Collision with terrain involving Kubicek Balloons BB78Z, VH-RJR, Elwood, Victoria, on 20 April 2022

Executive summary

What happened

On the morning of 20 April 2022, a Kubicek BB78Z hot-air balloon, registered VH‑RJR and operated by Liberty Balloon Flights, was being prepared for a balloon transport flight for 13 passengers from Royal Park, Victoria. This was the first flight of the balloon since manufacture and the intended destination was Moorabbin Airport.

The pilot did not observe any abnormalities during the pre-flight inspection, and after the passengers boarded, the balloon departed for an anticipated 1-hour flight. Shortly after departing, and while flying over the Melbourne Central Business District, the pilot noticed a small gap in the balloon’s manually operated deflation system between the edge of the vent panel – a fabric panel used to vent air out of the circular opening at the top of the balloon (vent aperture) – and the vent aperture. This gap allowed hot air to leak out reducing the buoyancy of the balloon. The pilot was unable to seal the gap and descended the balloon to a lower altitude in search of a suitable landing location.

The pilot decided to attempt a landing at Elwood Beach, with the basket impacting the roofs of 2 buildings on the way there. During the approach to the beach, the pilot descended the balloon through trees into a suburban street. The basket landed outside the entrance of an apartment building and the envelope deflated over the building’s roof. The balloon and basket sustained minor damage during the forced landing, and 3 passengers sustained minor injuries.

What the ATSB found

The balloon had a modified deflation system with longer spacing between the vertical load tapes at the vent aperture edge compared to the standard deflation system design. This spacing allowed normal envelope pressure to push the vent panel upwards through the vent aperture, allowing air to leak uncontrolled out of the envelope. This deflation system issue was only evident at elevated envelope temperatures, normally reached during flight when the pressure on the vent panel was higher.

Shortly after take-off, the balloon’s burners heated the air in the envelope increasing the pressure on the vent panel, and air started to leak out around the vent aperture edge. This leak led to a significant increase in burner (and fuel) use to maintain altitude. While searching for a suitable landing site at low altitude, control difficulties led to the balloon's basket colliding with the roofs of 2 buildings. After assessing available landing options, the pilot decided to attempt a landing at Elwood Beach.

While approaching the beach, fuel reduced to a level where altitude could not be maintained, and the pilot decided to land the balloon in a suburban street. During the forced landing, the basket collided with terrain resulting in minor injuries to 3 passengers.

The investigation found that, at the request of the operator, the balloon manufacturer developed and approved a design change to the balloon's deflation system. However, the manufacturer made incorrect assumptions about the deflation system design and subsequently did not conduct the required tests or analysis to ensure the safety of the design change on VH-RJR.

After the design change was approved, the balloon was subjected to the manufacturer’s production inflation test, undertaken to ensure each balloon was in a condition for safe operation. A temperature sensor was fitted during the test so a minimum internal envelope temperature could be reached. For reasons that could not be determined, the actual internal envelope air temperature reached during the test was lower than recorded, and below the minimum required value. The lower temperature achieved during the test reduced the upwards pressure on the vent panel such that the deflation system design issue was not identified.

Finally, the balloon manufacturer did not have an adequate process to verify the accuracy of the temperature recorded during production inflation tests, which probably contributed to the incorrect temperature reading recorded during the VH-RJR test. The ATSB brought this safety issue to the manufacturer’s attention.

What has been done as a result

Kubicek Balloons implemented several actions in response to this occurrence:

• Temperature sensors are now calibrated annually.
• The production inflation test procedure has been updated: 
  • Roles and responsibilities are more clearly defined.
  • All balloons with a modified deflation system will undergo a more comprehensive inflation test with a specific test methodology, the use of 2 temperature sensors, guidance on how to correctly install and position the sensors, and use of the test results to show compliance of the design with affected certification requirements.
  • The production test for standard balloons (that is, balloons with no modifications affecting flight characteristics) has been amended. The minimum envelope temperature requirement has been removed and replaced with a specific weight to be placed into the basket depending on the size of the balloon envelope. The envelope will be heated to equilibrium temperature where the weight is lifted slightly off the ground before the deflation system is tested. This approach will ensure that each balloon is tested under the same load regardless of the ambient conditions that can change throughout the year.
• The production quality control checklist was updated to verify whether any balloon modifications and required tests were completed.

Safety message

This investigation highlights the importance of engineering rigour in analysis, design, and testing.

Any assumptions used in the engineering analysis and design of safety critical features on aircraft must be based on sound engineering logic, subject to rigorous review to assess their validity, and documented. This is especially important when previously tested and approved designs are incorporated into different aircraft types.

Instrumentation used in aircraft testing, such as temperature sensors, play an important part in the monitoring and recording of data to ensure the safety and reliability of aircraft. Robust procedures and processes must be in place to ensure that instrument measurements are valid, accurate, and reliable.

The occurrence

On the morning of 20 April 2022, a Kubicek BB78Z hot-air balloon, registered VH‑RJR and operated by Liberty Balloon Flights, was being prepared for a balloon transport[1] flight for 13 passengers from Royal Park, Victoria. This was the first flight of the balloon since manufacture and the intended destination was Moorabbin Airport.

Before the flight, the pilot conducted a pre-flight inspection. This involved partially inflating the balloon envelope with a fan while on the ground to inspect the deflation vent system (see the section titled Balloon information). The basket contained 6 full propane fuel tanks, sufficient for the intended flight, and the burners were used to inflate the envelope with hot air. After the balloon was ‘stood up’, the pilot confirmed the correct functioning of the deflation vent system.

After the pre-flight inspection, the passengers boarded the balloon, and at 0635, the balloon departed for an anticipated 1-hour flight. The pilot noticed during the pre-flight heating and initial stages of the flight, that the overlap of the vent panel – a fabric panel used to vent air out of the circular opening at the top of the balloon (vent aperture) – and the vent aperture was smaller than on other Kavanagh balloons they had flown. However, the deflation system was sealing correctly during these stages, and so the pilot was not concerned. Passenger images showed the vent panel before take-off and about 2 minutes after take-off (Figure 1). The image taken shortly after take-off showed that the vent panel was close to, or was, pushing through the vent aperture.[2]

Figure 1: Vent panel before (left) and after (right) take-off

Source: Passenger

At about 0640, the pilot activated the burners to ascend above the Melbourne Central Business District (CBD). About 4 minutes later, and with the balloon flying over the CBD, the pilot noticed a small gap between the edge of the vent aperture and the vent panel. This gap allowed hot air to leak out, reducing the buoyancy of the balloon. The pilot attempted to seal the gap multiple times using the deflation system rope lines but was unsuccessful and decided that a forced landing was necessary. The pilot then descended the balloon to a lower altitude in search of a suitable landing location. As the flight progressed, the gap between the vent aperture and the vent panel expanded and altitude control became increasingly difficult, with precise altitude control no longer possible.

At about 0656, the pilot attempted a landing in Fawkner Park (Figure 2), but as the balloon descended over the Royal Botanic Gardens it tracked away from the larger central areas of the park. The pilot heated the envelope and ascended into north-westerly winds to attempt to track back towards the park’s centre but was unsuccessful. The balloon then continued to track south‑south‑east along the western edge of the park adjacent to nearby buildings.

Figure 2: Balloon flight track

Source: Google Earth and Hot Air, annotated by ATSB

At about 0706, the pilot descended the balloon to track towards Elwood Beach and instructed the passengers to adopt the landing position. During the descent, the balloon’s basket impacted a glass fence on top of a building. Shortly after, the pilot advised the passengers of a malfunction with the deflation system, for them to remain in the landing position, and the intent to land at Elwood Beach. The pilot continued to fly the balloon at low altitude towards Elwood Beach, which required almost continual operation of 1 or 2 of the balloon’s 3 burners to maintain altitude, with precise altitude control not possible.

At about 0714, the balloon’s basket impacted the top of another building. At about this time, liquid fuel for 2 of the balloon’s 3 burners was exhausted, significantly reducing the heat generated by those burners and rendering them ineffective.[3] Unable to maintain altitude, the pilot continued to activate the remaining burner to reduce the descent rate as much as possible as the balloon descended through trees into a suburban street. As the balloon struck the trees, the pilot pulled the fast deflation line to deflate the balloon envelope. However, this was only partially accomplished as tree branches pulled the line out of the pilot’s hands.

During the landing, the basket was not orientated with the long side perpendicular to the direction of travel. Although this was the normal procedure for any landing, the impact with the trees rotated the basket, and the pilot did not have time to correct this using the balloon’s rotation vents. Furthermore, using the rotation vents would have increased the rate of descent.

The basket came to rest outside the entrance of an apartment building and the envelope deflated over the building’s roof (Figure 3). The balloon and basket sustained minor damage during the forced landing, and 3 passengers sustained minor injuries.

Figure 3: Balloon landing site during the post-incident recovery

Source: ATSB

Context

Pilot information

The pilot held a commercial pilot licence (balloon) and had accumulated 3,950 hours of flying experience, of which about 300 hours were on balloons in the same class[4] as the BB78Z. The pilot had flown 60 hours in the previous 90 days. The occurrence flight was the first flight the pilot was undertaking in a BB78Z.

In discussing the incident, the pilot stated that:

• After noticing the deflation system was not sealing correctly, the pilot maintained the balloon’s altitude as low as possible because it was safer and provided more potential landing areas. The heat required to ascend would have increased the fuel burn, reducing the balloon’s endurance. Moreover, later in the flight, keeping a lower altitude provided the shortest route to Elwood Beach – an area the pilot had previously landed a balloon. However, due to this low altitude with precise altitude control impossible, the pilot could not slow the balloon’s descent fast enough to avoid colliding with the two buildings.
• Albert Park was a potential landing option, but the recent Formula One Grand Prix race meant that there was still a lot of work happening at the park with lots of associated equipment. The reduced altitude control would have also made it difficult to manoeuvre towards the park for a landing.
• Elsternwick Park was also an option, but based on the prevailing winds would have required an ascent, increasing the fuel used. Therefore, the pilot attempted to land at Elwood Beach.

Figure 4: Balloon flight track with potential landing options

Source: Google Earth and Hot Air, annotated by ATSB

Meteorological information

North-north‑west surface winds at 7-8 kt and an air temperature of 11 °C were forecast at Essendon Airport and Moorabbin Airport for the balloon’s expected flying time.

The balloon’s GPS unit recorded its velocity during the flight (indicative of wind speed and direction) which, after descending over the Royal Botanic Gardens, mostly varied between 6‑10 kt.

Balloon information

The BB78Z is a 275,000 cubic feet hot-air balloon produced by Kubicek Balloons, a balloon manufacturer based in Czechia. The incident balloon (VH-RJR) was manufactured in 2021 (Figure 5) and included a T‑partitioned basket with 2 passenger compartments fitted with rope handles, and a triple burner system. The envelope has vertical load tapes which transfer the internal envelope forces to carry the basket, and 24 gores (vertical fabric panel sections between vertical load tapes).

Figure 5: VH-RJR

Source: ATSB

The balloon was equipped with a Kubicek 3-line deflation system (Figure 6). In-flight venting was achieved by pulling on the red-white line (parachute vent line) which in turn pulled the vent panel (Figure 7) at the top of the balloon for a controlled release of air through the vent aperture. Releasing the parachute vent line allowed the vent panel to close, being pushed upwards by the pressure of the heated air within the envelope.

The parachute vent line was used to descend the balloon, such as when approaching to land. For final landing, when the balloon was close to the ground, the fast deflation line (red line) was pulled so that the centre of the vent panel was pulled down into the balloon for rapid deflation. A white line was connected to the shroud centralising lines to stretch the vent panel over the vent aperture for proper sealing and to also reset the vent panel after the red line was pulled. A weight was attached to the white line to assist with sealing.

Figure 6: VH-RJR deflation system

Source: Kubicek Balloons, annotated by ATSB

Figure 7: Vent panel

Source: ATSB

The envelope was fitted with a temperature label which was a small strip sewn into the envelope fabric with several temperature-sensitive areas (116-154 °C) that changed colour permanently according to the maximum envelope fabric temperature reached. The envelope was also fitted with a temperature warning streamer which fell towards the pilot if the envelope air temperature exceeded its maximum limit of 124 °C.[5] Both temperature indicators were located internally near the top of the balloon.

Before the flight, the pilot completed a load chart based on the temperature at the launch site (10 °C) and expected maximum altitude (3,000 ft). This indicated that there was sufficient available lifting capacity to conduct the flight.  

Number of passengers

The balloon’s basket had 2 passenger compartments, each with a maximum occupancy of 6 people, which was based on a minimum floor area for each person. This number was independent of the actual weight and size of the passengers, which also needed to be considered by pilots before each flight. The manufacturer advised that the maximum passenger compartment occupancy must never be exceeded due to the limited number of rope handles available, and the requirement for each passenger to adopt a safe and comfortable landing position.

On the incident flight, 7 people (adults and children) were carried within one of the passenger compartments. Although the additional passenger was reportedly able to adopt a good landing position, and no injuries were reported by this passenger, the carriage of the additional passenger increased risk. While the ATSB assessed that the risk was not significantly increased in this case, it is important that pilots adhere to the flight manual passenger limitations.

Post-incident balloon testing

The balloon was retrieved from the incident site and stored in a secure facility. In May 2022, the ATSB arranged for tests to be conducted on the balloon’s deflation system in Yarra Glen, Victoria. Representatives from the ATSB, balloon manufacturer, operator (including the incident pilot), and the Civil Aviation Safety Authority (CASA) were in attendance.

The envelope was first inflated on the ground using a fan to conduct an external and internal inspection of the envelope (Figure 8), with the following observed:

• pulleys and rope lines were serviceable
• there was minor impact damage to the envelope fabric from the landing
• the temperature streamer was intact and the temperature indicator colour was unchanged.

Figure 8: Internal envelope inspection

Source: ATSB

A wireless temperature sensor was fitted to provide an indication of the maximum internal envelope air temperature reached during the test. The basket was tethered, and the burners were used to inflate the envelope. People were loaded into the basket to provide a similar weight to the incident flight. The ambient air temperature at the time of the test was about 7 °C at 230 ft above mean sea level.

The internal envelope air temperature was increased by operating the burners, while external and internal camera footage of the vent panel was taken (Figure 9). At low temperatures, the vent panel began to push up against the internal envelope and vertical load tapes as designed, creating a seal. At about 90 °C, edges of the vent panel between the vertical load tapes pushed up through the aperture creating many gaps for internal envelope air to vent out. Attempts to seal the gaps using the parachute vent line and white line were unsuccessful. At higher temperatures, the gaps became larger and more numerous.

Photos and video taken during the test indicated vent panel behaviour similar to that shown in the passenger’s video of the incident flight (Figure 1). The incident pilot also reported that the vent gaps were very similar to those observed during the incident flight. The balloon envelope was subsequently shipped to the manufacturer’s headquarters in Czechia for further examination.

Figure 9: Deflation system testing

Temperature values are approximate

Source: ATSB

Deflation system design change

The European Union Aviation Safety Agency (EASA) is the civilian aviation safety regulator for the European Union, responsible for prescribing minimum standards required in the interest of safety for the:

• design
• material
• construction
• quality of work
• performance

of aircraft, aircraft engines, and propellers. EASA issue sets of certification requirements based on aircraft category. Successful completion of the certification process, where an aircraft (such as a balloon) complies with the certification requirements, enables the aircraft to receive a type certificate.

The BB78Z was certified under the EASA regulations, receiving a type certificate from EASA in 2016. For the BB78Z, the relevant EASA certification requirements were found in the certification specification for hot air balloons (CS‑31HB).

Before VH-RJR was manufactured in 2021, the operator requested a larger deflation vent (aperture and panel) to increase the balloon’s descent performance. Greater descent performance was desirable for flights over built-up areas such as Melbourne, where landing options were limited and small in area. To accommodate the request, the manufacturer increased the radius of the vent aperture from the standard 3.6 m to 4.0 m, and utilised the 4.0 m deflation system design that already existed on the manufacturer’s larger balloons. This modification was to be accomplished via a change to the balloon’s type certificate.

Changes to a type certificate under EASA regulations followed a general process:

• Classification of the proposed change as either ‘major’ or ‘minor’[6] to determine the approval pathway.
• Determining the certification requirements affected by the proposed change.
• Providing evidence that the change is compliant with the affected certification requirements.

Change classification

Kubicek held a Design Organisation Approval^[7] issued by EASA that granted privileges to develop and approve minor changes and some major changes, including new deflation systems (major change) and an exchange of deflation systems between different balloons (minor change). A change that Kubicek was not authorised to approve, could be developed by Kubicek and submitted to EASA for approval.

As the VH-RJR deflation system design change was based on the 4.0 m deflation system used on its larger balloons, Kubicek classified it as a ‘minor change’.

Approval

During the design change process, the certification requirements affected by the change are determined. Approval of the change is then based on whether compliance with the certification requirements can be demonstrated. The manufacturer listed the following certification requirement as being affected by the deflation system design change:

The manufacturer’s design change approval form listed 8 documents against this requirement as evidence of compliance, and formed the basis upon which the deflation system design change was approved. The ATSB’s review of the compliance documents found that each one contained engineering drawings showing the larger 4.0 m deflation system geometry on the BB78Z balloon, but no evidence that the design met the stated certification requirement. The manufacturer provided the following comments on the design change approval:

• No further analysis or testing was required for compliance with the certification requirement since previous certification activities and in-service experience showed that the 4.0 m deflation system design was suitable on larger balloons.
• Although not explicitly part of the design change approval, the tethered manufacturer production test would provide some assurance on the suitability of the modified design.

Kubicek approved the design change and then manufactured VH-RJR with the modified deflation system. VH-RJR was the only balloon with this deflation system design change produced.

Post-incident investigation

After the incident, Kubicek compared the manufactured deflation system dimensions with the original design drawings and found no differences. The design differences between the VH‑RJR deflation system and the same size deflation system fitted to the manufacturer’s larger certified balloons was also reviewed. This found that when incorporated into the smaller BB78Z balloon, the vertical load tape spacing at the edge of the vent panel (Figure 10) differed from other designs as follows:

• VH-RJR BB78Z with 24 gores and 4.0 m radius vent aperture – 1,042 mm spacing
• Standard BB78Z with 24 gores and 3.6 m radius vent aperture – 940 mm spacing
• Standard larger balloon with 28 gores and 4.0 m radius vent aperture – 893 mm spacing

Figure 10: VH-RJR vent panel spacing between load tapes

Source: ATSB

Regarding the effect of the increased vertical load tape spacing on VH‑RJR, Kubicek stated:

Manufacturer testing

All balloons manufactured by Kubicek were subject to a tethered test to ensure the balloon flight controls performed correctly and the balloon was in a condition for safe operation. The test involved the following:

• balloon assembled with an internal envelope air temperature sensor, with the basket tethered to the ground
• weight placed in the basket to allow internal envelope temperature to be raised to a minimum of 100 °C (not to exceed 124 °C)
• heat the balloon to achieve a height of 0.5-3 m above the ground for at least 30 seconds
• record the take-off temperature and maximum temperature achieved
• check the function of the deflation system and rotation vent
• conduct a visual inspection of the balloon shape.

The VH-RJR test was performed with an ambient air temperature of 7 °C and at 814 ft above mean sea level. The test report indicated that the maximum internal envelope temperature reached 114 °C, with no issues with the deflation system function. After successfully completing the test, the balloon was delivered to the operator.

Post-incident investigation

The post-incident testing arranged by the ATSB on VH-RJR indicated that gaps in the deflation system were forming between the vent panel and edge of the vent aperture at about 90 °C internal envelope temperature. This temperature was below the reported temperature reached during the manufacturer test with similar ambient conditions (temperature and altitude) such that similar internal envelope temperatures created comparable internal envelope pressure. To examine this discrepancy, Kubicek used software to estimate the actual envelope air temperature reached during the test. The software estimated that the maximum internal envelope temperature only reached about 89 °C instead of the 114 °C recorded on the report.

Temperature sensors

As part of the manufacturer’s tethered test, a wireless temperature sensor (probe and transmitter) was fitted to the top of the envelope to record the internal envelope air temperature. The sensor probe was placed inside a Velcro tab designed to measure the temperature at 20 mm from the envelope fabric surface during the test (Figure 11). A receiver located in the pilot’s compartment was wirelessly linked to the temperature transmitter and provided the temperature reading during the test.

Figure 11: Envelope air temperature sensor

Source: Kubicek, modified and annotated by ATSB

The primary purpose of the temperature sensor was to ensure that the test’s minimum envelope air temperature was achieved (100 °C), and the maximum allowable temperature (124 °C) was not exceeded. The envelope air temperature is directly related to the buoyancy force acting on the balloon which is generated by the heated air within the envelope. Significantly, as the internal envelope air temperature increases compared to the ambient air temperature outside the envelope, the pressure pushing upwards on the vent panel also increases.

The position of the sensor probe from the envelope fabric was important to obtain the targeted temperature reading as the air temperature within the envelope could vary significantly depending on location. Balloon temperature sensor research data indicated that at the top of the balloon, where the heated air accumulates, the temperature reading would increase as the sensor moved away from the fabric. For example, a sensor that was 20 mm from the fabric could read 25 °C higher than if positioned directly on the fabric.

In addition to sensor probe position, temperature sensor readings can also be affected by aging during storage, thermal stress, mechanical stress, receiver issues, and calibration problems.

Kubicek provided the following information regarding the use of temperature sensors:

• Different models of temperature sensors and receivers were used to conduct the tests and each sensor and receiver combination was subject to an annual functional check. The sensors were not subjected to any recurrent calibration after purchasing from the temperature sensor manufacturers.
• The tethered test inflation procedure did not include any procedures for the installation of the temperature sensors.
• Information on the type of temperature sensor and receiver used during the tethered test inflations did not need to be recorded, and was not recorded during the VH‑RJR test.

The ATSB and balloon manufacturer reviewed images and video from the VH-RJR manufacturer test, but no conclusions could be drawn about the type of temperature sensor used, its location, or how it was installed.

Entry into service

Based on the BB78Z type certificate issued by EASA in 2016, CASA issued the BB78Z with a type acceptance certificate[8] in 2018, making the model eligible to receive an Australian standard certificate of airworthiness (CoA).

Under CASA’s Civil Aviation Safety Regulations, an imported aircraft certified by a recognised national aviation authority (including EASA) can be issued with a standard CoA if CASA or an authorised person[9] is satisfied that:

(a)  the aircraft conforms to the type design; and

(b)  any modifications or repairs to the aircraft have been carried out in accordance with a supplemental type certificate or an approved modification/repair design; and

(c)  the aircraft is in a condition for safe operation

In practice, this process involved review of relevant documentation such as the type certificate, modification and repair approvals, maintenance records, log books, flight manual, and compliance with any airworthiness directives. The issue of the CoA was reliant on the accuracy and completeness of the information available and the information provided to CASA or authorised person by the applicant.

An inspection of the aircraft, either remotely through photos or a physical inspection, was also required to confirm that the aircraft's physical condition was acceptable and in a condition for safe operation. A manned free balloon[10] such as the BB78Z, also required a test inflation to ensure there were no obvious flaws, but the test was not mandatory if a similar test inflation had been entered in the balloon's logbook.

The operator received delivery of VH-RJR on 13 April 2022 – one week before its first flight (the incident flight) – and arranged for information to be submitted to an authorised person to apply for the CoA. Included in the supplied information was an extract from the balloon’s logbook which showed a 0.5 hour flight for the balloon manufacturer’s tethered test in October 2021.

The authorised person reviewed the supplied information and filled out the necessary checklists. The CoA for VH‑RJR was issued on 17 April 2022, with no associated limitations, and permitted the aircraft to begin passenger carrying operations. Once the CoA had been issued, there was no requirement for the operator to conduct any test flight before entry into service.

In discussing the VH-RJR CoA process, the authorised person stated the following:

• No test inflation was conducted as part of the CoA application process since the balloon’s logbook included an entry for a manufacturer test.
• If a test inflation was conducted as part of the CoA application, in terms of checking deflation system operation, it would only require a functionality check, which would be performed at relatively low envelope air temperatures. Since the deflation system problem identified on VH‑RJR occurred at relatively high envelope temperatures, the problem with the deflation system would very likely not have been identified during such a test.
• None of the information supplied to the authorised person as part of the CoA application indicated that the envelope’s deflation system had been modified. However, for a new aircraft such as VH-RJR coming from the manufacturer, there was an assumption that any changes had been done in accordance with the type design, and any manufacturer approvals would be available. Therefore, even if the modification approval was reviewed as part of the CoA application, the CoA would still have been issued.

Safety analysis

Incident flight

On the morning of 20 April 2022, VH‑RJR was being prepared for a balloon transport flight for 13 passengers from Royal Park, Victoria to Moorabbin Airport. This was the first flight of the balloon since manufacture.

As the deflation system issue only became visible at elevated envelope temperatures normally reached during flight, the pilot was unable to identify the issue during the pre-flight checks. Shortly after VH-RJR departed, the pilot activated the burners to climb over the Melbourne CBD, raising the air temperature in the envelope which increased the upwards pressure on the vent panel. The increased pressure pushed the panel’s edge through the aperture creating gaps for the envelope air to leak out. The pilot noticed this, and after unsuccessful attempts to seal the gaps, decided to look for a suitable location for a forced landing.

Landing in built-up areas is challenging due to the many obstacles and limited large open spaces. Fawkner Park and Albert Park were potential landing areas, but both presented a high risk of collision with the adjacent buildings, while flying to Elsternwick Park would have required more fuel than Elwood Beach. The pilot's decision to remain at low altitude provided the best chance of completing a safe landing. Further, aiming for Elwood Beach, an area with minimal people and obstacles, and in the direction of the wind, was a suitable option.

The air escaping out of the envelope around the vent panel made it difficult for the pilot to control the balloon’s altitude and flight path, and required significantly increased burner use (and therefore fuel) to maintain altitude. In combination with flying at low altitude to search for a suitable landing location, obstacle avoidance was difficult, and the balloon’s basket collided with 2 buildings during the flight. However, the pilot instructed the passengers to adopt the landing position before each collision to reduce the risk of injury.

Although there was sufficient fuel on-board to conduct a normal balloon flight to Moorabbin Airport, the increased fuel burn to keep the balloon aloft reduced the fuel to a level where altitude could no longer be maintained. This occurred during the approach to Elwood Beach, and consequently, the pilot decided to land the balloon in a suburban street. During the forced landing the basket collided with trees and then terrain, resulting in minor injuries to 3 passengers.

Deflation system design change

Before VH-RJR was manufactured, the operator requested a larger deflation system to improve the BB78Z’s descent performance. The design change to the deflation system was classified as ‘minor’ and therefore approved internally by the manufacturer, Kubicek, within its EASA design organisational privileges. The change was based on the larger deflation system used on the manufacturer’s larger certified balloons.

As part of the design change approval process, the manufacturer needed to demonstrate that the change was compliant with relevant BB78Z certification requirements – which in this case was to establish the suitability of the design change by tests or analysis. However, the documentation used to show compliance with this requirement did not contain any tests, analysis, or information to demonstrate that the design was safe and suitable to use on the BB78Z.

The design change approval was based on 2 undocumented and incorrect assumptions:

• A previously certified design feature would be suitable on a different sized balloon, even though the vent panel geometry between the vertical load tapes changed due to the different number of gores.
• The manufacturer’s tethered test would provide assurance of the design’s suitability.

Implementing the 4.0 m deflation system design, used with the larger 28 gore balloons, on the BB78Z with only 24 gores, resulted in longer spacing between the vertical load tapes at the vent aperture edge. As this increased spacing was the only geometric difference identified, and production issues were ruled out, the longer spacing most probably allowed normal envelope pressure to push the vent panel up through the vent aperture.

Since no assessment on the design’s suitability was conducted during the design process, the design issues were not identified prior to approval of the change. The balloon was subsequently manufactured with the modified deflation system and subjected to the manufacturer’s production test.

Manufacturer production testing

All balloons manufactured by Kubicek were subject to a tethered test to ensure the balloon flight controls performed correctly and the balloon was in a condition for safe operation. The internal envelope temperature recorded on the VH-RJR manufacturer production test report (114 °C) was above the minimum required value (100 °C). However, based on post-test calculations, the actual temperature reached during the test was probably only about 89 °C. Information on the temperature sensor used during the test, its location, or how it was installed, was not available, so it was not possible to determine the reason for this significant temperature discrepancy.

Significantly, the lower envelope air temperature achieved during the test reduced the upwards pressure on the vent panel. As a result, the deflation system design problem, which began to occur at about 90 °C, was not identified. If the temperature reading during the test had been accurate and the minimum required value of 100 °C had been achieved, the vent panel gaps would have almost certainly been identified during the test. However, the production test was not a design‑related test, and as such, could not be relied on as assurance that a design was safe and suitable for use. For example, if the vent panel started to push up through the aperture at a temperature above 100 °C, the production test could be passed with a deflation system issue present.

The internal envelope temperature was an important parameter to record during the production test as it ensured that normal anticipated pressure acting on the vent panel were achieved. However, the manufacturer had limited ability to verify that the temperature being recorded was accurate since:

• there was no procedure or information about the installation and correct positioning of the temperature sensor
• the accuracy of the temperature sensors used by the manufacturer was not known
• a single temperature sensor was used.

If the manufacturer had sufficient means to verify that the recorded temperature sensor readings were accurate, the incorrect temperature reading during the VH-RJR test would almost certainly have been identified.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the collision with terrain involving Kubicek Balloons BB78Z, VH-RJR, 15 km north‑west of Moorabbin Airport, Victoria on 20 April 2022.

Contributing factors

• The balloon's modified deflation system had longer spacing between the vertical load tapes at the vent aperture edge compared to the standard deflation system design. This spacing allowed normal envelope pressure to push the vent panel upwards through the vent aperture, allowing air to leak uncontrolled out of the envelope.
• Shortly after take-off, air leaked out around the vent aperture edge. This reduced balloon control and led to a significant increase in burner (and fuel) use to maintain altitude.
• While searching for a suitable landing site at low altitude, control difficulties led to the balloon's basket colliding with 2 buildings.
• While approaching the intended landing area at Elwood Beach, fuel reduced to a level where altitude could not be maintained, and the pilot decided to land the balloon in a suburban street. During the forced landing, the basket collided with terrain resulting in minor injuries to 3 passengers.
• At the request of the operator, the balloon manufacturer had developed and approved a design change to the balloon's deflation system. However, the manufacturer had not conducted the required tests or analysis to ensure the safety of the design change on the balloon (VH-RJR).
• After the design change was approved, the balloon was subjected to the manufacturer’s production inflation test. For reasons that could not be determined, the actual internal envelope air temperature reached during the test was lower than that recorded, and below the minimum required value. The lower temperature achieved during the test reduced the upwards pressure on the vent panel such that the deflation system design issue was not identified.
• The balloon manufacturer did not have an adequate process to verify the accuracy of the temperature recorded during production inflation tests. (Safety issue)

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Manufacturer test procedures

Safety issue number: AO-2022-028-SI-01

Safety issue description: The balloon manufacturer did not have an adequate process to verify the accuracy of the temperature recorded during production inflation tests.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.

Additional safety action by Kubicek Balloons

Kubicek advised that the flight manual for all balloons has been updated to include a new section which describes the purpose of the temperature sensor and its use during flight (a temperature sensor is optionally fitted to some balloons). At the time of this report, the revised flight manual was awaiting regulatory approval.

CASA               Civil Aviation Safety Authority

CBD                 Central Business District

CoA                 Certificate of Airworthiness

EASA               European Union Aviation Safety Agency

Sources of information

The sources of information during the investigation included the:

• balloon manufacturer
• Bureau of Meteorology
• Civil Aviation Safety Authority
• authorised person for VH-RJR certificate of airworthiness
• balloon operator
• pilot of the incident flight
• passengers
• recorded data from the GPS unit on the aircraft
• video footage and images of the incident flight.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the balloon pilot and operator
• the balloon manufacturer
• Civil Aviation Safety Authority
• the authorised person for VH-RJR certificate of airworthiness
• Civil Aviation Authority of the Czech Republic
• Air Accidents Investigation Institute of the Czech Republic
• European Union Aviation Safety Agency.

Submissions were received from:

• The balloon pilot and operator
• the balloon manufacturer
• Civil Aviation Safety Authority
• the authorised person for VH-RJR certificate of airworthiness.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

 

---