On 9 November 2015, Pacific National train 9150 was travelling from Carwarp in north-western Victoria to Melbourne. The train consisted of two locomotives and 20 wagons, of which 19 were loaded with grain.
At about 1532, the train was travelling through Nunga, 8 km south of Ouyen, at about 80 km/h. The train had almost cleared the Janiels Road level crossing when the trailing bogie of the last wagon derailed. The train was brought to a stand about 1,400 m beyond the crossing with no injuries. The track sustained damage from the derailed wagon.
What the ATSB found
The ATSB found that the derailment was a result of the track buckling during the passage of train 9150. Instability in the track was the result of the rails creeping over time and bunching at the crossing, increasing their vulnerability to lateral misalignment in the hot conditions of that day.
It was found that the asset management systems used to identify problematic levels of rail creep (the longitudinal movement of rail over time) did not incorporate algorithms to flag creep that had accumulated over an extended period. There was a reliance on these systems by track maintenance staff, and in the absence of flags for the identification of cumulative creep, the potential for lateral instability at this location was not identified. General inspections did not provide an effective supplementary means of detecting the potential instability.
It was also found that creep management procedures did not ensure that creep defects were identified and managed in a timely manner and prior to the onset of hot weather.
What's been done as a result
V/Line has updated the network standard for the inspection and assessment of lateral stability. It has also included algorithms within the asset management system for the accurate assessment and generation of remediation work orders for cumulative creep, and to correct for fixed points within track, such as level crossings.
In addition, V/Line has amended its procedures to include a requirement to assess and correct rail creep prior to 1 November each year.
Safety message
Asset management systems that provide the primary triggers for rail creep management should consider all criteria that can affect the creep condition and ensure corrective action prior to the onset of extreme weather conditions.
The occurrence
On 9 November 2015 at about 1205, train 9150 loaded with grain departed Carwarp in north-western Victoria destined for Kensington in Melbourne (Figure 1).
Figure 1: The route from Carwarp to Nunga and derailment location relative to Melbourne
Source: Google Earth annotated by Chief Investigator, Transport Safety (Vic)
The train proceeded to Hattah where it was held for about two hours and then to Ouyen where there was a crew change at about 1520. The train departed Ouyen at about 1525. The driver reported that after leaving Ouyen they conducted a successful ‘running test’ of the air brake.
The train was travelling at about 80 km/h as it approached the Janiels Road[1] level crossing in Nunga, about 8 km south of Ouyen. The crew did not observe anything unusual as they approached and passed over the crossing.
The train had almost cleared the crossing when, at about 1532, the trailing bogie of the last wagon derailed. Following the derailment, the track was observed to be laterally displaced just prior to the crossing (Figure 2).
The derailed wagon disturbed the continuity of the brake pipe, with a reported minor loss of air pressure. Alerted by this, the driver looked back and saw dust and ballast coming from the rear of the train. In response, he made a brake application and the train stopped about 1,400 m beyond the crossing (Figure 3).
Figure 2: Laterally displaced track just prior to the Janiels Road level crossing, looking in the train’s direction of travel.
Source: V/Line annotated by Chief Investigator, Transport Safety (Vic)
Figure 3: The derailed trailing wagon and track damage
Source: Chief Investigator, Transport Safety (Vic)
Nunga is a sparsely populated area with a mostly flat landscape. The derailment occurred immediately north of the Janiels Road level crossing located 501.142 km[2] from Melbourne.
Weather
The forecast maximum temperature issued for the area was 35 °C. The maximum recorded temperature at Ouyen on the day of the derailment was 36.1 °C with 12.1 hours of sun, and it is probable that conditions at Nunga were similar.
Track infrastructure
Classification and traffic
The regional rail network, that includes the section of track from Carwarp to Nunga, is managed by V/Line. The track was classified Class 3 meaning it could service freight traffic travelling up to 80 km/h. Freight trains generally travelled empty heading north, and returned loaded travelling south. Passenger traffic was not using this line.
Track construction
Approaching the level crossing, the track was tangent (straight) over flat terrain. It was constructed using 47 kg/m rails supported on base plates and fixed to timber sleepers by dog spikes. Rails were welded into lengths of about 82 m that were joined using fish-plated connections (Figure 4).
Figure 4: Typical track condition at Nunga showing joints, rail fixtures and ballast
Source: Chief Investigator, Transport Safety (Vic)
Site track inspection
On the morning after the derailment an inspection was conducted of about 400 m of track on the approach side (by train 9150) of the Janiels Road level crossing. The weather conditions were similar to the day of the derailment.
Sleepers were in fair condition and the ballast condition and shoulder profile was generally good. Mechanical joints on both rail legs were closed.
Recent track maintenance
The most recent works in the area were conducted in August 2015. Records indicated that tamping was conducted between 496 and 502.5 km on 23-24 August and ballast resurfacing from 28 August. The scope of these works did not include rail adjustment.[3]
Janiels Road level crossing
The Janiels Road level crossing was unsealed and consisted of a dual-gauge 11 m track panel that incorporated concrete sleepers supporting 47 kg/m rail affixed using resilient fasteners[4] (Figure 5). Records indicate that the panel was installed in October 2008 as part of the Mildura Rail Corridor upgrade.[5]
Figure 5: Janiels Road level crossing, upgraded to dual-gauge rail configuration supported on concrete sleepers and affixed using resilient fasteners.
Source: Chief Investigator, Transport Safety (Vic)
Local operational conditions
There was no speed restriction on this section of track at the time of the derailment. This meant that the maximum permitted line speed for train 9150 was 80 km/h.
Lateral stability and the installation of jointed track
Jointed track
Jointed track made of 82 m welded lengths of rail has expansion gaps that provide a nominal range of 12 degrees in rail temperature in which the rail is stress free.
Construction
V/Line standard NIST-2650 Use and Laying of Rail specified procedures to ensure that rail stress remained within the prescribed limits at the extremes of rail temperature. For jointed 82 m lengths of rail, the network standard specified that the gap between rail ends should be fully open (11 mm) when laid at a rail temperature between 25-27 °C, and fully closed (rail ends butted together) when laid at a rail temperature between 37-38 °C. Gap requirements were specified for installation temperatures between these limits, and other procedures prescribed for temperatures outside the 25-38 °C range.
Correctly installed rails would therefore be effectively stress free within the working limits of the expansion gap at rail temperatures of between about 26 and 38 °C. At temperatures below about 26 °C, the contracted rails would be in tension, and at temperatures above 38 °C joints would be expected to be fully closed and the rails in compression.
The temperature range at which jointed rail is stress free can be affected by rail creep, the longitudinal movement of rail over time. Creep can result in rail bunching in some areas and being stretched in others. Bunching results in excess rail through a location, and the lowering of the stress free temperature range.
Rail stress in hot conditions
Rail temperatures in excess of 50 °C in the region are not uncommon. Rail temperatures can typically be 50 per cent more than ambient[6] or higher, depending on several environmental factors including solar radiation. As a result, in hot weather rail temperatures will normally exceed 38 °C, the nominal upper limit of the stress free temperature range, resulting in rails being in a longitudinally compressed condition. Track stability then relies on rail fastenings and track supporting formations, including ballast, to resist the forces that induce rails to buckle (move laterally) when in compression.
Where there has been creep resulting in the bunching of rail, the rail will enter a state of longitudinal compression at a lower temperature to that intended at installation. The result is that in hot weather these compressive forces will be greater and lateral buckling forces on fixings and track support higher. The potential for the lateral misalignment of rail is therefore increased.
Inspection and other measures for managing lateral stability
Regimes
The condition of track to withstand hot weather is managed in a number of ways, including:
general inspections
the management of rail creep
heat related speed restrictions (WOLO[7]) and heat patrols.
General inspections
Track inspection requirements and their frequencies are specified in V/Line procedures. For Class 3 track, V/Line procedures specified that track patrols should be conducted weekly. Track patrols could be conducted by road-rail vehicle or front-of-train and were expected to identify the following defects and conditions that may relate to lateral stability:
lateral misalignments
poor track geometry
sharp or flat areas in curves
track movement.
On this line, track patrol inspections were predominantly by road-rail vehicle.
The most recent track patrol through this location prior to the derailment was conducted by road-rail vehicle on 3 November 2015; no defects were identified.
For Class 3 track, V/Line procedures also specified annual walking inspections that included in their scope the following observable conditions related to lateral stability:
longitudinal movement (creep) through fastener assemblies
lateral movement of track and track geometry issues
rail, weld or joint misalignment
joints that were frozen or had incorrect gaps
deficient ballast profile
poorly consolidated ballast
wet and/or contaminated ballast
poor ballast quality
pumping sleepers, or other signs of poor track support
poor sleeper/fastening condition.
The most recent walking inspection was recorded as being conducted on 30 September 2015. This inspection did not identify any conditions at the derailment location requiring remedial action.
Management of rail creep
V/Line procedures defined creep as the longitudinal movement of rails in the track, caused by the action of traffic on the line. They described rail creep as typically occurring:
on grades
at location where trains brake
in the direction of predominant track tonnage
in track with poor condition sleepers, fasteners and anchors.
Rail creep changes the stress condition of the rails and therefore its management over time is a critical part of ensuring track stability. Creep that results in the bunching of rail at a particular location will result in higher compressive forces within the rail. These forces may become extreme in hot weather, and increase the potential for a rail to buckle. This is most likely to occur on the approaches to fixed points, like turnouts and level crossings, against which rail can bunch.
Creep is monitored using permanent trackside points called creep monuments that are typically 1 km apart. V/Line procedures required each creep measurement at each monument to be compared with the previous measurement and also to be assessed for long term accumulation since the creep point was last reset (Figure 6).
Figure 6: V/Line limits for rail creep
Change in creep since previous measurement
Cumulative gain or loss of rail between adjacent monitoring points (extrapolated to 1000 m)
Priority 1 (C1 Defect)
50 mm or more
100 mm or more
Priority 2 (C2 Defect)
30 mm or more
50 mm or more
Source: V/Line network standard NIPR- 2708
The track maintenance group responsible for the section measured rail creep in the autumn and spring of each year. These measurements were recorded in a centralised asset management system and creep exceedance reports generated. These exceedance reports were then assigned to the section track supervisors for remediation.
The asset management system used by V/Line changed on 1 July 2015. Both the previous and new system had been tailored by V/Line to meet its business requirements. The rules for creep management were the same in each system. Both systems included algorithms for evaluating the ‘creep since previous measurement’ but neither evaluated cumulative creep. When transitioning from the old to new system, the previous two creep measurements (autumn 2015 and spring 2014) were transferred to the new database. Creep data prior to autumn 2014 was not transferred to the new system.
Additional heat-related controls
In hot weather the risk of rail misalignment is elevated. Additional controls to manage this risk took the form of reduced train speeds (WOLO) and heat patrols. For this section of line, WOLO precautions were implemented when temperatures were forecast to exceed 36 °C. This temperature was consistent with or lower than other Australian regional networks and was established in the context of the condition of the network and other network measures for controlling track lateral stability.
The WOLO train speed for this section of track was 65 km/h and generally applied between 1200 and 2000 unless otherwise specified. Notices could also be utilised to prohibit trains from operating.
The forecast temperature on 9 November 2015 was 35 °C and as a result, heat-related controls were not applied. The actual temperature was not significantly different to that forecast. The maximum temperature recorded at Ouyen was 36 °C and the maximum temperature reached at Nunga was likely similar.
Train
Crew
The train crew of two were both based at Maryborough and on this day were rostered to work Train 9150 from Ouyen to their home depot. Both were qualified for their respective duties and had met the medical requirements for their roles.
Consist
Train 9150 consisted of two locomotives, G548 and X44, and 20 grain hopper wagons coded either VHGF or VHHX with a total length of 340.228 m. The X class locomotive (116 t) was being hauled dead (shut down).
The total trailing mass was 1,576 t with 19 wagons loaded and one (the 12th) unloaded due to a defect with its discharge doors. Of the loaded wagons, five wagons were recorded as having a gross mass of 75 t and the remaining wagons being 76 t. The derailed wagon, VHHX 00712D, had a recorded gross mass of 75 t. All recorded wagon masses met the network load restriction requirements.
Post-derailment inspection of the derailed bogie found that, apart from consequential damage related to the derailment, the bogie was in good condition. There were no indications of bogie hunting (instability).
Train operation
The train was being operated at about 80 km/h, consistent with the permitted maximum speed for this section. There was nothing identified in the handling of train 9150 that may have contributed to the derailment.
Similar occurrences
The ATSB has investigated two other train derailments on the Mildura line that occurred in years 2014-2015.
RO-2014-003 – Derailment of grain train 9130 at Emu, Victoria on 12 February 2014
On 12 February 2014 at around 1400, 10 wagons of a loaded grain train travelling south from Birchip to North Geelong derailed at Emu in North Central Victoria. Emu is located about 223 km south of Nunga between Dunolly and St Arnaud. The derailment occurred on the approach to a set of trailable points at the Melbourne end of Emu Loop that was also a short distance from the Emu Road level crossing.
The ATSB investigation concluded that the derailment was the result of the lateral misalignment of the track that developed during the passage of the train in the hot conditions of that day. The points had provided a fixed point against which the rails bunched. It was found that V/Line’s processes for responding to identified rail creep defects did not ensure remedial action before the onset of warmer seasonal conditions.
In response to the safety issue identified in the ATSB investigation, V/Line advised that it had completed its review and update of its track standard for the inspection and assessment of lateral stability and indicated that a plan for implementation of the standard would be completed by October 2016.
RO-2015-029 - Derailment of freight train 9156 at Ouyen, Victoria on 29 December 2015
On 29 December 2015 at around 1700, 12 wagons of a loaded grain train travelling south from Carwarp to Geelong derailed on the north (approach) side of the William Street level crossing in Ouyen. This derailment occurred about 8 km north of Nunga, was heat-related and the subject of an ATSB investigation.
Based on available evidence, the ATSB concluded that the derailment originated at a lateral track misalignment (buckle) just north of the Janiels Road level crossing.
The following analysis is focused on the management of rail creep. Rolling stock and driver performance (train handling) were not factors that contributed to the derailment.
Rail creep
Rail is prone to creep in the direction of predominant traffic tonnage, bunching at fixed points such as level crossings and turnouts. This was the scenario present at the Janiels Road level crossing.
The nearest creep monument to the north of the Janiels Road level crossing (501.142 km) was at the 502 km post. The measured values of creep at this monument are shown at Figure 7, with a correction also included to account for the distance to the crossing fixed point.[8]
Figure 7: Creep measurements for monument at 502 km
In the period from 2011 autumn to 2012 autumn, two creep defects were flagged in the Down rail. As a result and following the 2012 autumn measurements, 40 mm of rail was cut from the rail at the 502.05 km point. There is no record of how the rail was adjusted either side of this point to accommodate the removal of rail and the effect on the rail at Janiels Road is unknown.
By the spring of 2015, cumulative creep on both rails had significantly exceeded defect criteria. However, the system did not flag this exceedance to track supervisors. Neither the previous nor the new asset management systems included algorithms to identify and assess creep that had accumulated since the last creep reset. The asset management systems only compared creep measurements with the previous two readings. As a result, the slow but regular rail creep southward towards the Janiels Road level crossing was not identified for remedial action.
The 2015 spring measurement for the Up rail was sufficient to flag a C2 defect when compared to the previous two readings. However, this measurement had not been processed by the time the derailment occurred.
The system also did not correct the creep measurements to take account of the Janiels Road level crossing acting as a fixed point. Given that the monument was 858 m from the crossing, this correction would not have been significant in this instance. However, in other scenarios, this could result in significant underestimation of potential lateral instability at a fixed point.
Other track inspections
The scope of annual walking inspections included checking that joints were not frozen or had incorrect gaps. However, the consistent assessment of gaps requires inspection within a specific (and known) rail temperature range and it was unlikely that the annual walking inspection would provide a reliable assessment of rail stress condition. The most recent walking inspection through Nunga was undertaken on a warm day with a maximum temperature of about 34 °C. As a result, the rail joints were probably closed during that inspection.
There was no other inspection regime that might have consistently identified changes in rail stress condition at high risk locations. The network placed a high reliance on the asset management system to initiate closer inspection of track potentially affected by creep.
Timeframe for addressing identified creep
The 2015 spring creep measurement in the Up rail met the criteria of a priority 2 defect when compared to the 2015 autumn measurement. The spring creep measurement was made in the days leading up to 27 October 2015 and supplied to the asset management team prior to the procedural deadline of 30 October. Records indicated that this measurement was up-loaded into the asset management system after the derailment and a work order to assess the defect raised on 20 November 2015. The work order specified a ‘latest completion date’ of 29 December 2015 (60 days from 30 October) and under the Job Plan Details it was noted that ‘The assessment must be undertaken within 60 days and in any case prior to 31 October in same year as inspection’. The work order deadlines were contradictory and the 31 October date unachievable given the deadline of 30 October for taking the creep measurements.
Due to lag in the system and the timeframes for completion of each phase, the requirement to complete creep measurements by 30 October meant that remedial action would extend into November and potentially December.
The processes used for responding to a creep defect included:
checking the creep measurement for accuracy
if the creep defect was confirmed, checking joints 1 km either side of the creep monument
as required, releasing rail and making rail adjustments
recording any rail adjustments and creep resets in the asset management system.
If the full process of creep measurement, assessment, and remedial action had been completed before the 9 November, the derailment would probably have been avoided.
Climate statistics for Ouyen indicate a mean maximum temperature (Figure 8, green graph) for November of 27.4 °C and a maximum recorded temperature (Figure 8, red graph) for November comparable with the summer months of December-February. This suggests that in this district creep related defects should be addressed prior to November.
The ATSB investigation into the derailment at Emu on 12 February 2014 raised the issue of timeliness of response to creep defects.
Figure 8: Climate statistics for Ouyen, showing mean maximum temperatures (green) and highest recorded temperatures (red) by month.
Source: Bureau of Meteorology
Track works
The track between 496 and 502.5 km underwent tamping and ballast resurfacing works in August 2015. This disturbance probably made the track more susceptible to creep. There was an acceleration in rail creep that year leading to the creep between 2015 autumn and 2015 spring (Figure 7) exceeding the C2 (priority 2) defect limit.
Track lateral instability
Rail creep over a long period had led to bunching of rails on the north side of the Janiels Road level crossing. While cumulative rail creep was excessive at the 502 km post, the movement between this post and the crossing was unlikely to have been uniform. It is probable that bunching was most severe closer to the fixed point, the level crossing. The concrete-sleepered dual-gauge panel installed in 2008 would have been a stronger anchor point than the previous timber installation.
The rail creep had led to joint gaps closing at lower temperatures reducing the rail stress free temperature and resulting in higher compressive forces in the rails in hot conditions.
In the ambient and solar conditions of the afternoon of the 9 November 2015, the rail temperature was probably in the mid-50s °C and the rails in a state of severe longitudinal compression. The track-train dynamics generated by the passage of 9150 at 80 km/h, in combination with this compression, resulted in lateral loads that could not be contained by the rail and track support, and the rails buckled.
From the evidence available, the following findings are made with respect to the derailment of train 9150 at Nunga, Victoria on 9 November 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
Rail creep over a prolonged period resulted in the bunching of rail on the north side of Janiels Road level crossing. This rendered the rails vulnerable to lateral instability in the hot weather of 9 November 2015 and a lateral misalignment developed during the passage of train 9150.
Asset management systems that were used to identify problematic levels of rail creep did not evaluate nor assess cumulative creep. [Safety Issue]
There was no supplementary system of inspection that was effective in identifying rail creep in jointed track. The network placed a high reliance on the asset management system to initiate closer inspection of track potentially affected by creep. [Safety Issue]
The procedures for measuring, assessing and remediating rail creep in spring did not ensure creep defects were addressed in a timely manner and prior to the onset of hot weather. A creep defect identified by the spring measurements was not corrected before the derailment.[Safety Issue]
The track underwent works in August 2015 that probably made it more susceptible to creep.
Other factors that increased risk
Asset management systems used to identify problematic levels of rail creep did not correct for fixed points between creep monuments. [Safety Issue]
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Asset management systems that were used to identify problematic levels of rail creep did not evaluate nor assess cumulative creep.
Safety issue description: There was no supplementary system of inspection that was effective in identifying rail creep in jointed track. The network placed a high reliance on the asset management system to initiate closer inspection of track potentially affected by creep.
Safety issue description: The procedures for measuring, assessing, and remediating rail creep in spring did not ensure creep defects were addressed in a timely manner and prior to the onset of hot weather. A creep defect identified by the spring measurements was not corrected before the derailment.
Safety issue description: Asset management systems used to identify problematic levels of rail creep did not correct for fixed points between creep monuments.
Sources and submissions
Sources of information
V/Line Pty Ltd
Pacific National
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to V/Line Pty Ltd, Pacific National and the Locomotive Drivers.
Submissions were received from V/Line Pty Ltd. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 12 November 2015, a pilot was mustering cattle in a Robinson R22 helicopter, registered VH-HWJ, at a property about 90 km south of McArthur River Mine, Northern Territory.
At about 1400 Central Standard Time (CST), as the helicopter approached the cattle yards, it descended rapidly and collided with a tree and terrain. The helicopter landed on its side and sustained substantial damage (Figure 1). The accident occurred about 200 m prior to the cattle yards. The pilot sustained serious injuries and was unable to recall the sequence of events.
Figure 1: Accident site showing damage to VH-HWJ
Source: Helicopter operator
Analysis of fractured yoke
The yoke connecting the clutch shaft to the rearward flex plate was found to have fractured at the connection to the shaft (Figure 2). The ATSB conducted analysis to determine whether the yoke failure may have contributed to the accident, or occurred as a result. The analysis found no evidence of fatigue damage in the yoke, and no other signs of pre-existing damage. The helical fracture was consistent with torsional overstress inducing failure in the yoke.
Figure 2: Fracture surfaces
Source: ATSB
Weather
The weather at McArthur River mine was recorded at 1200 and 1530. At 1200, the wind was from 340° at 5 kt and the temperature was 36 °C. At 1530, the wind was from 160° at 4 kt and the temperature was 38 °C. The direction of the helicopter relative to the wind at the time of the accident could not be determined. The ambient temperature at the time of the accident was about 37 °C. Although the influence of the temperature on the accident is unknown, high ambient temperatures adversely affect helicopter performance.
Operator comments
Subsequent to a previous accident, the operator mandated the wearing of helmets for all pilots. The operator commented that although the pilot sustained head injuries, the outcome might have been worse if the pilot had not been wearing a helmet.
ATSB comment
The ATSB was unable to determine the cause of the accident.
Safety message
US military research[1] analysed helicopter accidents that were at least partially survivable. It found that occupants not wearing a protective helmet were significantly more likely to sustain severe and fatal head injuries. The US National Transportation Safety Board (NTSB) also acknowledged that the use of head protection can reduce the risk of injury and death. The NTSB issued Safety Recommendation A-88-009, recommending that crewmembers of emergency medical services helicopters wear protective equipment including helmets.
The ATSB investigation report (AO-2014-058) into an accident involving a Robinson R22 helicopter where the pilot sustained a serious head injury, reminded pilots and operators to consider the benefit of occupants wearing helmets to reduce the risk of head injury in the event of an emergency landing.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 10 November 2015, at 1200 Eastern Standard Time (EST), a Cessna 208B aircraft, operated as regular public transport Flight 525 by West Wing Aviation, departed Palm Island Airport for Townsville Airport, Queensland. On board were the pilot and eight passengers.
At about 1250 pm, as the aircraft neared Townsville in instrument meteorological conditions (IMC)[1], air traffic control (ATC) issued the pilot with a runway 07 area navigation (RNAV) instrument approach. The pilot configured the aircraft, and commenced the instrument approach. The pilot reported that approaching the final approach fix,[2] the aircraft was configured with the second stage (20°) of flap, and a power setting of about 1200 ft/lb of torque, resulting in an airspeed of about 125 kt.
Shortly after, at about 1,000 ft above ground level (AGL), the pilot broke visual,[3] and selected the third stage of flap (30°) in preparation for landing. However, this selection of flap resulted in a ‘muffled bang’ from outside the aircraft, which the pilot described as sounding like a tyre blow out. The pilot also reported that the aircraft banked ‘violently’ and steeply to the left.
The pilot immediately attempted to reduce the steep angle of bank and regain control by applying opposite (right) aileron. However, the aircraft continued to roll left, with the subsequent secondary aerodynamic effect of yaw to the left.[4] Descending through about 700 ft, and with the aircraft now travelling at about a 45° angle left of the extended runway centreline and still not responding, the pilot applied full opposite rudder. There was some response from the aircraft to this control input, but the pilot reported it was still not ‘under control’.
The pilot immediately retracted the flaps from 30° to 20°, which resulted in them being able to reduce the angle of bank and regain partial control. The pilot alerted ATC that assistance on the ground might be required after landing.
During this sequence of events, the aircraft had travelled so far off course that the pilot was unable to see the runway even though the aircraft remained in visual conditions. The pilot was able to manoeuvre the aircraft onto an oblique approach and land without further incident. Emergency services followed the aircraft as it was taxied clear of the runway to parking. There were no injuries to those on board, and no damage to the aircraft.
Pre-flight and pre-take-off checks
The pilot reported conducting a thorough daily inspection prior to the first flight of the day. This included fully extending the flaps to check all the eyelets, rods and flap travel. During the pre-take-off checks, the pilot also individually checked each stage of flap to check for correct operation. There were no abnormalities.
Initial post-incident inspection
During the taxi to parking, the pilot fully retracted the flaps. With the flaps flush against the trailing edge of the wing, initially, neither the pilot nor the aircraft maintenance engineer could pinpoint the reason for the control issue. However, when the engineer gave the left flap a shake, it fell freely down, unattached on the inboard side. After removing some wing access panels, the engineering inspection discovered a loose flap bell crank retaining bolt.
The Cessna 208B Flap System
The operator provided the following information (modified by the ATSB).
The Cessna 208B flap system is comprised of both mechanical and electrical components. The cockpit flap control selection lever, operated by the pilot, provides input to the flap switch actuator, which controls the primary flap motor. Allowing the pilot to select any flap position between 0 and 30 degrees, with detents at UP, 10, 20 and FULL down settings. The flap actuator assembly drives a bell crank, through a series of pushrods, connecting rods, interconnecting rods, and other bell cranks.
In the event that the primary flap system fails, there is an independent standby switch and motor.
Figure 1: VH-WZJ inboard aft flap bell crank assembly
Source: Operator, modified by the ATSB
Operator report
The operator conducted both a ‘hard / overweight landing’ inspection and a ‘severe air turbulence or severe manoeuvres’ inspection after the incident. The operator also sought maintenance guidance from the aircraft manufacturer.
The operator advised that a flap bolt had come loose allowing the lower part of the rear aft bell crank to move free. An inspection indicated that the pivot bolt may not have been lubricated for a long period of time.
The aft bell crank as referenced to in (Figure 2) showed that the assembly is secured into location with a single bolt securing into an anchor nut assembly on the bottom. According to the operator, there was no secondary locking system.
Figure 2: Diagram showing the location of the left wing flap inboard aft bell crank assembly
Source: Cessna 208 illustrated parts catalogue, modified by the ATSB
Reference was made to the Cessna 208 maintenance manual (maintenance manual), chapter 27-50-01 ‘removal and installation procedures' for this component. However, the instructions did not include a recommended torque setting for any hardware in the flap system. Engineers were required to reference a torque setting in chapter 20 of the maintenance manual – the ‘standard practices’ section. The procedures also advised on the requirement for Loctite 242 to be applied to the component.
As a safety measure, the operator checked all other Cessna Caravan aircraft in the fleet. All were found to have the hardware in the flap system correctly torqued.
Independent audit
An independent audit of the operator’s maintenance system did not find any anomalies. All maintenance, relevant airworthiness directives (AD’s) and Cessna service bulletins (SB) had been correctly complied with. All upcoming inspections were also correctly scheduled.
The independent audit noted that there was no maintenance error. However, the audit concluded that there was a causal combination of both the design of the part, and the limitations of the maintenance schedule instructions.
The Civil Aviation Safety Authority’s (CASA) Service Difficulty Report (SDR) system
The ATSB contacted CASA and requested information regarding reports of any similar occurrences to Cessna 208B aircraft. CASA advised that there have been no similar flap hardware failures reported on these aircraft in the last five years (involving Australian aircraft).
Pilot experience and comments
The pilot has in excess of 4,000 hours flying Cessna 208 aircraft.
Once the left flap mechanism had failed, the aircraft was unresponsive to any control input, and it felt like being in a massive crosswind from the right. The right wing was generating a large amount of lift.
The pilot was not aware of the asymmetric flap situation until sometime after landing. The flap indicator had travelled to 30°, so there had been no reason to doubt it.
The pilot suspects that with the right flap extended to 30°, the dynamic pressure generated by the propeller wash must have pushed the broken left flap back up close to the zero flap position, resulting in the asymmetric flap situation.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
West wing Aviation
As a result of this occurrence, West Wing Aviation has advised the ATSB that they are taking the following safety actions:
Type of safety action
The reason for the pivot bolt working loose could not be established. However, as a preventative measure the operators approved Maintenance Program has been amended. This amendment included new maintenance actions and new replacement intervals for the affected bell crank, that are additional to the maintenance requirements in the Cessna maintenance schedule tasks.
This included life limits similar to those mandated by Cessna for the primary flap bell crank assembly and replacement at 10,000 landings for:
bearings fitted to all four aft flap bell cranks
bearings fitted to the left inboard forward flap bell crank
all four aft flap bell crank attaching parts and bolts
left inboard forward flap bell crank attaching parts and bolt.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 1730 AEDT[1] on 7 November 2015, the owner-pilot of an Airbus Helicopters (Eurocopter) EC135 T1, registered VH-GKK, departed Breeza, New South Wales, on a private flight to Terrey Hills, New South Wales. The flight was conducted under the visual flight rules and there were two passengers on board.
About 40 km to the south-west of the Liddell mine, the pilot diverted towards the coast, probably after encountering adverse weather conditions. Witnesses in the Laguna area observed the helicopter overfly the Watagan Creek valley in the direction of higher terrain. The helicopter was then observed to return and land in a cleared area in the valley.
After 40 minutes on the ground, the pilot departed to the east towards rising terrain in marginal weather conditions. About seven minutes later and approximately 9 km east of the interim landing site, the helicopter collided with terrain. A search was initiated about 36 hours later. The helicopter wreckage was found at about 1840 on 9 November 2015. The pilot and two passengers were fatally injured.
What the ATSB found
The ATSB found that the pilot departed an interim landing site under the visual flight rules in marginal weather conditions. The pilot likely encountered reduced visibility conditions leading to loss of visual reference leading to the collision with terrain.
The ATSB also found that the fixed, airframe-mounted emergency locator transmitter had been removed and that personal locator beacons which required manual activation were carried instead. While in this accident it did not affect the outcome for the occupants, the lack of activation, combined with the absence of flight notification information, delayed the search and rescue response.
Safety message
Weather-related general aviation accidents remain one of the most significant causes of concern in aviation safety and the following safety messages are key:
Avoiding deteriorating weather or instrument meteorological conditions (IMC)[2] requires thorough pre-flight planning, having alternate plans in case of an unexpected deterioration in the weather, and making timely decisions to turn back or divert.
Pressing on into IMC conditions without a current instrument rating carries a significant risk of encountering reduced visual cues leading to disorientation. This can easily affect any pilot, no matter what their level of experience. In the event of inadvertent entry into IMC, pilots are encouraged to contact air traffic control for assistance.
ELTs and PLBs are key safety devices that may become inhibited in a crash. In light of their respective limitations, it is worth considering the use of both.
On 7 November 2015, the owner-pilot of an Airbus Helicopters EC135 T1,[3] registered VH‑GKK, made arrangements to fly from a private helipad at Terrey Hills, 17 km north of the Sydney Harbour Bridge, to Breeza, 44 km south-west of Tamworth, New South Wales. Based on a direct track, the distance was 146 NM (270 km). The flight was originally intended for the day before, but was reportedly postponed due to severe storm warnings for the Hunter Valley, which was on the direct track.
This was a private flight under the visual flight rules (VFR)[4] for the pilot and his wife to attend an event near Breeza (Figure 1). They indicated that they might return to Terrey Hills later that day, or possibly the next. The pilot’s wife was also a qualified helicopter pilot.
Figure 1: Area of operation with dashed line representing nominal return track
Source: Background image Google Earth, annotated by ATSB.
The pilot did not submit a flight notification to Air Traffic Services and, as the flight was conducted under the VFR and outside controlled airspace, there was no requirement to do so. There was no record that the pilot accessed aviation-specific meteorological forecasts and reports in preparing for the flight. Given that there were multiple means of access to those products and other sources of weather information, the pilot may have obtained the weather through these sources.
There was limited recorded data available for the flight from Terrey Hills to Breeza. VH-GKK departed Terry Hills sometime after 0940 and arrived at Breeza at about 1100. It was arranged for an acquaintance, who was a documentary filmmaker, to join the pilot and his wife for the return flight. Their return track would take them over the Werris Creek coal mine where their intent was to film the mine and surrounds.
It appears that the pilot was hoping to leave at about 1700 but there was a delay associated with the event. Witnesses recalled that the helicopter lifted off at about 1730 and headed in a south-easterly direction, toward the general location of the mine. The weather at Breeza was warm and sunny, with predominantly clear skies and light winds.
Based on photos recovered from the filmmaker’s camera, the pilot departed at 1735 and tracked to Werris Creek coal mine then southward in the general direction of Terrey Hills. At 1800, air traffic control radar detected the helicopter in the vicinity of the Liddell mine in the Hunter Valley, which was about the halfway point. On initial detection, the helicopter was at 2,800 ft above mean sea level,[5] before climbing to 3,500 ft as it approached higher terrain. It had an average groundspeed of 116 kt and the pilot was maintaining a consistent track in the general direction of Terrey Hills (The radar data recorded between 1800 and 1821 is depicted in Figure 3).
From 1811, the radar data shows a descent and at 1812, the pilot made a turn to the left to track in a more easterly direction. Shortly after, the radar return dropped out when the helicopter was at 2,700 ft with a groundspeed of 125 kt.
Three minutes later, the helicopter reappeared on radar 13 km south-east of the last position, at 1,900 ft with a groundspeed of 146 kt. The pilot then maintained a consistent south-easterly track in the general direction of Warnervale, located near the coast. A photo taken from inside the helicopter at 1817 (Figure 2), shows that low clouds and darkening skies were being encountered during this time.
The south-easterly track continued for about 6 minutes and covered 25 km until the pilot made a left turn onto an easterly track. At this point the helicopter was at 1,800 ft and in the vicinity of the eastern end of the Watagan Creek valley. The radar return dropped out soon afterwards.
Figure 2: Image of weather conditions recorded at 1817 looking towards the Watagan Mountains
Source: Recovered camera. Copyright: Not to be reproduced.
Figure 3: Radar data (in solid blue line) of the helicopter track on 7 November 2015 before the interim landing with times and accident site
Source: Background image Google Earth, annotated/modified by ATSB
Witnesses reported that the helicopter crossed the valley and continued in an easterly direction, in conditions they described as overcast with low clouds and rain.
At about 1830, witnesses observed the helicopter return to the valley from the east. The pilot landed the helicopter in an open area within the valley in conditions that witnesses reported as including low cloud, reduced visibility and moderate to heavy rain. One of the passengers took photos of this interim landing site, with two pictures showing the weather conditions at 1901 and 1910 respectively (Figure 4 and Figure 5). During the period that the helicopter was on the ground, the available ambient light varied with the overcast conditions and there was low cloud and drizzle in the area.
Figure 4: Image of VH-GKK at the interim landing site at 1901, facing eastward with obscured, rising terrain in the background
Source: Image retrieved from passenger camera. Copyright: Not to be reproduced.
Figure 5: Image of VH-GKK at the interim landing site at 1910
Source: Image retrieved from passenger camera. Copyright: Not to be reproduced.
The witnesses noted that the helicopter remained on the ground for about 40 minutes before departing at about 1915. By 1920, the helicopter was observed over a property to the east of the Watagan Creek valley, tracking east toward timbered, rising terrain. The witness reported that the heavy rain had abated to drizzle and the visibility remained low.
The helicopter reappeared on radar for a couple of returns at 1919:40 and 1919:45, about 2 km east of the interim landing site. Nothing more is known about the helicopter flight path until 1921:41, when it reappears on radar a further 6 km to the east (Figure 6). The pilot then made consecutive right turns to reverse track from a north-easterly to north-westerly direction while climbing from 1,700 ft to 2,100 ft. Radar detection was lost after 1922:50 and there was no further available data about the flight path.
While the flight was intended to reach Terrey Hills that day, it was also understood by relatives of the passengers that it might not return that evening. As a result, the following day, no immediate concerns were raised with authorities despite the fact the pilot and passengers had not arrived at Terrey Hills. The alarm was raised about 36 hours later, after it became apparent that they were overdue. The pilot of the helicopter had not logged a search and rescue time (SARTIME)[6] with Airservices Australia, nor was a flight note[7] left with a nominated other.
An aerial search for the missing helicopter began at 0930 on 9 November 2015. The wreckage was located in heavily timbered, hilly terrain within the Watagans National Park later that day. The pilot and the two passengers were fatally injured.
The helicopter had collided with terrain near the top of a ridge on a south-easterly heading and close to the last recorded radar detections at an elevation of 1,340 ft. The time of the accident could not be precisely established but was estimated to have occurred by 1925.
Figure 6: Radar data (solid red line) of the helicopter track after the interim landing with nominal intermediate tracks (dashed white lines) and times
Source: Background image Google Earth, annotated/modified by ATSB.
The pilot was issued with an Australian Private Pilot (Helicopter) Licence in January 1989, following acceptance of a licence issued in the United Kingdom in 1988. At the time of the accident, the pilot held endorsements for two types of piston-engine helicopter and three types of turbine-engine helicopter, including the EC135 type that the pilot was operating.
In 1991, the pilot was issued a Night VFR[8] Helicopter rating and in 1992, the pilot completed low flying training. Between 2005 and 2008, the pilot was approved by the Civil Aviation Safety Authority (CASA) to give endorsement or conversion training in EC-135 helicopters. The pilot did not hold an instrument rating[9] and there was no indication that he had sought to obtain one. This limited the pilot to visual flight operations.
The pilot’s logbook recorded a total aeronautical experience of 2,654 hours, which included 1,256 hours on the EC135 helicopter type. This included a total of 5 hours of simulator experience, 7.5 hours instrument flight time, and 8.1 hours in command at night. No night experience was logged since September 2010, so the pilot did not appear to meet the night-VFR recency requirements.
The most recent helicopter flight review was conducted by a CASA Flying Operations Inspector (FOI) in March 2014. This included a pre-flight assessment of the pilot’s interpretation and application of meteorological reports. It also included a bad weather navigation exercise and diversion. The FOI assessed that the pilot performed to a satisfactory standard overall, and displayed average flying skills and a high level of technical knowledge about the helicopter.
The pilot held a Class 2 Civil Aviation Medical Certificate that was due to expire in May 2016. He was required to wear distance vision correction and to have vision correction available for reading. Post-mortem and toxicological examination found no underlying medical disorder likely to lead to incapacitation of the pilot, however the medical examiner could not exclude hypertension as contributing to the accident.
A search of the ATSB database yielded notifications regarding two significant occurrences involving the pilot and VH-GKK: a weather-related event in December 2004 and a wire strike in November 2012. This earlier event is described in a book published by the pilot. As the book relates, the pilot became caught in cloud at low level over water then climbed to a safe altitude to continue in cloud with reference to a GPS[10] moving map. The pilot advised air traffic services of the situation and sought information about the extent of the weather. Approaching land displayed on the moving map, the pilot slowed down and gradually descended until the coastline became visible. According to the book, to cope with this type of situation the pilot was night-rated and regularly practised flying on instruments, and the helicopter was equipped with an autopilot and instrumentation.
In the wire strike event, the helicopter was damaged and was subsequently operated in that condition for a short duration. This was investigated by CASA, as were other events:
August 2006: main rotor blade contact with trees resulting in main rotor damage
May 2012: operations at an aerodrome in close proximity to aircraft on the ground with risk of collision or damage from downwash
Although the pilot disputed the investigation findings, CASA undertook counselling in 2006 and licence suspension in 2013. Following the flight review conducted by a CASA FOI in March 2014, CASA reinstated the pilot’s licence.
The ATSB did not identify a connection between the incident history and the flight into terrain.
Visual flight rules
The basic principle for VFR operations is for pilots to ensure that the flight is conducted in visual meteorological conditions (VMC), which provides for sufficient flight visibility and clearance from cloud. In non-controlled airspace (Class-G) and for operations at/below 1,000 ft above ground level (AGL), the general requirement is for 5,000 m visibility and clearance from cloud.
In the case of helicopters operated below 700 ft AGL, the minimum required visibility can be decreased to 800 m if certain conditions are met. The pilot must be operating during the day only and at a speed that allows adequate opportunity to see any obstructions or air traffic in sufficient time to avoid a collision.
Unless a pilot holds a current instrument or night visual flight rules rating, a departure must not take place unless the estimated time of arrival for the destination (or alternate destination) is at least 10 minutes before last light.[11] However, the presence of cloud cover or poor visibility, may cause daylight to end at a time earlier than the time stated.
For a night-VFR flight, a pilot must be at or above the lowest safe altitude in conditions that provides at least 5,000 m visibility and specified clearance from cloud. In this case, the weather conditions were not suitable for night VFR so the pilot was restricted to daylight conditions.
Calculations based on an average groundspeed of 120 kt, taken from the approximate departure time from the interim landing site, indicated that an arrival at the Terrey Hills base would have occurred about 15 minutes before last light.
Aviation-specific meteorological forecasts and warnings
Overview
The Bureau of Meteorology (BoM) produces observations, forecasts, warnings and advisories that are essential for safe and efficient aviation operations. For flight planning, aviation users were advised to obtain the applicable aviation meteorological products from Airservices Australia, the official provider of the Aeronautical Information Services. These products could be obtained through:
Airservices NAIPS Internet Service (free registration required)
Airservices AVFAX (free registration required)
Airservices Pilot Briefing Services (free-call telephone)
Third party websites and apps with access to NAIPS.
In addition, the BoM provided an unofficial copy of aviation meteorological products on their website and nominated a phone number on some forecasts for users requiring more information.
The pilot was not registered to access NAIPS or AVFAX directly and there was no indication that the pilot utilised the Airservices Pilot Briefing Service to obtain weather forecasts or reports on the day of the accident. The pilot did have mobile devices with internet access and was registered to use at least one app that provided aeronautical information sourced from NAIPS. That app did not record any details of the data obtained by a user.
On a ‘Useful data’ sheet dated 2013, the pilot noted the BoM website address and phone numbers as the only entries under the heading of weather. The ATSB did not have information about the pilot’s internet use and there was no record of the pilot calling the BoM on the day of the flight to Breeza.
Before departure from Terrey Hills, the pilot could have used a home computer or mobile device to access aviation forecasts and reports through the app or the BoM website. From then on, wherever there was mobile internet data available, the pilot could have used a mobile device to access weather information.
At the time of the occurrence, the BoM produced three general types of routine forecasts applicable to general aviation: an area forecast for a defined geographical region and aerodrome forecasts (TAF) [12] and trend forecasts (not relevant to the occurrence flight) for specified aerodromes/airports. The bureau generally issued these forecasts for a set validity period but would issue an amended forecast if there was a change to the expected weather conditions during the validity period.
The bureau also issued warnings if they became aware of un-forecast deterioration (AIRMET) and if there was significant weather expected (SIGMET). In addition to being available on demand from aeronautical information providers, these warnings were broadcast on relevant air traffic service frequencies.
It is noted that at the time of the occurrence, aviation meteorological forecasts were presented in a textual format. In November 2017, the area forecast was replaced with a Graphical Area Forecast and Grid Point Wind and Temperature Forecasts to make it easier to interpret and use the information.
Following is a summary of the decoded text of the relevant aviation-specific forecasts and warnings issued by the BoM. The times have been converted from UTC to AEDT.[13]
Area forecasts 7 November 2015
The direct track from Terrey Hills to Breeza and return was within the eastern half of Area 20 which covers north-eastern NSW. On the day of the flight, the initial Area 20 forecast was issued at 0253 and was valid from 0400 to 1600. This was the forecast valid in the period before the pilot’s departure from Terrey Hills.
Between 0400 and 1600, in the eastern half of Area 20, isolated thunderstorms were forecast from 0700 and isolated showers from 1000. There would be areas of broken low cloud and isolated fog/mist but these were expected to clear by 1100. As a surface trough moved up the coast from near Williamtown during the period, broken low cloud and light showers/drizzle were expected to form behind it. This low cloud would be between 1,000 and 3,000 ft AMSL but would lower to 500 ft in showers/drizzle. (There was also other cloud forecast at or above 3,000 ft but this was not relevant to the occurrence.)
For the critical locality of Murrurundi Gap, 53 km south-east of Breeza and close to the direct track, there would initially be broken cloud on the ground but in the period from 0900 to 1100 this would become scattered cloud at 6,000 ft (3,700 ft above ground) with light showers of rain.
The initial area forecast was superseded by an amended forecast issued at 0828, which was itself superseded by an amended forecast issued at 1439. Another amended forecast was issued at 1549, which was the forecast valid for the return flight from Breeza.
In the overviews of all three amended area forecasts, isolated thunderstorms and rain showers were still forecast in the eastern half of the area throughout the period. The areas of broken low cloud that had been forecast to clear by 1100 were now forecast to redevelop after 1700. In the amended forecasts issued at 1439 and 1549, broken low cloud would be expected from the start of the respective validity periods over the sea/coast south of Williamtown Airport (near Newcastle) and in rain showers, and this would extend inland from 1600. From 2100, isolated fog and mist would be expected over land. From 2200, broken cloud would be on the ground at Murrurundi Gap.
Based on the forecast issued at 1549, by the time the pilot departed Breeza at 1730, there would be broken cloud between 1,000 ft and 8,000 ft over the sea and coast south of Williamtown Airport and extending. There would also be broken cloud between 2,000 ft and 5,000 ft with higher scattered cloud over the ranges and slopes that pilot intended to fly over in the latter part of the flight. Thunderstorms and rain showers may also have developed on or near the intended track with associated visibility down to 2,000 m and severe turbulence in the thunderstorm.
Aerodrome forecasts 7 November 2015
The pilot was operating between his private helipad at Terrey Hills and a private property at Breeza, neither of which are served by aerodrome forecasts (TAFs). In the case of such flights, pilots can refer to TAFs for aerodromes in the vicinity of the intended route. As well as providing a more localised forecast, these TAFs can inform contingency planning. The heights referenced in TAFs are heights above the aerodrome reference point (ground).
Although Sydney International Airport is the closest airport to Terrey Hills with a TAF (or equivalent), the TAF for RAAF Base Richmond, located 40 km to the west of the pilot’s helipad, would be a useful reference. Other TAFs of interest for this flight would be for Maitland and Scone aerodromes for the en route phase and Tamworth Airport for the arrival and departure at Breeza.
The TAFs issued early in the day for Richmond forecast light showers of rain and few cloud at 1,000 ft and broken at 2,000 ft. Although the cloud was due to lift after 1300 to 2,500 ft and 3,000 ft respectively, intermittent periods of broken cloud at 1,000 ft with rain showers up to 1500 and after 2000 were forecast.
Amended Richmond TAFs were issued at 1030, 1544, 1609 and 1734. Based on the 1544 and 1609 TAFs that were valid about an hour before the pilot’s intended departure from Breeza, the weather in the Terrey Hills local area could have been light showers of rain with scattered cloud at 1,500 ft and broken cloud at 2,500 ft. From 1700 onwards, there would be temporary periods up to 60 minutes duration where the cloud would be broken at 1,000 ft with rain showers.
The initial TAF for Maitland was issued at 0450 and was valid from 0600 to 1900. The cloud was scattered at 2,000 ft with rain showers. From 1100 onwards, there would be intermittent periods where the cloud would be broken at 1,000 ft with drizzle and visibility reduced to 4,000 m.
An amended Maitland TAF was issued at 1137 and was valid from 1300 to 0100 the next day. The conditions were the same as the initial forecast until 1900 when the intermittent periods would extend to temporary periods. Another amended TAF was issued at 1919 to include a 30% probability of a thunderstorm.
The TAF for Scone was issued at 0451 and was valid from 0600 to 1900. For the periods that the pilot was airborne, the cloud was forecast to be scattered at 1,000 ft and 4,000 ft with light showers of rain.
The TAFs for Tamworth were issued at 0942 and 1535. These were essentially the same and advised of scattered cloud at 5,000 ft and rain showers until 2300, when the cloud would change to ‘few’ at 1,000 ft.
Warnings 7 November 2015
An AIRMET[14] issued at 1543 indicated that isolated thunderstorms were observed at Richmond, NSW. An amended area forecast was subsequently issued at 1549 as described above.
Forecasts and warnings 6 November 2015
Given it was reported to the ATSB that the pilot intended to conduct the flight the day before but cancelled due to warnings of storms in the Hunter Valley, the ATSB reviewed the relevant forecasts and warnings issued by the BoM for the day before.
The area forecast for Area 20 issued early in the day forecast isolated thunderstorms throughout the area until 1600 when they were expected only in the Hunter Valley and northward. Broken low cloud would be on the ranges/slopes and sea/coast but would clear by 1300. Any isolated fog and mist was to clear by 0900.
For the critical locality of Murrurundi, broken cloud was forecast to be on the ground with light showers of rain until it improved between 1000 and 1200. From 1000 onwards, there would be temporary periods up to 60 minutes duration of thunderstorms with broken cloud on the ground.
The TAFs issued for Richmond forecast possible foggy conditions that would clear by 0900 followed by benign conditions for the rest of the day. For Maitland, Scone, and Tamworth, the morning conditions included a risk of fog, and scattered low cloud with light showers of rain. By late morning, intermittent or temporary periods of thunderstorm activity could be expected at the three locations until evening.
Assessment of the weather conditions
7 November 2015
To assess the weather conditions encountered by the pilot on the return flight to Terrey Hills, the ATSB obtained and integrated the following data:
helicopter position from radar data
forecast for Area 20
weather radar imagery and observations from the BoM
witnesses in the vicinity of the interim landing site
private weather station data in vicinity of the interim landing site.
Weather radar images from Lemon Tree Passage (located on the southern shores of Port Stephens) recorded significant rainfall returns over Richmond at 1548. As the thunderstorm moved to the north-east, the weather radar images showed that it developed from a single isolated return into a wide band of rainfall extending 50 km in a north-west / south-east direction.
By 1812, the rain/storm band had moved north-east to be evident 100 km west and south-west of Williamtown Airport. At the same time, the helicopter was identified at a position that is just north of the weather band (Figure 7).
As the rain/storm band continued to move to the north-east, the helicopter moved to the southeast and was identified at 1818 at a position that correlates with the leading edge of the rain/storm band.
By 1822, the leading edge of the rain/storm band had encircled the identified position of the helicopter. At 1830, the rain/storm band was over the Watagan Creek valley location where the pilot landed the helicopter (Figure 8).
Figure 7: Composite weather image and position of VH-GKK at 1812
Source: Background image Geoscience Australia, Weather image Bureau of Meteorology, annotated/modified by ATSB.
Figure 8: Composite weather image and position of VH-GKK at 1830
Source: Background image Geoscience Australia, Weather image Bureau of Meteorology, annotated/modified by ATSB.
Witnesses in the Watagan Creek valley area recalled that on the afternoon of the accident, a storm had approached from the south-east with dark clouds and rain moving in. By 1600 the weather had started to deteriorate further, with low cloud in the valley. Between 1830 and 1845, around the time when the helicopter landed in the valley, the witnesses reported that there was heavy rain and reduced visibility in the area. One witness, who advised he was a pilot, later reported that the conditions did not appear conducive to VFR flight.
By 1912, the intense elements of the rain/storm front had moved away from the interim landing site but there was still light activity to the east and south-east. When the helicopter was last identified at 1922:50, it was in the vicinity of the light precipitation activity that had moved up the coast and adjacent ranges (Figure 9).
Figure 9: Composite weather image 1922-1924 and position of VH-GKK
Source: Background image Geoscience Australia, Weather image Bureau of Meteorology, annotated/modified by ATSB.
The data recorded by a local private weather station situated at the eastern end of the Watagan Creek valley reflected conditions that were conducive to cloud and fog, including fluctuations in ambient light and rainfall throughout the afternoon and early evening. That recorded data also indicated that there was a change in the ambient lighting. Between 1852 and 1909, the ambient lighting improved but by 1915 the lighting had returned to previous, darker conditions and no further improvements in ambient lighting up to, and beyond, the time of the accident were recorded.
Last light for Terrey Hills was calculated as 1954, although the presence of cloud cover or poor visibility will cause daylight to end at a time earlier than the time stated. Pilots are advised to make allowance for this when flight planning or when confronted with such factors when an estimated time of arrival nears the end of daylight. It should be noted that the parameters used in compiling times of last light do not include the nature of the terrain surrounding the location, or the presence of other than a cloudless sky and unlimited visibility at the destination location.
Aircraft and maintenance
The helicopter was powered by twin Turbomeca engines and was configured for seating five people. The helicopter was manufactured in 1999 and was registered in Australia the same year. Since new, the helicopter had been operated for about 1,400 hours.
The aircraft was equipped with all of the required instrumentation for flight under the VFR, Night VFR, and IFR, but was not being maintained to IFR specifications. Since manufacture, the helicopter had been fitted with a 3-axis autopilot and Garmin GNS[15] 430 and GNS 530 units. These avionics were integrated and provided the capability to navigate IFR conditions in various autopilot modes. The GNS 530 could display terrain information or provide a Terrain Awareness and Warning System (TAWS), depending on the installed hardware and configuration. The status of the unit fitted to VH-GKK was not established.
The helicopter was also equipped with an auxiliary battery providing ground power for camping and photography equipment.
The helicopter was maintained primarily by the owner-pilot who held a CASA instrument of approval to perform and certify specific aspects of maintenance. There were no anomalies identified in the maintenance records.
Following a 12-monthly inspection, the owner-pilot issued a maintenance release in April 2015 for a period of 12 months and 200 hours of operation. No defects were recorded and maintenance due during the validity period was signed off. Since April 2015, some minor work had been recorded in the logbook, including removal of the fixed Emergency Locator Transmitter (ELT).
Two personal locator beacons (PLBs) were on board and both were found at the accident site within their respective cases. The PLBs were an appropriate regulatory substitute for the fixed unit that had been removed prior to the accident. Neither of the PLBs demonstrated evidence of manual or attempted activation.
At the time of the accident, the aircraft had been operating below its maximum gross weight and the centre of gravity was within the flight manual limits.
Wreckage and impact information
Accident site assessment
The helicopter wreckage was distributed in a linear pattern along a distance of approximately 90 m on a heading of 143 degrees magnetic. The first items in the trail were parts from the tail, which indicated that the helicopter entered the tree canopy in a slightly nose up attitude. Tree upper limb damage about 40 metres from the start of the wreckage trail indicated that the helicopter was not banking during entry.
Along the wreckage trail, the trees were about 34 m high and a number of these had upper trunks and branches that were damaged, which was indicative of a relatively level trajectory. As the helicopter passed through the tree canopy, the helicopter cockpit and cabin progressively disintegrated.
All of the helicopter major subassemblies were identified at the accident site. A fragment of one of the main rotor blade tips was found 80 m to the west of the main wreckage along with remnants of tree-top foliage and light branches. There was insufficient evidence to determine how the foliage was dislodged.
The ATSB examined the wreckage and did not identify any pre‑existing aircraft defects that may have contributed to the accident sequence.
Data download
The ATSB recovered various aircraft components with recorded data stored from the accident site. The helicopter was not equipped with a flight data recorder or cockpit voice recorder, nor were they required to be fitted in accordance with Australian regulations. The Garmin GNS 430 and 530 units did not record flight parameters.
The two engine control units recovered from the accident site recorded engine power parameters and related parameters such as collective pitch. To establish the functionality of the engines, the ATSB arranged for the Bureau d'Enquêtes et d'Analyses (BEA) to work with the engine manufacturer in France to download data from the engine control units. This data showed that the engines were operating normally up to the time of the accident. A failure message, typically generated as a result of this type of accident, was recorded at the same time by both units, approximately 7 minutes after electrical power was turned on, prior to departure from the interim landing site.
The warning unit recovered from the accident site monitors the status of critical operating systems and provides warnings in case of abnormalities such as engine fire, fuel low level, battery malfunction, and low main rotor RPM. The ATSB downloaded data from the warning unit and arranged for the data to be decoded by the BEA and another independent agency. There were no anomalous recorded warnings from engine start until the end of the recorded data. At that point, the warning unit recorded autopilot and main rotor RPM decay warnings that were attributed to the collision with terrain.
The data recorded by the engine control units and the warning unit was not as comprehensive as that recorded by a flight data recorder and does not provide sufficient evidence that all of the helicopter systems were operating normally. However, based on the available data, it is almost certain that the engines were operating normally.
Mobile electronic devices
The ATSB recovered three mobile phones, three cameras, and one iPad from the accident site. The pilot’s iPhone was undamaged and had logged the last phone call at 0828 on the morning of the flight. A weather app was installed, but no data was available to indicate usage.
Another iPhone, belonging to the pilot’s wife, was undamaged and logged the last phone and text activity at 0935 on the morning of the flight. The phone belonging to the other passenger was too damaged to recover any data.
The stored data on the cameras was reviewed and images recorded during the return flight were retained and used in developing the sequence of events and weather information. The iPad did not have a SIM card and no information useful to the investigation was identified.
Emergency locator transmitters
Civil Aviation Regulation (CAR) 252(A) requires the carriage of an emergency locator transmitter (ELT) on most flights in Australian airspace. This requirement can be satisfied by an ELT that is mounted on the helicopter and activates automatically when it senses an excessive force, such as a ground impact. An alternative means of compliance is the carriage of a portable personal locator beacon (PLB) that is activated manually.
On activation, an ELT or PLB transmits on two frequencies, one of which can be detected by orbiting satellites that transmit a signal to search and rescue coordinators. The other frequency can be picked up by overhead aircraft for detection and homing in on the activated beacon, or can be used by crews to alert relevant authorities.
The ATSB research report AR-2012-128: A review of the effectiveness of emergency locator transmitters in aviation accidents states that search and rescue personnel were alerted to aviation emergencies in a variety of ways including radio calls and phone calls and that ELT activation accounted for the first notification in only about 15 percent of incidents. To the date of the research report reference, ELT activations have been directly responsible for saving an average of four lives per year.
The research report noted that both fixed ELTs and personal portable beacons have limitations that include degraded signalling capability when the ELT aerial is damaged in a serious accident, and lack of activation when the impact force is not aligned with the orientation of the ELT or when the occupant is unable to activate a PLB due to injury. GPS-equipped ELTs significantly increase the accuracy of positional information and newer ELTs, incorporating 3-axis g-switches may improve the likelihood of activation upon impact. Carriage of a PLB in place of, or as well as a fixed ELT will be of most safety benefit if it is carried on the person.
Additionally, developments in tracking technology now allows for GPS supported or combined GPS/cellular network supported products enabling real time monitoring of an aircraft’s movements, with the provision of scheduled updates to nominated parties and immediate notification in case of an emergency. Automatic alert signals can also be provided in the event of loss of power or sudden change in altitude with the ability to manually activate in the event of an emergency.
Visual flight into Instrument Meteorological Conditions
Accident data
The safety risks of VFR pilots flying from VMC conditions into instrument meteorological conditions (IMC)[16] are well documented. This has been the focus of numerous ATSB reports and publications, as VFR pilots flying into IMC represent a significant cause of aircraft accidents and fatalities. In 2013, the ATSB Avoidable Accidents series was re-published. One of these publications, the booklet titled Accidents involving Visual Flight Rules pilots in Instrument Meteorological Conditions outlined that:
In the 5 years 2006–2010, there were 72 occurrences of visual flight rules (VFR) pilots flying in instrument meteorological conditions (IMC) reported to the ATSB…About one in ten VFR into IMC events result in a fatal outcome.
Additionally, a study conducted by the United States National Transportation Safety Board (2005) found that ‘about two-thirds of all general aviation accidents that occur in instrument meteorological conditions (IMC) are fatal’.
Wiggins and O’Hare (1995) explained that when pilots are not trained or qualified to fly in IMC and find themselves in these conditions, ‘the result will almost inevitably involve loss of control of the aircraft resulting in a fatal crash’.
Loss of visual cues and spatial disorientation in low visibility conditions
In a discussion of spatial disorientation, Benson (1999) defined the experience as follows:
Spatial disorientation is…[where] the pilot fails to sense correctly the position, motion or attitude of the aircraft or of him/herself [resulting in] errors in perception by the pilot of their position, motion or attitude with respect to their aircraft...
Gibb et al. (2010) explain that seeing the horizon is ‘crucial for orientation of the pilot’s sense of pitch and bank of the aircraft.’ In conditions of low visibility, the horizon may not be visible to the pilot, during which time they can become rapidly disorientated.
Extensive research on spatial disorientation indicates that loss of control will likely occur between 60 seconds (Benson, 1983 in Gibb et al., 2010) and 178 seconds (Newman, 2007) after the loss of visual reference. This is the case even when the aircraft is in straight and level flight at the time vision is lost, and is shorter still if the aircraft is in a turn. Gibb et al. (2010) state that ‘spatial disorientation accidents have fatality rates of 90–91 percent, which indicates how compelling the misperceptions can be’.
Related occurrences
ATSB investigation AO-2008-063 Controlled flight into terrain – Scone, New South Wales on 14 September 2008
On 14 September 2008, a Cessna Aircraft Co. U206A aircraft, registered VH-JDQ, with a pilot and two passengers on board, was on a private flight under the visual flight rules (VFR) from Bankstown, NSW to Archerfield, Qld with a planned stop at Scone, NSW. The aircraft was reported missing when it did not arrive at Archerfield as expected later that day.
Australian Search and Rescue were notified and, during the subsequent search, the wreckage of the aircraft was located the following day on top of a 3,800 ft ridge in rugged terrain, approximately 56 km (30 NM) north-north-east of Scone Airport. All three occupants were fatally injured and the aircraft was destroyed.
The weather in the area at the time of the occurrence was not suitable for VFR flight and included low cloud, rain showers and high winds. Inspection of the accident site indicated that the aircraft was tracking towards Scone prior to impact with terrain.
ATSB investigation AO-2009-077 Visual flight into instrument meteorological conditions – Dorrigo, New South Wales on 9 December 2009
On 9 December 2009, at about 1120 Eastern Daylight-saving Time, the pilot of a Bell Helicopter Company 206L-1 LongRanger, registered VH-MJO, was conducting a visual flight rules fire‑fighting support flight in the area of Dorrigo, New South Wales with one passenger on board. Shortly after takeoff, the pilot encountered reduced visibility conditions due to low cloud. Subsequently, all visual reference with the horizon and the ground was lost. The pilot attempted to land, but the helicopter impacted the ground in an uncontrolled state and with significant vertical force. The passenger was fatally injured and the pilot was seriously injured. The helicopter was seriously damaged.
The investigation found that after the pilot established the hover, the helicopter entered the rapidly fluctuating cloud. The pilot lost visual reference and became spatially disoriented and the helicopter impacted the ground in an uncontrolled state. The at times rapidly-moving fog or low cloud in the vicinity of the helicopter landing area (HLA) increased the risk of visual operations encountering instrument meteorological conditions at the HLA.
ATSB investigation AO-2011-100 VFR flight into dark night conditions – Horsham, Victoria on 15 August 2011
On 15 August 2011, the pilot of a Piper PA-28-180 Cherokee aircraft, registered VH-POJ, was conducting a private flight transporting two passengers from Essendon to Nhill, Victoria under the VFR. The flight was arranged to return the passengers to their home location after medical treatment in Melbourne.
Global Positioning System data recovered from the aircraft indicated that when about 52 km from Nhill, the aircraft conducted a series of manoeuvres followed by a descending right turn. The aircraft subsequently impacted the ground at 1820 Eastern Standard Time, fatally injuring the pilot and one of the passengers. The second passenger later died in hospital as a result of complications from injuries sustained in the accident.
The ATSB found that the pilot landed at Bendigo and accessed a weather forecast before continuing towards Nhill. After recommencing the flight, the pilot probably encountered reduced visibility conditions while approaching Nhill due to low cloud, rain and diminishing daylight, leading to disorientation, loss of control and impact with terrain.
ATSB investigation AO-2016-031 Collision with water – Cape Tribulation, Queensland on 7 April 2016
On 7 April 2016, the pilots of two Robinson R22 helicopters flew from Mossman, Queensland to various fishing locations to the north with a passenger in each helicopter. Late in the afternoon, the pilots commenced the direct return flight to Mossman.
Shortly after passing Cape Tribulation, in dark night conditions, one of the helicopters registered VH-YLY, collided with the sea. The passenger was injured in the accident but was able to reach the shore and notify emergency services. The pilot’s body was not located.
The ATSB found that the pilot, who was only qualified to operate in day-VFR conditions, departed on a night flight and continued towards the destination in deteriorating visibility until inadvertently allowing the helicopter to descend into water.
The ATSB did not have access to recorded data that showed the helicopter flight path or key operational parameters, at, or immediately before the collision with terrain. There were no witnesses to, or video of, the accident sequence. As such, the ATSB was reliant on recorded engine parameters and system warnings along with interpretation of aircraft wreckage, the accident site and weather data, to determine the characteristics of the collision with terrain.
The following analysis examines the known flight path and considers elements that may have influenced the decision to depart the interim landing site and continue the flight. The analysis also examines safety considerations associated with VFR pilot decision making and the carriage of emergency locator transmitting devices.
Pre-flight weather assessment
Although the pilot did not have a NAIPS account for access to aviation weather forecasts/reports, the pilot might have accessed equivalent weather information from other sources or referred to available non‑aviation weather information.
Based on the Area 20 forecast and aerodrome forecasts (TAFs) available before the pilot’s departure from Terrey Hills, it would have been apparent that the flight to Breeza and return could be affected by isolated thunderstorms, and low cloud with light showers/drizzle near the coast south of Williamtown. Although the weather for the flight to Breeza was not reported to have presented a problem, the return flight was later in the day and the type of forecast weather was associated with a moist, unstable air mass.
If the Area 20 forecast issued about an hour before the intended departure from Breeza was taken into consideration, it would be apparent that the flight could be affected by isolated thunderstorms, and low cloud south of Williamtown that would have extended inland. The TAFs for aerodromes adjacent to the route were relatively benign, but the TAF for Richmond indicated that the weather in the Terrey Hills area could have temporary periods of low cloud and rain.
The forecasts were generally consistent with the conditions that developed in the area. The thunderstorm-related activity on the pilot’s intended route was more extensive than the isolated descriptor in the forecast might indicate. However, this type of weather was not precluded by the forecast and local conditions across a forecast area will vary.
Collision with terrain
Data downloaded from the engine control and warning units indicated that there was no problem with the operation of the engines or other monitored helicopter systems up to the point of collision with terrain. There was also no radio transmission from the pilot, either heard or recorded, to advise of any problem. This was consistent with examination of the helicopter wreckage and review of the helicopter logbooks that did not identify any airworthiness concerns. Although these items of evidence are not conclusive, it is unlikely that there was a problem with the helicopter.
The ATSB accessed and analysed a variety of sources of meteorological data to ascertain the weather at the time of the accident. There was low cloud, drizzle and reduced visibility in the area. Although the conditions were marginal for VFR, there was likely to be some variability and it was not possible to establish if the weather in the latter stages of the flight allowed the pilot to operate clear of cloud and with a minimum of 800 m visibility, as per the helicopter visual meteorological conditions (VMC) requirements.
The last recorded radar data showed that the pilot conducted a series of right turns with a change of direction from south‑east to north-west. During the turns, the pilot climbed from 1,700 to 2,100 ft, which correlated to an increase in height above terrain from about 350 to 750 ft.
It is almost certain that the pilot made the right turns in response to the weather conditions and it is possible that the pilot lost visual contact with the ground and climbed to ensure that he maintained terrain clearance. Given the weather conditions, at the point the radar returns dropped out, it is unlikely that the pilot was able to remain in VMC. It is possible that pilot was reversing track to return to the interim landing area.
Nothing more is known about the helicopter’s flight path until it collided with terrain shortly afterwards on a south-easterly bearing and close to the last recorded radar position. This bearing and position are consistent with a continuation of the original flight track; however, the ATSB could not determine if that was the pilot’s intention.
In the period from the last recorded radar return prior to the collision with terrain, the pilot descended about 700 ft. The ATSB was unable to determine if the pilot was taking advantage of a break in the cloud to descend visually or trying to descend through cloud to establish visual reference to the ground.
If the pilot had been descending through cloud in order to establish visual reference to the ground, this behaviour may have been consistent with the pilot’s experience in 2004, as related in the book published by the pilot. Although the book related the pilot’s descent in cloud until visual reference was established at low altitude, the context in this case was different. Instead of flying over water and coastline, the pilot was contending with terrain that was undulating, uniformly textured, and relatively high.
To fly visually in this environment with low visibility is difficult, as the situation requires that the pilot maintain reference to the ground to maintain control, avoid terrain, and avoid low cloud and other areas of reduced visibility. The pilot had GPS receivers and moving map displays to assist with navigation, and flight instruments and autopilot with IFR capability, but that equipment was of limited use if the pilot was attempting to maintain visual reference. Based on the data available to the ATSB, it was not possible to determine whether the accident was a result of controlled flight into terrain or loss of control due to spatial disorientation.
Assessment of local conditions
It was not possible to establish if the manoeuvring before the collision with terrain indicated the pilot was attempting to return to the previous landing area or attempting to find a way through to the destination. Whatever the pilot’s intentions, at the time of the accident the pilot probably found himself in a situation where he was unable to negotiate the weather conditions with visual reference to the ground. In that context, the ATSB considered the pilot’s decision to lift off from the interim landing site and to continue the flight.
The ATSB was unable to identify all of the aspects relevant to the pilot’s decision to depart from the interim landing site but it is likely that the pilot was influenced by the following situational factors:
an apparent improvement in the local weather
the expected flight time to the destination meant that the expected time of arrival was getting increasingly closer to last light
the distance from the interim landing site to lower terrain was relatively short
the pilot may have been unaware of the actual weather along the prospective route or had reasonable expectations of navigating the weather conditions.
In considering a departure from the interim landing site, the pilot was able to assess the weather visible from the location and had the capability to access forecast and actual weather information via mobile devices. Although the pilot’s phone was not used, there were other devices available, and internet use for those devices could not be established.
The pilot’s decision to depart the interim landing site can be interpreted as likely taking advantage of a break in the severity of the local weather to proceed as far as the weather would allow. If the pilot had reached the lower terrain near the coast, there was a greater likelihood of being able to continue the flight to the destination or land at an airport with access to accommodation.
Once airborne, the pilot would have been in a position to assess the in-flight visibility and cloud and rain in the intended direction of travel. In another occurrence investigation,[17] the ATSB has found that the ‘continuation of flight towards an area of low cloud and rain was likely influenced by the inherent challenges of assessing low visibility conditions, particularly without instrument flying proficiency.’ This finding was based on the following references.
The United States National Transportation Safety Board (2005) found that ‘reduced-visibility weather represents a particularly high risk to [general aviation] operations’ and that ‘weather may…test the limits of pilot knowledge, training, and skill to the point that underlying issues are identified.’
Wiegmann and Goh (2000) explained that:
One reason why pilots may decide to continue a VFR flight into adverse weather is that they make errors when assessing the situation. That is, pilots are seen to engage in VFR flight into IMC [instrument meteorological conditions] because they do not accurately assess the hazard (i.e., the deteriorating weather conditions).
The previously mentioned United States National Transportation Safety Board report (2005) added that in these cases, pilots who might appear to intentionally engage in risky behaviour may actually be making choices that they mistakenly believe to be safe:
Even if pilots are able to correctly assess current weather conditions, they may still underestimate the risk associated with continued flight under those conditions, or they may overestimate their ability to handle that risk.
Wiggins and O’Hare (1995) further explained how errors in assessment can take place, acknowledging that weather-related decision making can be highly complex and therefore more prone to errors:
Because of the variable nature of operations in the aviation environment, weather-related decision making is often considered a skill that cannot be prescribed during training. Rather it is expected to develop gradually through practical experience. However, in developing this type of experience, relatively inexperienced pilots may be exposed to hazardous situations with which they are ill‑equipped to cope.
ATSB Aviation Research and Analysis Report B20070063, An overview of spatial disorientation as a factor in aviation accidents and incidents, stated that pilots should not attempt to fly into instrument meteorological conditions under the VFR. Pilots should develop a plan prior to take-off on what to do if the weather en route is different from that expected, or deteriorates. This plan should consider a requirement to divert or turn back prior to entering instrument meteorological conditions. However, this depends on a pilot correctly assessing the weather conditions. The United States National Transportation Safety Board (2005) noted that targeted weather-related training programs have had some success in teaching pilots to recognise and respond to deteriorating weather conditions.
Additionally, Wiggins and O’Hare (2003) evaluated the effectiveness of a cue-based training system called Weatherwise, which was designed to equip VFR pilots with the skills to recognise and respond to the cues associated with deteriorating weather conditions during flight. VFR pilots were more likely to use the cues following the training, with subsequent improvements in their weather-related decision-making. The Weatherwise program was made available to pilots by the Civil Aviation Safety Authority (CASA). Additionally, CASA produced a Weather to Fly education program which focuses on topics such as the importance of pre-flight preparation, making decisions early, and talking to ATC.
The ATSB was unable to determine the pilot’s understanding of the weather conditions ahead of him prior to entering an area of low visibility conditions. However, the pilot had demonstrated an awareness of the risk posed by the weather and the need to maintain visual reference by diverting from the original track from Breeza then turning back from the first attempt to cross the high terrain.
Until the conditions improved, the only safe option available to the VFR pilot was to leave the helicopter at the interim landing site or transit to another landing area in the valley as the conditions permitted.
Weather-related general aviation accidents remain one of the most significant causes for concern in aviation safety; the often-fatal outcomes of these accidents are usually all the more tragic because they are avoidable.
In the 5 years 2006–2010, there were 72 occurrences of visual flight rules (VFR) pilots flying in instrument meteorological conditions (IMC) reported to the ATSB. Seven of these resulted in fatal accidents, causing 14 fatalities. That is, about one in ten VFR into IMC events result in a fatal outcome.
Flying into IMC can occur in any phase of flight. However, a 2005 ATSB research publication General Aviation Pilot Behaviours in the Face of Adverse Weather concluded that the chances of a VFR into IMC encounter increased as the flight progressed, with the maximum chance occurring during the final 20 per cent of the flight distance.
The dangers of flying VFR into IMC have been recognised for a long time, yet VFR pilots still fly into deteriorating weather and IMC. This publication describes recent weather-related general aviation accidents and incidents that show that weather alone is never the only factor affecting pilot decisions that result in inadvertent IMC encounters. It has been produced solely with the intention of encouraging all pilots, no matter what their experience level, to develop the knowledge and skills required to avoid unintentional operations in IMC.
One of the key messages is for pilots to avoid deteriorating weather by conducting thorough pre-flight planning and to have alternate plans in case of an unexpected deterioration in the weather and making timely decisions to turn back or divert.
This principle applies to all aircraft operations, even though helicopters are inherently more flexible in terms of availability of landing areas and manoeuvrability. All pilots need to have a relevant and effective contingency plan that is based on the best available information in weather forecasts and reports.
Location of aircraft in an emergency
The pilot was operating with two Personal Locator Beacons (PLBs) and no fixed Emergency Locator Transmitter (ELT). Unlike a fixed ELT, the PLBs were not fitted with a ‘g’ switch and would require manual activation to transmit information. In this case, the occupants were fatally injured in the accident and no position information was transmitted from the beacons.
ATSB report AR-2012-128: A review of the effectiveness of emergency locator transmitters in aviation accidents references an Australian Maritime Safety Authority (AMSA) recommendation that occupants of an aircraft proactively activate an ELT (or PLB in this case also) when flying in dangerous weather conditions. This would greatly increase the likelihood of establishing the exact position of the aircraft if required. AMSA would need to be notified once the dangerous phase of the flight was complete and the ELT/PLB has been switched off. Activating a beacon under such circumstances requires an active decision on the part of the pilot. Additionally, in the event of inadvertent entry into IMC, pilots are encouraged to contact air traffic control for assistance, however on this occasion, no radio calls from the pilot to air traffic control were on record.
The severity of an accident potentially restricts fixed or portable ELTs to be reliably activated due to impact forces that can render the units inoperable, with research noting that they save about four lives a year. Furthermore, search and rescue operations also place others at risk and a degree of uncertainty exists until a missing aircraft is located. The removal of the fixed ELT with the potential for self-activation, for manually operable PLBs was in accordance with the regulatory requirements. On this occasion, the absent transmission coupled with the uncertainty of when the group would return to Terrey Hills, delayed the search and rescue response.
From the evidence available, the following findings are made with respect to the collision with terrain involving Airbus Helicopters EC 135 T1, VH-GKK, that occurred near Cooranbong, NSW on 7 November 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factor
The pilot departed an interim landing site for Terrey Hills under the visual flight rules with a high risk of encountering forecast cloud and reduced visibility. Due to the likely presence of cloud, the pilot probably experienced a loss of visual reference leading to a collision with terrain.
Other findings
The personal locator beacons carried in lieu of a fixed emergency locator transmitter were required to be activated in the case of an accident. While in this accident it did not affect the outcome for the occupants, the lack of activation, combined with the absence of flight notification information, delayed the search and rescue response.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the Civil Aviation Safety Authority
the Bureau of Meteorology
Airservices Australia
the French Bureau d'Enquêtes et d'Analyses
the German Federal Bureau of Aircraft Accident Investigation
Benson, AJ, 1999a, “Spatial disorientation – general aspects”, in J Ernsting, AN Nicholson & DJ Rainford (Eds.), Aviation Medicine (3rd ed.), Oxford, England, Butterworth Heinemann, pp. 419-436.
Gibb, R, Gray, R and Scharff, L, 2010, Aviation Visual Perception: Research, Misperceptions and Mishaps, Ashgate Publishing Limited, Surrey, United Kingdom.
Wiegmann, D and Goh, J, 2000, Visual Flight Rules (VFR) Flight into Adverse Weather: An Empirical Investigation of Factors Affecting Pilot Decision Making, Federal Aviation Administration research DTFA 00-G-010, Illinois, United States.
Wiggins, M and O’Hare, D, 1995, “Expertise in Aeronautical Weather-Related Decision Making: A Cross-Sectional Analysis of General Aviation Pilots”, Journal of Experimental Psychology: Applied Vol. 1 No. 4, pp. 305-320.
Wiggins, M and O’Hare, D, 2003, “Weatherwise: Evaluation of a cue-based training approach for the recognition of deteriorating weather conditions during flight”, The Journal ofHuman Factors and Ergonomics Society, pp.337-345.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority and the German Federal Bureau of Aircraft Accident Investigation.
Submissions were received from both organisations. A review of those submissions did not result in any amendment to the text of the report.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 19 September 2013, the pilot of a Beechcraft B300, registered VH-FIZ, was conducting calibration activities of ground-based navigation aids at Williamtown (Newcastle Airport), New South Wales.
During the calibration activities, the aircraft conducted a 7 NM (13.0 km) orbit around Williamtown. However, the Tower air traffic controller had intended the aircraft to hold south of Williamtown over land. At the same time, other aircraft were approaching Williamtown to land.
VH-FIZ tracked on the 7 NM arc towards, and then across the coast, on a converging path with a formation of four Boeing F/A18 aircraft that were on a visual approach to Williamtown. The formation flew directly below VH-FIZ with less than the required 1,000 ft separation.
What the ATSB found
The ATSB found that the applicability of a general requirement to conduct aviation risk assessments at Department of Defence aerodromes for complex, new, unusual or irregular activities was open to interpretation. This led to an absence of prior planning for the calibration activities, resulting in an air traffic control work-around on the day of the activities that did not address all related safety aspects. One work-around was that airspace over land usually controlled by Approach was transferred to the Tower. The resultant airspace controlled by the Tower was considerably larger than normal, resulting in the Tower controllers having difficulties visually monitoring the airspace and needing to rely on the surveillance display for situation awareness.
An instruction given to VH-FIZ to ‘orbit’ was insufficiently clear, resulting in the pilot misinterpreting it as permission to conduct a pre-planned 7 NM (13.0 km) orbit around Williamtown. As a result of the Tower controller’s assumption that VH-FIZ would remain in the area they intended, the aircraft was not adequately visually monitored by the controllers in the Tower, or monitored on radar by the Approach controller. This removed any chance of early detection of the impending aircraft conflict. When the Tower controller did detect the conflict, clear control instructions were not immediately given to either VH-FIZ or the F/A18s, leading to a loss of separation.
What's been done as a result
The Department of Defence took proactive action to improve the implementation of aviation risk management (AVRM) to ensure that AVRM plans developed for unusual or irregular operations, such as calibration operations, addressed staffing and traffic levels, coordination and workload.
Safety message
Although not guaranteeing the absence of aircraft separation incidents, prior planning for unusual or irregular operations can permit the development of robust air traffic control defences that address the specific hazards of that operation. Aircraft separation safety also relies on controllers issuing specific control instructions to all pilots, along with the provision of timely and relevant traffic information to pilots of aircraft identified to be in conflict.
Williamtown Visual Terminal Chart
Source: Airservices Australia
The occurrence
At 1549 Eastern Standard Time[1] on 19 September 2013, a Hawker Beechcraft Corporation B300, registered VH-FIZ (FIZ), was conducting calibration operations at Williamtown (Newcastle Airport)[2] in NSW (Figure 1). While conducting a 7 NM (13.0 km) orbit around Williamtown at 3,100 ft (the broken blue line in Figure 1), a loss of separation (LOS) occurred between FIZ and a formation[3] of four Boeing F/A18 aircraft (F18s). The formation of F18s flew directly below the B300 with less than the required 1,000 ft separation.
The calibration activity involved checking the equipment associated with the instrument landing system (ILS),[4] which was aligned to runway 12,[5] and the tactical air navigation system (TACAN).[6] To complete the calibration, numerous approaches and manoeuvres were required to test the accuracy of the navigational equipment, each referred to as a run. The various planned runs each had a number on a run sheet held by both the pilot of FIZ and air traffic control (ATC).
The Williamtown ATC Tower controller normally had jurisdiction over the airspace within 5 NM (9.3 km) of Williamtown over land (dark green area in Figure 1), from the surface to 1,500 ft above mean sea level (AMSL),[7] referred to as the aerodrome traffic zone (ATZ). Earlier in the day, additional airspace had been released by the Williamtown Approach controller to the Tower controller – over land within a 12 NM (22.2 km) radius of Williamtown, from the surface to 3,500 ft AMSL (light green area in Figure 1).
On the day of the occurrence, the wind at Williamtown favoured the use of runway 30 (marked in orange in Figure 1), so the majority of FIZ’s approaches were to the opposite direction non-duty runway. To reduce traffic complexity, FIZ was permitted to conduct calibration runs while ATC held other aircraft on the ground or outside the airspace released to the Tower controller, while FIZ was held clear of traffic when a mix of military and civil aircraft were required to depart or arrive. The majority of military aircraft arrived via the initial point, marked by a pink cross in Figure 1 (see the section titled Military operations).
Figure 1: Williamtown Tower airspace: Dark green shading shows the usual airspace, light green shows additional airspace on 19 September 2013. An orange arrow indicates the duty runway location and direction. A blue dashed line indicates the intended flight path of VH-FIZ during the aerodrome orbit run. A pink cross indicates the initial point used by military aircraft.
To reduce the need for extensive voice-coordination between the Tower and Approach controllers, Williamtown ATC added information to an aircraft’s data label[8] on the surveillance data display. The information added to a data label, referred to as silent coordination, was visible to both Approach and Tower controllers. For an arriving aircraft, the Approach controller would add arrival type (e.g. ‘T’ for a TACAN) or that an aircraft had reported visual (‘V’). Both the Tower controllers that day (morning and afternoon shifts) had been using the data label for FIZ to indicate the current run number, and, when known, the next run number. However, at 1530 the Tower controller did not include a run number in the data label of FIZ, rather the label indicated that the calibration aircraft was completing a TACAN approach to runway 12 (which was run 3A) and that the next approach would be a 7 NM (13.0 km) orbit of Williamtown (run 1A). Shortly after, the data label was amended to show that the next run would be the second TACAN approach to runway 12 (run 3B).
At 1537, the Tower controller advised the pilot of the calibrator aircraft that, after the next run (that is, run 3B), FIZ would be required to hold to facilitate a number of arriving aircraft. In response, the pilot of FIZ asked ‘on completion of this run would it be possible to join the 7 TAC[9] counter-clockwise orbit 3,100 and would that keep us clear of traffic?’ This referred to run 1A on the TACAN run sheet, although the pilot did not include ‘run 1A’ in the request. The Tower controller responded with ‘standby’.
To enable the calibration of all of the TACAN equipment, the second of each run number (runs 1B, 2B and 3B) required ground-based technicians to switch to the redundant TACAN system. However, there was a delay in the requested switch for run 3B which was increasingly causing a delay to arriving aircraft, so the Tower supervisor told the Tower controller to cancel run 3B and hold FIZ to facilitate the arrivals.
At 1541, on being advised to hold south of the airfield not above 1,500 ft, the pilot of FIZ asked ‘… can we climb up and do the orbit then?’ The Tower controller responded with ‘… affirm climb not above 3,100 (ft).’ Anticipating that they may become busy with other tasks, the Tower controller reported requesting the Surface Movement controller to monitor FIZ.
At 1543, the pilot of the first of the arriving aircraft, a passenger Airbus A320, contacted the Tower controller and was cleared to track from the north of Williamtown to the right base leg of the circuit for runway 30. At the same time, surveillance data showed that FIZ commenced flying in a counter-clockwise direction (run 1A) around Williamtown from a position 7 NM (13.0 km) to the west of the airfield (position 1 on Figure 2).
Figure 2: Williamtown airspace showing the location and track of VH-FIZ and a formation of four Boeing F/A18 aircraft (numbers represent relative locations at the same time – see Table 1)
At 1546, the pilot of the lead aircraft in a formation of three BAE Systems Hawk aircraft (Hawks) contacted the Tower controller east of Williamtown for a visual approach stream landing[10] via ‘straight initial’ (see the section titled Military operations) to runway 30. The Hawks were descending to 2,500 ft, 1,000 ft above the level of the A320, and advised the Tower controller that the aircraft would be deploying brake-chutes[11] on landing.
At the same time, the pilot of the lead aircraft of a formation of four F18s contacted the Approach controller tracking from the west directly to Williamtown on descent to 8,000 ft. At the time, the transponder for the lead F18[12] indicated that the aircraft was descending through flight level[13] (FL) 137. The Approach controller entered silent coordination in the data label for the F18s which indicated that the aircraft would track to overhead the airfield and then to the northeast on a heading. No information on how or if the aircraft would return for landing was included.
At 1545, the Tower controller cleared the A320 to land and at 1546 cleared the Hawks for a visual approach. At the same time, the Tower controller was involved in coordinating personnel to enter the runway after the Hawks landed to retrieve the brake-chutes. The surveillance data showed that, nine seconds later, FIZ crossed the coast tracking in a north-easterly direction, leaving the airspace released to the Tower controller and entering airspace under the jurisdiction of the Approach controller (position 3 , Figure 2).
Shortly before the formation of F18s passed overhead Williamtown at 1547, the Approach controller cleared the F18s to descend to 5,000 ft and track for an arrival via ‘right initial’ to runway 30 involving a right descending turn towards the ‘initial point’ seen in Figure 2 (see the section titled Military operations). The Approach controller then removed the heading from the F18s data label. After the pilot of the lead F18 reported the Hawks in sight, the Approach controller cleared the F18s for a visual approach.
Ten seconds after clearing the F18s for a visual approach, the Approach controller updated the silent coordination on the data label to show that the F18s were making a visual approach via right initial (the F18s were then at position 6 in Figure 2). Nine seconds later, at 1548, the pilot of the lead F18 contacted the Tower controller while descending through 6,300 ft and on a converging track with the track of FIZ.
Twenty four seconds later, as FIZ was maintaining 3,100 ft at 7 NM (13.0 km) to the southeast of Williamtown and about 8 NM (14.8 km) from and 1,100 ft below the F18s, the Tower controller asked the pilot of FIZ to confirm that the aircraft was holding south of the airfield. The pilot responded in the negative and that FIZ was conducting a counterclockwise orbit of Williamtown.
Fourteen seconds later, when the aircraft were about 6 NM (11.1 km) apart, the Approach controller alerted the Tower controller to the need for a safety alert[14] between the aircraft. The Tower controller responded that he had ‘got it’ and 4 seconds later issued a safety alert to the pilot of FIZ: ‘safety alert Toxin Tripod four F18s your 2 o’clock passing through 3,000’. At this time, the lead F18 was descending through 3,400 ft, 5 NM (9.3 km) directly in front of and converging with FIZ. At that time, FIZ was travelling at 230 knots (kt) towards the F18s travelling at 460 kt.
At 1549, as the pilot of FIZ reported the F18s in sight, separation between the formation of F18s and FIZ reduced below 3 NM (5.6 km) with the lead F18 descending through 2,700 ft. Nineteen seconds later, the F18s flew directly below FIZ with less than the required 1,000 ft separation and they advised the Tower controller that they were ‘visual with the traffic that just passed overhead’
Shortly afterwards, the Approach controller resumed the airspace outside 5 NM (9.3 km) Williamtown and above 1,500 ft, and FIZ was transferred to the Approach controller’s frequency for the remainder of the calibration flight. The F18s landed shortly afterwards.
Table 1: Location of VH-FIZ and the F18s at specified times as shown in Figure 2
As a Department of Defence (Defence) airfield, air traffic services at Williamtown, also known as Newcastle Airport, were provided by Defence personnel. Approval had been granted for the operation of a number of civil aircraft, including regular public transport flights. In 2013, there were 16,764 domestic/regional airline movements[15] into and out of Williamtown.[16] In addition to airlines and military aircraft, civilian general aviation aircraft also regularly used the airfield.
Airspace
Williamtown Tower controllers are normally responsible for the Aerodrome Traffic Zone (ATZ) (shown as the dark green area in Figure 1) that includes the circuit area; 5 NM (9.3 km) radius of Williamtown, over land only, from the surface to 1,500 ft above mean sea level (AMSL).
On the morning of the occurrence, the Tower and Approach supervisors learnt that calibration check activities for the instrument landing system (ILS) and the tactical air navigation system (TACAN) would commence at 1100. There were no procedures in place relating to the control and sequencing of the calibration flight. To expedite the calibration activity and reduce the workload of both the pilot and controllers, the Tower and Approach supervisors agreed that VH-FIZ (FIZ) would remain on the Tower controller’s frequency and operate in airspace normally under the jurisdiction of the Approach controller. To achieve this, airspace usually under the control of Approach was released to the Tower. The released airspace, over land within a 12 NM (22.2 km) radius of Williamtown, from the surface to 3,500 ft (light green area of Figure 1), would contain all of the planned calibration runs apart from the two 7 NM (13.0 km) orbits of Williamtown. The latter required FIZ to track over water in airspace controlled by Approach.
The airspace was released to the Tower controller 2 minutes before FIZ became airborne. The pilot of FIZ had been cleared to operate within 15 NM (27.8 km) of Williamtown not above 3,300 ft. However, as the clearance did not specify ‘over land’, the clearance contained the airspace required to complete all calibration runs.
Personnel information
On weekdays, three controllers normally worked in Williamtown Tower – a Tower supervisor, a Tower controller and a Surface Movement controller. On the morning of the occurrence, two additional controllers were present – a training officer and a checking controller. The afternoon shift comprised three controllers – the Tower supervisor, the Tower controller and a newly endorsed Surface Movement controller. All controllers held the appropriate endorsements to provide a Tower control service for aircraft operating within the Williamtown airspace.
A review by the Australian Transport Safety Bureau (ATSB) indicated that the roster for the controllers was unlikely to have resulted in work-induced fatigue.
The primary duty of the Tower controller was to visually separate aircraft. The surveillance display could be used as a separation and situation awareness aid, as long as that utilisation did not detract from the primary duty of applying visual separation. The intent of allowing Tower controllers to use the display to establish or monitor separation was to enable the controller to convert a radar separation standard established by the Approach controller into a Tower visual separation standard for arriving aircraft and vice versa for departing aircraft. The display was not designed to enable Tower controllers to use radar as the primary method of separation between aircraft operating within the ATZ.
The larger than usual volume of airspace released to the Tower controller required the controller to, on occasion, use the display to monitor and separate aircraft, even though they were not trained to use radar separation. Neither the afternoon Tower supervisor nor the Tower controller had ever operated with such a large volume of airspace. They both reported that it had been difficult to see the calibration aircraft and that often binoculars were needed to see FIZ.
Aircraft information
The operator of FIZ provided calibration services to both of Australia’s air navigation service providers – Airservices Australia and Defence. The flight crew included a number of technicians to undertake the actual calibration tasks while the pilot maintained a pre-determined and specific flight path and level.
The four Boeing F/A18 aircraft (F18s) were operated by Defence personnel based at Williamtown. The F18 flight crew operated in accordance with procedures designed to provide separation assurance and contained within the Williamtown Base Standing Instructions (Base SIs), available to both the Defence aircrew and air traffic control (ATC) personnel.
Calibration activities
Both the ILS and the TACAN were designed for use by aircraft in instrument meteorological conditions (IMC)[17] and both provided guidance to aircraft during the final stages of an approach to land. Routine monitoring, ground testing and maintenance ensured that the systems performed within the specified tolerances and that the operational integrity and serviceability of the systems were maintained. Australia-wide, periodic flight testing (calibration) was required to ensure that ground-based aeronautical navigational equipment remained within the tolerances required for the safe operation of aircraft.
The Flight Commander[18] at Williamtown was given 24 working days’ notice that a calibration aircraft would be operating there for a 2-day period. The run sheet for the instrument landing system (ILS) calibration was emailed to Williamtown 2 days prior to the occurrence, but those for the tactical air navigation system (TACAN) were only emailed on the morning of 19 September 2013 (the day of the occurrence). Additionally, the TACAN run sheet was only provided in ‘draft’ to the operational personnel, not to the Flight Commander.
The run sheet for the ILS listed 23 runs and included a copy of the Williamtown visual terminal chart (VTC) with relevant information added. The ILS run sheet indicated that some runs could be deleted, and that runs would not necessarily be consecutive. The run sheet for the TACAN calibration was emailed to Williamtown in draft format, with a note ‘The run numbers are to assist with Pilot/ATC communications, not to indicate the order in which the runs will be completed.’ Although the approaches and manoeuvres were listed as runs, the layout was significantly different to that used on the ILS run sheet. The TACAN runs included two 7 NM (13.0 km) orbits around Williamtown (runs 1A and 1B, the blue broken line in Figure 1) and two approaches to each runway (runs 2A and 2B to runway 30, runs 3A and 3B to runway 12).
At about 1500, when the afternoon Tower shift commenced work, FIZ had completed almost all of the ILS runs, but had yet to commence the TACAN runs.
When run 3B was cancelled and the pilot of the calibration aircraft asked ‘… can we climb up and do the orbit then?’ the Tower controller reported that they expected FIZ would complete a holding orbit. That is, that the pilot would conduct a continuous steady rate turn to remain to the south of the airfield. However, the tracking of FIZ demonstrated that, on receiving the response ‘…affirm climb not above 3,100’, the pilot understood the controller had cleared the calibration aircraft for the 7 NM (13.0 km) orbit around the Williamtown TACAN.
Military operations
Military fast jets and some training aircraft operate predominately in formation where the pilots of two or more aircraft fly in close proximity to each other and operate as a single aircraft with regard to navigation, position reporting and control.[19]
Military aircraft ‘initial and pitch’ circuit procedures were as follows:
For military fast jet and training aircraft, the preferred method of joining the circuit is via a procedure known as Initial and Pitch. The aircraft (or formation) will track to the Initial Point, a point at 5 NM downwind of the runway in use displaced to the dead side, and track inbound at high speeds. At any stage once abeam the threshold of the runway in use, and safe to do so, the aircraft turns (“Pitches”) to join downwind and configures for landing.[20]
The initial point for runway 30 was a position at the intersection of a line aligned slightly north of the runway and the coast to the east of Williamtown (pink cross on both Figure 1 and 2). Base SIs required military pilots to report their position to the Tower controller 30 seconds prior to the initial point as left, right or straight initial – the direction denoting the turn required from their arrival path to align with the landing direction. Traffic information[21] was provided to these aircraft following that report.
Organisational and management information
Coordination
The 453 Squadron Williamtown Flight Standing Instructions (ATC SIs) stipulated that the Approach controller did not need to seek a clearance from the Tower controller for visual approaches to the duty runway for locally-based Hawk and F18 aircraft. They also stipulated that those aircraft on a visual approach would be transferred to the Tower frequency at 10 NM (18.5 km). However, the Approach controller was required to coordinate all traffic that would infringe the ATZ.
To reduce workload when the ATZ was controlled by the Tower controller, voice coordination from Approach to Tower controllers for arriving locally-based Hawk and F18 aircraft was replaced by silent coordination. Silent coordination was conducted by placing the intentions for the aircraft in the data label for the aircraft or formation on the surveillance display, utilising abbreviations listed in the ATC SIs.
Strategic separation assurance
The Manual of Air Traffic Services (MATS)[22] stipulated that separation assurance must be applied. It defined strategic separation assurance as:
Strategic separation assurance is the designing of airspace, air routes, air traffic management plans and air traffic control practices, to reduce the likelihood that aircraft will come into conflict, particularly where traffic frequency congestion or system performance, amongst other considerations, may impair control actions.
Strategic separation assurance was provided at Williamtown and published in the Base and ATC SIs. When issued a visual approach, pilots of locally-based military aircraft were required to remain outside the Tower’s airspace until provided with traffic information on aircraft within that airspace. The normal vertical limit of the Tower’s airspace was 1,500 ft with a requirement that local military aircraft were required to overfly not below 2,500 ft. On the day of the occurrence the Tower’s airspace was increased to 3,500 ft. However, as the operators of the local military aircraft were not advised, the minimum overfly altitude remained unchanged at 2,500 ft. Changing the airspace on the day of the occurrence without changing these requirements, or amending the silent coordination arrangements, negated the documented strategic separation measures applicable to locally-based military aircraft.
Separation
Separation is the concept of ensuring an aircraft maintains a prescribed minimum distance from another aircraft or object. Within controlled airspace, ATC provided separation using standards specified in the Manual of Standards Part 172[23] (MOS 172) and listed in MATS. Although different standards could be used between military aircraft, Williamtown ATC used the MOS 172 standards when controlling civil, or a combination of civil and military, aircraft. Only one separation standard was required to be in place between aircraft at any one time, but another standard had to be established by a controller prior to the current separation minimum being infringed. Controllers normally base the method of separation on operational advantage but the type of separation standard used depends on a number of factors.
The ATC SIs required the Tower controller to separate and sequence circuit aircraft with all arrivals, departures and transits of the ATZ. As well as all aircraft conducting operations in the ATZ, aircraft arriving via the initial point were considered to be circuit aircraft at the initial point.
The methods of separation used by Williamtown Tower controllers were predominately vertical and visual. Although the Tower controller had access to a surveillance display, they were not trained or endorsed to use that equipment for radar separation, and as such, the surveillance standard of 3 NM (5.6 km) did not apply. However, the Tower controller could use the surveillance display to assist with situation awareness and for silent coordination (see the section on Coordination).
The use of one of the two vertical separation standards available to the Tower controller, 500 ft or 1,000 ft, was dependent on the maximum take-off weight (MTOW) of the aircraft being separated. If both aircraft were 7,000 kg MTOW or less, 500 ft could be used. Although the MTOW of the calibration aircraft was below 7,000 kg, the weight of the F18s was considerably higher so the appropriate minimum vertical separation standard between FIZ and the F18s was 1,000 ft.
To determine the altitude of the F18s for separation purposes, the Tower controller could request the pilot of the lead F18 to report when the formation had descended through 2,100 ft (1,000 ft below FIZ).
Two visual separation standards were available to the Tower controller. The use of the visual (pilot) separation standard transferred separation responsibility from ATC to the pilot of an aircraft and required that pilot to ensure that their aircraft remained clear of other aircraft. A number of requirements existed for the use of the visual (pilot) standard, the most relevant to this occurrence were that the pilot of one aircraft had to have reported the other aircraft in sight and the pilot of the other aircraft, if IFR, had to have been provided with traffic information and advised that the responsibility for separation had been transferred.
The visual (ATC) separation standard could be used between aircraft that had been positively identified by the Tower controller visually identifying the aircraft type. Prescribed separation minima could be reduced in the vicinity of airfields when adequate separation could be provided using visual observation and each aircraft was continuously visible by the Tower controller. However, visual (ATC) separation could only be applied when the projected flight paths of the aircraft did not conflict. As long as the calibration aircraft remained over land to the south of Williamtown, the visual (ATC) separation standard existed.
The lateral separation standard of 1 NM (1.9 km) could have been applied to the aircraft if their positions were determined relative to a prominent topographical feature. If the Tower controller has issued positive holding instructions to the pilot of FIZ to hold over land to the south of the airfield, and the controller had established that the aircraft was holding in that position either by sighting the aircraft or by pilot report, the lateral standard would have existed.
Of the separation standards available to the Tower controller, the only applicable standards on the day were 1,000 ft vertical, visual (pilot) or lateral. As the requirements for the visual (pilot) standard and the lateral standard were not in place, 1,000 ft was required between FIZ and the F18s. When the Tower controller identified that FIZ was over water to the south-east of the airfield, they asked the pilot for confirmation that the aircraft was holding to the south. However, if the Tower controller had at that time issued turn instructions to the pilot to re-establish FIZ over land and clear of the projected flight path of the F18s, the visual (ATC) separation standard would have been re-established between the calibration aircraft and the F18s.
Monitoring aircraft
To ensure that separation was maintained, Tower controllers were required to monitor the traffic situation. However, the Tower controller did not monitor the location of FIZ holding to the south and was therefore unaware that the aircraft had crossed the coast and left the airspace under their jurisdiction. Although the Tower controller had requested that the Surface Movement controller monitor FIZ, monitoring an aircraft of that size at that distance was difficult. Additionally, the Approach controller did not monitor the airspace under their jurisdiction sufficiently to observe FIZ crossing the coast.
Compromised separation recovery
If a controller determined that aircraft were, or would be, in unsafe proximity, the controller was required to issue a safety alert, using the following prescribed phraseology:
SAFETY ALERT TRAFFIC (number) MILES OPPOSITE DIRECTION / CROSSING LEFT TO RIGHT / RIGHT TO LEFT (level information).[24]
Although the Tower controller did issue a safety alert to the pilot of VH-FIZ, the correct phraseology was not used, and no safety alert was provided to the F18 pilots.
Supervision
The Tower supervisor was responsible for, among other activities, supervising and coordinating the work of the Tower and Surface Movement controllers, and for maintaining a close working liaison with the Approach supervisor.
The Tower supervisor reported that the calibration aircraft was difficult to see when it tracked to hold south of the airfield and that they had told the Tower controller a number of times to provide clearer holding instructions to the pilot of FIZ as the aircraft did not look like it was holding as expected.
Close liaison was a regular activity for the supervisors to optimise traffic management as the majority of Williamtown Tower traffic was high speed military aircraft, sometimes requiring last-minute sequence changes for operational reasons.
Priorities
The Australian Aeronautical Information Publication (AIP) stated that an aircraft first able to use the airspace in the normal course of its operations would be given priority. However, as the AIP allowed for aircraft engaged in navigation aid checks to be given priority, controllers prioritised FIZ’s operations as much as possible. The prioritisation was achieved by holding departures on the ground and holding arrivals outside the calibration aircraft’s area of operations for short periods of time, then holding FIZ to facilitate departures and arrivals.
Risk management
Defence required the use of aviation risk management strategies across all aviation activities. In line with this, the agency responsible for Defence air traffic services stipulated that any complex, new, unusual or irregular activity required a risk assessment and that treatments be developed for any risks assessed as medium or higher.
Williamtown ATC had in place a number of generic risk assessments and treatments for occasions when less than the required number of endorsed personnel were available to assist decision making while balancing controller workload and safety. Issues requiring consideration included anticipated traffic complexity or unusual activity, complexity of airspace, and experience levels. The documentation provided direction on the number of personnel required and methods for reducing the number or complexity of traffic. Within each assessment, the level of risk had been assessed in line with specific conditions and/or treatments – including staffing and traffic levels, weather, equipment serviceability and airspace configuration. However, there were no risk assessment for increased traffic complexity (such as a calibration aircraft operating to the non-duty runway) or for additional airspace being released to the Tower controller.
Although executive personnel within the Williamtown ATC unit were notified of the calibration flight inspection 5 weeks prior to the event on 15 August 2013, and further details of the proposed inspection were available from an internal Defence website, the Williamtown Flight Commander reported that, as calibration flights occurred a number of times each year at Williamtown, they were not considered irregular activities and therefore did not require the development of a risk assessment or treatment. The Flight Commander noted that initial notification of calibration flights had provided no details.
Previous occurrences
A review of the ATSB database identified three notifications involving a calibration aircraft at Australian airfields in the 7 years prior to, and one shortly after, the Williamtown occurrence. None of these notifications were investigated by the ATSB.
The ATSB research report AR-2012-034 Loss of separation between aircraft in Australian airspace – January 2008 to June 2012, noted that ‘assessing and planning’ or ‘monitoring and checking’ errors were involved with most individual controller actions that contributed to loss of separation (LOS) occurrences. Ineffective management of compromised separation before it became a LOS was categorised as an assessing and planning error. Monitoring and checking errors included controller actions associated with maintaining awareness of traffic disposition and not detecting that the pilot of an aircraft was not complying with an instruction when there was opportunity to detect this.
Additionally, the ATSB report found that about a quarter of LOS occurrences contributed to by ATC actions involved communication errors. These included not passing traffic information to pilots once separation was compromised and not providing clear, timely or urgent instructions to pilots when separation had been lost to ensure that immediate action was taken to avoid other aircraft or re-establish separation.
The research report found that task demands were the most common type of local condition identified in LOS occurrences where controllers were involved – in particular, high workload and distractions. Common in all ATC environments, these local conditions were more common in the Tower environment. Controller knowledge, skills and experience factors were also identified as local conditions in LOS occurrences.
Although the opportunity for Williamtown air traffic control (ATC) to undertake prior planning for the calibration operations had existed in the 24 working days between the initial notice and the activity, no such planning took place. Defence air traffic services stipulated that any complex, new, unusual or irregular activity required a risk assessment. However, as calibration flights occurred a number of times each year, the Williamtown ATC Flight Commander did not believe that such activity required the conduct of a risk assessment. In addition, although Williamtown ATC had in place a number of generic risk assessments and treatments for unusual situations, there were no risk assessment for increased traffic complexity such as that created by the calibration activities.
Prior planning and a risk assessment had the potential to identify the need to increase staffing in both the Tower and Approach areas, provide briefings for ATC personnel and the pilots of locally-based aircraft, and ensure controllers had a thorough understanding of the calibration run sheets prior to the activity commencing. Such prior planning would have incorporated strategic separation assurance considerations.
The Williamtown Approach controller released airspace to the Tower controller that was considerably larger than that normally controlled by the Tower. That resulted in both the Tower supervisor and the Tower controller having difficultly monitoring the airspace visually, and the need for the Tower controller, though not trained in the use of radar separation, to rely on the surveillance display for situation awareness as well as separation. In situations where the location of an aircraft is known (from a position report or from observing a surveillance display), a controller could quickly use the binoculars to locate an aircraft. However, to locate an aircraft at an unknown position, the controller would need to scan the sky, possibly with the assistance of binoculars. Although binoculars were available to the controllers, binoculars could potentially limit the controller’s view. Using binoculars would also have been time-consuming.
During the morning, there had been two additional controllers in the Tower cabin than normal. They were able to assist with monitoring VH-FIZ (FIZ), and a number of the controllers present had experience with the use of surveillance data for monitoring aircraft and providing separation instructions. At the time of the occurrence, only three controllers were in the Tower cabin. One was newly endorsed in Surface Movement control, without having undertaken training in the control of airborne aircraft. The other two controllers present were not trained in separating aircraft with surveillance data.
Williamtown Base Standing Instructions (Base SIs) and 453 Squadron Williamtown Flight Standing Instructions (ATC SIs) contained restrictions and requirements, for both controllers and locally-based military aircrew, to provide strategic separation assurance between arriving locally-based military aircraft and those within the airspace normally controlled by the Tower controller. These specifically required the local aircraft to remain clear of airspace under the Tower controller’s jurisdiction until issued with traffic information. The last minute planning conducted on the morning of the occurrence by two ATC supervisors, though well intentioned, resulted in less than optimal conditions. These included procedures that negated the established strategic separation assurance documented in both Base and ATC SIs, increased traffic complexity, and the need for the Tower controller to rely on the surveillance display when the controller was not trained to use radar separation.
The run sheet provided to ATC for the calibration of the tactical air navigation system (TACAN) numbered each required run and included a note ‘The run numbers are to assist with Pilot/ATC communications, not to indicate the order in which the runs will be completed.’ Had the pilot of VHFIZ (FIZ) used the run number (Run 1A) in the request to conduct the 7 NM (13.0 km) orbit around Williamtown, the Tower controller may not have misinterpreted the pilot’s request with a request to hold south of Williamtown in an orbit – a standard holding manoeuvre that would essentially keep the aircraft in the same area. However, as the only calibration runs requiring 3,100 ft were the 7 NM (13.0 km) orbits of the Williamtown TACAN, the Tower controller’s reported belief that the pilot of FIZ had asked for that altitude to prepare for the next run to runway 30, for which the run sheet indicated a commencement altitude of 1,500 ft, demonstrated that the controller was either not referring to the run sheet or did not understand the run sheet.
If the Tower controller had used run numbers on the data labels for silent coordination, the Approach controller would have had the opportunity to maintain situation awareness of calibration activities. Further, the use of run numbers would have provided cues to the Tower controller. In turn, the Tower controller may then have been more likely to use the numbers in communication with the pilot of FIZ, removing the opportunity for the pilot to misunderstand the controller’s approval to conduct an orbit.
Although prompted a number of times by the Tower supervisor, the Tower controller did not issue specific holding instructions to the pilot of FIZ. Specific holding instructions could have included ‘hold over land to the south of the field’ or to hold over a specific location. Such an instruction would have resulted in the pilot of FIZ questioning their understanding of the approval to conduct an orbit.
Once the pilot of FIZ commenced the 7 NM (13.0 km) orbit around Williamtown, in line with the pilot’s interpretation of the Tower controller’s response to the request, a loss of separation assurance (LOSA) existed between the calibration aircraft and the formation of four Boeing F/A18 aircraft (F18s) tracking for runway 30. Believing that FIZ was holding to the south in an orbit, the Tower controller did not visually monitor FIZ’s position. Instead, the Tower controller relied on the Surface Movement controller to do so while the Tower controller attended to other aircraft.
An opportunity to identify the loss of separation assurance at an earlier point was lost when the Approach controller did not identify that FIZ had crossed the coast, leaving the airspace released to the Tower controller. The Tower controller had not coordinated FIZ’s entry into airspace under the jurisdiction of the Approach controller. However, the Approach controller should have observed the calibrator entering and remaining in airspace under their jurisdiction. FIZ crossed the coast into the Approach controller’s airspace prior to the F18s passing overhead Williamtown and before they were issued with a visual approach. If FIZ had been identified in the Approach controller’s airspace at this stage, the F18s could have been held away to allow FIZ to complete the 7 NM (13.0 km) orbit of Williamtown, or the Tower controller could have been instructed to turn FIZ to re-establish the calibration aircraft over land. When the Approach controller did observe FIZ and realise the potential conflict with the F18s, they immediately contacted the Tower controller and asked that a safety alert be issued.
Once the Tower controller became aware of FIZ’s position to the south-east over water, clear and urgent information was not immediately provided to the pilot to ensure separation and avoidance with the F18s. As the closure speed between the calibration aircraft and the F18s was very high, the opportunity to provide timely control instructions and traffic information was lost when the controller asked the pilot of FIZ to confirm that the aircraft was holding to the south even though the controller had observed the aircraft tracking in a northerly direction south-east of Williamtown. The absence of clear control instructions to either the calibration aircraft or the formation of F18s resulted in a loss of separation (LOS) between aircraft that had not been provided traffic information in relation to the impending conflict. The absence of traffic information in sufficient time and in sufficient detail increased the risk posed by the LOS.
Findings
From the evidence available, the following findings are made with respect to the loss of separation between a Beechcraft B300, registered VHFIZ, and a formation of four Boeing F/A18 aircraft that occurred near Williamtown (Newcastle Airport), New South Wales on 19 September 2013. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The applicability of a general requirement to conduct aviation risk assessments for complex, new, unusual or irregular activities was open to interpretation. [Safety issue]
The absence of prior planning relating to the operation of the calibration aircraft resulted in a work-around that did not address all related safety aspects and negated the existing strategic separation assurance.
The Williamtown Approach controller released airspace to the Tower controller that was considerably larger than that normally controlled by the Tower, resulting in both the Tower supervisor and the Tower controller having difficultly monitoring the airspace visually, and the need for the Tower controller, though not trained in the use of surveillance control, to rely on the surveillance display for separation.
The absence of specific control instructions by the Tower controller to the pilot of VH-FIZ created an opportunity for the pilot to misunderstand the Tower controller's intent in relation to the pilot’s requested ‘orbit’.
The Tower controller did not monitor the flight path of VH-FIZ due to an assumption the aircraft would remain in the area the controller had intended the aircraft to remain, leading to a loss of separation assurance.
The Approach controller did not monitor their airspace sufficiently well to observe VH-FIZ crossing the coast into airspace under their jurisdiction, removing the chance for earlier detection of the loss of separation assurance.
The Tower controller did not provide immediate and clear control instructions to either VH-FIZ or the formation of F18s once the conflict was detected, resulting in a loss of separation with the formation of Boeing F/A18 aircraft flying directly below VH-FIZ with less than 1,000 ft separation.
Safety issues and actions
The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Absence of prior planning
The applicability of a general requirement to conduct aviation risk assessments for complex, new, unusual or irregular activities was open to interpretation.
The sources of information during the investigation included:
the Department of Defence (Defence)
Airservices Australia
the operator and pilot of VHFIZ.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Defence, the pilot and operator of VHFIZ and the air traffic controllers directly involved.
Submissions were received from Defence. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Early in the afternoon on 7 November 2015, a Robinson R44 helicopter, registered VH-HOQ (HOQ), was conducting pilot training on the western end of Redcliffe aerodrome, Queensland. HOQ was conducting a training sortie and had an instructor and student on board. The training involved practicing engine failures in the hover and while taxiing. Their operations were confined within the aerodrome boundary (Figure 1) and clear of the runway and taxiway. They had completed the initial part of the sortie on the grass area to the south of the taxiway.
Figure 1: Redcliffe Aerodrome layout showing the approximate position of the aerodrome boundary (yellow)
Source: Google Maps. Modified by ATSB
At the same time, a de Havilland DH82A (Tiger Moth), registered VHBJE (BJE), was taxiing for departure on runway 07. BJE was departing for a scenic flight with the pilot and one passenger on board. Both aircraft were operating under the visual flight rules,[1] and the weather conditions were fine and clear.
While BJE was taxiing for Runway 07, HOQ moved to the grassed area just north of the taxiway to practice engine failures while taxiing. These manoeuvres involved the helicopter flying at low level parallel to the taxiway and landing on the grass. Once they had reached the eastern end of the grass area the instructor would taxi back to the start point to allow more training to occur.
Due to the nature of the helicopter training being conducted, the focus of the instructor and student was reduced to their immediate operations. During the transit from the grassed area to the area next to the taxiway HOQ did not advise the change in operating area on the common traffic advisory frequency (CTAF)[2] to other aircraft. While they were aware of the Tiger Moth, they did not consider it to be a concern. This was because the helicopter operations were going to remain clear of where the Tiger Moth was intending to operate.
The pilot of BJE broadcast their intentions to taxi and enter the runway to other aircraft in the area on the Redcliffe CTAF. There were no other radio transmissions by other aircraft while BJE was taxiing and entering the runway. While taxiing, the pilot of BJE noted the position of the helicopter and saw that it was well clear. The pilot of BJE therefore did not expect that the helicopter would change operating area to conflict with their departure.
The pilot of BJE lined up for departure on the grass beside the runway, because the aircraft was fitted with a tail skid, not a tail wheel. The grass area for BJE’s take off was within the runway strip to the side of the runway closest to the taxiway. BJE commenced the take-off run and, shortly after, the pilot noticed HOQ flying on a parallel track to BJE (Figure 2). The helicopter was to the right, slightly ahead and above BJE, and in close proximity.
Figure 2: BJE during the take-off run just prior to HOQ conducting the left turn
Source: Observer
Shortly after becoming airborne from the grass runway, at about 50 to 60 ft above ground level (AGL), the pilot of BJE saw the helicopter commence a left turn towards the runway. Thinking that there was going to be a collision, the pilot of BJE took avoiding action by conducting a hard left turn, with a high angle of bank, at low altitude. The approximate tracks of the aircraft are depicted in Figure 3.
Figure 3: Redcliffe aerodrome showing the runway strip (white). The take-off run and left turn of BJE is indicated in orange. The track of HOQ when conducting the engine failures during taxi and the reversal turn is indicated in blue.
Source: Google Maps. Modified by ATSB
The instructor in HOQ was executing a reversal turn in order to reposition the helicopter for further training (Figure 4). The manoeuvre involved a 180-degree left turn, to reverse the direction of flight, with an increase in height to about 50-60ft and a bank angle of about 50o. The turn and track back down the grassed area would keep the helicopter outside the runway strip and clear of BJE. However, as the instructor had not advised their intentions on the CTAF, the pilot of BJE was unaware that the helicopter was going to remain clear of the aircraft.
Figure 4: View from the Tiger Moth when the helicopter was approximately half way through the reversal turn
Source: Video from passenger
Pilot comments
Instructor, HOQ: Teaching, demonstrating, and conducting, practice engine failures at low level is a very high demand task. The instructor’s attention is, predominantly, directly ahead of the aircraft and in closely monitoring the student control inputs. This is to ensure that the student is executing the correct technique and safely executing the manoeuvre to avoid damage to the aircraft.
The operations in between the taxiway and the runway strip were going to be conducted so that they would always remain clear of other aircraft operating on the runway. The instructor did not advise the change in operating area as he assessed that there would be no conflict between the aircraft.
Pilot in Command, BJE: During the taxi to the runway the pilot noted the position of HOQ. At this time HOQ was operating to the south of the taxiway and not near the runway. The next time that the pilot of BJE saw HOQ was just after commencing the take-off roll. This surprised the pilot of BJE as he had not heard any transmissions advising that HOQ had changed their operating area. As a result, when HOQ commenced the reversal turn, he assessed that a collision was imminent. To avoid the possibility of a collision, the pilot of BJE turned the aircraft away to the left. The turn was made at low level, with a high angle of bank and at a relatively slow airspeed.
ATSB comment
Both pilots were monitoring the CTAF and the pilot of BJE had transmitted their intentions correctly. However, as the instructor of HOQ did not advise that they were going to conduct the reversal turn, the pilot of BJE did not know that the helicopter would remain outside the runway strip. The avoiding action taken by the pilot of BJE in this case may have been avoided if the helicopter pilot had communicated their intentions.
Safety message
Pilots are encouraged to ‘err on the side of caution’ when considering when to make broadcasts on CTAF, particularly when the aircraft operations are likely to be in close proximity to other aircraft.
Insufficient communication between pilots operating in the same area is the most common cause of safety incidents near non-controlled aerodromes.
A search for other traffic is eight times more effective when a radio is used in combination with a visual lookout than when no radio is used.
The CASA booklet titled Operations at non-controlled aerodromes provides guidance with respect to the limitations of the see-and-avoid principle and relevant radio procedures. Civil Aviation Advisory Publication 166-1 also provides relevant guidance with respect to CTAF procedures.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 6 November 2015, at about 1829 Eastern Daylight Saving Time, the pilot of a Cessna Aircraft Company 310R registered VH‑BWZ, on a private flight from Moorabbin to Mildura, Victoria lost control of the aircraft near Mildura Airport and collided with terrain. The pilot was fatally injured and the aircraft destroyed.
What the ATSB found
Witnesses reported that when on final approach to land at Mildura, at low altitude, the aircraft yawed to the left, dropped its left wing and rapidly lost altitude. A number of factors contributed to the loss of control. The aircraft’s left engine was found to have been starved of fuel and at the time of the accident was not producing power. The left propeller was found to be towards fine pitch, not feathered (rotation of propeller blades to an edge-on angle to the airflow to minimise aircraft drag following an in-flight engine failure or shutdown), and the flaps and landing gear were fully extended, consistent with a normal landing configuration. In that configuration with the engine not producing power, the aircraft’s performance would have degraded to the extent that altitude could not be maintained.
The ATSB was unable to ascertain why the left engine was starved of fuel, nor could it be determined when the engine was starved of fuel. The ATSB did establish that it was likely the aircraft was carrying a substantial amount of fuel on board for continued flight and that the left engine and left propeller were capable of normal operation.
Several components recovered from the aircraft were tested. Some abnormalities were identified, however, it was unlikely that these contributed to the accident. No mechanical defects were identified that may have contributed to the accident. However, examination of the aircraft was limited due to the extent of the damage resulting from the post-impact fire.
It was likely that the combination of the inoperative left engine with the propeller in the fine pitch and the right engine at high power resulted in asymmetric thrust. Whilst at low altitude in a landing configuration with asymmetric thrust, the pilot lost control of the aircraft.
Safety message
In situations such as an inoperative engine condition, the aircraft’s landing gear, flaps and or propeller management can potentially impose increased drag impacting significantly on the aircraft’s performance. Low airspeed in critical phases of flight such as take-off and landing can further exacerbate the situation. Pilots need to train, maintain their skills and constantly monitor aircraft systems to be prepared for abnormal flight situations, especially during critical phases of flight where greater attentional focus is required.
While ATSB research has found that the rate of power loss accidents in multi-engine aircraft occur less than that in single-engine aircraft, they are more likely to be fatal and overwhelmingly due to the potential for loss of control. In particular, the approach phase of flight is considered riskier due to lower altitudes and lower available aircraft energy.
This accident has emphasised the adverse consequences of aircraft configuration on performance with one-engine inoperative, particularly when at low altitudes. It reinforced the importance of pilots remaining well versed in engine failure response procedures and being aware of the drag penalties associated with varying configurations. It also highlighted the challenges associated with recognising an asymmetric condition when in a descent or at a low power setting. When faced with an inoperative engine in a multi-engine aircraft, attention to both aircraft control and performance is crucial for safe flight.
The occurrence
On 3 November 2015, the pilot of a Cessna Aircraft Company 310R, registered VH-BWZ, departed Mildura, Victoria on a private flight to Latrobe Valley. The pilot had intended to return to Mildura the next day, however, due to poor weather, he elected to fly to Moorabbin. On 5 November, the pilot was again unable to return to Mildura due to poor weather and took the opportunity to have some minor maintenance performed on the aircraft while at Moorabbin where a wire was repaired to the tachometer.
On 6 November, at about 1650 Eastern Daylight-saving Time,[1] the pilot departed Moorabbin for Mildura, operating under instrument flight rules.[2] Despite the pilot having some difficulties shortly after departing, including a transient transponder code issue, navigating in poor weather and reporting a ‘downward force on the aircraft’, the pilot appeared to resolve these issues and stated to air traffic control (ATC) an intention ‘to continue to Mildura’. ATC subsequently issued vectors to depart Melbourne airspace for Mildura.
The flight between Melbourne and Mildura appeared to continue uneventfully. Airservices Australia surveillance radar data showed the aircraft tracking direct from Melbourne to Mildura at an altitude of 6,000 ft until radar services were no longer available.
While en route, the pilot sent several text messages, and telephoned the Mildura automatic weather information service and a family member. During this latter communication, the pilot indicated that he experienced difficulties while departing Moorabbin, however, the pilot did not state any specific mechanical defects or problems with the aircraft. The pilot was reported to have sounded normal during that conversation.
At about 1814, the pilot made a broadcast on the Melbourne Centre ATC frequency that the aircraft was 38 NM (70 km) from Mildura, at top of descent. No further broadcasts were made by the pilot on this frequency. It was unknown if the pilot made a call on the Mildura common traffic advisory frequency as broadcasts were not recorded.
Several witnesses situated to the south and east of Mildura Airport observed the aircraft approaching from the north, consistent with being on final approach to runway 18. One witness described the aircraft to be flying ‘in a nose-up attitude or yawing’.[3] At about 1829, when about 1.9 km north-north-east from the runway at low altitude, several witnesses described the aircraft as yawing left, the left wing dropping, the aircraft then rotating in an anti-clockwise direction and rapidly lose altitude before colliding with terrain.
The aircraft collided with steel trestles mounted on wooden poles that were strung with heavy gauge single strand wires, used to support grape vines. The aircraft came to rest on four strands of 11,000 volt high tension (HT) power lines that were strung across the property from the road. A post impact fuel-fire ensued. The pilot, the sole occupant, was fatally injured and the aircraft destroyed.
Pilot information
The pilot held a Private Pilot (Aeroplane) Licence issued on 25 June 2006. The pilot was endorsed on the Cessna 310 in September 2012 and last completed a multi-engine flight review in December 2013, valid until December 2015. The pilot was also the owner of VH-BWZ.
Extracts from the pilot’s logbook found at the accident site showed a total flying experience of about 511 hours. The pilot’s experience on the Cessna 310 was estimated at about 113 hours, based on a combination of entries on the aircraft’s maintenance release and the pilot’s logbook. It appeared that the pilot had not flown in the period February to October 2015. However, on 14 October 2015, the pilot completed an instrument landing system endorsement for the private instrument rating with a Civil Aviation Safety Authority (CASA) approved testing officer. During the endorsement, the pilot was subjected to several simulated one-engine inoperative exercises in the approach phase-of-flight. The testing officer reported that the pilot’s response to these exercises were considered ‘normal’.
The pilot held a valid Class 2 Medical Certificate with the requirement for reading correction to be available while exercising the privileges of the licence. While a post-mortem medical examination found that the pilot had a mild heart enlargement, there was no evidence of any pre-existing conditions identified that may have contributed to the accident.
The investigation included an assessment of whether the pilot may have been experiencing a level of fatigue known to have an effect on performance. Consideration was made of the pilot’s sleep obtained, time awake at the time of the occurrence, time on task, potential workload and environmental factors. However, given the limited data available in relation to the pilot’s sleep history in the 72 hours prior to the accident and the nature of the individual actions leading up to the accident, there was insufficient evidence to determine whether fatigue contributed to the accident.
Aircraft information
The aircraft was maintained by a provider approved by CASA. About 4 months prior to the accident, a periodic inspection was conducted and the aircraft was released to service. The maintenance provider reported that during the pre-maintenance engine run check the autopilot was operated while holding the elevator trim wheel. This test established that, while the autopilot was operating the trim could be arrested manually, establishing that the elevator trim could be overridden if unintentionally activated.
The aircraft’s fuel system consisted of two main tanks located on the tip of each wing and two auxiliary tanks located within each wing. The combined usable capacity was about 100 US Gallons (378 L) for the two main tanks, and 63 US Gallons (238 L) for the auxiliary tanks. The main tanks were integrally sealed aluminium tanks, which were vented to the atmosphere. Each auxiliary fuel tank consisted of two interconnected bladder-type fuel cells that were located between the wing spars in the outboard section of each wing.
Two fuel selectors, one for each engine, were located on the floor in between the pilot and co-pilot seats. These allowed selection of main tank fuel, auxiliary fuel, cross-feed and no fuel through the wing selector valves located in each respective wing.
Meteorological information
The Mildura aerodrome forecast, issued at 1613 and valid between 1700 on 6 November to 0500 on 7 November 2015 indicated that conditions were forecast as CAVOK[4] with a wind direction of 210° at 10 kt. The Bureau of Meteorology provided the ATSB with data recorded by the automatic weather station at Mildura which indicated at the time of the accident (1829), the wind was 220° at 11 kt gusting to 12 kt.
Wreckage and impact information
The aircraft was found in a left-wing, nose-down attitude and had come to rest on four strands of 11,000 volt HT power lines that were strung across the nearby property from the road. Ground scars of ruts, and soil and vegetation built up on one side of the landing gear and wings, indicated that the aircraft was rotating in an anti-clockwise direction during the impact sequence. The aircraft was destroyed by the impact forces and a post impact fuel-fed fire. The ATSB examined the wreckage and found:
The landing gear was down and flaps fully extended.
Continuity of all flight controls was established.
The elevator, rudder and aileron trims were found in the neutral position.
There was nil evidence of a pre-impact structural failure or in-flight fire.
All fuel caps were identified in the wreckage in a closed locked position. The left wing main fuel tank was found attached to the left wing tip, while the right main tank had separated from the wing and had been thrown forward about 10 m. Both were significantly melted, consistent with the fuel-fed fire. The outer section of the right auxiliary fuel tank had fractured and separated due to the impact forces, and was found forward of the main wreckage, also significantly melted (Figure1). The inner section of the right wing auxiliary fuel tank did not burn and contained an adequate quantity of fuel to obtain a sample. That sample was field tested and found to be consistent with aviation fuel of a suitable quality. In contrast, the left auxiliary fuel tank displayed only some degree of melting. In consideration of the left wing-down attitude at the time of impact, it was unlikely that the left auxiliary fuel tank contained a significant quantity of fuel.
Figure 1 : Aircraft wreckage with evidence of fire and right wing auxiliary fuel tank in the foreground
Source: ATSB
The right engine propeller blades were towards the fine pitch[5] and displayed significant bending, torsional twisting and chord wise (across the width of the blade) scratching. The bolt holes of the engine crankshaft propeller flange, where the propeller mounted to the crankshaft with bolts and locating dowels, were elongated opposite to the direction to the crankshaft rotation. This was consistent with the right engine producing significant power when colliding with terrain.
The left engine propeller displayed no evidence of torsional bending or chord wise scoring, nor was the engine crankshaft propeller mount flange distorted. The angle of the propeller blades were consistent with being towards the fine pitch. In addition, one HT power line was found routed through the left propeller arc and engine cowling, then under the wing and through the landing gear. There was no evidence of the HT power line or the single strand wires used to support the grape vines being wrapped around the engine crankshaft. Similarly, there was evidence of arcing and mechanical abrasion on one of the propeller blades from contact with a HT power line while in-flight. This was limited to the leading edge of the propeller blade only. Collectively, these elements indicated that at the time of the collision the left engine was not producing power nor was the propeller producing thrust.
The cockpit and cabin were severely fire damaged, consistent with a significant fuel-fed fire supplied from the right inboard section of the auxiliary fuel tank.
The fuel selectors located in the cockpit were melted. Examination of the wing fuel selector valves, operated through push pull rods from the cockpit, showed that the right valve was selected to the right main fuel tank. In that position, the right engine received fuel from the right main fuel tank. The left wing fuel selector valve was in between the left auxiliary and cross-feed positions. The ATSB could not establish if that valve position was:
representative of the tank selection during normal operations,
selected in response to a left engine issue, or
a result of the impact sequence.
For each engine, the fuel line between the engine and fuel control unit and the engine and the wing were disconnected by the ATSB. The right engine fuel lines contained fuel. In contrast, no fuel was observed in the fuel lines of the left engine. No mechanical defects were identified that may have prevented normal operation of the left engine.
The source of ignition that led to the fire could not be established, however, the aircraft battery, damaged aircraft electrical wiring, hot engine and turbo charger, HT power lines and collision with steel were all possible sources of ignition. No mechanical defects were identified that may have contributed to the accident.
The left engine and propeller were recovered from the wreckage and transported to a CASA approved overhaul facility for detailed inspection under the supervision of the ATSB. The autopilot pitch and roll servos, and elevator trim actuator were also removed and sent to the United States for inspection under the supervision of the Federal Aviation Administration (FAA) and aircraft manufacturer. These components were tested in accordance with the manufacturer’s system of maintenance (refer to section titled Test and research).
Test and research
Left engine fuel system
The left engine fuel control fuel filter and fuel manifold top cap were removed and examined. No foreign object debris or fuel was identified in either component.
Left engine and propeller examination
Left engine internal components used to achieve normal engine operation, including the crankshaft, connecting rods, pistons, pushrods, cylinders, valves, camshaft, bearings and gears were inspected and found to have continuity. External accessories such as the fuel pump, magnetos, propeller governor and fuel injector were inspected and tested for correct operation. Other components such as the turbo charger and associated components were visually inspected.
The left propeller was also disassembled and inspected. Witness marks of the propeller blade situated in the cuff and bearing race damage found within the propeller established that, at the time of the collision, the propeller was towards the fine pitch position. Nothing was identified from those inspections or tests that may have prevented normal engine or propeller operation.
Autopilot pitch and roll servo, and elevator electric trim actuator
The servo drive motor for the autopilot pitch mode operated when power was applied. When an over voltage is detected in the system, the unit should trip the autopilot off-line and stop the motor; this function was inoperative. The motor clutch assembly was tested and slipped at 17 in lb in the clockwise direction and 21 in lb in the anti‑clockwise direction. The specification for this unit is 14 ±1 in lb in either direction. The actuator mount clutch on the capstan did not breakaway until 70 in lb in both directions. The specification for this clutch to slip is 20 ±2 in lbs.
The servo drive motor for the autopilot roll mode and the electric elevator trim actuator were also tested. Some minor breakout torque discrepancies were identified, however, were not considered significant.
Operational information
Fuel quantity
The pilot’s personal fuel records showed that 219.69 L was uplifted at Latrobe Valley on 4 November. The ATSB could not determine if that fuel was placed in the main and/or auxiliary fuel tanks. However, a witness at Latrobe Valley reported observing the main fuel tanks full. There were no fuel records identified to indicate any fuel uplift at Moorabbin.
The combined flight time from Latrobe Valley to Moorabbin and Moorabbin to Mildura was about 110 minutes, excluding taxi time. A pilot that had previously flown the aircraft reported that it had an average fuel burn rate of 60 litres per hour per engine (120 litres per hour total).
The Cessna Aircraft Company’s Pilot Safety and Warning Supplements, dated 1 June 1998, stated that:
Many twin engine Cessna airplanes incorporate auxiliary fuel tanks to increase range and endurance. These tanks are usually bladder type fuel cells located symmetrically in the outboard wing areas and contain no internal fuel pumps. When selected, the fuel from these tanks is routed to the engine driven fuel pump.
If the auxiliary fuel tanks are to be used, the pilot must first select main tank (tip tank) fuel for at least 90 minutes of flight with use of 63-gallon auxiliary fuel tanks. This is necessary to provide space in the main fuel tanks for vapour and fuel returned from the engine driven fuel pumps when operating on the auxiliary fuel tanks. If sufficient space is not available in the main tanks for this returned fuel, the tanks can overflow through the overboard fuel vents. Since part of the fuel from the auxiliary fuel tanks is diverted back to the main tanks instead of being consumed by the engines, the auxiliary tanks will empty sooner than may be anticipated. However, the main tank volume or quantity will be increased by the returned fuel.
As the ATSB was unable to establish the amount of total fuel on-board the aircraft when it departed Latrobe Valley or Moorabbin, or the pilot’s fuel management practices, the fuel remaining in each tank at the time of the accident could not be determined.
Asymmetric operations
The aircraft was fitted with two Teledyne Continental IO-520-MB piston engines and two three‑bladed McCauley propellers. Both engines rotated clockwise as viewed from the pilot’s seat.
When discussing the differences between single-engine and multi-engine aircraft, the FAA Airplane Flying Handbook (2016) stated that:
The basic difference between operating a multiengine airplane and a single-engine airplane is the potential problem involving an engine failure. The penalties for loss of an engine are twofold: performance and control. The most obvious problem is the loss of 50 percent of power, which reduces climb performance 80 to 90 percent, sometimes even more. The other is the control problem caused by the remaining thrust, which is now asymmetrical. Attention to both these factors is crucial for safe OEI [one-engine inoperative] flight.
The majority of light multi-engine aircraft such as the Cessna 310 have two wing-mounted engines that produce symmetrical propeller thrust during normal operation. One-engine inoperative operations on these aircraft result in asymmetric thrust and drag due to the offset position of the engines from the aircraft’s centreline. This results in a tendency for the nose of the aircraft to yaw in the direction of the inoperative engine. The extent of the yaw may vary depending on which engine becomes inoperative. The engine whose failure would most adversely affect an aircraft’s performance and handling qualities is termed the ‘critical’ engine. As the Cessna 310 engines turn in a clockwise direction, the left engine is the critical engine.
The asymmetric yawing tendency may be countered through the application of rudder and aileron control inputs. However, the minimum control speed of 80 kt[6] for the Cessna 310 must be achieved to ensure that the rudder and aileron retain sufficient control authority to maintain directional control of the aircraft. The Cessna 310 Pilot’s operating handbook stated that, the aircraft is controllable at this speed, but performance is so far below optimum that continued flight near the ground is improbable. Consequently, the handbook indicated that a more suitable recommended safe single-engine speed was 92 kt. At this speed, altitude could be maintained more easily with the landing gear retracted and the propeller feathered[7]. This speed is similar to the all engines landing approach speed of 93 kt with full flaps selected.
In addition, the CASA Civil Aviation Advisory Publication 5.23-1(2) stated that the majority of engine failures were not instantaneous. For example, if an engine failed as a result of fuel starvation or low fuel pressure, the engine will usually cough and splutter before stopping. However, the FAA recognised that:
An engine failure in a descent or other low power setting can be deceiving. The dramatic yaw and performance loss will be absent. At very low power settings, the pilot may not even be aware of a failure.
Pilot actions
The Cessna 310 Pilot’s operating handbook states that, following an engine failure, the pilot’s first consideration is to maintain control of the aircraft and ensure the airspeed remains above the minimum control speed. It then states that the pilot needs to identify the inoperative engine, adjust the operative engine as required, and perform a number of checks relating to fuel flow, tank selection and quantity; engine oil pressure and temperatures; magneto switches and mixture. If the engine does not re-start, the pilot must ‘secure’ or shutdown the engine, which includes feathering the propeller. The FAA flying handbook highlighted that completely securing a failed engine may not be necessary or even desirable depending upon the failure mode, altitude, and time available.
Aircraft performance degradation
The aircraft manufacturer advised that the Cessna 310 had a single-engine climb rate of about 375 feet per minute (at sea level and at maximum landing weight). However, with drag penalties of an unfeathered windmilling[8] propeller, landing gear extended and full flap, the aircraft’s single-engine climb performance would degrade. Under these conditions, one-engine inoperative performance would result in a descent at 875 feet per minute.
Various other sources have also highlighted these adverse consequences on aircraft single-engine performance. For example, Multi-Engine Pilot Manual by Jeppesen Sanderson (1992) stated:
It is important that the pilot be familiar with the correct order for drag reduction following an engine failure. Normally, a windmilling propeller contributes the greatest amount of drag, followed by full flaps, extended landing gear, and the control deflections required to stop the airplane from turning. Since it is considered unwise to immediately feather an engine before it has been positively identified, drag is normally reduced by first retracting flaps and gear. Next, the failed engine is identified and the propeller is feathered. However, the specific order of drag reduction may vary between types of twin‑engine airplanes, so the manufacturer’s recommendations should be followed.
Generally, the landing gear is not extended during the approach until the airplane is established at approach airspeed and the pilot is positively assured of reaching the desired runway. This timing is important since the extension of the landing gear adds sufficient drag to create a 300 to 500 f.p.m. [feet per minute] rate of descent without power reduction.
The wing flaps should be used as little as possible, preferably not at all until the landing gear is extended and the landing is assured.
The FAA Airplane Flying Handbook (2016) stated:
A single-engine go-around must be avoided. As a practical matter in single-engine approaches, once the airplane is on final approach with landing gear and flaps extended, it is committed to land on the intended runway, on another runway, a taxiway, or grassy infield. The light-twin does not have the performance to climb on one engine with landing gear and flaps extended. Considerable altitude is lost while maintaining VYSE[9] and retracting landing gear and flaps. Losses of 500 feet or more are not unusual. If the landing gear has been lowered with an alternate means of extension, retraction may not be possible, virtually negating any climb capability.
The CASA Civil Aviation Advisory Publication 5.23-1(2) stated:
A windmilling propeller causes the largest component of drag on an aircraft that suffers an engine failure. If the propeller is not feathered following an actual failure…the aircraft’s climb performance cannot be guaranteed. In many cases, it is likely that the aeroplane will only be able to maintain a descent.
Multi-engine power loss accidents
An ATSB research report, Power loss related accidents involving twin-engine aircraft (Research and analysis report B2005/0085), found that power loss accident rates in twin-engine aircraft were almost half of the rate for single-engine aircraft.[10] However, a power loss accident in a twin‑engine aircraft was more likely to be fatal and overwhelmingly the result of in-flight loss of control. Of the 58 accidents identified between 1993 and 2002 that resulted in damage following the power loss, seven accidents occurred during the approach phase of flight. Three of these involved a loss of control, including one fatal accident. Given the approach phase was a relatively small portion of the overall flight, this was considered a more risky time, with low altitude and only a little more energy available than during the take-off phase.
When on final approach to runway 18 at Mildura, witnesses reported seeing the accident aircraft at low altitude yaw to the left, followed by the left wing drop where the aircraft rapidly lost altitude. The aircraft subsequently impacted powerlines before colliding with terrain. The pilot was fatally injured, and the aircraft destroyed. The ATSB examined air traffic control recorded data, the aircraft wreckage, the pilot’s training and medical records, postmortem and toxicology reports, aircraft maintenance history and witness interviews. Aircraft components, including the left engine, left propeller and aircraft auto-pilot servo units were recovered from the wreckage for further examination.
The pilot was appropriately qualified to conduct the flight and was declared medically fit. Despite having relatively low flying hours on the aircraft type and twin-engine aircraft operations, the pilot demonstrated proficiency about one month prior to the accident where he completed an instrument landing system endorsement for the private instrument rating in the accident aircraft. During that endorsement he was subject to several simulated one-engine inoperative exercises during the approach phase for the ILS endorsement.
Four months prior to the accident, the maintenance provider performed a simple operational test of the autopilot and held the elevator trim wheel, proving that the elevator electric trim could be overridden manually. The ATSB did identify some anomalies with the auto-pilot elevator clutch assembly but could not determine if those abnormalities were pre-existing or were a result of the collision with terrain The ATSB did not consider the identified abnormalities factors contributing to the accident.
Examination of the left engine and propeller determined the engine was not producing power nor was the propeller producing thrust. This was most likely due to fuel starvation to that engine. No mechanical defects were identified that may have contributed to the occurrence. However, the examination of the wreckage was limited due to the extent of the fire damage sustained to the aircraft.
The following analysis will examine fuel starvation of the left engine and the subsequent power loss. The adverse consequence of this on aircraft performance, combined with the aircraft’s configuration, will also be discussed.
Left engine and fuel
Disassembly, inspection and examination of the left engine, left engine accessories and the left propeller at the accident site and during the post onsite detailed examination did not identify any mechanical defects or abnormalities that may have prevented normal engine or propeller operation.
However, examination of the engine fuel system identified no fuel in the left engine fuel manifold and supply fuel lines, which is situated between the wing fuel selector and the engine. The right fuel manifold and supply fuel line did contain fuel.
The aircraft departed Latrobe Valley with both main fuel tanks full, a total of at least 378 L of usable fuel on board. The flight time from Latrobe Valley to Mildura via Moorabbin was about 110 minutes. Based on that data and in consideration of an average fuel burn of 2 litres per minute, there should have been at least 158 litres of fuel remaining on board when the aircraft reached Mildura, not taking into account any fuel in the auxiliary fuel tanks. On that basis, it is likely that the aircraft had a significant amount of fuel on board at the time of the accident and the left engine had been starved of fuel.
The severe disruption of the left and right main fuel tanks and the right auxiliary fuel tank, including burning and melting indicated that those tanks held a significant amount of fuel at the time of the collision. In contrast, the left auxiliary fuel tank did not display the same level of disruption, including burning and melting of the aluminium structure or bladder fuel cell indicating that it is likely the left-wing auxiliary fuel tank did not have a significant quantity of fuel at the time of the accident.
The position of the wing fuel selector valves during flight was inconclusive as it could not be determined if the pilot had selected the fuel selector to the position found during the wreckage examination, or whether it was a result of the accident sequence.
The reason for the starvation of fuel to the left engine and the disparity of fuel quantity between the left and right auxiliary fuel tanks could not be quantified or determined due to the damage to the aircraft from impact forces and post impact fire.
Asymmetric condition
Witnesses observed the aircraft yawing to the left prior to loss of aircraft control and evidence located at the accident site showing the aircraft rotating in an anticlockwise direction during ground impact sequence was consistent with asymmetric thrust. It was likely the inoperative engine (which was the critical engine), with its propeller towards the fine pitch and the opposite engine at high power, resulted in an asymmetric thrust condition. To maintain control of the aircraft and counteract asymmetric thrust the pilot needed to apply rudder and if necessary the aileron to counteract the forces generated from the drag of the non-performing engine and high thrust from the performing engine. Rudder and aileron input also increases drag and contributes to the decay of airspeed.
Aircraft performance degraded
The ATSB could not determine when the engine failed, nor could it be determined if or when the pilot was aware of the failure. At the time of impact, the aircraft landing gear and flaps were fully down, the flight control trim devices were in the neutral position and both propellers were towards the fine pitch, consistent with a normal landing configuration. In this configuration, combined with the left engine not producing power the drag penalties were such that altitude could not be maintained.
It is possible that the pilot may have been in the initial stages of responding to the engine failure and was not in a position to secure the engine, which included feathering the propeller. Further, it is not known if the landing gear and flap positions were selected prior to the asymmetric condition in preparation for a normal landing or after, as the pilot may have believed an engine inoperative landing onto the runway could be assured. Irrespective, in this configuration the aircraft’s performance would have degraded to the point at which altitude could not be maintained to assure a landing.
This accident highlights the adverse consequences of aircraft configuration on one-engine inoperative performance, particularly when at low altitudes. It further demonstrates the challenges of asymmetric operations and the importance of pilots being aware of the drag penalties and associated consequences.
Findings
From the evidence available, the following findings are made regarding the collision with terrain involving a Cessna Aircraft Company 310R, registered VH-BWZ, which occurred 1.9 km north-north-east of Mildura Airport, Victoria, on 6 November 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
For undetermined reasons the left engine was starved of fuel, which resulted in a loss of power during flight.
The left engine’s loss of power while the aircraft was in a landing configuration resulted in the pilot being unable to maintain aircraft control and the aircraft subsequently collided with terrain.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Airservices Australia
a number of witnesses
Textron Aviation
the Civil Aviation Safety Authority
United States Federal Aviation Administration
Victoria Police.
References
Jeppesen Sanderson Inc 1992, Multi-Engine Pilot Manual, Jeppesen Sanderson, Colorado.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority, Airservices Australia, Textron Aviation, the aircraft maintenance provider, National Transportation Safety Board and the operator of the aircraft.
Submissions were received from the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 1050[1] on 31 October 2015, Genesee & Wyoming Australia train 6DA2 derailed near Marla, South Australia. The derailment resulted from a package bearing failure on wagon FQWY 12-F. The wagon and three other container wagons were significantly damaged and there was significant damage to the track. There were no injuries.
What the ATSB found
The ATSB found that the journal and bearing on wagon FQWY 12-F had seized and lost interference fit. The loss of interference fit generated high levels of frictional heating between the bearing and the axle journal, and the subsequent torsional shearing failure of the axle (commonly referred as a ‘screwed journal’). The axle failure caused the axle and wheels to stop rotating, resulting in one wheel skidding along the railhead for approximately 50 km, before derailing.
On the balance of the available evidence, the ATSB concluded that a loss of lubrication was the most likely contributor to the bearing breakdown and seizure. Evidence also suggested the breakdown developed relatively rapidly, given the absence of a positive fault detection from two bearing acoustic monitoring systems (RailBAM) passed on the previous day of the occurrence.
Safety message
Bearing failures leading to derailment continue to occur within the Australian rail network. Rail operators must continue to be vigilant and ensure axle bearings are correctly installed, maintained, and monitored throughout their life.
At about 0900[2] on 30 October 2015, Genesee & Wyoming Australia (GWA) train 6DA2 carrying containerised freight departed Berrimah (near Darwin, Northern Territory) bound for Adelaide Freight Terminal (AFT) (near Adelaide, South Australia). At Alice Springs, train 6DA2 stopped to off load and pick up containerised freight before continuing onto AFT the following day.
Prior to leaving Alice Springs, a full mechanical examination, including train brake test, and brake pipe leakage test (FX1) was completed. No issues were detected, and train 6DA2 departed at about 0555 bound for AFT in Adelaide.
Shortly after crossing the Northern Territory border into South Australia (at about the 1,001 km point[3] - Figure 1), a bearing journal separated from the lead axle of the trailing bogie 2 on the fourth-to-last wagon of the train. It is likely that as the right bogie side-frame collapsed, the additional load on the left caused the axle to tilt and jam the right wheel onto the wagon body. This subsequently caused the left side wheel to ‘lock up’ and slide along the railhead (flat spot shown in Figure 3).
At the time, train 6DA2 was travelling through a section of track with a speed restriction of 50 km/h. The crew however, did not notice any consequences related to the failed bearing journal.
The train continued travelling south for about 35 km and cleared a speed restriction at about the 965 km point. The driver then started to increase speed to the normal operating track speed of 110 km/h. The wheelset/bogie side-frame continued to slide, resulting in minor markings on some rail fastenings, scarring on the head of the rail, damage to a cattle grid and starting several small spot fires.
Figure 1: Map of locality of the occurrence, the journal, and the derailment site
Figure 1 illustrates the locality of the derailment in relation to Alice Springs. The callout box on the left illustrates where the journal was located. The callout box on the right illustrates where the train derailed. Source: Natmap annotated by the ATSB
Approximately 50 km after the journal separated from the axle, the wheelset climbed across the railhead and derailed (951 km point). The wheelset continued for an additional 11 km before the bogie completely dislodged from under the wagon body, resulting in significant damage to three following wagons and track (940 km point).
At about the same time (1153), the driver noticed a subtle pull on the train. The driver checked the gauges, looked in the locomotive rear-view mirrors, and noticed a small amount of dust at the rear of the train. The driver asked the observer (co-driver) if he could see any dust from his side of the train. Initially the observer reported nothing. However, shortly after the observer noticed some dust on his side of the train. The driver applied the brake, resulting in the train decelerating.
In the last few hundred meters of travel, after the brake application, the driver noted a further drop in brake pipe pressure, indicating a physical disruption in the brake system before the train came to a stand.
Figure 2 shows an illustration of the sequence of events.
Figure 2: Sequence of event against track speed
Figure 2 illustrates the position of key events leading up the derailment against the permitted track speeds (speed restrictions). The illustration is not scale. Source: ASTB
The observer was tasked to go and inspect the rear of the train. As he walked towards the rear of the train, he found that the rear bogie on wagon FQWY 12-F (fourth-to-last wagon) had dislodged from the platform and was located alongside the track approximately 500m from the rear of the train (Figure 3). The remaining three 2-pack wagons remained upright with all bogies derailed, with some completely removed from their associated platforms. Several containers from the derailed wagons had broken away from the train and landed in the rail corridor. The derailment had also caused significant damage to 12 km of track resulting in mostly cracked sleepers and damage to rail fasteners. There was no spillage of any dangerous goods.
Figure 3: Photo of derailment site with the screwed journal axle in the foreground
Figure 3 shows the derailment site. The axle in the foreground is the lead axle from the trailing bogie (refer to figure 2) of wagon FQWY12-F which was found to have the screwed journal. The callout box depicts the flat wheel due to the wheel jamming as a result of the screwed journal. Also pictured is the mated bearing on the journal. Obscured from view on the axle is the screwed journal. Source GWA
Train 6DA2 was an intermodal freight service operated by Genesee & Wyoming Australia (GWA) between Darwin and Adelaide. On departure from Darwin, NT, the train consisted of three locomotives (GWU 6 leading, ALF 18 trailing and ALF 21 off line) hauling 29 wagons for a total length of 1,179 m and trailing mass of 2,016 t.
The 26th wagon behind the locomotives was FQWY 12-F, a 2-pack platform wagon (Figure 4) used to transport containers. The FQWY class wagons are rated at 43 t (tare), 184 t (gross) and operate at a maximum speed of 115 km/h.[4] The wagons ride on 70 t AAR three piece bogies. The wagons are owned and maintained by GWA.
Figure 4: Schematic of FQWY 12-F
The R2 axle bearing on platform two bogie D failed. The wheelset was the leading axle on bogie D in the direction of travel. Source: Genesee Wyoming Australia Pty Ltd and annotated by ATSB
The failed axle was the lead axle on the rear bogie (Bogie D). At the time of the derailment the train was traveling at approximately 82 km/h. A 6.45 t container was loaded on platform A and an 11.8 t container loaded on platform B.
Train crew
The train crew consisted of four drivers working the train in pairs on a rotating 8-hour relay shift. Two crew members would work the train while the remaining pair of drivers rested in the accommodation provided in the attached crew van.
Train handling
Analysis of the train data logger and found that train handling was consistent with the speed restrictions of the track.
Drugs and alcohol
Due to the remoteness of the site and time limitations, neither driver was tested for the presence of alcohol or drugs.
Track information
The track infrastructure was leased and maintained by GWA, with the movement of rail traffic managed from GWA’s Transport Control Centre located at Dry Creek (South Australia).
The standard gauge (1,435 mm) track was a mixture of 47 kg/m and 80 lb/yd rail fastened to concrete sleepers by resilient clips. The track formation comprised sand/clay based soil, topped with a capping layer and overlaid with ballast to a nominal design depth of 250 mm. The track bed supported prestressed concrete sleepers spaced at 667 mm centres.
Sections of track with 80 lb/yd rail had a speed restriction for freight trains of 50 km/h. Sections of track with a 47 kg/m had a limit of 110 km/h.
The rail size at the Point of Derailment (PoD) (approximately 951 km point) consisted of 47 kg/m. The rail size at the location where the journal separated (approximately 1,001 km point) was 80 lb/yd.
Wagon Maintenance
As per GWA Wagon Maintenance Instruction (WMI 01-01), all wagon maintenance was based on time or kilometres travelled. The inspection frequency was also dependant on the type of wagon. However, where a defect was detected either by a train examination or by condition monitoring equipment such as RailBAM, the wagon was scheduled for repairs.
For the FQWY class wagons, the maintenance instruction specified a time-based inspection period of five years from its last inspection date.[5] However, the maintenance instruction also stated the frequency of the examination is subject to duty cycle, and condition monitoring equipment available on the operational route.
The failed axle (numbered 45043), with bearing numbers 040321 and 00686 (left and right respectively), was installed under wagon FQWY 12-F in August 2014. The wagon’s most recent maintenance was completed in July 2015. While three wheelsets were changed on platform A, the wheelsets on platform B (including axle 45043) were within specification and returned to service.
Package bearings
The bearing that failed on wagon FQWY 12-F was a SKF 70t E-class package unit bearing. The mated bearing was a Timken 70t E-class package unit bearing.
Packaged bearings consist of two tapered roller bearing assemblies (rollers, cage and inner ring/raceway, sometimes referred to as a cone) mounted inside a common outer ring/raceway (sometimes referred to as the cup). During assembly, a spacer ring of specific width is placed between the two cones to ensure the correct pre-loading for the bearing assemblies. Outside each bearing assembly is a seal wear ring, over which the grease seal is positioned. When installed on the wheel-set, a backing ring is mounted on the in-board side of the axle journal and an end-cap is bolted onto the outer end of the bearing journal (Figure 5).
The manufacturers’ specification for the grease amount for the Timken bearing was approximately 400 grams (14 oz) and the SKF bearing at just over 450 grams (16 oz).
Figure 5: General arrangement of package bearing
The package bearing is assembled then press fitted onto the axle journal. As the bearing is completely sealed prior to being fitted there is no requirement to add any lubrication post fitting. Source: RISSB, coloured and annotated by ATSB
Maintenance
The Australian Rail Industry Safety and Standards Board (RISSB) is responsible for the development and management of rail industry standards, rules, codes of practice and guidelines, all of which have national application. Australian Standard AS7516 Railway Rolling Stock - Axle Bearings – Part 2: Freight Rolling Stock covers the maintenance of the various types of bearings used in the Australian railway industry, including package type bearings.
Section 3.2 of AS7516-2 states that package bearings should be of the No Field Lubrication (NFL) type, and that all components of the package assembly shall have the design capability of completing a service life without maintenance attention. Replacement of package bearing lubrication should occur not more than 8 years after assembly.
Bearing history
The failed bearing (00686) was manufactured in May 2005, with the first recorded fitting to an axle by Downer EDI occurring in February 2006. The bearing was subsequently inspected/remanufactured and re-fitted to different axles at irregular intervals until August 2014 when it was fitted to the axle subsequently used on FQWY 12-F. The fitting of the mated bearing was done concurrently.
Since its installation in August 2014, the wheel set (45043) has travelled over an estimated 335,000 km in a 13-month period.
During it’s in service life of over 10 years it is estimated that bearing would have travelled between 2,500,000 km and 3,000,000 km.
Bearing fatigue life
Bearing fatigue life is commonly referred to as the L10[6] life. This is a calculated prediction of bearing life in terms of stress cycles (related to revolutions) based on 10% of bearings showing the first evidence of fatigue. The first evidence of fatigue is defined as when one of the rolling contact surfaces develops a spall measuring approximately 6 square mm (refer to section - Contributors to bearing failure, Rolling surface damage).
Based on formulae contained in ISO281:2007, Roller bearings – Dynamic load ratings and rating life, the basic rating life of a roller bearing, in millions of revolutions (L10) is inversely proportional to the 10/3 power of the load applied. For example, if the bearing load is halved, the fatigue life will increase by a factor of about 10. Conversely, doubling the bearing load will result in a decrease in fatigue life by a factor of about 10.
The bearings used on the FQWY class wagon were ‘Class E’ tapered roller bearings and are commonly used on railway rolling stock throughout Australia. A typical fatigue life specification for a Class E bearing indicates that its L10 life is equivalent to about 2,600,000 km (wheel diameter of about 840 mm) when operating at maximum bearing load for 50% of its time. Tapered roller bearings are designed to support both radial loads (weight of wagon and other vertical forces) and thrust loads (cornering and other lateral forces). When considering bearing load, manufacturers sometimes provide both radial and thrust load ratings for their bearings. The rating is usually specified at a specific rotational speed of 500 revolutions per minute, which equates to about 80 km/h for wagons with a wheel diameter of 840 mm.
Records show that the bearing had been in service for just over ten years and travelled an estimated 3,000,000 km. However, its exact loading over this time could not be determined, as there are no accurate records kept over the life of the bearing.
When applying the L10 considered loading of 50% for the bearing, the bearing is determined to be in the 90% range of failure (developing rolling surface defects) at 10 years. However, when applying a more practical loading profile for FQWY 12-F of typically running to Darwin loaded and returning empty, the loading percentage is significantly reduced. As a result, the fatigue life for bearings operating from Adelaide to Darwin is likely to be much higher than the L10 life specified in the manufacturer’s documentation. Consequently, the fatigue life would likely increase beyond the 10 years/3,000,000 km travelled at the 50% loading.
It is considered typical of railway bearings, that their serviceable life is usually limited by factors other than simple bearing fatigue. While actual kilometres and loadings are not known for this bearing, it was considered unlikely that the bearing on wagon FQWY 12-F failed due to simple fatigue alone.
Bearing examination
GWA forwarded the recovered failed bearing components to Bureau Veritas for metallurgical examination. The Bureau Veritas also examined the mated bearing (opposite end of axle).
It was evident that a bearing on the wagon had failed and completely seized, causing the inner raceway to loose interference fit and spin on the axle journal. This generated and transferred sufficient heat into the journal to reduce its strength, make it ‘plastic’, and caused it to separate from the axle (an event commonly referred to as a screwed journal).
Post-derailment inspections were unable to locate any rolling elements or seals. The remaining components (Figure 6) consisted of the outer race shell (cup), a single inner race (cone) and the screwed off end of the axle with the bolted end cap.
Figure 6: Recovered components of failed bearing
The remaining components of the failed bearing above were retrieved from site and was inspected and analysed by the Bureau Veritas Source: Genesee & Wyoming Australia and annotated by ATSB.
Examination of the inner race of the failed bearing found stamping from SKF (Sweden). There was evidence of significant heat damage and significant amount of mill scale (flaky surface, often found on hot rolled steel), suggesting a long period of exposure to high temperatures.
Examination of the outer race was unable to identify any stamping. There was significant mechanical and thermal damage to the surfaces, as well as a build-up of mill scale. Marks found around the race suggested post incident false brinelling[7]. An area of spalling was also noted on the rolling surface of the outer race, though this was partially obscured by post failure surface damage.
There was no evidence of residual lubrication or grease on any of the bearing components.
The Bureau Veritas concluded that the most likely contributor to the bearing failure was a lubrication supply issue. This may have been due to either seal failure or inadequate lubrication at the time of assembly of the bearing package. The seal was not recovered so could not be examined to determine its condition and the possibility that it may have failed prior to the derailment.
Partner bearing
The examination also included the partner bearing from the opposite end of the axle, and found it to be in good order. The amount of grease in the mated bearing was only a light application and contained small amounts of sand. The Bureau Veritas estimated conservatively that there was less than 200 grams of grease in the bearing as supplied (approximately 50% when compared to a newly packaged bearing). However, Downer EDI considered the grease levels to be relatively typical for in-service bearings. This was noted by ATSB investigators, during site visit to the Downer EDI workshops, in Port Augusta (February 2016). A collection of in service bearings, when examined, showed about 50% grease content, when compared to newly packaged bearings. There was no evidence of false brinelling or surface damage on the mated bearing.
Both grease seals were present and intact, though post derailment observations show the end seals of the bearing appearing to be ‘wet’ which indicates that some grease may have been liberated during the derailment. It could not be determined how much grease was installed in the bearing. However, it is likely that some grease from the mated bearing was lost as a result of the derailment.
Figure 7: Mated bearing with signs of grease leaking from end caps
Figure 7 shows that the end seals of the bearing appearing to be ‘wet’ which indicates that some grease may have been liberated during the derailment. This also indicates that there may have been a failure in the bearing seal. Source: Genesee & Wyoming Australia
Predictive monitoring
The RailBAM system is a predictive bearing condition monitoring system (Appendix A) used throughout Australia. The system listens for unique acoustic signatures known to be associated with specific defect conditions in bearings, such as rolling surface faults and looseness / fretting faults.
Rather than identifying imminent failure of a component, RailBAM facilitates the potential identification of defects as they develop. This is achieved through analysis of acoustic signature data and the identification of data trends from multiple passes. Rail vehicle operators may use this information for ongoing monitoring and/or scheduling for servicing and repairs.
RailBAM has proved reliable at detecting the acoustic signatures of developing surface faults such as spalling damage. However, it has proved more difficult to detect an acoustic signature that would suggest loss of lubrication.[8]
RailBAM data for 6DA2
A wayside RailBAM site is located near Berrimah. RailBAM data from that site for 6DA2 was examined. The data showed a single acoustic signature associated with the subsequently failed bearing (leading axle on the trailing bogie on wagon FQWY12-F). The signature was consistent with low-level rolling surface irregularity.
Since RailBAM is a predictive system for identifying data trends, it generally requires a series of consistent repeated detections to determine if the noise is erroneous or a true identification of a bearing fault. Consequently, a single low-level acoustic signature is considered more likely a false positive rather than a developing fault.
No alert or alarm condition was identified against wagon FQWY 12-F by the RailBAM system at Berrimah.
Similarly, there were no alarms or alert trends recorded against wagon FQWY 12-F for previous journeys through the condition monitoring stations at Berrimah, Port Germien (South Australia) or Northgate (South Australia).
It should be noted that GWA advised they no longer use RailBAM to track bearing looseness or fretting faults as it is considered to be unreliable.
Contributors to bearing failure
The failure process resulted in complete destruction of the bearing and much of the evidence that may have identified the cause of the failure. Consequently, the investigation looked at the common failure modes for railway bearings to identify the most probable cause.
The main contributors to rolling-stock axle bearing failure are:
Rolling surface damage Rolling surface damage (spalling) is a contact-fatigue mechanism and can result from lubrication supply or effectiveness issues, contaminants carried in the lubricant, or indentations due to impact loading. Spalling is where the bearing surfaces or rollers begin to break up, or flake. The material that has broken away then moves around inside the bearing, causing further damage to the rolling surfaces.
Component failure A common cause of bearing failure is failure of the cage. The cage maintains the roller bearings in the correct spacing and alignment. If the cage loses its ability to correctly align and guide the rollers, the resultant forces can lead to rapid deterioration and break-up of the cage. Under these conditions, broken cage material may become jammed in the rolling surfaces, with bearing seizure the likely result. Note that cage failure can also occur as a consequence of other failure modes, including rolling surface damage or lubrication failure.
Lack of (or faulty) lubrication The purpose of a lubricant is to reduce friction by separating the rolling surfaces at the points of high-pressure contact. Contamination of the lubricant by foreign materials such as metal flakes, filings and dirt reduces the effectiveness of the lubricant, and often causes accelerated wear of the components. A lack (or loss) of lubricant, through failed seals or poor maintenance, can result in elevated levels of frictional heating at the contact surfaces – leading to the eventual overheating of the bearing. This can cause components within the bearing to fail, such as the roller bearing cage.
Examination of the failed bearing found evidence of rolling surface damage. However, the absence of repeat acoustic signatures from the various RailBAM sites suggests the bearing condition on FQWY 12-F had deteriorated relatively quickly.
Failure of the cage (component failure) may have contributed to the failure of the bearing, however the cage could not be located so this mode of failure could not be confirmed.
Considering the available evidence and in the absence of any evidence to the contrary, a loss of lubrication was considered the most likely contributor to the failure and seizure of the bearing, resulting in a catastrophic failure with minimal (if any) warning signs.
Package bearings used within Australia require minimal in service maintenance, generally limited to visual inspections. When a package bearing is identified as requiring service, either through visual detection of a fault or through predictive monitoring systems such as RailBAM, the axle with the two package bearings is sent for bearing replacement.
The bearing packages are removed from the axle, stripped and cleaned before being sent for inspection. All components of the stripped package bearing are kept together (cup, cone, bearings, and spacers) excluding the seal, which is disposed of. The inspection and remanufacturing area then receives the components.
At the commencement of each shift the remanufacturing staff verify the operation of all equipment, including the grease applicator. The grease injection system has seven settings for delivering a pre-determined amount of grease for the various areas of a packaged bearing, such as the rollers/cage. The operator checks a test application using calibrated scales to ensure the correct amount of grease is delivered for each setting. The results are recorded on a daily test sheet.
An initial examination of the bearing components is carried out prior to a detailed review. If any damage or corrosion is detected the bearing is scrapped. The more detailed inspection examines the bearing for any marks or damage to the rolling surfaces. The internal and external diameters are checked and the bearing endplay (movement) tested before the bearing is reassembled and packed with grease.
The grease injection system delivers a pre-determined amount of grease to the various areas of the bearing. The operator selects the appropriate grease delivering option for each component and manufacturer of the bearing (Rollers, Spacer ring). The selections are clearly marked and numbered one through seven, each number showing the amount of grease delivered in ounces and grams.
After each phase, the bearing package is visually inspected to confirm the correct amount of grease has been applied. Once the bearing has been fully greased the final seal is pressed onto the package and the bearing history sheet updated.
Whilst the most likely contributor for the bearing failure was a lack of lubrication and the observation suggesting approximately 50% lack of grease in the partner bearing, the ATSB could not substantiate any failure in EDI Downers remanufacturing. In general, the axle bearings on FQWY 12-F were maintained in accordance with GWA and rail industry standards.
Findings
From the evidence available, the following findings are made with respect to the derailment of train 6DA2 near Marla on bearing failure on 31 October 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
Freight train 6DA2 derailed due to a failed axle on wagon FQWY 12F.
The axle failed when the bearing seized, generating enough heat for the bearing journal to go ‘plastic’ and separate from the axle, a condition referred to as a ‘screwed journal’.
Other findings
A loss of lubrication most likely contributed to the relatively quick deterioration and seizure of the bearing, resulting in a catastrophic failure of the bearing with minimal (if any) warning signs.
The axle bearings on FQWY 12-F were maintained in accordance with GWA and rail industry standards.
It was considered unlikely that the bearing on wagon FQWY 12F failed due to simple fatigue alone.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Genesee Wyoming Australia
GWA have investigated and implemented the following short-term actions:
Investigate imposing a life limit on bearings, either by years or by overhauled cycles (i.e. bearings greater than 8 years old and/or greater than 8 rebuilds to be scraped when the wheelsets is next machined).
Investigate the use of polymer cage in all new bearings.
Investigate recent development relating to bearing seals.
Develop a process for examining bearings and for providing important feedback from the bearing maintainer on the analysis of bearings that have been identified as faulty by wagon condition monitoring systems.
Review the preferred bearing supplier/maintainers unit overhaul quality processes and subject bearing to random inspections at various stages of their lifecycles.
Consider utilising alternative bearing suppliers.
Conduct a gap analysis between Pacific Nationals wheel bearing standards used by Downer EDI and the RISSB Wheel Bearing Standards, December 2015.
Consult with other rolling stock operators on the methods they use in an effort to increase best practice.
Conduct an audit of the EDI Downer workshops in Port Augusta.
Complete a quality examination of bearings recently overhauled by Downer EDI.
GWA have investigated and implemented the following long-term actions:
Consider the installation of Hotbox detectors on the Northgate BP-Berrimah corridor.
Investigate the use of ‘on wagon’ bearing condition monitoring.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
The Australian Rail Track Corporation (ARTC)
Railway Industry Safety and Standards Board (RISSB)
Genesee & Wyoming Australia (GWA)
References
ATSB Transport Safety Report, Rail Occurrence Investigation RO-2008-010
ATSB Transport Safety Report, Rail Occurrence Investigation RO-2010-011
SKF, Product Information 401, Bearing failures and their causes 1994
Bureau Veritas, Metallurgical report, 11 December 2015
Genesee & Wyoming Australia Wagon Maintenance Instruction WMI 01-01
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Genesee Wyoming Australia, the drivers of train 6DA2, EDI Downer, and the Office of the National Rail Safety Regulator.
Submissions were received from Genesee Wyoming Australia, a driver of train 6DA2, EDI Downer, and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Condition monitoring systems
Hot-box detectors
Hotbox detectors are a reactive method of condition monitoring. They usually detect the infrared signature of bearing components and alarm if the temperature exceeds a predetermined setting. However, there are a number of variables that can affect their performance on a mixed freight/passenger rail corridor. These variables include but are not limited to:
train loading
train speed
weather conditions.
Consequently, hotbox detection is usually used as a ‘last line of defence’ to protect railway infrastructure assets critical to production processes such as coal and ore carrying railways.
Due to the potentially unreliable performance of hotbox detectors under mixed freight/passenger conditions, more effort has been directed towards predictive condition monitoring of railway rolling stock travelling on the interstate main lines.
Bearing Acoustic Monitoring
Bearing Acoustic Monitoring (BAM) is a predictive condition monitoring system that ‘listens’ to the acoustic signature of bearings and can detect faults as they develop. It is the primary method for detecting potential bearing faults on rolling-stock travelling on the interstate main line. Recorded data from each train is stored in a database allowing evaluation, trending, and maintenance scheduling of rolling-stock based on predicted bearing condition.
BAM uses sensitive acoustic arrays to record the sounds emanating from wheels and bearings passing through the monitoring site. The recordings are processed for the sound characteristics that are unique to specific types of bearing faults. BAM is best at detecting faults on rolling surfaces such as the inner and outer raceways, and rollers in rolling-stock bearings. BAM can also detect looseness or fretting faults and ‘noisy’ wheels (flanging and wheel flats).
BAM systems are usually installed and maintained by infrastructure managers. However, the data is made available to rolling stock operators through a web interface. The BAM database categorises potential bearing faults in the form of levels of severity (1, 2, and 3 with level 1 being the most critical). The database allows operators to analyse bearing fault history and trends in order to plan their preventative maintenance strategies.
As for any monitoring system, there are some limitations. For example, BAM is a system that ‘listens’ for bearing noises, and under some conditions, other noises (rubbing equipment, tread defects or flanging wheels) may affect the results. However, being a predictive condition monitoring system, multiple passes of potentially defective bearings allows true fault trends to be clearly identified and actioned before a defect reaches a critical level.
It is evident that predictive condition monitoring and a pro-active approach by train operators has become an integral tool for managing the risk of bearing defects on freight rolling stock, especially in relation to rolling surface defects. For example, the ARTC BAM site at Nectar Brook showed a reduction in the number of level 1 rolling surface faults from about 0.5% in 2002 to about 0.05% in 2010. However, Level 1 looseness or fretting (LF1) faults have not experienced the same improvement. In 2002, LF1 faults were about 1.2%, reducing down to about 0.6% in 2005 before rising back to 1.0% in 2009 and 2010.
On-board condition monitoring
In the past, condition monitoring of rolling-stock has been the realm of trackside equipment (Hotbox, RailBAM, etc.), usually fixed at a specific geographical location. While predictive systems may provide a broader level of protection, reactive systems are limited to protection of equipment and infrastructure in the immediate vicinity.
The next evolution of condition monitoring would be one that continuously monitored each wagon for developing faults (predictive) and immediately communicated any critical conditions to the train drivers (reactive). This type of system is referred to as an on-board condition monitoring system. While various limitations (functional and economic) have prevented these systems being widely used on railway freight operations in the past, recent technological developments have now made the concept more attractive. However, at the time of this incident, only limited developmental work had been started within Australia.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the afternoon of 2 November 2015, a Eurocopter AS350-BA helicopter, registered VH-SFX, was performing a low-altitude aerial weed spotting operation over dense forest in the Whyanbeel Valley, Queensland. On board the helicopter were the pilot, a navigator and two aerial spotters.
While conducting the work, the helicopter yawed twice in an uncommanded manner. In response, the pilot climbed and increased the helicopter’s forward airspeed and attempted to return to his base of operations. Subsequently, the engine failed, which required the pilot to conduct an autorotation and emergency landing.
The passengers adopted the brace position and the helicopter landed heavily with the skids digging into the uneven terrain and breaking off. The navigator in the front seat received minor injuries and the pilot received serious back injuries from the impact forces.
What the ATSB found
The ATSB found that the emergency landing was handled in a competent and proficient manner. The pre-departure briefing gave the passengers the necessary knowledge to prepare for the emergency by adopting the brace position and exiting the helicopter only when it was safe to do so.
Analysis of the engine identified that the aircraft lost power due to a front bearing failure in the turbine module. The failure was due to an accumulation of coke particles in an oil jet. The ATSB was unable to conclude specifically why the coke particles had formed.
The severity of the engine failure was increased through the fracture of the power turbine shaft and the subsequent separation of the turbine disc. This was due to a lack of adhesive on the splined nut that was threaded to the rear of the power turbine shaft.
A service information bulletin issued by the helicopter manufacturer in 2010 recommended that AS350 helicopter operators consider the safety benefits of installing energy-absorbing seats. Had these seats been installed, the forces imparted to the pilot during the accident sequence may have been reduced.
What's been done as a result
The engine manufacturer (Safran Helicopter Engines) has amended their procedure manual to include systematic cleaning of the power turbine front bearing assembly oil jet and oil jet supply pipe. Safran HE have initiated a number of training and process changes to ensure the adhesive bonding between the power turbine and the rear nut is maintained during service.
Safety message
This investigation highlights that responding to an emergency in a timely and proficient manner can minimise the consequences of an accident. Similarly, providing emergency procedures briefings enables passengers to react appropriately in an emergency.
In this occurrence, the reason for the engine oil jet coking leading to the engine failure was not specifically determined. However, a range of factors can affect engine oil coking. These factors should be considered to ensure normal ongoing engine operation.
The occurrence
On 2 November 2015, a Eurocopter AS350-BA helicopter, registered VH-SFX, was performing aerial work to identify noxious plants in dense forest within the Whyanbeel Valley (Figure 1), Queensland (Qld). The nature of the aerial work required the helicopter to operate at a low altitude and airspeed. On board the helicopter was the pilot, a navigator and two aerial spotters. The base of operations was in Mossman, Qld.
At approximately 1620 Eastern Standard Time,[1] during the fourth flight of the day, the helicopter momentarily yawed twice within a short period in an uncommanded and unusual way. The pilot, concerned with the uncommanded movements, ceased the operation, climbed and increased the helicopter’s forward airspeed. The pilot then elected to head back towards the base of operations (approximately 11km away) and, if required, land along the way if a suitably safe area along the flight path presented.
Shortly after, the chip detector light[2] illuminated on the instrument panel, prompting the pilot to search for a suitable landing area. As the helicopter continued to climb through approximately 200 ft, the engine stopped producing power.
The pilot identified the most suitable area to land, given the limited available height and airspeed, and commenced an emergency autorotation. The identified area was uneven, overgrown with plants, and surrounded by tall trees. During the landing sequence, the skids of the helicopter dug into the terrain and were broken off. The helicopter came to rest about 10 m after first touching down. The passengers received nil to minor injuries and waited until the rotor blades had ceased turning before evacuating the helicopter. The passengers then assisted the pilot who had received serious back injuries. The helicopter was substantially damaged.
Figure 1: The helicopter’s GPS track, arriving in the area of operations, its flight path around the forested terrain in the Whynabeel valley, and the accident site
The pilot held a valid Commercial Pilot (Helicopter) Licence that was issued on 6 January 2004 and a valid Class 1 Aviation Medical Certificate. The pilot’s last flight review was issued on 17 February 2014 and was valid until 29 February 2016.
The pilot had a total flying experience of about 6,200 hours, of which over 3,000 hours were in the AS350 series helicopter. This included a substantial amount of experience conducting low-level operations. In the previous 90 days, the pilot had flown 9 hours on type, and in the previous 24 hours the pilot had flown 6 hours on type. The pilot reported feeling rested and alert prior to the occurrence flight.
Helicopter information
The helicopter was a Eurocopter AS350-BA helicopter, manufactured in 1981 and first registered in Australia on 16 June 2005. At the time of the occurrence, the airframe had accumulated approximately 10,518 hours total time in service (TTIS).
Wreckage and impact information
The on-site examination found that the helicopter struck the ground tail rotor first, with the skids subsequently digging into the uneven terrain and separating from the fuselage (Figure 2).
The engine had sustained damage consistent with a high-energy failure. The power turbine separated from the disc and the containment shield was twisted and deformed. The exhaust duct was bulged and puncture marks from internally liberated engine debris was evident (Figure 3).
Figure 2: VH-SFX at the accident site
Source: ATSB
Figure 3: View of the helicopter engine at the accident site
Source: ATSB
Engine information
The helicopter was powered by a Turbomeca[3] Arriel (model 1B) engine, located above and to the rear of the passenger compartment. The Arriel 1B engines feature a modular design with the major modules consisting of an axial and centrifugal compressor, an annular combustion chamber, a two-stage axial turbine, a single-stage axial power turbine and a reduction gearbox (Figure 4). This occurrence related to a failure within the power turbine.
Figure 4: General arrangement of a Turbomeca Arriel 1B turboshaft engine showing the locations of the major sub-components
Source: Turbomeca, modified by the ATSB
Power turbine information
Gases from the two-stage axial turbine are directed downstream to the power turbine. The power turbine disc and shaft is a cantilevered design supported by front and rear bearings (Figure 5). Surrounding the power turbine is a containment shield to prevent high-energy engine debris from exiting the engine in the event of a blade fracture or disc separation from the shaft. The fractured turbines blades did not penetrate the containment shield in this occurrence.
Figure 5: General arrangement of the power turbine showing the relative location of the major parts including the guide vanes, labyrinth seal, power turbine shaft, rear nut, and the front and rear bearings
Source: Turbomeca, modified by the ATSB
Engine examination
The engine was removed from the helicopter and a preliminary examination was completed at the engine manufacturer’s facilities in Sydney, New South Wales. The power turbine shaft assembly of the engine was subsequently transported to the manufacturer’s facilities in France. The assembly was inspected in detail under the supervision of the French aviation investigation agency, the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile (BEA). The examination determined that:
The power turbine disc had fractured in overstress and separated from the power turbine shaft (Figure 6). The power turbine disc sustained a complete loss of power and the turbine blades had separated from their respective stations. Fracture of many of the blade inter-recesses within the disc had also occurred.
The front bearing of the power turbine shaft had totally seized (Figure 7). Evidence of roller skidding, metal contamination and gross overheating was found within the bearing assembly. The accumulation of hardened coking products and varnish deposits from oil degradation was also found within the rolling elements.
As a result of extreme frictional heating, the oil-air labyrinth seal, just forward of the front bearing, had melted and fused with the power turbine shaft.
Metallurgical analysis of the power turbine shaft showed that it had been exposed to temperatures in excess of 1,300C. That temperature was several hundred degrees above the normal maximum operating temperature of the engine.
Examination of the oil jet and surrounding oil ducts to the front bearing of the power turbine shaft identified that the jet outlet was blocked with an accumulation of coke particles (Figure 8).
Examination of the splined nut that was threaded to the rear of the power turbine shaft assembly revealed evidence that it had tightened. The location of the nut determined the position of the shaft and any potential axial preload of the shaft bearings. No evidence was found of the adhesive that was required to have been applied between the threads on the rear shaft and the nut (Figure 9).
Figure 6: Cross-section through the power turbine assembly from the engine showing that the disc had separated from the shaft and the blades had fractured
Source: Turbomeca, modified by the ATSB
Figure 7: The seized front bearing and labyrinth seal, showing blackening from severe heat distress, flattening of the rollers, deformation of the cage and sealing fins
Image source: Turbomeca, modified by the ATSB
Figure 8: Close up of the blockage (circled) at the oil jet to the front bearing, as positioned in the general arrangement view
Image source: Turbomeca, modified by the ATSB
Figure 9: Cross-section of the rear splined nut contacting the rear bearing inner race
Source: Turbomeca
Power turbine rear nut adhesive bonding
The engine manufacturer had intended for an adhesive to be used in order to secure the rear nut into position. The adhesive was only applied during maintenance at a Turbomeca overhaul facility when the power turbine was overhauled.
Failure to adequately bond the nut could result in a tightening of the rear nut when abrupt changes in torque occur, leading to axial displacement of the turbine shaft in excess of the designed amount. This displacement would result in contact between the turbine shaft and the front bearing inner race, resulting in frictional heating, and damage to the turbine shaft.
The engine examination identified that the rear nut fitted to the rear of the power turbine shaft had not been adhesively bonded, as required.
Oil coking
The observed coking of the front bearing and its oil jet duct was likely a result of the engine oil exposure to abnormally high temperatures in the area. While there were clogging inspection procedures of the power turbine rear bearings, no preventative maintenance actions existed that allowed for the identification of coking within the front bearing.
Coking is an artefact from exposure to abnormally high temperatures that leads to oxidation and chemical breakdown of the oil. Coking can form as a thin-film layered deposit (as was the case in the oil duct) or in thicker clumps (which resulted in the clogging of the oil jet). It forms within the oil distribution channels and pipes, and can shed from the wall surface leading to reduced or obstructed oil flow. Determining the initiating source of coke formation is difficult as it can be attributed to a combination of influences, including:
operational conditions such as hot shutdown
design traits such as abrupt changes in oil flow direction and areas of low fluid velocity that can lead to reduced oil flow rates
low-drainage areas resulting in conductive or convective oil temperature increases post-shutdown
reductions in cross-sections such as scavenge ports that increase the likelihood of blockage
prolonged aircraft inactivity leading to moisture absorption of coke deposit.
The manufacturer of Arriel engines had published guidance for the thermal stabilisation of engines at shutdown. The guidance involved throttling the engine back until the engine was at ground idle for at least 30 seconds prior to shutdown. Stabilising an engine after operation allows for the temperature to reduce and thermally balance, while maintaining sufficient oil-scavenging capability and oil flow rates to minimise the potential for coke formation. Non-compliance with the manufacturer’s stabilisation recommendations may lead to coking.
The helicopter operator’s manual referred to the correct shutdown procedure in the AS350 flight manual. However, an appendix to the operator’s manual included a checklist that referred to a two-minute idle time before shutdown. The engine manufacturer advised that a two-minute shutdown would not adversely affect the formation of coke particles.
The engine manufacturer reported that a design trait of the power turbine is that the fluid velocity is lower at the bottom of the oil jet duct to the front bearing. For a given volume, this trait can lead to increased convective heating of the oil and depending on the temperatures in that region, may lead to coking.
In the period January 2000 to September 2015, there were 13 cases of Arriel engine deterioration in the power turbine shaft front bearing due to oil jet clogging. However, this is the only accident that has resulted in the failure of the turbine shaft.
Engine maintenance
The most recent significant maintenance involved removal of the engine from the airframe for repair after it sustained foreign object damage in February 2015 (7,786 hours TTIS). The centrifugal compressor and gas generator were replaced in May 2015. The engine was not operated during this period.
The last scheduled engine maintenance was performed on 30 October 2015 (8,060 hours TTIS), two days prior to the accident. Among the maintenance actions performed at that time, a clogging check of the gas generator rear bearing was conducted along with an inspection of the oil return line strainer. No anomalies were recorded in the maintenance documentation. The helicopter subsequently accumulated an additional 5 hours flight time up until the accident. There was no overdue maintenance requirements or declared defects.
Oil and filter analysis program
The helicopter operator had been monitoring the internal health of the engine components by participating in a spectrometric oil and filter analysis program (SOAP). That program relied on detecting the type and quantity of wear-material products within the engine oil and oil filter. The wear-material is generated from the breakdown mechanisms of internal engine components. SOAP checks were recommended by the engine manufacturer at intervals not exceeding 100 hours of service.
The most recent oil sample was collected and analysed approximately 10 hours prior to the engine failure. The previous sample to that was taken approximately 100 hours prior to the failure. Those checks indicated no unusual trends or signs that internal damage had been developing.
Emergency Procedures
The AS350 flight manual defined the emergency procedures for the illumination of the ‘ENG CHIP’ chip detector light and an autorotation landing. As per the AS350 flight manual, upon the Illumination of the ‘ENG CHIP’ caution light the pilot was required to:
“Land as soon as possible: land at the nearest site at which a safe landing can be made.”
A successful autorotation is dependent on the pilot’s airmanship and the helicopter’s speed and altitude relative to the airspeed-height envelope.
Airspeed-height envelope
The airspeed-height envelope defines a region within the helicopter’s flight envelope where there is insufficient energy (height and/or airspeed) for a successful autorotation to be completed. Section 5.1 of the AS350 flight manual defines the airspeed-height envelope for the helicopter. The envelope is determined using the density altitude and weight of the helicopter. The resulting envelope outlines the avoidance zone (Z); operating in the avoidance zone as defined in the FAA Rotorcraft Flying Handbook (FAA-H-8083-21A) ‘“may not allow enough time or altitude to enter a stabilised autorotative descent.’
Helicopters are not restricted from conducting operations in the avoidance zone, however, a pilot should always evaluate the risk of the manoeuvre versus the operational value.
In this case, the helicopter was equipped with a Garmin GPSMAP 195 portable device capable of storing track data for flights. During the operational portion of the flight, the helicopter was inside the avoidance zone. This was due to the aircraft being required to travel at a low airspeed and altitude such that the aerial spotters were able to identify the noxious plants.
The GPS track data for the accident ended while the aircraft was still airborne. At the time of the last track point, the aircraft was approximately 295 ft above the terrain travelling at approximately 65 kts groundspeed. This was outside the avoidance zone defined as per the flight manual.
Survival aspects
The passengers had received the pre-departure briefing and adopted the brace position. The navigator in the front seat received minor injuries and the pilot received serious back injuries from the impact forces. No objects were located underneath the front or rear seats.
Helicopter seating
The helicopter was fitted with the original seats installed by the manufacturer (Figure 10). The rear passenger seats had deformed during the accident and likely absorbed some of the energy during the impact. The seat-belt attachments remained intact during the accident sequence. There was no observable deformation to the front seats of the helicopter.
In 1999, the helicopter manufacturer released a service letter (SL No. 1424-25-99) to inform all helicopter operators of the optional availability of redesigned seating for the pilot and copilot. The improved seat design increased the strength of the seat and attachments, and depending on the installed option, introduced energy-absorbing seat installations.
The manufacturer also published a service bulletin (EC SB AS350 No. 25.00.57) recommending the installation of the energy-absorbing seats on AS350 helicopters. A European Aviation Safety Authority (EASA) safety information bulletin, SIB 2010-05, reiterated the safety benefits associated with the installation of energy absorbing seats.
According to the EASA SIB, the modification of the helicopter in accordance with the SL would:
increase the pilot and co-pilot’s seat strength and crashworthiness and thus to provide an increased level of protection to the occupants in case of impact during an accident.
Figure 10: VH-SFX front seats (left) and rear passenger seats (right)
Emergency equipment
The helicopter was fitted with an emergency locator transmitter (ELT) that could be activated by a switch on the instrument panel, an emergency position indicating radio beacon, and a first aid kit. Just prior to touchdown the pilot activated the ELT. After the landing, two passengers proceeded on foot to search for persons/households to contact emergency services. About 30-45 minutes after the accident occurred, the passengers were met by emergency services, who were responding to the ELT transmissions. The pilot received medical treatment onsite and was transported to hospital for further treatment. There were no other communication devices available, such as a satellite phone, for contacting emergency services.
While conducting aerial weed spotting operations at low level, the helicopter’s engine failed necessitating an emergency landing into unfavourable terrain. The ground impact resulted in substantial damage to the helicopter. The pilot received serious injuries and the passengers sustained nil to minor injuries.
This analysis will examine why the engine failed, why an impending failure was not detected, the pilot’s handling of the emergency, and how occupant injuries can be reduced in the event of a hard landing.
Engine failure
The uncommanded yawing of the helicopter was the result of the engine failing from a seizure of the front bearing to the power turbine. The failure commenced rapidly when the oil supply to the front bearing became obstructed due to clogging of the bearing’s oil jet by the accumulation of coke particles (a solid residue from the breakdown of the engine oil).
During this period of transient engine operation, it is likely that the abrupt changes in torque from the power turbine and the lack of adhesive, led to a progressive tightening of the rear nut (fitted to the rear of the shaft). The tightening resulted in an axial coupling between the front bearing, stop, and labyrinth seal. That contact generated additional frictional heating and a further temperature rise within the shaft.
The combined effects of the front bearing seizure and the axial coupling of the components led to excessive heating and a subsequent critical reduction in mechanical properties for the shaft. Consequently, the turbine shaft was unable to sustain the operating stresses and it eventually fractured at the interconnection with the disc.
Oil coking
Coke formation is influenced by a range of complex factors (as mentioned in the coke formation section). The engine had been removed from the aircraft due to foreign object damage early in 2015 and spent several months out of operation. The ATSB was not able to determine if coke deposits were present at this point in time. Similarly, it was unknown if inactivity had impacted on moisture absorption of any coke deposits. The manufacturer has subsequently added an additional operation in their maintenance procedures which include the systematic cleaning of the turbine shaft front bearing assembly oil jet and oil jet supply.
While non-compliance with the stabilisation time before engine-shutdown can result in coke formation, the operator’s procedures, included a stabilisation time of not less than 30 seconds and it was reported that flight crew followed these procedures. As such, the ATSB was unable to determine to what extent (if any) the compliance with stabilisation times affected the formation of coke particles.
The service history of the Arriel-series engine indicates there have been multiple instances of deterioration of the turbine shaft front bearing as a result of the front oil jet clogging. The geometry around the oil jet was such that in the event of front bearing degradation due to clogging, temperature rises in this area would occur. This induced variations in the oil fluid velocity and led to conditions that were favourable to coking and the formation of hardened deposits. The use of the manufacturer specified oil and continuous monitoring for metal particles should have limited the effect of this phenomenon. However, the metal particle detection checks (SOAP) were not intended for assessing the presence of coke particles, but rather the breakdown of engine components. In this instance, clogging of the oil jet likely occurred before the breakdown of the engine components. The ATSB was unable to determine to what extent the geometry of the area affected the formation of coke particles.
Due to the complex combination of factors that can affect coke formation, the ATSB was unable to determine a specific source that led to the coke formation and oil clogging of the front oil jet.
Adhesive bonding of the power turbine rear nut
The engine manufacturer had intended for an adhesive be used in order to secure the rear nut into position. The adhesive was only applied during maintenance at a Turbomeca overhaul facility when the power turbine was overhauled. The engine examination identified that the rear nut fitted to the rear of the power turbine shaft had not been adhesively bonded, as required.
The engine would still have ceased operating if the appropriate adhesive had been present on the rear splined nut. However, the likelihood of the shaft failing would have been reduced and the failure sequence less severe. The failure sequence would likely have been extended, allowing greater time for the pilot to respond to the failing engine.
Flight operation
The operation necessitated the helicopter to operate at a low altitude and airspeed. At the time of the uncommanded yaw movements and subsequent ‘ENG CHIP’ light illumination, the helicopter was inside the avoidance zone. According to the helicopter operating manual, an ‘ENG CHIP’ light illumination necessitates the pilot to land the helicopter ‘as soon as possible’. This should be interpreted as soon as safe landing is possible. The pilot immediately increased airspeed and altitude and brought the aircraft out of the avoidance zone. This allowed the pilot to conduct a successful autorotation when the engine failed.
At the time, the helicopter was over densely forested and steep terrain, making it unsuitable for a safe landing. The pilot had elected to head back towards the base of operations (approximately 11 km away) and land if there was a suitably safe area along the flight path. Given the location of the helicopter and the surrounding terrain, returning to a known safe landing area (the base of operations), with the possibility of identifying a safe landing area during transit, provided an appropriate option in the difficult circumstances.
The pilot’s actions while responding to the emergency situation likely prevented serious injuries to the passengers.
Helicopter seating crashworthiness
The rear passengers had adopted the brace position prior to the impact and the seats had absorbed some of the energy from the hard landing. These passengers received nil injuries. Similarly, the passenger in the front seat braced for the landing and received only minor injuries.
The helicopter was fitted with the original front basic seats installed when it was manufactured. The basic seats complied with the minimum performance standard of the applicable certification bases.
As aerospace technology and design has evolved since the original certification, new certification rules have been enacted to better protect the occupant’s safety in the event of an accident. The manufacturer of the helicopter had installation options available to operators to install energy-absorbing seats. Energy absorbing seats reduce the amount of energy transferred to their occupants in the event of an accident.
In the case of this accident, there was not enough information on the impact forces and dynamics to determine whether energy-absorbing seats would have reduced the injury severity to the pilot.
Findings
From the evidence available, the following findings are made with respect to the engine failure involving a Eurocopter AS350BA helicopter, registered VH-SFX that occurred in the Whyanbeel Valley, Queensland on 2 November 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The helicopter lost power due to a failure of the Arriel 1B engine. The failure was a result of coke particles that had clogged the front oil jet from the power turbine shaft, preventing oil flow, and leading to a total seizure of the front bearing. The specific source that led to the coke formation and oil clogging of the front oil jet could not be determined.
The rear-splined rear nut had not been adhesively bonded to the power turbine shaft, as required. When the front bearing failed, the lack of adhesive led to a progressive tightening of the nut and additional frictional heating of the shaft from contact with the static engine components. The consequential reduction in material strength from the heating allowed the power turbine shaft to fracture and the disc to separate, further increasing the severity of the engine failure.
Other factors that increased risk
The helicopter was not fitted with energy absorbing front seats, which may have reduced the risk of injury to occupants during an accident.
Other findings
The ATSB found that the emergency landing was handled in a competent and proficient manner. The decision by the pilot to increase forward airspeed and altitude, after the uncommanded and unusual yaw movements, removed the helicopter from within the avoidance zone and likely prevented serious injuries to the passengers.
Safety issues and actions
Proactive safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
The engine manufacturer (Safran Helicopter Engines) has amended their practices to include:
Periodic cleaning of the power turbine front bearing assembly oil jet and oil jet supply pipe. This reduces the occurrence probability for oil jet clogging by removing any accumulated deposits from these locations.
Degreasing of the threaded surfaces prior to application of the adhesive bonding and assembly of the parts. Maintenance and overhaul personnel have been informed of the importance of degreasing the surfaces before bonding the nut to the power turbine shaft.
Safran Helicopter Engines is also studying the use of heating equipment to obtain a more repeatable polymerization.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Safran Helicopter Engines (formerly Turbomeca)
Airbus Helicopters (formerly Eurocopter)
the Civil Aviation Safety Authority
the aircraft operator
the pilot
the passengers.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the pilot, the passengers, the aircraft operator, the Civil Aviation Safety Authority, Airbus helicopters, Safran Helicopter Engines ,and the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile (BEA).
Submissions were received from the pilot, the aircraft operator, Safran Helicopter Engines, the Civil Aviation Safety Authority and the BEA. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 29 May 2015, at about 1145 Eastern Standard Time (EST), a Victa 115 Airtourer aircraft, registered VH-MUV (MUV), departed from Leongatha Airport, Victoria, for crosswind circuit training, with an instructor and student on board.
The student pilot was flying the first circuit. The instructor reported that the circuit was normal and the approach was stable up to about 100 ft above ground level (AGL) when the student put the final stage of flap out. As the aircraft flared to land on runway 22, a strong gust of wind blew the aircraft off the runway centreline to the left and the aircraft bounced hard. The student initiated a go-around, applying full power, with the aircraft still drifting further to the left. As the aircraft was not climbing, the instructor called “taking over” and the student handed over control of the aircraft. The instructor lowered the nose of the aircraft to gain airspeed.
The aircraft continued to drift further away from the runway centreline. The student noticed the flaps were in the down position and, thinking that it would assist and without checking with the instructor, retracted the flaps to the up position. The aircraft descended and about 100 m past the threshold of runway 22, the aircraft collided with the airport perimeter fence. After a further 20 m, the aircraft flipped over the fence and came to rest upside down. The instructor and student exited the aircraft quickly through the broken canopy, as fuel was gushing from the fuel tanks. The instructor and student pilot received minor injuries and the aircraft was substantially damaged (Figure 1).
Figure 1: VH-MUV inverted after flipping over the airport perimeter fence
Source: Aircraft operator
Instructor comment
The instructor reported that the purpose of the flight was to instruct the student in crosswind landing techniques and then to conduct further flight training in the training area. The instructor indicated that, as they were planning to conduct 2 hours of flight training, the aircraft had full fuel on board and was near the aircraft maximum take-off weight.
The instructor described the wind as gusting between 15 to 22 kt at 270 degrees, with a crosswind component of between 10 to 15 kt.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.
Flight training organisation
As a result of this accident, the flight training organisation advised the ATSB that they are taking the following safety actions:
The instructor has been briefed on the importance of making sure students understand not to touch any of the aircraft’s controls when the instructor is in control of the aircraft.
The instructor has been briefed on the handing over and taking over procedures with the emphasis on handing over and taking over controls procedures.
Safety message
It is important in flight training to have a positive exchange of flight controls. The US Federal Aviation Administration (FAA) has found that numerous accidents have occurred due to a lack of communication or misunderstanding regarding who had actual control of the aircraft, particularly between students and flight instructors. The FAA publication Aviation Instructor’s Handbook, includes a section on the Positive Exchange of Flight Controls. The handbook provides guidance to use for the positive exchange of flight controls (Figure 2).
Figure 2: FAA Positive exchange of Flight Controls
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
