Sequence of events

The balloon pilot and his two passengers were conducting a private flight as part of the Canberra balloon festival. The balloon's equipment included three aluminium liquefied petroleum gas (LPG) fuel cylinders, dual burners, three radios, a motorcycle-type lead-acid battery, an altimeter and a variometer. After completing a normal flight, the pilot prepared to land the balloon on an area of parkland. This area was relatively small, with large trees on the approach and a street and houses in the direction of flight. Following the touchdown, as the balloon envelope continued to travel, the basket gradually tipped over and the pilot pulled the ripline to deflate the envelope. At about that time, the occupants of the basket noticed a fireball in the basket and immediately evacuated. Witnesses described the flames as yellow. The pilot stated that he let go of the ripline and allowed the balloon to ascend, deciding that it was safer for the fuel cylinders to be in the air than on the ground surrounded by bystanders. Witnesses heard an explosion and saw an object fall from the remains of the basket. The fire continued to burn, and subsequently consumed the wicker basket and damaged the lower panels and skirt of the envelope. Debris from the balloon fell across three suburbs and damaged several houses. The remains of the balloon were subsequently found 1.6 km from the initial landing point.

The pilot of the balloon was wearing a hat, a short-sleeved cotton shirt, trousers, gloves and shoes. He sustained serious burns to his forearms, face and neck. The male passenger was wearing a woollen lumberjack-style long-sleeved shirt, jeans, gloves, boots, sunglasses and a hat. He sustained minor burns to his face and wrists and was the only occupant not admitted to hospital. The female passenger was wearing running shoes, three-quarter length pants, gloves and a long-sleeved top which did not tuck into the waistband of her pants. She sustained serious burns to her shins and stomach.

Wreckage examination

An examination of the wreckage of the balloon established that two aluminium fuel cylinders were each connected to one of the two burners. One tank was connected by both the vapour feed line and the liquid feed line, while the other was only connected by the vapour feed line. Both pilot-light valves were on, the cross-feed valve was off and both the liquid and vapour offtake valves on both fuel cylinders were on. It was also noted that a male connector fitting had broken off flush with the top of the threaded portion of the body of the corresponding fuel cylinder liquid offtake valve.

Further examination of the broken fitting showed that it had been partially fractured when the fire developed. The fracture was sufficiently large to allow the uncontrolled escape of LPG into the balloon's basket. The fracture surfaces indicated that the fire was no longer burning near the fracture at the time the fitting broke away completely. The fitting had fractured in a downward direction, and there was no evidence of fatigue or pre-existing defects.

One aluminium fuel cylinder was found along the debris trail between the initial landing site and the final location of the remains of the balloon. This cylinder had failed because of a single ductile rupture of the upper shell section, characterised by a large bulged area, outwardly turned fracture lips and extensive blackening and sooting around the rupture.

Pilot light usage

The balloon manufacturer's Flight Manual section 4.6 'Landing', stated that the pilot light should be turned off before touchdown. Some balloon pilots indicated that they sometimes left the pilot lights on for landing if they were certain that the balloon basket would not tip over, allowing them to conduct a go around if required. Once the pilot lights were turned off, if insufficient height was available to relight the pilot lights, a pilot would normally be prevented from conducting a go around before the balloon touched down.

Fuel cylinder fitting selection

The broken fitting consisted of a Rego 8101P5 service valve coupled to a 7141M check connector. With this configuration, the assembly extended outside the fuel cylinder guard ring.

A comparison of the Rego 8101P5/7141M combination liquid offtake valve (left), and the Rego 8180 valve (right), and their relationship to the fuel cylinder guard ring

The balloon manufacturer's maintenance manual stated that "only factory supplied parts and materials are permitted to be used for repair or maintenance actions". The manufacturer advised that they previously supplied the Rego 8180 valve, but now supplied the BMV 344 handwheel-type liquid offtake valve in place of the Rego 8180 valve. The BMV valve was similar to the Rego 8180 valve. Balloon industry personnel suggested that while the Rego 8180 valve was the most widely used fitting, the Rego 8101P5/7141M combination was also relatively widely used in ballooning applications.

While the balloon manufacturer's documentation provided guidance regarding selection of fuel cylinder fittings, general practice among balloonists was for gas supply companies to replace, if required, fuel cylinder fittings during the mandatory 10-yearly cylinder inspection. Gas supply company personnel generally have extensive experience and knowledge regarding fuel cylinder maintenance, but they do not normally have much involvement in the aviation industry. They are not provided with detailed guidance regarding the appropriate selection and configuration for fuel cylinder fittings for aviation applications.

The investigation did not establish who had installed the Rego 8101P5/7141M combination liquid offtake valve.

The pilot of a piper Archer was cleared for final by the Terminal Area (TMA) controller for a practice runway 35 Instrument Landing System (ILS) approach at Canberra. The duty runways at Canberra were 17 and 12. A Saab 340, VH-KDQ, had recently departed from Canberra using runway 17 when the Canberra surface movement controller (SMC) recognised that it was tracking in the opposite direction towards the Archer which was on final approach. The TMA controller took action to resolve the situation by instructing the pilot of the Archer to turn away from the ILS approach. The Archer was at about 8 NM on final approach at 4,500ft while KDQ was 2 NM upwind leaving 3,000ft on climb. The Canberra aerodrome controller (ADC) dept KDQ on frequency until he observed on radar that the Arhcer was turning and then instructed the crew of KDQ to contact the TMA controller.

The separation standard required between aircraft was either 3 NM laterally or 1,000ft vertically. Examination of recorded radar data indicated that the distance between the aircraft was about 4 NM laterally and 1,100ft vertically at the closest point of approach. There was no infringement of separation standards.

The TMA controller had moved the electronic flight strip for the Archer into the traffic management window of The Australian Advanced Air Traffic System (TAAATS) display, indicating that the aircraft was to carry out the ILS approach. The movement of the electronic strip into the traffic management window automatically indicated the pending arrival of the aircraft to the ADC in Canberra Tower. The ADC annotated the electronic strip with a "back-slash", which indicated an acknowledgment of the pending transfer.

Six aircraft had been issued airways clearances for departure from Canberra. The TMA controller was aware of the pending departures but he was not aware of when they would be ready for take-off. Two of those aircraft, Impulse 935 and VH-KJQ, subsequently taxied and the ADC advised the TMA controller that he was releasing those aircraft. Auto release procedures, which were in operation at the time, authorised the ADC to clear aircraft for take-off on pre-determined departure tracks after advising the TMA controller of the pending release. Auto release procedures were designed to minimise voice coordination between the TMA controller and ADC. Under auto release procedures, dependence was placed on the ADC to ensure that there was sufficient spacing between successive departing aircraft to enable the TMA controller to establish and maintain the required separation standard. The ADC advised the TMA controller that the Archer could "have the ILS" after those two aircraft, while also reiterating that there were a number of additional pending departures.

By the time KJQ had become airborne, a further three aircraft had taxied for departure: Eastern 832, Impulse 917 and KDQ. The ADC advised the TMA controller that two of the aircraft were approaching the holding point and one was just leaving the parking apron. The ADC also instructed the TMA controller to "hold [the Archer] out". The TMA controller did not acknowledge that instruction nor did the ADC seek acknowledgment. The ADC subsequently advised the TMA controller that he was releasing "Eastern 832 followed by Impulse 917 then KDQ". The TMA controller replied "Roger".

The TMA controller was required to annotate his electronic flight strip with an "A" for each aircraft to signify that auto-release coordination had been carried out. After receiving the coordination on the latter three aircraft, the TMA controller did not immediately annotate his electronic strips. Rather he advised the pilot of the Archer of a further delay and provided radar vectors for re-sequencing. When he did annotate the electronic strips with an "A", he only annotated Eastern 832 and Impulse 917. The controller stated later that he might have omitted to annotate the electronic strip for KDQ by confusing that aircraft with KJQ, the crew of which had just called the controller with a departure report.

The TMA controller then vectored the Archer to carry out the ILS approach after the departure of Impulse 917. After that crew had contacted the TMA controller, the pilot of the Archer was cleared for final for the ILS approach. By the time KDQ became airborne, a further two aircraft had taxied and the ADC coordinated their release with the TMA controller. The TMA controller queried that they would be "after" the Archer, to which the ADC replied "no they're RPT [Regular Public Transport] they've got higher priority they are going".

The ADC and TMA controllers then entered into a discussion about the situation that lasted about 26 seconds. During that period neither controller seemed to understand where the aircraft under the other person's control was in relation to the aircraft under their control. It was not until a third party, the Canberra SMC, intervened that the controllers understood there was a potential conflict situation and the TMA controller then took action to resolve the situation.

Auto-release procedures

Canberra Local Instructions stated that prior to issuing a take-off clearance, the ADC "shall advise the TMA controller of the pending release and receive an acknowledgment by callsign". During this occurrence, the ADC released five aircraft: none were acknowledged by callsign nor were callsign acknowledgments sought.

Voice coordination - arriving aircraft

Movement of the electronic flight strip into the traffic management window and acknowledgment of the sequence by annotating the strip with a backslash was normally the only coordination required between the TMA and the ADC for an arriving aircraft. Canberra Local Instructions stated that, in addition to the use of the traffic management strip, the TMA controller "shall voice coordinate when:

a) An instrument approach other than a straight-in approach to the system arrival runway will be conducted."

Further, Canberra Local Instructions stated that use of the reciprocal runway directions may be approved for individual aircraft:

"a) when an aircraft is conducting a practice instrument approach and missed approach subject to mutual agreement between TMA and CBA [ADC]".

From the time the Archer was turned away from the ILS approach on the first occasion there was no mutual agreement between the controllers for the use of the reciprocal runway and there was no voice coordination regarding the subsequent approach for the aircraft.

Traffic Management

The Archer pilot contacted the Melbourne Senior Terminal Area Controller (STAC) to book a training ILS approach at Canberra. The booking system established an order of priority for flight crews competing for training ILS approaches. It was reported that it would be unusual for the STAC to deny an ILS booking. It was mainly a paperwork exercise and there were no known busy times blocked out on the booking sheet. In this particular instance there was no coordination between the FMA staff and Canberra tower staff regarding the suitability of the timing of the training ILS approach for the Archer, despite seven pending departures from the reciprocal runway around the same time.

Organisational Issues

The Canberra TMA controllers were originally co-located with the aerodrome function in Canberra. During that time controllers were rotated through both TMA and aerodrome elements. In 1994, the TMA element was relocated to Melbourne. The controllers involved in this occurrence had 5.5 and 7 years experience respectively in their positions at Canberra Tower and in Melbourne. During that time, both had two familiarisation visits to each other's unit. In both cases, one visit was prior to the transition to TAAATS and one was as part of the transition process. Neither controller believed that the frequency of these visits was sufficient to maintain an appropriate level of awareness and appreciation of the other person's working environment.

The crew of the Boeing 737 reported that when the speed brake was selected, during descent into Sydney with the autopilot engaged, the aircraft rolled slightly to the right. The autopilot was disengaged, and the speed brake was again selected with the same result. The speed brake was restowed and the flight continued and landed without further incident.

The operator reported that inspection of the aircraft, on 15 February 2001, revealed that the left-wing number three flight spoiler "UP" cable (P/No. WSA2-3) had failed at a pulley in the left wheel well at Wing Buttock Line (WBL) 73.00. The failure was due to corrosion as evidenced by rust deposits at the failure location. During rectification, all other left wing spoiler cables were replaced due to evidence of minor corrosion. Following repair, the aircraft was returned to service.

The operator reported that, after a previous spoiler cable failure in 1997 due to corrosion, an Engineering Release (ER) had been issued to require the inspection of all spoiler cables at the next Phase 20 check and subsequent 2C check with cable replacement at the next 4C check. Replacement at the 4C check terminated the inspection requirements of the ER.

As a result of the cable failure on 15 February 2001, the ER was revised to require inspection of the cables on an ongoing basis with cable replacement at every 4C check interval to preclude recurrence.

Subsequently, on 28 February 2001, the incident aircraft underwent overnight maintenance at Melbourne. During the maintenance inspection, the left-wing spoiler cables, that had previously been changed at Sydney on 15 February 2001, were found to be mis-routed. The operator's investigation revealed that the maintenance engineers involved in the original rectification had travelled from Brisbane to Sydney that day and had worked a period in excess of 24 hours with minimal breaks. Excessive hours worked and fatigue of the maintenance engineers was considered to have contributed to the misrouting of the cables and the failure to detect the misrouting during a duplicate inspection of the spoiler control system.

A Boeing 747 (B747) had departed Avalon, Victoria on a track that passed over Melbourne and then to the northeast. The crew had been issued with a requirement to initially maintain flight level (FL)200. The departures controller had imposed the limitation in accordance with standard operating procedures that required the "cap" to be placed on all aircraft that had planned to a higher flight level. Airspace above FL200 was under the jurisdiction of a sector controller. In addition, the horizontal boundary between the two controllers' airspace below FL200, was 30NM from Melbourne airport.

The departures controller had a Piper Navajo aircraft tracking ahead of a sequence of three jet aircraft departing from Melbourne airport. That situation required that the jet aircraft be radar vectored around the slower aircraft before they could be placed on their flight planned tracks. The first of the jet aircraft was a Boeing 737 (B737) for Brisbane, which departed approximately the same time as the B747.

The tracks of the aircraft were such that the B737 was initially to the left of the B747, but at approximately 30NM northeast of Melbourne they crossed and thereafter diverged.

The sector controller had noticed that the B747 would probably reach FL200 while still in departures airspace and, as a consequence, be forced to maintain FL200. In order to provide the crew of the B747 with an unrestricted climb profile, he coordinated with the departures controller to authorise the crew of the B747 to climb to FL370.

At that time, the B737 was below and approximately 30NM ahead of the B747. However, the ground speed of the B747 was approximately 70 knots faster than the B737, and the B737 had a greater rate of climb.

As the B737 approached the horizontal airspace boundary, the departures contoller handed over the aircraft to the sector controller while it was passing FL170. The sector controller then approved the crew to climb to FL370, as he believed there was sufficient distance between the aircraft to maintain separation. A short time later, the B747 was also handed over to the sector controller as it was passing FL200 and approximately 8 NM behind the B737. At that moment, The Australian Advanced Air Traffic Control System (TAAATS) Short Term Conflict Alert (STCA) activated and the controllers immediately attempted to prevent an infringement of separation standards. However, the crew of the B747 was on his frequency and asked the departures controller to maintain that aircraft at a lower level. The departures controller issued an instruction for the crew of the B737 to maintain FL190 but did not receive a reply, because that crew was on the sector frequency as instructed.

At that moment, the crew of the B747 made radio contact with the sector controller who immediately issued an instruction for them to turn the aircraft. There was a delay as the crew questioned the instruction, but they commenced the manoeuvre when the controller issued the instruction a second time using the word "immediately". He then instructed the crew of the B737 to level out, which they did.

The aircraft passed approximately 2.5NM apart while the vertical separation standard of 1,000ft did not exist. The required radar separation standard was 5 NM.

Shortly after take-off, the crew of the Boeing 747 aircraft received a number four engine fire warning advisory. The crew actioned the non-normal checklist, secured the number four engine, and discharged two engine fire bottles before the fire indication extinguished. The crew then jettisoned fuel and completed an uneventful landing at the departure airport.

Initial inspection by operator maintenance personnel revealed evidence of charring and discolouration around the engine combustion area. Maintenance personnel removed the engine from the aircraft and the engine was then test run on an engine test cell. The test run revealed a fuel leak from the left and right fuel manifold connectors. The connectors were confirmed as being secured with safety lockwire, but subsequent torque checks revealed a lower value of torque than that required by the engine manufacturer's maintenance manual. The fuel manifold connectors were re-torqued and another test run completed. The resulting test run at high power settings revealed no discrepancy. A decision was made by the operator to have the engine overhauled before being put back into service.

During cruise, the Boeing 767 (B767) crew noticed that the fuel consumption was 230 kg per hour more than normal. After the cargo had been unloaded at the destination, the crew had the cargo re-weighed. The actual cargo weight was more than 3,400 kg greater than the weight stated on the manifest.

The operator reported that its investigation revealed that four pallets had been carried from Honolulu to Sydney and that all were heavier than the weights recorded on the manifest. The discrepancies were 2,277 kg, 887 kg, 220 kg, and 10 kg.

The two pallets with the greatest weight discrepancies had been transported from mainland USA in a freight aircraft operated by a US operator, and had been transferred at Honolulu to the B767 for onforwarding to Sydney. The weights stated on the pallet tags for the internal US leg were in pounds, but the B767 operator required the weights to be in kilograms. The agent who handled the freight for the US operator at Honolulu converted the weights from pounds to kilograms and pencilled in the converted weights on the deadload sheet for the Honolulu-to-Sydney flight.

When the agent who handled freight at Honolulu for the B767 operator received the pallet weights, she did not check the figures against the loadsheet issued by Load Control. Consequently, she did not realise that the weights stated on the loadsheet had already been converted to kilograms, and applied the conversion a second time. Also, as the agent for the US operator was confident that she had passed the correct weights to the B767 agent, she did not recheck to ensure that the B767 agent had received the correct weight information.

The 220 kg and 10 kg weight discrepancies affecting the other two pallets were probably the result of weighing or recording errors.

The B767 operator has since amended procedures for its agent at Honolulu. Under the new procedures, only the supervisor will carry out weight unit conversions and liaise with other operators' agents. This should minimise the risk of erroneous information being passed between agents and help to ensure that all required checks are carried out.

The B767 operator is monitoring the effectiveness of the new procedures.