an update on the weather. They sent photos of the local conditions and said the cloud at Toowoomba was not really low, there was no wind and there had been some rain. At 1336 Eastern Daylight-saving Time,^[1] the pilot departed Evans Head Airport , with one passenger on board. The pilot was conducting a private flight under the visual flight rules^[2] to Toowoomba via Boonah (Figure 1).

Figure 1 - Accident flight departure, destination and accident locations

 Source: Google Earth, annotated by the ATSB

The pilot flew in a north-north-westerly direction towards Boonah via the Richmond River valley (Figure 2). The aircraft reached a maximum altitude of 1,950 ft above mean sea level^[3] just prior to reaching Kyogle. At 1353, the pilot commenced a 180° turn overhead the township of Kyogle and diverted, likely due to low cloud on their intended flight path. At 1357 a family member contacted the passenger as they had seen the turnaround overhead Kyogle on OzRunways.^[4] The passenger replied to say they were ‘going home due low cloud’. The pilot flew south back down the valley to Casino Aerodrome, landing at 1406.

During the time on the ground at Casino, the pilot contacted a friend in the area and left a voice message. The message stated they could not get past Kyogle due to the weather, so they had landed at Casino. (refer to the section titled Meteorological information below.)

Figure 2 - Flight tracks for VH-TWQ on 12 January 2020

Source: Flightradar24 and Google Earth, annotated by the ATSB

At 1454, the pilot took off from Casino and flew in a west-north-westerly direction. At 1510 TWQ commenced a series of rapid descents and climbs, between 3,100 and 4,000 ft, followed by a left descending turn. Shortly afterwards TWQ collided with terrain. The pilot and passenger were fatally injured, and the aircraft was destroyed. There were no witnesses to the accident.

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) +11 hours.
2. Visual flight rules (VFR): a set of regulations that permit a pilot to operate an aircraft only in weather conditions generally clear enough to allow the pilot to see where the aircraft is going.
3. Above mean sea level (AMSL): All altitudes and heights will be referenced to AMSL unless otherwise stated.
4. The OzRunways application is an electronic flight bag. An electronic flight bag is a portable information system for flight deck crew members which allows storing, updating, delivering, displaying and/or computing digital data to support flight operations or duties. It provides the option for live flight tracking by transmitting the device’s position and altitude

Context

Pilot information

General information

The pilot held a Private Pilot Licence (Aeroplane) issued in July 1982 and was qualified to fly by day under the visual flight rules. The pilot also held a single-engine aeroplane class rating. The pilot last conducted a single-engine aeroplane flight review in June 2018 that was valid until June 2020. The pilot had about 1,200 hours flying experience recorded in the pilot’s logbook with a total of about 140 hours on the Wittman Tailwind. In the 90 days prior to the accident, the pilot had flown 12.4 hours total, of which 11.2 hours were in TWQ.

The pilot’s logbook showed a total of 8.4 hours instrument flying experience. Of these, 5 hours were accumulated between 1982 and 1983. The remaining 3.4 hours were accumulated from 1986 to 2015. The pilot did not hold an instrument rating.

Medical information

The pilot held a Class 2 aviation medical certificate that was valid until October 2021 with two restrictions noted. One restriction required distance vision correction be worn and the other required reading correction to be available during flight.

The pilot was reported to be in good health and not taking any medications at the time of the accident.

Due to the pilot being away from home for the days preceding the accident, a detailed 72-hour history could not be obtained. From the limited information available there were no fatigue‑related concerns identified.

A limited post-mortem examination and toxicological screening was performed. There was nothing found to support incapacitation.

Aircraft information

Overview

VH-TWQ (TWQ) was a Wittman Tailwind, an amateur-built aircraft in the experimental category. TWQ had a two seat, side-by-side seating arrangement. The structure was a combination of tubular steel frames and fabric covering on the fuselage. Wooden wing ribs had a bonded plywood skin covering. The flight controls consisted of push-pull type control tubes. All flight controls and flaps were fabric covered. The Wittman had a fixed undercarriage in a taildragger configuration.

TWQ was fitted with a Lycoming XIO-320^[5] four cylinder, horizontally opposed piston engine and was fitted with a ground adjustable Whirlwind two-bladed composite propeller.

Entries in the logbook indicated that the owner-pilot commenced construction of the aircraft as an amateur builder in January 2006. The aircraft was completed in August 2018. A CASA authorised person issued a special certificate of airworthiness in the experimental category on 25 December 2018.

On 28 June 2019, the pilot issued a maintenance release that was valid for 12 months. This allowed the aircraft to be operated privately under the day visual flight rules. The aircraft flew for 33.3 hours between 28 June 2019 and the day of the accident. No defects or unserviceable equipment endorsements were recorded on the maintenance release.

The last entry in the aircraft’s maintenance records was the change, by the pilot, of the engine oil and filter in October 2019. The pilot changed the engine oil filter in accordance with the maintenance schedule.

Operating limitations

Aircraft operating limitations were contained within the flight manual for the aircraft and relevant limitations are detailed in Table 1 and Table 2.

Table 1 – Airspeed limitations

Table 2 - Stall speeds

Navigation / cockpit instruments

The aircraft was fitted with a Garmin G3X (G3X) flight display, capable of displaying the engine monitoring instruments, primary flight instruments and navigation information.

The pilot was reported to navigate primarily by using paper maps, using the main Garmin screen to display attitude and heading information as well as engine parameters. The pilot had an iPad mounted beside the G3X unit running the OzRunways application. It was reported that the pilot’s use of OzRunways navigation and flight planning features was limited to using the direct to function which plotted a track from the aircraft’s current location to a desired destination. The pilot was also reported to use the weather radar overlay function on OzRunways. This overlay displayed rain when detected by radar but did not display the presence of clouds.

Wreckage and accident site information

Accident site

The accident site was located in dense rainforest, about 72 km west-north-west of Casino, within the Tooloom National Park (Figure 2). The New South Wales Police Rescue and Bomb Disposal Unit assisted ATSB investigators to access the site on foot.

The accident site was on the eastern side of a ridgeline at an elevation of 3,170 ft. The highest ground in the immediate area of the accident site was approximately 3,200 ft.

Wreckage examination

The aircraft’s structure was substantially disrupted (Figure 3). The wreckage trail was about 120 m long on a bearing of approximately 270°. All major aircraft components were located at the accident site. ATSB investigators did not identify any signs of pre-existing airframe damage. Due to the disruption of the airframe, the aircraft’s attitude when it entered the tree canopy could not be determined. There was no evidence of fire. Site and wreckage examination did not identify any defects or anomalies that might have contributed to the accident.

Figure 3 - VH-TWQ’s empennage at the accident site

Source: ATSB

Engine and propeller

On-site examination of the engine and propeller did not identify any defects that could have contributed to the accident. Damage noted to the propeller, during this examination, were consistent with the engine producing significant power at the time of the accident.

Flight control system

All primary and secondary flight controls were located on-site. An examination of the flight control systems did not identify any faults that could have contributed to the accident.

Fuel

The fuel tank was located toward the end of the wreckage trail. It was torn from the fuselage and had ruptured. Rain had entered the tank post-accident, therefore the fuel that remained in the tank was not tested.

Weight and balance

The on-site examination found a small amount of lightweight cargo. It was reported that the occupants took minimal cargo with them when they departed for the weekend. Weight and balance was calculated using full fuel and maximum baggage on departure out of Toowoomba and was calculated to be within limits. The aircraft did not refuel again after departing Toowoomba. Weight and balance was also calculated for the expected fuel remaining at the time of the accident and was also within limits.

Emergency locator transmitter

The aircraft was not fitted with an ELT, nor was it required to be. An Emergency Position Indicating Radio Beacon was located in the wreckage and had not been activated. This unit was tested on-site and functioned as required.

Operational Information

The flight from Evans Head to Boonah required the pilot to cross the McPherson Range (Figure 4). The McPherson Range is a spur of the Great Dividing Range, heading in an easterly direction from near Wallangarra, Queensland, to the coast. It also forms part of the border between New South Wales and Queensland.

Figure 4 - Accident site and McPherson Range

 Source: Google Earth and Flightradar24, annotated by the ATSB

Terrain across the range varies in altitude with several areas above 3,000 ft and some peaks above 4,000 ft.

The initial flight from Evans Head to Casino, indicated that the aircraft was attempting to cross the ranges via a route known as the ‘border loop’. The border loop is a route commonly used by VFR pilots to transit the range. Tracking is north up the Richmond River valley, past the town of Kyogle, then over the ranges where the railway cuts through the high ground.

Another common route over the ranges is to fly via the Toonumbar Dam, then Killarney to Warwick, which is similar to the track of the second flight. Another pilot who attended the Fly‑In reported that when attempting to fly over the ranges they use a minimum of 4,000 ft, and normally fly over the range at about 5,000 ft.

Meteorological information

Bureau of Meteorology forecast

The planned flight from Evans Head to Boonah traversed two Graphical Area Forecast (GAF)^[6] areas. The accident site was located on the border of the GAF NSW East (NSW-E) and the GAF QLD South (QLD-S). 

Forecast weather conditions in the GAF for NSW-E, valid from 1000 to 1600 on 12 January 2020, that potentially affected the flight included:

• Average conditions of greater than 10 km visibility with areas of broken^[7] stratocumulus clouds between 3,000 and 6,000 ft
• Widespread smoke reducing visibility to 8,000 m
• Isolated showers of rain reducing visibility to 4,000 m with associated cloud including broken stratus 1,000 to 2,000 ft and broken cumulus, stratocumulus 2,000 to 8,000 ft
• Isolated thunderstorms and rain reducing visibility to 2,000 m with associated cloud including isolated cumulonimbus 6,000 to above 10,000 ft, broken stratus 500 to 2,000 ft and broken stratocumulus 2,000 to 6,000 ft
• Isolated smoke over land reducing visibility to 1,000 m
• Moderate turbulence is implied in cumulous, stratocumulus and altocumulus cloud. Severe turbulence is implied in thunderstorms, cumulonimbus and towering cumulus

The GAF for QLD-S was valid from 0900 to 1500. Forecast conditions that potentially affected the flight included:

• Average conditions of greater than 10 km visibility with areas of scattered stratus 1,500 to 3,000 ft, scattered cumulus and stratocumulus 2,500 to 7,000 ft, and further cloud layers above 8,000 ft
• Isolated dust and smoke reducing visibility to 7,000 m and 5,000 m respectively
• Scattered rain reducing visibility to 5,000 m with associated broken stratus 1,200 to 4,000 ft, broken stratocumulus 5,000 to 8,000 ft and broken altocumulus and altostratus 8,000 to above 10,000 ft
• Scattered showers of rain reducing visibility to 3,000 m with associated occasional towering cumulus 5,000 to above 10,000 ft and broken stratus 1,200 to 3,000 ft
• Isolated thunderstorms and rain reducing visibility to 2,000 m with associated isolated cumulonimbus 4,000 to above 10,000 ft, broken stratus 1,500 to 4,000 ft and broken stratocumulus 4,000 to 6,000 ft
• Moderate turbulence is implied in cumulous, stratocumulus and altocumulus cloud. Severe turbulence is implied in thunderstorms, cumulonimbus and towering cumulus

Neither of the GAFs were corrected and no SIGMETs or AIRMETs affecting the QLD-S area were issued during the validity period. An AIRMET was issued for the NSW-E GAF region, however this was for an area to the west of the flight path and did not affect the conduct of this flight.

The Bureau of Meteorology (BoM) Grid Point Wind and Temperature forecast valid at the time of the flight, forecast the wind to be 20 kt from 160° at 2,000 ft and 19 kt from 130° at 5,000 ft.

The BoM also provided an aerodrome forecast (TAF)^[8] for Ballina and Lismore. Lismore Aerodrome was the closest aerodrome to the flight path with a TAF available. TWQ flew within 9.7 km of Lismore aerodrome on the flight from Evans Head to Casino. Lismore is located 20 km east north east of Casino with an elevation of 35 ft. The amended Lismore TAF, issued at 1145 on 12 January 2020, was valid from 1300 on the day of the accident. The TAF forecast 14 kt winds from 160°, visibility greater than 10 km and light showers of rain. Cloud was forecast to be scattered with a base of 2,000 ft above the aerodrome and broken with a base 3,000 ft above the aerodrome. The forecast indicated that between 1300 and 1700 there would be temporary periods, greater than 30 minutes but less than 60 minutes in duration, of deteriorating weather conditions. These conditions included visibility reducing to 4,000 m, showers of rain and broken cloud with a base of 1,000 ft above the aerodrome.

Great Eastern Fly-In event meteorology

On the morning of 12 January 2020, the pilot of TWQ attended the Fly-In pilot’s briefing which included the meteorology for the day. The briefing, delivered by event staff, included weather information based on forecasts available from the BoM for Evans Head, the surrounding airfields and the GAF NSW-E. The display was cancelled at 0830 during the briefing due to the cloud base at Evans Head being approximately 1,000 ft above ground level (AGL) with a reduction to 600 ft AGL forecast during the day.

Bureau of Meteorology observations and analysis

The BoM reported that there were no observations of the actual conditions at the location of the accident. The BoM commented that the winds south of the McPherson Range, below 5,000 ft, would have been south-west to south-easterly. The generally southerly wind flow, heading towards the range, would be consistent with orographic cloud^[9] formation. The BoM noted that the forecast broken cloud at 3,000 ft was likely to be a reasonable representation of the conditions. The BoM also stated that the summits of Wilsons Peak at 4,030 ft and Mount Barney 4,430 ft are higher than the bases of the cloud forecast in this area. No thunderstorm activity was detected near the flight path from Casino.

Lismore airport observations

Half hourly observations^[10] were recorded at Lismore Airport on the day of the accident. At 1500, the wind was from 170° at an average speed of 11.1 kt, with a gust of 15.9 kt recorded. The temperature was 23.2 °C and the mean seal level pressure was 1014.4 hectopascals (hPa). Cloud was overcast with a base of 3,300 ft. 

Casino aerodrome weather recordings

The Casino Automatic Weather Station (AWS) recorded several weather parameters on the day of the accident. At 1500, the wind at Casino Aerodrome was from 170° at an average speed of 6 kt and the temperature was 23.6 °C. No cloud data is available for Casino AWS, as no ceilometer is installed at this location.

Witness observations of weather

Local residents

Residents in the vicinity of the accident location confirmed that the top of the ridgeline, where the accident site was located, was in cloud on the afternoon of the accident. Several of the witnesses commented they could see about three quarters of the way up the ridgeline, which was calculated to be approximately 2,800 ft. These residents commented that it was an overcast day and it had been raining on and off throughout the day.

Tooloom fire tower weather observations 

The Forestry Corporation of New South Wales has several observation towers positioned in the region of the flight. The Tooloom tower is located closest to the flight path from Casino, at an elevation of 2,619 ft (Figure 5).

An observer was positioned in the tower on 12 January from 0900 to 1500 and recorded weather conditions on the hour. Throughout the day, visibility remained at 0 km, with the cloud recorded as 8 oktas. In addition, the relative humidity was recorded at 98 per cent or above throughout the day. The wind was from the south-south-east around 9 kt with an average gust of 19 kt.

Figure 5 – Tooloom fire tower location and proximity to flight track

Source: Google Earth and Flightradar24, annotated by the ATSB

Flight track proximity to Tooloom Fire Tower

At 1509, TWQ, at its closest, passed 4.23 km to the west-south-west of the Tooloom Fire Tower (Figure 5). The aircraft was tracking from the south-east to the north-west. At 1509 the aircraft was at 3,575 ft, with a ground speed of 141 kt and tracking 332°. Tooloom Fire Tower has an elevation of 2,619 ft, and was in cloud at 1500, as it had been since 0900.

Pilot access to weather information

On the morning of the accident, the pilot attended the Fly-In event briefing which included weather for the event and the area. There was no log recorded indicating that the pilot accessed the weather information through the National Aeronautical Information Processing System (NAIPS) on the day of the accident. However, it is possible that the pilot obtained additional weather information from other sources.

Recorded data

Overview

The aircraft was fitted with a Mode S transponder that broadcast ADS-B^[11] data which included the position and altitude of the aircraft. The data was received by Flightradar24 and provided to the ATSB. Also on-board was a mobile device with the OzRunways electronic flight bag (EFB) application installed. The application had an option enabled for live flight tracking by transmitting the device’s position and altitude. OzRunways information was also obtained by the ATSB. This data had a sampling rate of every 5 seconds.

The ATSB compared the data from both sources and they were found to be consistent. The flight data from OzRunways was plotted for the accident flight along with the terrain elevation. (Figure 6).

Figure 6 - OzRunways data and terrain elevations for the final flight of TWQ

Figure 5 shows the aircraft’s flight data from OzRunways. Groundspeed is annotated in red, altitude in light blue and track in black. The altitude of Tooloom fire tower is also marked in blue. This line starts from the time where TWQ was abeam the fire tower. Terrain directly underneath the flight path is marked in green.

Source: OzRunways, US National Aeronautics and Space Administration Shuttle Radar Topography Mission data and ATSB

The first climb on the graph is part of the departure from Casino aerodrome. On a track generally to the north-west. The aircraft reached 3,000 ft and then descended to 2,200 ft.

The climb that commenced at approximately 1502 corresponded with the first range of high ground en route. A groundspeed of about 145 kt was maintained during this climb. The climb commenced at 2,200 ft and reached a peak of 4,100 ft.

The following descent from 4,100 ft to 3,100 ft, corresponded to a ground speed increase from 145 kt to 173 kt and a rate of descent of about 600 feet per minute. The altitude of TWQ at the bottom of this descent was above the altitude of Tooloom Fire Tower (Figure 6).

Over the last 4 minutes of the flight, the aircraft’s recorded groundspeed, rate of climb/descent and altitude oscillated significantly over short periods with the aircraft’s:

• ground speed varying rapidly between 109 and 175 kt,
• rate of climb and descent being between maximum values of +2,400 ft per minute and -2,400 ft per minute,
• altitude oscillating between 4,000 and 3,100 ft.

At approximately 1512 the final descent and turn towards the high ground commenced. The descent commenced from 4,000 feet with the aircraft travelling at 133 kt groundspeed and tracking 316°.

The last data point was recorded at 1512:49. The aircraft was passing 3,100 ft with an 1,800 feet per minute rate of descent. It was travelling at 172 kt groundspeed and tracking 276°.

Of note, during the last few minutes of flight, prior to the collision with terrain, TWQ maintained more than 1,000 ft clearance with the ground and in most places more than 2,000 ft above the ground.

G3X flight display

The G3X unit can log flight and engine data on a removable SD card, or additionally to an internal Flight Log. The G3X unit was badly damaged in the accident sequence. The SD card and a number of circuit boards from the G3X unit were recovered from the accident site. The SD card was found in the read only mode and therefore did not contain any data from the accident flight. While some flight data was able to be recovered from the internal memory, the last recovered flight data was from 30 December 2019.

Air Traffic Control

TWQ was operating outside controlled airspace at the time of the accident. The Brisbane Centre audio recording was obtained from Airservices for the New England area, which covered the accident flight path. There were no radio calls recorded from TWQ, however, they were not required to make any routine radio calls on this frequency.

Additional information

Visual Flight Rules

The CASA Visual Flight Rules Guide outlined that flight under the visual flight rules (VFR) can only be conducted in Visual Meteorological Conditions (VMC).^[12] Additionally, when operating at or below 2,000 ft above the ground or water, the pilot must be able to navigate by visual reference to the ground or water.

The flight, and the location of the accident, were in (non‑controlled) Class G airspace. The following conditions were stipulated for flight under the VFR in Class G airspace when below 10,000 ft and above 3,000 ft or 1,000 ft above ground level (whichever is higher):

• a flight visibility of 5,000 m
• a minimum vertical distance of 1,000 ft and horizontal distance of 1,500 m from cloud.

In the case of aeroplane operations in Class G at or below 3,000 ft or 1,000 ft above ground level (whichever is higher), the following minimum conditions were stipulated:

• a flight visibility of 5,000 m
• that the aeroplane shall be maintained clear of cloud and in sight of the ground or water

In addition to minimum visibility and distance from cloud, a pilot is also required to maintain a minimum height above the ground. CAR 157 details that a pilot in command must not fly the aircraft over:

• any city, town, or populous area at a height lower than 1,000 ft; or
• any other area at a height lower than 500 ft.

This does not apply if through stress of weather or any other unavoidable cause it is essential that a lower height be maintained.

Risks of flying in areas of reduced visual cues

The safety risks of VFR pilots flying from VMC conditions into instrument meteorological conditions (IMC)^[13] are well documented. This has been the focus of numerous ATSB reports and publications, as VFR pilots flying into IMC represents a significant cause of aircraft accidents and fatalities. In 2013, the ATSB Avoidable Accidents series was re-published. Of these publications, the booklet titled Accidents involving pilots in Instrument Meteorological Conditions outlined that:

In the 5 years 2006–2010, there were 72 occurrences of visual flight rules (VFR) pilots flying in instrument meteorological conditions (IMC) reported to the ATSB…About one in ten VFR into IMC events result in a fatal outcome.

In another occurrence investigation,^[14] the ATSB has found that the ‘continuation of flight towards an area of low cloud and rain was likely influenced by the inherent challenges of assessing low visibility conditions, particularly without instrument flying proficiency.’ This finding was based on the following references.

The United States National Transportation Safety Board (NTSB) (2005) found that ‘reduced-visibility weather represents a particularly high risk to [general aviation] operations’ and that ‘weather may…test the limits of pilot knowledge, training, and skill to the point that underlying issues are identified.’ The NTSB study also outlined that historically, about two-thirds of all general aviation (GA) accidents that occur in IMC are fatal, a rate much higher than the overall fatality rate for GA accidents.

Wiegmann and Goh (2000) explained that pilots may make errors in assessing the deteriorating weather conditions and decide to continue to VFR flight into the adverse weather. The previously mentioned NTSB report (2005) added that in these cases, pilots who might appear to intentionally engage in risky behaviour may actually be making choices that they mistakenly believe to be safe by underestimating the risks associated or overestimating their ability to handle the risks.

Wiggins and O’Hare (1995) further explained how errors in assessment can take place, acknowledging that weather-related decision making can be highly complex and therefore more prone to errors:

Because of the variable nature of operations in the aviation environment, weather-related decision making is often considered a skill that cannot be prescribed during training. Rather it is expected to develop gradually through practical experience. However, in developing this type of experience, relatively inexperienced pilots may be exposed to hazardous situations with which they are ill‑equipped to cope.

ATSB Aviation Research and Analysis Report B20070063, An overview of spatial disorientation as a factor in aviation accidents and incidents, stated that pilots should not attempt to fly into instrument meteorological conditions under the VFR. Pilots should develop a plan prior to take-off on what to do if the weather en route is different from that expected or deteriorates. This plan should consider a requirement to divert or turn back prior to entering instrument meteorological conditions. However, this depends on a pilot correctly assessing the weather conditions. The NTSB (2005) noted that targeted weather-related training programs have had some success in teaching pilots to recognise and respond to deteriorating weather conditions.

A cue-based training system called Weatherwise, was made available to pilots by the Civil Aviation Safety Authority (CASA). Additionally, CASA produced a Weather to Fly education program which focuses on topics such as the importance of pre-flight preparation, making decisions early, and talking to ATC.

One of the ATSB’s SafetyWatch priorities concerns in-flight decision making in relation to VFR flight in environments with reduced visual references. One of the key messages is for pilots to avoid deteriorating weather by conducting thorough pre-flight planning and to have alternate plans in case of an unexpected deterioration in the weather and making timely decisions to turn back or divert.

Spatial disorientation

Spatial disorientation is a type of loss of situation awareness, and is different to geographical disorientation, or incorrectly perceiving the aircraft’s distance or bearing from a fixed location. Spatial disorientation occurs when pilots do not correctly sense their aircraft’s attitude, airspeed or altitude in relation to the earth’s surface. In terms of an aircraft’s attitude, spatial disorientation is often described simply as the inability to determine ‘which way is up’, although the effects can often be more subtle than implied by that description.

Spatial disorientation occurs when the brain receives conflicting or ambiguous information from the sensory systems. It is likely to happen in conditions in which visual cues are poor or absent, such as in adverse weather or at night.^[15] Spatial disorientation presents a danger to pilots, as the resulting confusion can often lead to incorrect control inputs and resultant loss of aircraft control.

Research on spatial disorientation indicates that, for pilots who are not instrument rated, loss of control will likely occur between about 60 seconds (Benson, 1988 in Gibb, Gray and Scharff, 2010) and 178 seconds on average (Bryan, Stonecipher, & Aron, 1954) after the loss of visual reference. These studies led to the FAA’s and CASA’s ‘178 seconds to live’ educational campaigns. Gibb, Gray and Scharff (2010) also stated that ‘spatial disorientation accidents have fatality rates of 90–91 percent, which indicates how compelling the misperceptions can be.’

Related Occurrences

There have been a number of accidents relating to VFR pilots flying into reduced visibility conditions. Many of these occurrences have been summarised in the research reports previously mentioned (B2005/0127 and AR-2011-050) as well as in ATSB accident reports (for example, AO‑2015-131 and AO-2016-006). Of particular interest are those occurrences where pilots have avoided an accident outcome by seeking assistance from other aircraft or from ATC. Of note are two occurrences that occurred on the same day in a similar location but with a very different outcome. See below for details.

ATSB Investigation AO-2017-061

On 16 June 2017, a Cessna Aircraft Company C172M, registered VH-FYN, was being operated on a private flight from Southport Mason Field, Queensland to Ballina Airport, New South Wales. The purpose of the flight was to ferry the aircraft to Ballina for scheduled maintenance. Enroute, near the town of Bangalow New South Wales, the aircraft entered an area of reduced visibility, including low cloud, fog and drizzle. The aircraft diverted off the initial track and was last seen disappearing into cloud heading inland. A short time later the aircraft collided with terrain and the pilot was fatally injured.

ATSB occurrence 201702740

On 16 June 2017, the pilot of a light aircraft was flying under VFR from Taree, New South Wales, to Southport, Queensland. While near Ballina, New South Wales the weather suddenly deteriorated and the pilot attempted to turn back to land at Coffs Harbor, New South Wales. However, the weather continued to close in, at which point the pilot reported to ATC that he was now flying in instrument meteorological conditions (IMC). ATC observed a sporadic radar return in the position described by the pilot and advised that the pilot gain altitude, which assisted with radar identification. ATC then guided the aircraft to Evans Head, New South Wales where the weather had cleared sufficiently for the aircraft to land safely.

__________

5. The X designation is added to the engine model when used in the amateur built or experimental aircraft category.
6. TGraphical Area Forecast (GAF) provides information on weather, cloud, visibility, icing, turbulence and freezing level in a graphical layout with supporting text. These are produced for 10 areas across Australia, broadly State-based.
7. Broken cloud: used to describe an amount of cloud covering the sky of between five and seven oktas (eighths).
8. Aerodrome Forecast (TAF): a statement of meteorological conditions expected for a specific period of time in the airspace within a radius of 5 NM (9 km) of the aerodrome reference point. The heights referenced in TAFs are heights above the aerodrome reference point (ground).
9. Orographic cloud forms when airflow encounters a mountain or hill and is forced to rise. If the flow (air) is sufficiently humid, clouds form on the windward side of mountains and are called orographic clouds
10. Observations for Lismore Airport, including for cloud, are automated using information from sensors only.
11. ADS-B: Automatic Dependent Surveillance–Broadcast is a surveillance technology in which an aircraft determines its position via satellite navigation and periodically broadcasts it, enabling it to be tracked.
12. Visual Meteorological Conditions (VMC): a meteorological condition in which visual flight rules (VFR) flight is permitted – that is, conditions in which pilots have sufficient visibility to fly the aircraft while maintaining visual separation from terrain and other aircraft.
13. Instrument meteorological conditions (IMC): weather conditions that require pilots to fly primarily by reference to instruments, and therefore under Instrument Flight Rules (IFR), rather than by outside visual reference. Typically, this means flying in cloud or limited visibility.
14. AO-2016-006 Loss of control and collision with water involving Piper Aircraft Corp PA-28-235, VH-PXD. A copy of this report is available from www.atsb.gov.au
15. More information about spatial disorientation can be found in the ATSB aviation research and analysis report:
    B2007/0063, An overview of spatial disorientation as a factor in aviation accidents and incidents.

Safety analysis

Introduction

While en route from Evans Head, New South Wales, to Boonah, Queensland, the pilot of amateur-built Wittman Tailwind aircraft, registered VH-TWQ (TWQ), diverted to Casino, New South Wales, due to low cloud on the McPherson range. The pilot then took off after approximately fifty minutes on the ground and attempted to reach Boonah via a different route across the range. During the flight TWQ entered an area of reduced visibility. Approximately fifteen minutes after take-off TWQ commenced a series of rapid climbs and descents followed by a descending left turn which continued until TWQ collided with terrain.

Site and wreckage examination did not identify any defects or anomalies that might have contributed to the accident. Additionally, there was no evidence to support the pilot being incapacitated. Therefore, this analysis will focus on the examination of the factors that led to a visual flight rules (VFR) pilot entering an area of reduced visibility and losing control of the aircraft.

Decisions to depart Evans Head and Casino

After the Fly-In was called off due to the poor forecast weather the pilot and passenger elected to fly home to Boonah and Toowoomba. The pilot had attended the Fly-In event briefing that morning and was therefore aware of the local weather conditions and forecast. Neither the pilot’s nor the passenger’s family could identify a time pressure for the aircraft to return to Boonah and Toowoomba that day.

The relevant Graphical Area Forecasts did not preclude a departure under the VFR from Evans Head via Boonah to Toowoomba. However, they indicated the possibility of encountering areas of cloud, dust and rain in which visibility would reduce below that required for VFR flight. The inland route to Boonah, required the aircraft fly across the McPherson Range. Several of the peaks along this range are greater than 3,000 ft and a few are greater than 4,000 ft.

The generally south-south-easterly wind flow, heading towards the range, would have had the effect of pushing the weather up against the McPherson Range and reducing the visibility. So, while it was possible to depart under the VFR, the forecast conditions would have indicated that it was likely there would have been cloud on the ranges and have necessitated planning for an alternate route or diversion to avoid the area if the actual conditions reflected the forecast.

The pilot’s decision to depart the interim landing site can be interpreted as likely taking advantage of acceptable conditions at Casino with the notion that the weather further inland may have allowed for VFR flight over the ranges.

Once airborne, the pilot would have been in a position to assess the in-flight visibility and cloud and rain in the intended direction of travel. However, as discussed in the United States National Transportation Safety Board report (2005), it is possible that the continuation of flight towards the area of low cloud was influenced by the inherent challenges of assessing low visibility conditions.

The ATSB was unable to determine the pilot’s understanding of the weather conditions ahead of the aircraft prior to entering an area of low visibility conditions. However, the pilot had demonstrated an awareness of the risk posed by the weather and the need to maintain visual reference by diverting from the original track and turning back from the first attempt to cross the Ranges.

Development of the accident

Flying into an area of reduced visibility

The majority of the flight from Casino was conducted between 2,000 and 4,000 ft. Approximately 30 km north-west of Casino the aircraft began a climb over the first area of high ground. Terrain in this area is approximately 1,800 ft high. At about 1506, the aircraft reached a maximum altitude of 4,100 ft then entered a 600 ft/min descent where the groundspeed rapidly increased from 145 kt to 173 kt. It is likely that the pilot initiated the climb to clear terrain and then descended when the cloud conditions became unsuitable. This climb took TWQ above the forecast and observed cloud heights in the area, which indicated a cloud base of around 2,600 - 2,800 ft. The descent levelled out at 3,100 ft, and the terrain underneath was about 1,430 ft, allowing the pilot to continue the descent a further 1,670 ft and remain clear of the terrain, if the pilot was visual with terrain. It is possible that the pilot entered an area of deteriorating visibility at this time leading to the rapid descent and level off well above terrain.

From this point on, the pilot flew no lower than 3,100 ft, which was around the height of the some of the ridge lines in the area. It is therefore possible that the pilot was aware of the spot heights of terrain in the area and was attempting to stay above them.

At about 1508, in the vicinity of the Tooloom Fire Tower, the pilot commenced another climb. As the fire tower was in cloud, it is likely that the pilot entered an area of cloud during this climb. Flight data showed that the final turn and descent of TWQ was towards the high ground. The accident site was located near the top of the ridgeline. Either side of this ridgeline were areas of low ground, which the pilot could have manoeuvred towards if visual with terrain. The direction of turn as well as the descent and acceleration towards the terrain indicate the pilot was not visual with terrain at the time of the accident.

Spatial disorientation resulting from a loss of visual cues

Flight data from the last 4 minutes of the flight recorded the aircraft’s groundspeed speed varying between 109 and 175 kt. The aircraft’s rate of climb and descent varied between +2,400 ft/min and -2,400 ft/min. The aircraft’s altitude varied between 4,000 and 3,100 ft.

Of note, the speed recorded by the data is ground speed. Forecast winds for the area were up to 20 kt in the direction of travel of TWQ and could be considered all tail wind. If the actual winds were as forecast, the aircraft was being operated above the published manoeuvring speed limit of 130 kt indicated airspeed KIAS and likely up to the maximum structural cruising speed at some points.

The final data point showed the aircraft descending through 3,100 ft and travelling at 172 kt groundspeed. The aircraft was descending at 1,800 ft/min and was tracking towards the high ground.

The flight data from the last 4 minutes of flight was not consistent with normal operations of a Wittman Tailwind. The abrupt speed and altitude reversals and the operation of the aircraft over and near these speed limitations are indicative of a loss of control.

It is therefore likely that within 4 minutes of flying into conditions of reduced visibility, without adequate visual reference to the horizon, the pilot of TWQ became spatially disorientated leading to a loss of control and collision with terrain. It is possible that the pilot of TWQ was able to maintain some control initially upon entering cloud due to the pilot’s previous instrument flying experience. However, without recent experience and the training and qualification of an instrument rating the pilot was unlikely to have been able to maintain control in cloud for an extended period of time.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving Wittman Tailwind, VH-TWQ, which occurred in Tooloom National Park, New South Wales, 12 January 2020.

Contributing factors

• The pilot departed an interim landing site for Boonah under the visual flight rules with a high risk of encountering forecast cloud that reduced conditions below that required for visual flight.
• It is likely the pilot encountered conditions of reduced visual cues and became spatially disorientated which led to a loss of control and collision with terrain.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Bureau of Meteorology
• Civil Aviation Safety Authority
• Airservices Australia
• A number of witnesses
• recorded data from Flightradar24 and OzRunways

References

Australian Transport Safety Bureau, 2011, Avoidable Accidents No. 4 Accidents involving Visual Flight Rules pilots in Instrument Meteorological Conditions, Aviation Research and Analysis publication AR-2011-050.

Australian Transport Safety Bureau, 2017, Loss of control and collision with water involving Piper Aircraft Corporation, PA-28-235, VH-PXD, AO-2016-006.

Benson, AJ, 1999a, “Spatial disorientation – general aspects”, in J Ernsting, AN Nicholson & DJ Rainford (Eds.), Aviation Medicine (3rd ed.), Oxford, England, Butterworth Heinemann, pp. 419-436.

Gibb, R, Gray, R and Scharff, L, 2010, Aviation Visual Perception: Research, Misperceptions and Mishaps, Ashgate Publishing Limited, Surrey, United Kingdom.

Newman, DG, 2007, An overview of spatial disorientation as a factor in aviation accidents and incidents, Australian Transport Safety Bureau, Aviation Research and Analysis Report B2007/0063.

National Transportation Safety Board 2005, Risk Factors Associated with Weather-Related General Aviation Accidents, National Transportation Safety Board Safety Study NTSB/SS-05/01, Washington DC, United States.

Wiegmann, D and Goh, J, 2000, Visual Flight Rules (VFR) Flight into Adverse Weather: An Empirical Investigation of Factors Affecting Pilot Decision Making, Federal Aviation Administration research DTFA 00-G-010, Illinois, United States.

Wiggins, M and O’Hare, D, 1995, “Expertise in Aeronautical Weather-Related Decision Making: A Cross-Sectional Analysis of General Aviation Pilots”, Journal of Experimental Psychology: Applied Vol. 1 No. 4, pp. 305-320.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Family of the pilot
• Civil Aviation Safety Authority
• Fly-In Event Organiser
• Fly-In Chief Marshall
• Bureau of Meteorology
• Coroner’s representative

Submissions were received from:

• Bureau of Meteorology.

The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations & publishing information

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.