The driver of an empty passenger train that passed two signals at ‘Danger’ and entered a level crossing before the crossing booms had lowered was probably influenced by nicotine withdrawal symptoms, an ATSB investigation has found.

The 2 January 2018 incident occurred when a V/Line three-car VLocity train (number 7750) was repositioning on a non-passenger-carrying service from the outer Geelong, Victoria suburb of Waurn Ponds to Geelong Station, from where it was due to operate a passenger service to Melbourne’s Southern Cross Station. Shortly after passing Marshall Station, the train passed two signals at Danger (MSL10 and MSL8), entered the single line section between Marshall and South Geelong, and then entered the Marshalltown Road level crossing before the crossing booms had lowered.

At about the same time a V/Line Melbourne to Warrnambool service, with two crew and 166 passengers on-board, had departed Geelong and was heading towards Marshall on the same single line section. The trains were scheduled to cross using the loop track at Marshall. When the train controller in Melbourne became aware that train 7750 was passing signals at Danger, the controller initiated an emergency radio fleet call instructing both trains to stop. When stopped, the distance between the trains was about 940 metres.

The subsequent investigation into the occurrence, conducted on behalf of the Australian Transport Safety Bureau (ATSB) by the Victorian Government Office of the Chief Investigator, Transport Safety, determined that the driver’s performance was probably influenced by symptoms associated with nicotine withdrawal, having not applied a nicotine patch on that day.

Attempts by safety-critical workers to stop smoking should be managed under medical supervision.

The investigation report notes that nicotine withdrawal symptoms typically become apparent within a few hours of last nicotine exposure, and that task-related effects can include difficulty concentrating, memory impairment and attention difficulties. These and other symptoms of nicotine withdrawal probably had an adverse effect on the performance of the driver.

Further, the driver of train 7750 also tested positive for an inactive metabolite of cannabis, with levels suggesting use within the previous seven days. However, it could not be determined whether cannabis use had affected the driver’s performance at the time of this incident.

“Nicotine withdrawal can affect a driver’s performance. To minimise adverse impacts, attempts by safety-critical workers to stop smoking should be managed under medical supervision,” said Chris McKeown, Chief Investigator, Transport Safety.

The report also notes that at the time of the incident, signalling at Marshall did not include any additional enforcement controls to protect against a train exceeding its authority.

Subsequent to the incident, V/Line installed a train protection system at Marshall to stop a train that has passed a signal at Danger. The system also has several over-speed sensors to prevent a train entering the Marshalltown Road level crossing when unprotected.

As part of other infrastructure projects, V/Line also continues with planning for the provision of three-position signalling for this section of track.

“This investigation highlights that rail operators should consider fitting authority-overrun intervention at locations, such as at Marshall, that present a heightened risk due to rail operations on a single, bidirectional track,” Mr McKeown said.

Read the final report: Signals passed at danger by train 7750, at Marshall, Victoria, on 2 January 2018

The fatal in-flight break-up of a Cicaré CH-7 helicopter highlights the importance of operating amateur-built helicopters within their design intent to avoid unintended stresses, and ensuring that any modifications are assessed for the effects on structural integrity and handling.  

On 28 July 2015, the pilot/owner of an amateur-built (kit-assembled) Cicaré CH-7BT helicopter, registration VH-JEW, departed Indee Station in Western Australia for Roy Hill Station for planned aerial mustering work the next day. When about 8.5 NM north-west of Roy Hill Station, the helicopter’s stabiliser assembly fractured and separated from the tail boom, leading to the separation of the mast and main rotor. The helicopter then collided with terrain, fatally injuring the pilot.

During the subsequent ATSB investigation, examination of the recovered components found that the stabiliser mount had fractured due to overstress following the propagation of a fatigue crack in the area adjacent the weld. The crack had likely to have been present for some time prior to the final fracture.

While the ATSB was unable to fully determine the reasons for the initiation and propagation of the fatigue crack, it was likely the result of some combination of the design, operating conditions, and untested accessories. The helicopter had been fitted with an external storage pod, likely without the appropriate engineering assessment to ensure that the pod would not have an adverse effect on the helicopter’s performance, handling and structure.

The ATSB also found that, although the CH-7B was intended for recreational use only, this and other CH-7B helicopters had been used for aerial mustering. Operating outside the manufacturer’s design intent had the potential to induce stresses on the aircraft, leading to premature wear of components and possible failure.

“Aerial mustering can involve extremely frequent manoeuvring and rapid power changes that can apply very high loads on a helicopter that may be quite different to the type of flying for which it was designed,” ATSB Director Transport Safety Dr Stuart Godley said.

“The ATSB is advising the Australian agricultural mustering community that the manufacturer, Cicaré S.A., has stated these helicopters are not intended or recommended for aerial work, particularly mustering operations.”

“The ATSB is also advising owners and operators of amateur-built helicopters that, operating within their stated design intent and limitations is essential for safe flight. This also includes the addition of unapproved modifications or external accessories.”

Dr Godley noted that mustering operations and the addition of unapproved modifications, outside the limitations prescribed by the manufacturer, can potentially produce unintended stresses on the airframe leading to the premature failure of components.

“A Safety Advisory Notice is currently being distributed to Cicaré helicopter owners highlighting the risks associated with operating amateur-built helicopters outside of their design intent.” 

Safety Advisory Notice AO-2015-089-SAN-014: Are you operating your amateur-built helicopter as designed?

Read the final report: In-flight break-up involving Cicaré S.A. CH-7BT helicopter, VH-JEW, near Roy Hill Station, Western Australia, on 28 July 2015

Why the driver of a suburban passenger train did not slow the train before it collided with the buffer stop at Richmond Station in Sydney’s northwest on 22 January 2018, resulting in injuries to 16 people, could not be conclusively determined, an investigation into the event notes.

The eight-car Waratah class passenger train (designated A42) collided with the buffer stop at the end of Richmond Station’s platform 2 at a speed of about 26 km/h.

A number of possibilities for the driver’s inaction were examined during the course of the investigation, which was conducted on behalf of the Australian Transport Safety Bureau (ATSB) by NSW’s Office Transport Safety Investigations (OTSI). These included: the driver blacking out; the driver experiencing a microsleep due to fatigue impairment; or the driver being distracted or inattentive.

The buffer stop withstood the impact of the collision and prevented the train from crossing onto a main road, the investigation found. But the investigation also concluded that the two hydro-pneumatic rams on the front of the buffer stop did not perform as designed, due to their non-alignment with the crash energy management system on the front of the Waratah train.

In addition, the crash energy management system on A42 did reduce the impact force of the collision, but not all components performed as designed.

Rail operators should ensure that multi-layered defences are in place against over-speeding.

“Rail operators should ensure that multi-layered defences are in place against over-speeding,” said Mick Quinn, OTSI CEO and chief investigator.

“This should include infrastructure design, rolling stock design and train crew health management. They need to ensure that identified risk controls are implemented, and that these control measures are effective in their performance.”

Mr Quinn said that if the driver’s cab had been fitted with an inward-facing camera, the footage may have provided investigators with an insight to why the driver was unresponsive leading up to the collision.

“Having audio and video recordings would allow investigators to eliminate, early in the investigation, potential contributory factors,” he said.

Since the accident, Sydney Trains has proactively addressed a number of safety issues, including redesigning the buffer stops for Platforms 1 and 2 at Richmond, while intermediate train stops, previously identified and recommended as a risk control, have been installed at Richmond.

However, the ATSB has issued a formal safety recommendation calling for Sydney Trains to take action to ensure that existing procedures regarding train crew rest breaks between shift cycles are adequate and start time rotations are reinforced to safeguard against fatigue impairment of train crews.

Finally, the report notes that automatic train protection, which if installed on A42 may have prevented the incident, was still being trialled at the time of the incident. Transport for New South Wales has scheduled automatic train protection to be operational on most Sydney Trains electric rolling stock by May 2021.

Read the report: Collision of Waratah passenger train A42 with buffer stop, at Richmond Station, New South Wales, on 22 January 2018

The flight crew of an AirAsia X Airbus A330 did not follow proper procedures when faced with an engine oil pressure warning, attempting to restart the affected engine even after it had failed, as well as electing to divert to Melbourne when the aircraft was considerably closer to two other airports.

The engine oil pressure warning and subsequent engine failure occurred during a 16 August 2016 scheduled flight from Sydney to Kuala Lumpur, with two flight crew, eight cabin crew and 234 passengers on board. While in cruise near Alice Springs the flight crew received an ‘Engine 2 oil low pressure’ failure alert message, which the ATSB’s subsequent investigation of the event established was due to a shaft failure in the engine’s oil pressure pump.

That alert required immediate crew action comprising of reducing thurst on the affected Rolls-Royce Trent 700 engine to idle and then, in accordance with the Airbus procedure, ‘if [the] warning persists’, shutting down the engine.

Procedures need to be designed with clarity

However, the flight crew probably misinterpreted the term ‘persists’ as requiring they wait a certain period of time to determine if the condition was persisting. As a result, they continued to troubleshoot the failure, rather than shut down the engine.

After monitoring the engine the flight crew formed the view that the warning was the result of a gauge failure. With the intent of further trouble shooting, the crew then increased the engine’s thrust. This led to the engine stalling and ultimately failing.

However, despite evidence to the contrary, the flight crew determined that the failed engine was not damaged and could be restarted. Consequently, and contrary to the operator’s procedures, the flight crew made two attempts to restart the failed engine, even though there was no safety risk to the aircraft that demanded a restart attempt. Both attempts failed.

Also contrary to the operator’s procedures, the flight crew elected to divert to Melbourne following the engine failure, rather than to closer suitable airports in Alice Springs and Adelaide. Although twin-engined airliners such as the A330 are designed to fly safely on a single engine, this decision increased the time that the aircraft was operating in an elevated risk environment of single-engine operations.

“There are three key safety messages from this investigation,” noted ATSB Director Transport Safety Dr Stuart Godley.

“Not only does this occurrence demonstrate the importance of flight crews adhering to standard operating procedures when responding to aircraft system alerts, it also highlights that those procedures need to be designed with clarity,” Dr Godley said.

“Further, the investigation report identifies that where there is not a need for an immediate response, that flight crews look at the full contextural and available information before deciding on a plan of action.”

Since the incident, AirAsia X restated the operational requirements for flight crews for engine restarts and diversion decision making. Further, the airline has also used the occurrence as the basis for a training package for responding to engine failures, restarting failed engines, and diversion decision making.

Read the final report: Engine failure involving Airbus A330, 9M-XXD, 445 km south-east of Alice Springs, South Australia, on 16 August 2016

A Fokker F100 airliner inadvertently returned to service with a lock-out bolt installed, rendering one of its two engine thrust reversers inoperative.

An incorrect type of lock-out bolt used during maintenance the previous day meant that when the captain selected reverse thrust on landing at Karratha on a 27 December 2017 flight from Perth, the right engine thrust reverser did not activate. The aircraft was able to decelerate using normal braking and taxied to the gate without further incident.

An ATSB investigation found that during a maintenance task to inspect the aircraft engines’ emergency fuel shut-off cables, to safely isolate the thrust reverser mechanism a maintenance engineer installed the incorrect lock-out bolt, and then did not remove it after the maintenance was completed.

The investigation found that the engineer used the more conveniently located in-service lockout bolt from the aircraft’s flight deck for the task, instead of the appropriate maintenance lockout bolt, which is fitted with a large red warning flag, and had to be checked out of the tool store. As a consequence, the lock-out bolt did not show as missing during a tooling inventory check as the aircraft was released to service.

Further, there were no warning labels in the cockpit to warn the flight crew that the bolt may be installed.

“This investigation highlights the risks of varying from procedures when performing maintenance tasks,” ATSB Director Transport Stuart Macleod said.

“It is important that, in all parts of the maintenance system, there is an awareness of human factors associated with completion of the task. An understanding of the demands associated with a task may help identify informal work practices that can then be aligned with the formal procedures.”

In response to this incident, the maintenance organisation has highlighted to maintenance staff the importance of following the safety instructions and warnings contained in the aircraft maintenance manual. Further, the maintenance organisation has reinforced procedures for maintenance activities – including task assessments, tooling, and task procedures.

Over the past three years, the ATSB has now investigated three separate incidents where maintenance engineers have inadvertently left lockout bolts installed in passenger aircraft engines after maintenance. The other two incidents, investigations AO-2018-064 and AO-2017-117, involved maintenance providers in Brisbane and Adelaide, respectively.

Read the report: Undetected engine thrust reverser deactivation involving Fokker F100, VH-NHA, Karratha Airport, Western Australia, on 27 December 2017

The ATSB is strongly encouraging pilots of experimental powered gliders to install fire protection between the engine compartment and cockpit following its investigation into a fatal accident where a modified jet-powered glider was destroyed by fire.

The call follows the ATSB’s investigation into a 21 January 2018 accident where a Schleicher ASH-25E glider which had been retrofitted with two small gas turbine engines caught fire not long after being launched from the Bathurst Gliding Club’s Piper’s Field airfield in central west NSW.

The experienced pilot had planned to conduct a solo cross-country flight, and eight minutes into the flight, the glider had climbed to about 2,200 feet in a thermal. Shortly after, the glider abruptly started to descend and track back towards the airfield, and witnesses reported seeing smoke or liquid trailing from behind the glider’s cockpit.

At about 1,100 feet, the pilot jettisoned the front-seat canopy but did not exit the glider, possibly due to incapacitation. Fire engulfed more of the rapidly descending glider’s fuselage before it collided with the ground in a nose-down attitude. The pilot was fatally injured, and the aircraft was destroyed.

The ATSB strongly encourages pilots of powered experimental gliders to install fire protection.

Due to the severity of the post-impact fire, the ATSB investigation could not determine the ignition source, but did establish that the glider’s cockpit and engine housing were not separated by a firewall.

“Pilots of powered experimental gliders are strongly encouraged to install fire protection between their aircraft cockpit and the engine housing,” said ATSB Director Transport Safety Stuart Macleod.

“The ability to exit a glider relies on avoiding incapacitation that can happen quickly in the event of in-flight fires.”

The accident glider had originally been fitted with a small Rotax piston engine driving a propeller mounted on a retractable pylon that allowed the glider to undertake self-sustaining flight (that is, maintaining level flight or initiating a climb, but not for launching). In 2010, the pilot had removed the original engine and propeller, replacing them with two small Titan AMT gas turbine engines for self-sustaining flight, with two 25-litre collapsible fuel cells installed into the wing root.

Once fitted with the jet engines, the glider was flown under an experimental type certificate. The Gliding Federation of Australia’s Manual of Standard Procedures states that flying experimental category gliders “is entirely on the basis of voluntary acceptance of risk by the persons who elect to do so".

Following the accident, the Gliding Federation of Australia published an Airworthiness Directive and an Airworthiness Advice Notice, both entitled Engine Compartment Fire Containment and Retardation, which provide guidance regarding fire safety.

The Airworthiness Directive requires all powered glider operators to inspect and repair fire retardant paint, fit ‘in case of engine fire’ cockpit placards and ensure there is no flammable material on the cockpit side of any firewalls.

Read the final report: Collision with terrain involving experimental ASH-25E glider, VH-GOA, 13 km west-north-west of Bathurst, New South Wales, on 21 January 2018

The flight crew of an Airbus A320 received a landing gear not down master warning while on approach to land at Ballina Byron Gateway Airport, New South Wales, due to an incorrect aircraft configuration following a go-around, a new ATSB investigation report details.

During the 18 May 2018 flight from Sydney, the A320 was conducting a visual approach to land on runway 24, with the first officer manually flying the aircraft. Manoeuvring to join the circuit on a left base, the captain recognised that the aircraft’s airspeed and altitude were both higher than a normal approach profile. However, due to circuit traffic, the captain elected to have the aircraft established on final approach before commanding a go-around.

The ATSB established that the flight crew did not follow their operator’s standard procedures during the go-around and subsequent visual circuit at 1,500 ft. In particular, the flaps remained at Flaps 3 rather than Flaps 1 during the circuit. This created a series of distractions leading to a non-standard aircraft configuration for a visual circuit. Limited use of available aircraft automation added to the flight crew’s workload.

Following standard procedures mitigates the risk of the selection of inappropriate auto-flight modes, unexpected developments, or confusion about roles or procedures can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.

During the downwind leg following the go-around, the flight crew did not select the landing gear down as they had commenced the configuration sequence for landing at the Flaps 3 setting. Furthermore, the flight crew incorrectly actioned the landing checklist, which prevented the incorrect configuration for landing being identified and corrected, the investigation established.

Consequently, on the second approach, at about 700 ft, a master warning was triggered because the landing gear had not been selected down. The flight crew then conducted a second go-around and landed without further incident on their third approach.

“This occurrence highlights the importance of adherence to standard operating procedures and correctly monitoring the aircraft’s approach and parameters to provide assurance a visual approach can be safely completed,” ATSB Director Transport Safety Director Dr Stuart Godley said.

“Following standard procedures mitigates the risk of the selection of inappropriate auto-flight modes, unexpected developments, or confusion about roles or procedures that can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.

The ATSB report notes that an incorrect aircraft configuration for landing is rarely the result of a single action or identifiable event.

“In this case a number of factors, such as distraction and limited use of aircraft automation, combined to result in the landing gear not being selected to down,” Dr Godley said.

“While highly undesirable, it should be noted that the aircraft’s warning system effectively alerted the flight crew to the problem and the crew responded promptly to the warning and initiated a second go-around.”

Dr Godley said the incident reinforced how unexpected events during approach and landing phases can substantially increase what is already a high flight crew workload.

Read the final report: Incorrect configuration for landing involving Airbus A320, VH-VQK, Ballina/Byron Gateway Airport, New South Wales, on 18 May 2018

A loss of separation between two Boeing 737s on reciprocal tracks demonstrates the importance of communication and coordination between air traffic controllers operating in separate, yet adjacent airspace, as well as the need for a clear understanding of the responsibility for separation assurance when operating without a shared traffic picture.

These are the key safety messages from the ATSB’s final investigation report into the 11 October 2018 incident, where a Qantas 737-800, registration VH-VZD, was on descent to Brisbane Airport through military-controlled airspace near Amberley Air Force Base, while a Virgin Australia 737-800, VH-YFW, which had departed Brisbane Airport, was approaching Amberley airspace on a reciprocal track. (Airservices Australia, which operates Australia’s civil air traffic management system, and the Royal Australian Air Force, which is responsible for controlling military airspace, such as around major air bases, currently operate separate air traffic management systems at Brisbane and Amberley. As a result, in this scenario traffic information had to be shared manually.)  

Due to thunderstorms in the area, the Virgin aircraft was flying air traffic control (ATC)-assigned radar headings, rather than using a procedural standard instrument departure. As the Virgin aircraft approached Amberley airspace, the Brisbane departures controller (operating from Airservices’ Brisbane terminal control unit at Brisbane Airport) provided an identification of the Virgin aircraft to the Amberley approach controller, who advised that there was an aircraft on an inbound air route. Brisbane replied that the Virgin aircraft would soon be turning right, and thus would avoid Amberley airspace; however when advised to turn right, the crew of the Virgin aircraft replied that due to the weather they wished to continue on their current heading for another 70 or 80 nautical miles.

It was around this time that the Virgin aircraft entered Amberley airspace without a hand‑off from Brisbane ATC and without instructions to the crew to change to Amberley frequency. Prior to this, the Brisbane terminal control unit had not advised Amberley ATC of a changed terminal control unit configuration. This delayed Amberley ATC in being able to contact the correct controller position at the Brisbane terminal control unit to inform them of the inbound aircraft, thus reducing the opportunity for Amberley ATC to resolve the impending conflict.

Once appropriate communication between Amberley and Brisbane ATC was established, the Virgin aircraft was transferred to the Amberley frequency, and the two aircraft were diverted away from each other.

The successful recovery of separation illustrates the effectiveness of the conflict resolution training received by air traffic controllers in loss of separation events.

The ATSB's investigation found the aircraft had incurred a vertical and lateral loss of separation with a minimum-recorded distance between the aircraft of 2.1 nautical miles horizontally and 650 feet vertically, respectively, where the required separation was 3 nautical miles horizontally or 1,000 feet vertically. (Both aircraft were fitted with traffic collision avoidance systems which would have assisted in providing separation instructions to their flight crews in the event ATC were unable to resolve the situation.)

“This investigation highlights the importance of clear communication and coordination between air traffic controllers operating in different, yet immediately adjacent airspace, and the need for a clear understanding of the responsibility for separation assurance, especially when operating without a shared traffic picture,” ATSB Director Transport Safety Dr Stuart Godley said.

As a result of the incident, both Brisbane and Amberley ATC have taken a number of steps to improve communication between their two systems.

“The ATSB welcomes the new dedicated communications pathway between the Amberley approach and Brisbane departures south positions, and the implementation of an airspace release that controls the risk that short notice deviations present across the two non-linked systems.”

Dr Godley also said the successful recovery of separation illustrates the effectiveness of the conflict resolution training received by air traffic controllers in loss of separation events.

Read the final report: Loss of separation involving Boeing 737 aircraft, VH-YFW and VH-VZD, near Amberley, Queensland, on 11 October 2018