Aviation Investigation Report A07C0151

The Sundance Balloons International FireFly 12B hot air balloon (registration C-FNVM, serial number F12B-004) was attempting to land in a field adjacent to Birds Hill Provincial Park near the northern outskirts of Winnipeg, Manitoba. The balloon was operated by Sundance Balloons International under a Special Flight Operations Certificate issued by Transport Canada. One pilot and 11 passengers were on board, all in the balloon's basket. The flight was a local sightseeing flight originating in the southeast of Winnipeg and terminating in the northeast of Winnipeg.

The flight had been extended beyond Winnipeg as the pilot searched for a suitable landing area in strong winds. The balloon touched down and skipped several times. The basket was dragged on its side for about 700 feet and tipped over far enough for the burners to strike the ground as the balloon came to a stop. A propane fuel leak occurred and an intense uncontrolled fire ensued as the passengers were beginning to exit from under the partially-inverted basket. All occupants escaped; however, the pilot and two passengers suffered serious injuries in the intense fire. Four other passengers suffered minor injuries, some with burns. Two of the propane tanks and a fire extinguisher canister exploded, and the basket of the balloon was destroyed by fire. The accident occurred at about 0908 central daylight time.

The basic elements of the FireFly 12B hot air balloon are as follows: a large envelope that is inflated by hot air, a basket that carries passengers and fuel, a cable system that suspends the basket beneath the envelope, and a rigid frame that supports the propane burners above the basket. Rope and pulley systems run from the pilot position in the basket to positions in the envelope and function as an aerodynamic control system for the pilot. Propane is stored in tanks near the pilot, who controls the flow of fuel to the burners and pilot lights through a system of valves. The top of the envelope has a large opening. Outflow of air through this opening is controlled by a valve, which is a large, movable piece of fabric, shaped like and called a parachute. The envelope is deflated after landing by opening the parachute valve.

Before lift-off, large fans are used to inflate the envelope. Then, heat is introduced using the propane burners. In calm conditions, the passengers can be loaded after the envelope is inflated and the balloon is upright. In stronger winds, passengers are loaded with the basket on its side, and the basket rotates into alignment as the hot air is introduced and the aircraft ascends. Turning vents allow rotation of the balloon to align the long side of the basket perpendicular to the direction of travel to stabilize the basket during the landing. Although optional, the turning vents are highly desirable. They function by permitting the escape of hot air at the equator of the envelope in a direction that results in a rotational torque. Opposing vents allow rotation in either direction.

The local sightseeing flight in the balloon had been originally scheduled for the previous evening, but had been delayed because of weather. On the morning of the accident flight, the passengers met with crew members at a local shopping centre and then were transported to the launching site at Saint Vital Park, located in the southeast of Winnipeg. The 11 passengers were briefed and the flight departed at approximately 0730 central daylight time^{Footnote 1}. Since the winds were from the southwest, the flight proceeded in a northeast direction towards Birds Hill Provincial Park. The flight was to be about one hour in duration.

At 0706, the pilot obtained a weather briefing by telephone from the Winnipeg Flight Information Centre (FIC). The 0700 meteorological report for Winnipeg was as follows: wind 210° true (T) at 4 knots, visibility 6 statute miles (sm) with mist, a few towering cumulus clouds at 2000 feet above ground level (agl), broken ceiling at 8000 feet agl, temperature 17°C and dew point 16°C. The forecast provided was as follows: until 1000, winds 120°T at 5 knots, visibility greater than 6 sm, a few clouds at 1500 feet agl, broken ceiling at 10 000 feet agl, temporary visibility 2 sm in mist and a broken ceiling at 1500 feet agl. After 1000, the wind was forecast to be 270°T at 8 knots, becoming 280°T at 15 knots by 1200. The pilot was also informed about the possibility of strong winds at 1000 feet agl and thunderstorm activity outside of his planned flight. At 0855, the wind speed recorded at an unofficial weather site in the vicinity of Birds Hill Provincial Park was 19 knots. The unofficial weather site was not calibrated for accuracy.

The change in wind speed and direction occurred earlier than the forecast time of 1000. On initial contact with the Winnipeg Airport control tower at 0746, the pilot was given the surface wind at the airport of 230° magnetic (M) at 10 knots. A transmission one minute later to another aircraft on the same radio frequency gave a wind of 240°M at 10 knots gusting to 15 knots. Shortly after this information was transmitted, the path of the balloon crossed open areas within the city which might have afforded potential landing sites. There was also a significant change in the forecast ceiling at Winnipeg. At 0803, the tower reported the ceiling as 300 feet agl broken. At 0824, the pilot was given a wind of 230° at 10 knots gusting to 15 knots after indicating that he was planning to land east of the floodway, east of Winnipeg.

After leaving the outskirts of the city, the pilot attempted to land several times in different fields but chose to overshoot because of the wind speed and unfavourable ground conditions or obstacles. On the final landing attempt, at approximately 0855, the balloon descended at about a 45° angle, hit hard, and skipped several times. The impacts were severe enough to dislodge one of the burner frame support uprights. The upright came loose and was later found along the landing trail. A photograph taken during the landing showed the parachute still in the sealed position (see Photo 1). The pilot's efforts to reposition the parachute were observed to pull in the fabric of the envelope in the parachute area, though subsequent examination found the rigging to be correctly attached. The basket was dragged on its side for about 700 feet, coming to rest in a partially-inverted position. The passengers fell on top of each other as the basket overturned. The manifold of one burner was broken by the impact with the ground. The fuel had not been shut off before landing and the pilot was unable to reach any valves while the basket was being dragged across the ground. A propane leak occurred and the propane was ignited by the burner pilot lights. An intense fire broke out with the passengers and pilot beneath the basket. All escaped or were pulled from beneath the basket.

Image

The basket had skipped six times in the first 297 feet of travel across the ground. One burner frame riser was found about 321 feet from the first impact. The remains of seven propane tanks were identified in the wreckage; two tanks had ruptured. The manifold of one of the two burners had been broken off when the basket rolled partially inverted as it was being dragged. The propane supply lines had pulled out of their fittings on the burner.

The pilot held a valid balloon pilot licence with a night and instructor rating for all non-power-driven balloons. The pilot was an experienced balloon pilot with approximately 2122 hours of flying time. He had completed approximately 100 flights on the FireFly 12B. He had not flown in the 24-hour period before the accident flight. He had flown 5 hours in the past 7 days and 29 hours in the last 30 days, all in C-FNVM.

A balloon is defined as an aircraft in the Aeronautics Act. Some balloon operators use this type of aircraft for hire and reward and are thus a commercial air service and air carrier as defined in the Act. The accident balloon was privately registered and operated by Sundance Balloons International (Sundance Balloons) for the carriage of fare-paying passengers. At the time of the accident, Sundance Balloons owned and operated about 20 other balloons across Canada, 4 of which were of the same type as the accident balloon.

The accident balloon was manufactured by FireFly Balloons in 2007. A certificate of airworthiness was issued by Transport Canada (TC). The FireFly 12B was, at the date of the occurrence, the largest balloon manufactured by FireFly Balloons. It had an envelope capacity of 280 000 cubic feet, a total height of over 86 feet, and an approved gross weight of 3940 pounds. The basket, a FireFly model 60120, had a capacity of 12 passengers and one pilot. Type Certificate Data Sheet number A14SO certified the basket for six, seven, or eight 10-gallon propane tanks, although the basket had been shipped from the manufacturer with only six tanks. Weight and performance calculations, using the Balloon Flight Manual (BFM) data sheets and charts, indicated that the planned flight could be accomplished within the balloon's gross weight and envelope temperature limits.

The company's five FireFly 12B balloons had been modified in accordance with a TC-approved Limited Supplemental Type Certificate for the installation of turning vents and for changes to the parachute rigging. The primary reason for the re-rigging of the parachute was to increase safety by providing for commonality of materials and rigging within the Sundance Balloons fleet of aircraft. Tests of the envelope modifications were conducted with the balloons tethered. The balloons had flown approximately 50 hours since modification with no reported problems.

The rigging of C-FNVM was examined and no failures were found. Information provided indicated that the parachute valve of the FireFly 12B balloon envelope does not dump the air quickly after a landing in high winds, increasing the likelihood of a dragged landing.

The FireFly 12B is equipped with two burners, each of which is fed from a master tank and two slave tanks. Each master tank has a main fuel source and an alternate fuel source, each controlled by a shut-off valve similar to a barbecue propane tank valve. Each shut-off requires several turns to close the valve. Each master tank also has a pilot light shut-off valve, a relief valve, and a quantity indicator. Each slave tank has a main fuel source valve, a relief valve, and a quantity indicator. The fuel system is not equipped with an emergency shut-off valve, nor is it required to be so equipped. The propane fuel hoses were constructed using crimped sleeve fittings. Current airworthiness standards, contained in Chapter 531.46 of the Airworthiness Manual, require fuel hoses to be capable of withstanding twice the maximum fuel operating pressures of the system. These standards may be met using the acceptable data contained in Federal Aviation Administration (FAA) Advisory Circular 43.13-1B^{Footnote 2} or met by using alternate means that provide an equivalent level of safety.

The normal operating pressure of the fuel system is approximately 150 pounds per square inch (psi) and, depending on the environment, may increase to 200 psi. Hoses provided with the FireFly 12B balloon had been tested by the manufacturer of the balloon to 480 psi. Sundance Balloons manufactured its own fuel hose to connect the seventh inflator tank to the fuel system. Since this hose was destroyed in the post-crash fire, similar hoses were obtained from the operator. Pressure testing of these hoses revealed that the hoses began leaking at the crimped sleeve fittings at 150 psi.

The basket of the FireFly 12B is rectangular in shape and divided into three pairs of compartments. The two centre compartments are smaller and are used for the pilot and propane storage. On landing, the balloon is manoeuvred so that the pilot compartment is the front compartment of the centre pair, relative to the direction of landing. Passengers are placed in the two side pairs. C-FNVM was approved to carry seven propane tanks. The two master tanks are in the pilot compartment and the remainder are in the rear centre compartment. One of the tanks was routinely removed after it was used to inflate the envelope for departure, but it was left on board for the accident flight to use its residual fuel. The company operations manual did not provide any guidance on the use of the inflation tank during flight. Six of the tanks are secured with nylon strapping to the basket frame. The method of securing the inflation tank was not determined; however, company practice was to strap the tank either to the other tanks or to the frame of the basket. There was insufficient information to determine whether the inflation tank was certified for installation in the FireFly 60120 basket.

The carriage of fare-paying passengers in privately-registered balloons is authorized by TC by way of a Special Flight Operations Certificate (SFOC). In order to obtain an SFOC, the applicant must provide basic information, including a list of the balloons to be flown, as well as the registration, make, model, and size of each. TC then issues the SFOC. The SFOC states that the balloon operator is adequately equipped and able to conduct a safe balloon operation for the carriage of fare-paying passengers. In this specific occurrence, there was no initial inspection of the company to support this statement. The SFOC has no expiry date and there are no audits of the balloon operators. TC has indicated that there is no current list of SFOCs for balloons, either nationally or by TC region. TC has issued 89 SFOCs for balloons, but it is unknown which are active. C-FNVM was operated by Sundance Balloons under SFOC 5812-10-36.

Section 602.07 of the Canadian Aviation Regulations (CARs) requires operators to follow flight manual limitations when the balloon is certified with an approved balloon flight manual (BFM). The FireFly 12B balloon was certified with an approved BFM dated 20 May 2005. However, the limitations section of the BFM does not specify wind limits.

The performance section of the FireFly 12B BFM states that the maximum demonstrated wind speed at landing during certification tests was 7 mph. The normal procedures section contains the following caution in paragraph 3.6:

CAUTION - Over-valving at low altitude can result in uncontrolled descent to a hard landing. Exercise extreme care when landing at descent rates approaching 500 feet per minute and/or in winds above 7 miles per hour. For Hard Landings, see section 4.4.

The emergency procedures in section 4.4 describe how the balloon will behave during a hard landing and specifies the hard landing procedure to be used. The hard landing procedure contains the following direction:^{Footnote 3}

(2) Close all valves on all fuel systems securely before impact. Make sure that no ignition source is operating or operable.

Sundance Balloons had voluntarily produced and maintained an operations manual, although neither CARs nor the SFOC require the company to maintain such a document. The manual is not approved by TC and is general in application. The operations manual specifies that balloons are not to be operated in surface winds that exceed the manufacturer's limitations as defined by the pertinent BFM and are under no circumstances to be operated in surface winds that are, or are likely to become during the flight, greater than 15 knots. During landings in high winds, pilots may experience difficulty in deflating a balloon's envelope because of wind-induced distortion of its shape.

A total of 482 balloons are currently registered in Canada. Whether used to carry fare-paying passengers or not, the balloons are registered privately. Since 01 January 1997, there have been 15 reported accidents involving balloons in Canada. These accidents resulted in 3 fatalities and 26 serious injuries.

Balloon operators are not regulated under Part VII (Commercial Air Services) of the CARs and do not have to maintain operations manuals or maintenance control manuals. The upkeep of operations manuals and maintenance manuals, and a requirement to adhere to flight manuals, are recognized means of controlling risks inherent in aviation operations.

It was Sundance Balloons' policy to keep company manuals up-to-date and require all employees to adhere to the provisions of the manuals. The company reinforced this policy at an annual safety seminar.

Although the SFOC states that "it certifies that the Balloon Operator is adequately equipped and able to conduct a safe balloon operation carrying fare-paying passengers," there is no assurance or verification by audit and inspection that any standards are maintained once the SFOC is issued. Information provided by TC indicated that balloon operators could be subject to an inspection by a general aviation inspector once every 10 years, but this had never been accomplished for any balloon operator.

Image

Because balloons are not regulated under Part VII of the CARs and are considered part of general aviation, they are assigned the lowest priority of inspection in TC's National Cabin Safety Inspection Program. It is likely that no large balloon carrying fare-paying passengers would be inspected under this program. Furthermore, this means that no standards have been developed for balloon cabin safety to ensure standardization during certification of new types. Similarly, few standards have been developed for operators engaged in the transportation of passengers. The SFOC contains one such standard directing that a passenger safety briefing be carried out prior to flight in accordance with the CARs. Additionally, the presence of the balloon pilot in the basket close to the passengers is considered to provide a level of supervision and assistance to the passengers during flight.

During the examination of a similar balloon basket, it was observed that passengers can reach fuel manifold lines and fuel lines running overhead to the burners, as well as suspension lines. The sole restraint devices provided are loops of rope in each compartment that can be held while the basket is dragged across the terrain. The company operations manual includes the propane tank rims as a suitable point to hold onto during landing. Neither the company operations manual nor the FireFly 12B BFM includes the requirement for protective helmets or gloves in case of dragged landings nor were any required by regulation.

The forecast obtained by the pilot indicated suitable weather for the planned flight that was flight-planned to land by about 0830. The forecast winds would not have exceeded the BFM demonstrated wind speed of 7 mph until 1000 and would not have reached the limit of 15 knots specified in the company operations manual until 1200. However, the conditions changed more rapidly than forecast. After lift-off, the pilot was made aware that the wind speed at the Winnipeg Airport was 10 knots on initial contact with tower at 0746. Within one minute, the tower made a transmission on the same frequency including the information that the wind was gusting to 15 knots. While the BFM performance section indicated that the balloon had only been demonstrated to 7 mph in certification testing and the normal procedures section indicated that extreme care should be exercised while landing at wind speeds in excess of this speed, there was no wind speed limit specified in the limitations section of the BFM. Consequently, the balloon could be flown to a wind speed set by the company. The speed set in the company operations manual was a wind speed of 15 knots, more than twice the wind speed demonstrated in certification testing.

Upon receipt of information from the tower indicating that the weather forecasts were not correct and that the operations manual limit had been reached, the pilot continued over open areas of the city until 0824, at which time he indicated an intention to land some distance further away. Although the wind had quickly and unexpectedly reached the limit specified in the operations manual, there was no indication that the pilot attempted to land at the earliest opportunity.

The number of attempts to land indicates that the wind speed made the landing difficult to position or control. The hard landing procedure, outlined in the BFM, required the fuel valves to be closed and ignition systems to be turned off to reduce the risk of fire and explosion. The absence of readily accessible quick shut-off valves precluded the pilot from turning off the fuel after the balloon was on the ground, although he attempted to do so.

The pilot attempted to deflate the balloon envelope quickly and was unable to do so effectively even though the rigging was functional, resulting in a dragged landing of some 700 feet. The extended drag distance increased the risk of injury to the passengers and damage to the basket. The wind speed at the accident site could not be measured, but was likely between the wind speed of 15 knots recorded at the Winnipeg Airport and the 19-knot wind speed that was recorded near the accident site. Therefore, the company operations manual wind speed of 15 knots was too high to ensure a short drag distance while deflating the envelope after landing.

Although the SFOC states that "it certifies that the balloon operator is adequately equipped and able to conduct a safe balloon operation carrying fare-paying passengers," this statement was based solely on the licensing of the pilot and certification of the balloon. The SFOC did not trigger any audit or inspection cycle and in fact relegated the balloon to a status similar to that of privately registered general aviation aircraft. In practice, TC did not know which operators were active or the operator's actual area of operations. TC's National Cabin Safety Inspection Program would not have resulted in a balloon cabin safety inspection. Additionally, there was no requirement for passenger restraint or personal protective equipment. There was no requirement for approved manuals or specific regulatory standards. Consequently, there was no equivalent level of safety for balloon air carriers comparable to other commercial operators.

During the accident sequence, the fuel supply lines had pulled out of their fittings at the burner manifolds and, because the fuel system was not turned off, released liquid propane in the vicinity of the pilot lights, resulting in the fire and subsequent explosion.

The maximum operating pressure of the fuel system indicated that the fuel lines and fittings should have been able to withstand pressures up to 400 psi. Tests conducted by the TSB Engineering Laboratory on the exemplar hoses manufactured by Sundance Balloons International and used to connect the seventh inflator tank revealed that the fuel lines began leaking at the crimped sleeve fittings at 150 psi and, therefore, did not meet the airworthiness standards.

The following TSB Engineering Laboratory Report was completed:

• LP 080/007 – Burner System Examination

This report is available from the Transportation Safety Board of Canada upon request.

3.1 Findings as to Causes and Contributing Factors

1. The flight continued even though the winds exceeded the maximum demonstrated winds listed in the balloon flight manual and were at the upper wind limit specified in the company operations manual.
   
2. The fuel system was not shut down as recommended in the balloon flight manual procedures for a hard landing even though a hard landing was likely.
   
3. Because the balloon was not deflated quickly, the basket was dragged for some 700 feet and the integrity of the burner support structure was lost.
   
4. As the basket was dragged across the ground, the fuel line fittings were pulled out at the burner manifolds and liquid propane was released in the vicinity of the pilot lights, resulting in the fire and subsequent explosion.

3.2 Findings as to Risk

1. There was no mandated requirement for passenger restraint or personal protective equipment to reduce injury during a dragged landing.
   
2. Balloon air carrier operations do not have the same degree of regulatory oversight as other air carriers. There may not be an equivalent level of safety for balloon air carriers comparable to that of commercial operators.
   
3. Exemplar fuel supply hoses manufactured by Sundance Balloons International, one of which was used to connect the inflator tank, did not meet the required airworthiness standard.
   
4. The company operations manual maximum wind speed of 15 knots was more than twice the wind speed demonstrated in certification testing. This was too high to ensure a short drag distance while deflating the envelope after landing.

On 27 March 2008, the Board released two recommendations to Transport Canada as follows:

While some commercial balloon operators in Canada have fare-paying passenger loads equal to those of commuter and air taxi operators, their passengers are not assured of the same level of safety and oversight by regulations and standards. The Board is concerned that, without adequate standards and regulations for balloon operators, balloon passenger safety will be compromised. Therefore, the Board recommends that:

While some commercial balloon operators in Canada have fare-paying passenger loads in the range of those of commuter and air taxi operators, their passengers are not assured of the same level of safety and oversight by regulations and standards. The inability to quickly shut off the fuel supply during landing or in an emergency increases the risk of a fire and/or explosion, compromising balloon passenger safety. Therefore, the Board recommends that:

Transport Canada Response to A08-01

To address the subject of the level of equivalent safety of passenger-carrying commercial balloon operations, Transport Canada is conducting a risk assessment of commercial passenger-carrying balloon operations. This study will address the special flight operations certificate process and commercial passenger-carrying balloon operation oversight. Once the review is complete, should regulatory changes be required, Notice of Proposed Amendments will be developed and submitted to the Canadian Aviation Regulation Advisory Council for consultation.

Board Assessment of the Response to A08-01

Transport Canada's written response to the recommendation indicates that it intends to conduct a risk assessment and determine an appropriate means of addressing the issue of commercial passenger-carrying balloon operations. This study will address both the special flight operations certificate process and commercial passenger-carrying balloon operation oversight.

Once the review is complete, regulatory changes will be proposed should they be considered necessary. However, the Board believes that, Transport Canada's proposed review and regulatory amendment process will not yield any specific course of action that, in the short term, would reduce or eliminate the deficiency identified in Board Recommendation A08-01.

The response is assessed as "Satisfactory Intent".

Transport Canada Response to A08-02

To address the subject of the proposed emergency fuel shut-off for balloons carrying fare-paying passengers, Transport Canada is conducting a risk assessment to determine whether regulatory or non-regulatory solutions would be appropriate to address this issue. Once the review is complete, should regulatory changes be required, Notice of Proposed Amendments will be developed and submitted to the Canadian Aviation Regulation Advisory Council for consultation.

Board Assessment of the Response to A08-02

Transport Canada's response to the recommendation indicates that it intends to conduct a risk assessment and determine an appropriate means of addressing the issue of the proposed emergency fuel shut-off for balloons carrying fare-paying passengers. Once the review is complete, regulatory changes will be proposed should they be considered necessary. However, the Board believes that, Transport Canada's proposed review and regulatory amendment process will not yield any specific course of action, in the short term, that would reduce or eliminate the deficiency identified in Board Recommendation A08-02. The response is assessed as "Satisfactory Intent".

Next TSB Action

The Board will continue to monitor the safety of passenger-carrying balloon operations and will follow up Transport Canada's response in conducting its risk assessment process.

This deficiency file is assigned an "Active" status.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 20 August 2008.