What keeps aircraft apart, and how do we know it works?

Two helicopters collided at Pheriche, near Everest, on 3 November 2026. One passenger died and three people were injured, according to Nepal Police, as reported by ABC News.

Watching the footage, it is natural to ask why the aircraft came so close. The harder and more useful question is what was meant to keep them apart, and how anyone knew those controls were working.

The footage alone cannot answer that. But the ATSB’s completed investigation into the Sea World collision offers important lessons about how layers of protection can weaken together.

On 2 January 2023, two helicopters conducting scenic flights on Queensland’s Gold Coast collided about 130 feet above the ground. Four people died.

One aircraft became uncontrollable and fell to the ground. The pilot of the other managed a controlled landing despite substantial damage. The ATSB’s investigation traced the accident back through the arrangements intended to keep the aircraft apart.

The findings have relevance well beyond aviation. Construction sites, warehouses and other workplaces also rely on separation, communication, observation and timely decisions to prevent conflicting movements. The value of those controls depends on how they work together when information is missed or conditions change.

The distinction matters: the ATSB has completed its investigation into Sea World, while the available reporting on Pheriche remains preliminary. Similar outcomes do not establish similar causes. The learning that follows draws on the ATSB’s findings and asks how those lessons might apply to our own work.

A useful place to start is a missed message. If several people depend on it to make their next decision, its absence can weaken more than one control at once.

What remains between people and harm when one of our controls is unavailable, misunderstood or no longer effective?

What the ATSB established

At Sea World, the inbound pilot was waiting for a taxi call as a cue to arrange separation. But faults in the departing helicopter’s radio likely prevented that call from being broadcast. Neither pilot knew about the faults.

An earlier inbound call had not registered with the departing pilot, who was loading passengers. Ground crew advice that the airspace was clear had become outdated by departure. Restricted views, expectations and competing tasks further limited the opportunity to detect the conflict.

Operational changes had also weakened separation controls. The investigation therefore reached beyond the pilots’ final actions to the arrangements in which those actions took place.

Are the controls independent?

A risk assessment may list radio calls, visual checks, ground support, procedures and training as separate controls. Five entries on a register, however, do not necessarily provide five independent layers of protection.

Consider an operation where someone uses a radio message to decide where to look, when to proceed and whether another activity presents a threat. If the message is missed, several decisions can be affected at once.

Imagine a vehicle operator relying on a spotter to confirm that an area is clear, while a pedestrian assumes the operator has seen them. If the spotter’s radio fails, the apparent layers of protection may depend on the same missing information.

We need to follow those dependencies:

• What information does each control need, and where does it come from?
• How quickly can that information become outdated?
• What tells people a control has stopped working?
• What protection remains if nobody notices immediately?

When several layers weaken together

The idea that every layer must fail before an accident can occur is reassuring. It can also overstate how much protection was present in the first place.

A control may have been absent, unsuitable or ineffective before the work began. Several controls may share a common dependency. One change may weaken more than one layer at the same time.

We also need to distinguish prevention from measures that reduce consequences. Separation aims to prevent a collision. Restraints and emergency response serve different purposes once an event occurs. Some measures can still help even when prevention has failed.

Design separation into the work

The strongest opportunity to improve an operation often comes before a movement begins, when its routes, timing and interfaces are being arranged.

Physical separation or different operating times may remove a conflict or reduce how often people need to recognise and resolve one. The right arrangement depends on the work, but it deserves consideration before another instruction is added to a procedure.

Clear communication and careful observation remain important, but their effectiveness must be tested against the workload, visibility, timing and conditions people actually face.

Involve the people who perform the work and the specialists needed to assess it. Their experience helps expose where an arrangement that looks sound on paper is difficult to use in practice.

Plan for missing information

Even a well-designed operation needs a workable response when information is missing or conditions are uncertain.

An unacknowledged message, an obstructed view or disagreement about whether an area is clear should trigger a defined response. People need to know when to pause, who can resolve the uncertainty and what must be confirmed before work resumes.

That response has to be workable. An instruction to stop has limited value if there is nowhere safe to wait, nobody responsible for resolving uncertainty, or pressure to continue.

Recheck controls when operations change

An additional vehicle, a relocated access point, a new contractor or a different communication system may appear to be a small change. The important question is what it changes elsewhere.

A change may create a crossing point, restrict a view or lengthen the time between a check and the action it supports. It may also move a task into a busier period or make two controls dependent on the same person. Those effects can be easy to miss when the change is considered in isolation.

For a critical control, we should be able to explain the event it prevents, the conditions in which it must work, who keeps it effective, what evidence demonstrates that effectiveness and what happens when it is unavailable.

A completed risk assessment records a decision. Observation, testing and consultation help establish whether that decision remains sound.

What remains unknown at Pheriche

At Pheriche, the footage provides a starting point for questions about traffic sequencing, communication, visibility and coordination between operators. Answering them will require evidence about the actual operation, equipment, decisions and conditions.

Until that evidence is examined, explanations based on assumed pilot behaviour, operational pressure or organisational culture remain speculation. The practical lessons from Sea World can inform a review elsewhere without becoming a diagnosis of this accident.

Test the protection in your own work

Choose one activity in your own operation where a loss of separation could cause serious harm. Walk through it with the people who perform it. Identify what prevents conflicting movements, then test the assumptions: a message is missed, information becomes outdated, or a key control is unavailable.

What still protects the people doing the work?

If the answer depends entirely on someone noticing the conflict and recovering in time, there is a clear reason to revisit the design of the work.

The final seconds attract our attention. Much of the opportunity to prevent harm lies earlier, in the decisions that shape how work is arranged, coordinated and checked.

A control earns our confidence when we can explain what it prevents, show that it works in practice and identify what protection remains when it is unavailable.