Key points:

• Fatigue was likely exacerbated by mild hypoxia, contributing to the pilot falling asleep;
• Pilots need to monitor their health and wellbeing to ensure they are well rested before flight;
• Continuous use of supplemental oxygen is required when flying above 10,000 ft in unpressurised aircraft.

A pilot who overflew their destination and was unresponsive to air traffic control calls for 40 minutes had fallen asleep due to fatigue likely exacerbated by mild hypoxia from the intermittent use of supplemental oxygen, a new ATSB investigation has found.

The pilot was conducting a ferry flight of a Cessna 208B Caravan aircraft from Cairns, Queensland to Redcliffe on the afternoon of 2 July 2020. While cruising at 10,000 feet the pilot encountered unforecast icing conditions and poor visibility due to cloud and climbed to 11,000 feet and began using the aircraft’s supplemental oxygen system intermittently. (Pilots are required to continuously use supplemental oxygen when flying unpressurised aircraft, such as the Caravan, when flying above 10,000 feet.)

When the aircraft was about 53 km west-north-west of Sunshine Coast Airport, air traffic control (ATC) unsuccessfully attempted to contact the pilot regarding their planned descent into Redcliffe, the investigation notes.

Following repeated calls to the pilot, ATC enlisted the assistance of pilots in nearby aircraft to contact the Caravan pilot, who was seen to overfly Redcliffe and track towards Brisbane.

The pilot of a Royal Flying Doctor Service Beechcraft B200 King Air aircraft departing Brisbane was asked by ATC to intercept and contact the Caravan pilot, but their initial efforts were unsuccessful. The King Air pilot then dipped their wings and approached the Cessna in an attempt to trigger its traffic alert and collision system (TCAS), but the pilot remained unresponsive.

At 5:35 pm, after 40 minutes without contact and when the aircraft was about 111 km south-south-east of the intended destination, the pilot woke and ATC communications were re-established. The pilot was then instructed to land at Gold Coast Airport, where the aircraft landed safely just after 6pm.

“The ATSB found that the pilot was likely experiencing a level of fatigue due to inadequate sleep the night before and leading up to the incident,” ATSB Acting Transport Safety Director, Kerri Hughes, said.

“Further, operating at 11,000 feet with intermittent use of supplemental oxygen likely resulted in the pilot experiencing mild hypoxia. This likely exacerbated the pilot’s existing fatigue and contributed to the pilot falling asleep.”

Ms Hughes said most people generally underestimate their level of fatigue and tend to overestimate their abilities.

“This incident emphasises the importance of pilots monitoring their own health and wellbeing, to ensure that they are well-rested and adequately nourished, especially when conducting single pilot operations.”

Ms Hughes said the investigation carefully considered the role of hypoxia in the incident.

“Although a common symptom of hypoxia is loss of consciousness, it is not typical for someone experiencing hypoxia to regain consciousness, while still operating at the same altitude and without additional oxygen,” she said.

“Therefore, from the information obtained by a medical specialist engaged by the ATSB and from studies conducted on mild hypoxia at moderate altitudes, the ATSB determined that it was unlikely that the pilot had lost consciousness solely due to mild hypoxia.

“Rather, the pilot had fallen asleep likely due to a combination of fatigue and mild hypoxia, possibly exacerbated by dehydration and diet.”

Read the final report: Pilot incapacitation involving Cessna 208B, VH-DQP, near Brisbane Airport, Queensland, on 2 July 2020

Key points

• It was likely the pilot suffered an incapacitating medical event.
• Pilot unintentionally diverted off track, leading to the bucket becoming tangled in the trees and causing the helicopter to collide with terrain.
• Some medical conditions may be undetectable by the normal aviation medical screening process
• Pilots should remain vigilant for symptoms which may be the precursor to a more serious medical event.

An investigation by the Australian Transport Safety Bureau (ATSB) has found the pilot of a fire-bombing helicopter likely suffered an incapacitating medical event while repeatedly water bombing a fire near Ulladulla, New South Wales on the afternoon of 17 August 2018.

The pilot of a Kawasaki Heavy Industries BK117 helicopter, registered VH-JWB, had just filled its slung Bambi Bucket without incident from a dam and departed on a fifth fire-bombing circuit. Shortly after, the helicopter diverted off course contrary to the established flight pattern of the Woodburn fire. The bucket and longline then became caught in trees at the edge of a clearing, causing the helicopter to collide with terrain before coming to rest inverted. The pilot was fatally injured and the helicopter was destroyed.

None of the ground or airborne crews heard any radio transmissions from the helicopter immediately before the accident (during water bombing operations it is standard practice to make a radio call when leaving the circuit for any reason, to inform other airborne assets of the helicopter’s tracking). In the minutes prior to the accident, the pilot responded normally to a NSW Rural Fire Service Air Attack co-ordinator conducting an ‘operations normal’ radio call and did not report any difficulties at that time.

During the investigation, ATSB Transport Safety Investigators did not identify any pre-existing defects with the helicopter that may have contributed to the accident.

“The pilot’s post-mortem identified a focus of acute inflammatory change in the heart muscle, a condition known as lymphocytic myocarditis,” Director Transport Safety, Stuart Macleod said. “This condition is capable of causing sudden impairment or complete incapacitation. The pilot is unlikely to have known they suffered from this condition. There are no risk factors for the development of this condition and it cannot be detected by medical screening.”

The pilot’s post-mortem identified coronary heart disease which is also capable of causing sudden impairment and incapacitation. However, despite the pilot suffering from these two heart-related conditions, there was insufficient evidence to determine if they contributed to the accident.

“Pilots are reminded that some medical conditions may be undetectable by the normal aviation medical screening process and should remain vigilant for any medical symptoms which may be the precursor to a more serious medical event,” Macleod said.

The experienced pilot, with a total flying experience of approximately 7,750 hours (approximately 1,300 hours experience operating the BK117 and in excess of 3,000 hours of longline experience) was known to use an over-the-counter medication for the treatment of hay fever. Although labelled as non-sedating, this medication was not approved by the Civil Aviation Safety Authority for use while conducting flying operations.

“The pilot was known to have been taking this medication for some time, so any adverse effects on the day of the accident were considered unlikely,” Macleod said.

“However, pilots should also exercise caution when using over-the-counter medications as their availability does not mean they are automatically safe for use while conducting aviation activities.”

Due to the inverted nature of the accident and resulting vertical compression of the fuselage, the accident was not considered survivable. However, evidence from the first responders showed the upper torso restraint (UTR) was worn incorrectly at the time of the accident.

“Although on this occasion the accident was unsurvivable, the use of such a shoulder harness restraint generally reduces the likelihood of fatal head injuries,” Macleod said.

“Pilots are reminded to always use UTRs if they are fitted to the aircraft.”

Read the final report: Collision with terrain involving BK117 helicopter, VH-JWB, near Ulladulla, New South Wales, on 17 August 2018

A track worker who heard the whistle of an approaching passenger train and had to remove themselves from the danger zone was placed at risk of being struck by the train due to an unapproved safeworking practice, a new transport safety investigation details.

The track worker was an outer hand signaller helping to implement a Track Work Authority for repairs and maintenance work on the Dora Creek rail bridge, on the main north rail line between Sydney and Newcastle, on 9 May 2020.

As the outer hand signaller prepared to remove a railway track signal (RTS) from the rail line, they heard a train whistle and moved off the line to safety. The train, NSW TrainLink passenger service 283D from Newcastle to Sydney, ran over the RTS (a small device attached to a rail that explodes on impact, designed to attract the attention of train drivers) in response to which the driver applied the emergency brakes. The train came to a stand around 60 metres past the track worker.

The investigation into the incident, undertaken by the Office of Transport Safety Investigations (OTSI), which conducts rail safety investigations in NSW on behalf of the ATSB, found that in applying the Track Work Authority for the worksite, an unapproved practice was implemented. That practice, which was intended to improve train operations, involved the Protection Officer instructing workers to remove the railway track signals used to protect the worksite while trains were closely approaching. This was intended to let the train run unimpeded, but this action placed the outer hand signaller at risk of being struck by the train.

“If protection is removed to allow trains to run unimpeded, then effectively there is no Track Work Authority in place, and this practice put the hand signaller at risk as there was no defined process or method for protecting this worker,” said OTSI Chief Investigator and CEO Dr Natalie Pelham.

“This practice was not part of Sydney Trains’ recognised methodology for using a Track Work Authority.”

Sydney Trains has since committed to amend its Network Rules to reinforce an existing requirement where both the inner and outer protection must be replaced immediately after the passage of each rail traffic movement.

“Network rules and procedures for safeworking on railways have been developed to give direction and instruction to workers in how to safely manage work on track,” said Dr Pelham.

“When practices develop that deviate from the established procedures, care needs to be taken to ensure these practices do not introduce unintended risk.

“Rail safeworking practices should only be implemented as approved by the rail infrastructure manager.”

Read the final report: Near hit with rail worker by passenger train 283D, Dora Creek, New South Wales, on 9 May 2020

Key points:

• Ship was conducting a 3,300 NM passage returning to Hobart on charter to the Australian Antarctic Division;
• Large flames were seen erupting from open louvres of the port engine room’s exhaust casing above deck;
• On-going investigation will examine the origin of the fire and the operation of the ship’s fuel oil transfer system.

The Australian Transport Safety Bureau (ATSB) has released a preliminary report from its ongoing investigation into a fire on board the MPV Everest multirole vessel while on charter to the Australian Antarctic Division.

The report outlines basic factual information including the fire’s sequence of events as established as part of the investigation’s initial evidence collection phase, and does not detail any safety findings or analysis.

On the morning of 5 April, MPV Everest was about 1,075 NM north-east of Mawson station in the Southern Ocean on a north-north-easterly course bound for Hobart, with a crew of 37 and 72 expedition staff on board, the preliminary report details.

The ship was making good 11 knots, with power for propulsion being provided by three of the ship’s six engines – numbers 2 and 3 in the port engine room and number 6 in the starboard (the ship’s two engine rooms each contained two 5,760 kW and one 1,920 kW marine diesel engines).

Shortly before 1100, the ship’s master saw large flames erupting from open louvres in the port engine room’s exhaust casing. In response the master raised the alarm and instructed crew and expedition staff to report to their emergency muster positions.

The preliminary report details subsequent events on board the ship, including the mustering of the crew and expeditioners, the firefighting response, the shutting down of the ship’s port engine room and machinery, the ship’s loss of power, and the subsequent confirmation of the fire’s extinguishment.

Passage resumed at about 1820 after propulsion was restored with two engines in the starboard engine room (with the port engine room and machinery unusable). There were no injuries to anyone on board.

The following day, the ship’s master diverted MPV Everest to Fremantle, where it arrived on 13 April.

The preliminary report notes that during initial inspections of the fire-damaged engine room, the crew observed fuel oil dripping down into it from within the exhaust vent casing above.

Recorded data from the ship’s integrated automation system (IAS) showed a routine transfer to top-up the fuel oil settling tank in the port engine room was started at about 0925 on the morning of the fire, the report details. That data indicates that this tank probably overflowed sometime after 1030. The port fuel oil settling tank’s air vent pipes terminate inside the port engine exhaust casing.

“The ATSB’s investigation will continue to examine the origin and cause of the fire and its development, and the operation of the ship’s fuel oil transfer system, including pumps, piping, alarms and automation,” said ATSB Chief Commissioner Greg Hood.

“Other areas of investigation include the performance of the ship’s firefighting equipment, the effectiveness of the ship’s emergency response, and the efficacy of shipboard communication systems.”

Investigators will also continue to analyse recorded data, including from the ship’s integrated automation system and CCTV, and consider relevant human factors.

Mr Hood noted the preliminary report does not include any safety findings or analysis, which will be detailed in the investigation’s final report to  be released at the conclusion of the investigation.

“However, should a critical safety issue be identified at any stage during the investigation, the ATSB will immediately notify relevant parties so appropriate and timely safety action can be taken,” he stated.

Read the preliminary report: Engine room fire on board MPV Everest, Southern Ocean, on 5 April 2021

Australian Transport Safety Bureau Chief Commissioner Greg Hood has handed over the gavel as the chair of the International Transportation Safety Association (ITSA) after completing an unprecedented two-year term presiding over the international network of the heads of 18 independent transport safety investigation authorities.

During the conclusion of a two-day virtual annual meeting of ITSA member heads this week, Mr Hood officially transitioned the position of ITSA chair to Dr Veli-Pekka Nurmi, Executive Director and Professor at the Safety Investigation Authority Finland.

“Being chair of ITSA for two consecutive years – a first in the association’s history – was a great responsibility and privilege, particularly at a time when the world has been navigating the COVID-19 pandemic and when safe and efficient transport networks were needed like never before,” Mr Hood said.

“I wish Dr Nurmi all the very best as the incoming chair of ITSA for the next 12 months. I would also like to thank all ITSA members for their support during my tenure, and for their well wishes ahead of my retirement next month.”

The mission of ITSA is to improve transport safety in each member country by learning from the experiences of others. The case studies from member countries shared during this week’s annual conference covered a wide range of aviation, rail, marine and infrastructure incidents and accidents, and amplified their findings and safety messaging.

“The use of high fidelity animations to clearly demonstrate ‘what happened’ during an accident sequence and to help influence change by highlighting an investigation’s safety messaging has become more prevalent over recent years in a number of countries, including Australia,” Mr Hood noted.

“Using this form of visual media to help share safety learnings is proving to be very valuable, and will no doubt evolve further in the coming years.”

While international travel restrictions deferred the regular in-person ITSA annual meeting for two years in a row, Mr Hood hopes the ATSB will one day host ITSA members in Australia.

“Due to COVID-19, the ITSA 2020 and 2021 conferences intended to held in Sydney evolved into a virtual experience, which proved to be a valuable platform for sharing safety information and pursuing best practices in independent “no blame” transport safety investigations,” Mr Hood said.

“No doubt, the ITSA conference will have another opportunity to head down under in the future, which will not only afford members the opportunity to witness Australia’s transport safety environment first-hand, but will also allow for many members to experience the beauty of Australia for the first time.”

A fire on board a bulk carrier that took five days to contain and extinguish highlights the lack of adequate regulatory requirements and standards to address the known risk of fire on-board self-unloading ships, an ATSB investigation has found.

The 202 metre, Australian flagged self-unloading bulk carrier Iron Chieftain was discharging its cargo of dolomite at Port Kembla, New South Wales in the early hours of 18 June 2018 when friction, probably from a failed bearing, generated enough heat to ignite a rubber conveyor belt in the C-Loop internal cargo handling space. (Self-unloading bulk carriers are equipped with a series of conveyor belt systems and spaces that enable cargo to be unloaded without requiring shore-based equipment.)

During a regular safety round of the self-unloading system during cargo discharge operations, a crew member detected a strange smell and white smoke that abruptly changed to black as the crew member approached the deck casing door for the C-loop space.

The ship’s crew then initiated an emergency response but shipboard efforts to control the fire proved ineffective, with the fire soon establishing itself and spreading to the exterior of the ship, setting the discharge boom alight. The ship’s crew were eventually evacuated and Fire and Rescue New South Wales (FRNSW) firefighters took charge of the response to the fire. The fire was contained and eventually extinguished about five days later.

The fire caused substantial structural damage including breaches of two fuel oil tanks, and much of the self-unloading system was destroyed. The ship was subsequently deemed uneconomic to repair and declared a constructive total loss before it was towed to Turkey for recycling. However, there were no serious injuries or marine pollution reported as a result of the fire.

“The fire on board Iron Chieftain demonstrates how the effectiveness of a shipboard response to a fire depends primarily on the ability to detect the fire at an early stage and quickly extinguish it at the source,” said ATSB Chief Commissioner Greg Hood.

“Iron Chieftain’s self-unloading system was not equipped with a fire detection or fixed fire-extinguishing system in the C-Loop space, but nor was it required to be.

“This highlights the lack of adequate international standards or regulations for dedicated fire detection and fixed fire extinguishing systems in cargo handling spaces of self-unloading bulk carriers.” 

The ATSB’s investigation report also notes that the initial emergency response by the crew, in particular stopping the conveyor belts, aided the fire’s early development as heat could not dissipate.

“Following ignition, the combination of high fuel loads in the form of rubber conveyor belts in the C-Loop space and airflow from the vertical design of the loop and its ventilation fans, meant the fire quickly established itself and travelled along the C-Loop’s rubber conveyor belt system to the ship’s exterior to the deck discharge boom and set it alight,” said Mr Hood.

In addition, heat from the fire in the C-Loop space caused thermal stress, cracking and deformation to the adjacent heavy fuel oil tanks, releasing additional fuel for the fire and increasing its intensity and complexity.

“The ATSB recommends the introduction and improvement of international standards for suitable fire detection and fixed fire-extinguishing systems in the cargo handling spaces of self-unloading bulk carriers and the introduction of standards for the fire resistant properties of their conveyor belts,” said Mr Hood.

“The absence of these measures has been a contributing factor in at least three major shipboard fires over a 25‑year period, including Iron Chieftain.”

Mr Hood said the ATSB welcomes the commitment by the Australian Maritime Safety Authority (AMSA) and Lloyd’s Register to approach the International Maritime Organization (IMO) and the International Association of Classification Societies (IACS) respectively, to highlight the safety issue regarding the inadequacy of fire safety standards or regulations for self-unloading system spaces.

“Nonetheless, the ATSB is recommending that AMSA formally raise the safety issue with the IMO to initiate safety action aimed at addressing the risk of fire in the cargo handling spaces of self-unloading bulk carriers due to the inadequacy of the current associated standards and regulations,” he said.

Separately, the investigation notes that while the operators of Iron Chieftain had identified the fire risk in the ship’s cargo handling space due to the lack of fire detection and fixed extinguishing systems, particularly in the C-Loop space, about five years earlier, the prevention and recovery measures it put in place were not sufficient to mitigate the risk.

In response to the Iron Chieftain fire, the operator’s parent company, the CSL Group, initiated a fire risk mitigation project across its global fleet of self-unloading bulk carriers to improve fire detection and suppression technology, reviewing its firefighting policy and setting minimum fire safety standards for early fire detection and suppression at the ship design and build stage.

Finally, the ATSB also identified a safety issue relating to Fire and Rescue New South Wales’s marine firefighting capability as well as other safety factors related to the inconsistent conduct of ship’s drills and Port Kembla’s emergency response plans.

Read the report: Fire on board Iron Chieftain, Port Kembla, New South Wales, on 18 June 2018

Key points:

• Student pilot initiated a low-level go-around;
• Aircraft deviated from the runway centreline, stalled and commenced a spin, before impacting the ground;
• Student pilot had very limited experience in the Bristell aircraft type;
• Flying school’s flight dispatch procedures were not followed.

The student pilot of a Bristell aircraft that stalled and commenced a spin before colliding with the ground was not authorised to conduct the flight and did not have the necessary qualifications and skills to safely operate the aircraft, an ATSB investigation has found.

The student pilot had departed Melbourne’s Moorabbin Airport on the morning of 12 December 2019 to conduct a series of circuits in the Bristell in what was their first solo flight in the aircraft type.

Just after crossing the runway threshold for the first touch-and-go landing, witnesses observed the aircraft suddenly pitch up. The left wing then dropped, bank angle increased to the point where the aircraft became inverted, and the aircraft entered the first half rotation of a spin entry. The aircraft’s nose then dropped before it impacted the ground adjacent to a taxiway in a steep inverted attitude.

The student pilot was severely injured in the accident, and the aircraft was substantially damaged.

The ATSB’s investigation found that the pilot commenced a go‑around at low level when the aircraft deviated from the runway centreline in a crosswind (the crosswind component was subsequently calculated to be about 13 kt, within aircraft performance limitations).

During the go‑around, the aircraft aerodynamically stalled and commenced a spin.

“The ATSB identified that the student pilot did not have the necessary qualifications and skills to safely operate the Bristell aircraft solo,” said ATSB Director Transport Safety Stuart Macleod.

“The student had undertaken only one supervised training flight in the Bristell, and that flight, which was curtailed due to deteriorating weather conditions, did not include any go-arounds, crosswind landings or stall training.

“Consequently, the student pilot’s familiarity with the Bristell was very limited.”

All the student’s previous flying had been undertaken in the Aeropakt A-32 Vixxen, a lower-performance aircraft with a different configuration and handling characteristics compared to the Bristell.

“The Bristell exhibits different handling characteristics to the other aircraft type the student pilot had previously operated,” said Mr Macleod.

“Specifically, instructors reported that the Bristell is less docile and has a stronger tendency to pitch up when engine power is applied for a go-around.

“Instructors also reported that the Bristell has less elevator authority to counter the nose-up effect and a greater tendency to drop a wing during a stall.”

Even though the student pilot believed they were instructed, and authorised, to conduct a solo flight in the Bristell, the ATSB found that the student pilot did not follow the operator’s solo flight dispatch procedures, including not endorsing the aircraft’s maintenance release, and not undertaking the required solo flight briefing and sign out procedure with a flight instructor.

“Familiarity with an aircraft’s specific systems, controls, handling and limitations is essential for safe flight,” said Mr Macleod.

“That is why safety-critical procedures and regulations are in place to ensure that pilots have the required level of skill and experience to safely operate an aircraft.

“The outcome of this accident, which could just as easily have been fatal, illustrates the potential consequences of deviating from safety-critical procedures and regulations.”

Subsequent to the accident, the flying school operator, Soar Aviation, advised the ATSB that they had revised procedures to ensure an aircraft could not be taken by a student for a solo flight, either deliberately or inadvertently.

The flying school ceased operations in December 2020.

Read the final report: Loss of control and collision with terrain involving BRM Aero Bristell S-LSA aircraft, VH-YVF, Moorabbin Airport, Victoria, on 12 December 2019

Key points:

• Two separate landing gear failures during beach landings involved the same aircraft;
• Maintenance inspections probably would have detected faults that led to the failures;
• Investigation highlights that operators should consider additional inspections when operating aircraft in challenging conditions, in addition to ensuring they are conducting the required inspections in accordance with the manufacturer’s maintenance schedule.

Two separate right main landing gear failures involving the same Gippsland Aeronautics GA8 Airvan during beach landings on Fraser Island, Queensland highlight the need to not only conduct required inspections in line with the manufacturer’s maintenance schedule, but that operators consider additional inspections when routinely operating aircraft in challenging conditions.

In both instances – a right main landing gear collapse on 24 August 2019 and a right main wheel and axle separation on 31 October 2019 – it is probable that the faults that led to the failures were detectable during recent maintenance activity on the aircraft, an ATSB investigation found. Neither incident resulted in injuries. 

In the August 2019 incident the right main landing gear collapsed when a number of the eight mounting bolts securing the landing gear loosened and wound out, placing excessive loads on the remaining bolts causing them to eventually shear and the landing gear leg to collapse. 

Although the unsecured bolts would have been apparent during one or more periodic inspections, the investigation found recent maintenance had not detected any problems.

The 31 October landing gear failure occurred when, during the landing roll, the right main wheel and axle separated from the landing gear at slow speed. The ATSB’s investigation noted that surface contamination and corrosion in the axle inspection area indicated that the required pre-inspection cleaning had not been conducted for an extended period, decreasing the likelihood of any visual identification of cracking.

An inspection 27 flight hours before the second occurrence did not detect fatigue cracking at the main landing gear axle attach sleeve that led to the axle failure.

Further, the required axle magnetic partial inspection was about 470 flight hours overdue at the time of the axle failure.

“The operator’s aircraft experienced increased loads on the landing gear in operating from beach landing areas on Fraser Island as frequently as 20–30 times a day,” ATSB Director Transport Safety Dr Mike Walker said.

“In this challenging salt-laden and humid environment, the ATSB concluded that the operator did not place appropriate emphasis on ensuring the continuing airworthiness of the landing gear of its GA8 Airvan aircraft fleet.”

Following the two incidents, the operator, Air Fraser Island, appointed a new head of aircraft airworthiness and maintenance control, employed a quality assurance officer to audit its maintenance system, and made changes to the personnel conducting maintenance on its aircraft.

“Operators routinely conducting operations to beach landing areas should ensure that they are conducting the required inspections in accordance with the manufacturer’s maintenance schedule and procedures as a minimum standard," Dr Walker said.

“They should also consider improved and additional inspections when frequently operating aircraft in challenging conditions.”

Read the final report: Landing gear failures involving a GA8 Airvan, VH-BFS, Fraser Island, Queensland, on 24 August 2019 and 31 October 2019

The flight crew of a Boeing 767 freighter did not consult the minimum equipment list (MEL) and continued their departure from Auckland Airport on a scheduled service to Sydney following a fuel configuration advisory alert message as the aircraft approached the departure runway, an ATSB investigation found.  

The flight crew, consisting of the captain as pilot monitoring and the first officer as pilot flying, commenced duty at about 9:30 am on 27 July 2017 for a 11:45 am departure. After completion of engine start at 11:40 am, the fuel panel was correctly configured with fuel distributed as 6.6 t and 6.5 t in the left and right main tanks and 7.9 t in the main centre tank.

While taxiing for departure, an imbalance developed in the fuel load between the left and right main tanks while the centre tank was providing fuel to both engines, triggering a fuel configuration EICAS (Engine Indication and Crew Alerting System) advisory alert message just after completion of departure procedures and receipt of clearance to enter the runway.

After determining a fuel leak was not the cause of the imbalance and confirming that the fuel panel was correctly configured the flight crew began the non-normal checklist and decided to continue with the departure and address the fuel imbalance condition in-flight.

Early in the climb the first officer identified the fuel imbalance was the result of abnormal operation of the fuel system, resulting in fuel from the centre tank being distributed to the right tank. Not wanting to trigger another advisory alert the crew decided to delay the fuel rebalancing until the centre tank was empty.

The crew completed the fuel configuration non-normal checklist about 30 minutes after departure, during which time the fuel imbalanced increased past the operator’s fuel imbalance limit. The left and right fuel tanks were successfully re-balanced and remained in balance for the rest of the flight.

On arrival in Sydney, the crew verbally reported the abnormal fuel system behaviour to the dispatch maintenance engineer in Auckland and the maintenance engineer, but it was not entered into the technical fault log.

ATSB Director Transport Safety, Stuart Macleod, said that in making their decision to depart the crew had considered a number of factors including the likelihood of a fuel leak and the low priority of the alert advisory message but had not considered the MEL following the EICAS alert.

“The flight crew had differing knowledge of the MEL requirements following a fuel configuration alert message, and this combined with a shared belief that the risk was low enough for the flight to proceed and having only consulted the non‑normal checklist, led them to believe they were able to depart,” he said.   

Mr Macleod said the occurrence highlights the importance of flight crews being fully conversant with all operating procedures, particularly those related to aircraft unserviceability that are critical to the safety of flight operations.

“Had the crew consulted the MEL they would have seen the requirement to return to the gate and seek maintenance action before continuing operations of the aircraft,” he said.

“In addition, delaying the completion of the non-normal checklist resulted in the fuel imbalance increasing to 2.6 t in excess of the operator’s fuel imbalance limitations, unnecessarily elevating the flight’s safety risk.”

The investigation report explains that the fuel imbalance was the result of abnormal fuel system behaviour, probably caused by the malfunction of one of the three fuel system valves, resulting in fuel from the centre tank being fed into the right main tank. Maintenance action was unable to determine to the cause of the malfunction.

Mr Macleod said the investigation also highlighted the importance of any aircraft unserviceability being recorded in the aircraft’s technical log to ensure that it is addressed and to provide future reference in case of further, or related, instances.

“Not entering the abnormal fuel system behaviour in the aircraft’s technical fault log resulted in a delay to maintenance action until after a further two sectors had been flown by the aircraft and probably hampered in the identification of the underlying fault.”

In response to the occurrence, the operator, Tasman Cargo Airlines, has undertaken to amend its MEL to clarify crew actions in the event of an EICAS message between off‑blocks and take-off.

Read the final report: Fuel imbalance involving Boeing 767, VH-EXZ, during flight from Auckland, New Zealand to Sydney, New South Wales, on 27 July 2019

Key points:

• Train driver read through to a green signal on an adjacent line, resulting in a signal passed at danger;
• Habituation limited the effectiveness of the automatic warning system in warning the driver of approaching a red signal;
• Investigation found discrepancies in rail operator’s train diver maintenance of competencies (MOC) process;
• Processes for maintaining and assessing the competence of rail safety workers should be effectively monitored and reviewed.

An emergency ‘STOP’ command issued by a network control officer avoided the potential for collision between two Brisbane suburban passenger trains following a signal passed at danger (SPAD) incident, with the subsequent ATSB investigation highlighting the importance of assuring train driver competence and having sophisticated engineering controls in place to manage the risks of SPADs.  

Queensland Rail (QR) Citytrain passenger service TP43 had just departed Bowen Hills station after a driver change on 10 January 2018, with the departure signal at the northern end of the platform displaying a yellow aspect, denoting that the next signal (ME45) would be set at red. As the train approached that signal, the driver mistakenly read through to a green aspect signal for an adjacent line, the ATSB investigation found.

Approaching signal ME45, the automatic warning system generated an alarm in the train driver cab, indicating the signal was at danger, which, if the driver did not acknowledge, would have triggered an emergency brake application. The driver acknowledged the alarm by pressing the reset button, but that acknowledgement was almost certainly an automatic response and did not result in the driver effectively checking signal ME45.

The train subsequently passed signal ME45 and exceeded its limit of authority. This generated a SPAD alarm at QR’s rail management centre, resulting in a network control officer broadcasting an emergency stop command to the driver via the train radio.

The driver responded to the command and stopped the train 220 metres past signal ME45, and 126 metres short of a crossover and conflict point. At the time that TP43 came to a stop, another suburban passenger train had just cleared the conflict point.    

Although the ATSB found the driver probably misread the green aspect signal on the adjacent line, the investigation also identified issues with the automatic warning system, and with QR’s administration of its train driver maintenance of competency (MOC) process, ATSB Director Transport Safety Dr Mike Walker said.

The automatic warning system provided the same alarm for all restricted signals, whether double yellow, yellow, flashing yellow and red, creating the potential for habituation, Dr Walker noted.

“Citytrain drivers frequently encounter restricted signals, and so it is understandable how drivers can become conditioned to cancelling the automatic warning system alarm as a habitual, reflexive reaction,” he said.

“The absence of a higher priority alert when approaching a signal displaying a red aspect reduces the effectiveness of the automatic warning system to prevent SPADs.

“That increases the reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their effectiveness.”

The investigation also found that limitations with QR’s administration of the Citytrain driver maintenance of competency process, which involved each driver completing a written and practical assessment every 18 months (or 12 months after first qualifying), provided limited assurance that its drivers met relevant competency requirements, Dr Walker said.

“In assessments undertaken subsequent to the SPAD incident, the very experienced train driver was found not to have met the relevant competency requirements even though their previous maintenance of competency assessments showed no indications of any problems,” he said.

“Further, QR’s management oversight of the Citytrain driver MOC process did not include planned assurance activities or regular and effective auditing of how the MOC assessments were being conducted, even after there were multiple indications that the process could have been undermined by not being conducted as designed.”

Dr Walker noted that QR has subsequently undertaken a range of proactive safety actions to address the design and implementation of its train driver MOC process.

“This investigation highlights the importance for rail organisations to have an assurance system in place that effectively monitors and reviews processes for maintaining and assessing the competence of train drivers and other rail safety workers,” he stated.

“Those assurance activities must be suitably designed and implemented to ensure that they appropriately evaluate controls that manage risk.”

In addition, the investigation notes that limitations with the automatic warning system in preventing SPADs remain.

“There is only limited potential to redesign the existing automatic warning system to reduce the risk of SPADs,” Dr Walker said.

The ATSB notes that QR is introducing the European Train Control System, which will provide more sophisticated controls for detecting SPADs, however that system is only being implemented across parts of QR’s south-east network.

“This occurrence highlights the importance for suburban passenger rail networks to have sophisticated engineering controls in place to detect potential or actual SPADs and manage their risk,” Dr Walker said.

“In addition, even though SPADs are rare events for most drivers, the role of driver performance in minimising the risk of SPADs is critical. This investigation provides an opportunity for train drivers to reflect on the need for crosschecking signal information, particularly at locations where there is potential for a signal read-through.”

Dr Walker also noted that the ATSB identified safety issues with QR’s implementation of risk triggered commentary driving (RTCD), as well as the limited use of recorded data to determine driver compliance with key operational rules that had been designed to minimise the risk of SPADs.

Read the final report: Signal ME45 passed at danger involving suburban passenger train TP43 and near collision with another suburban passenger train, Bowen Hills, Queensland, on 10 January 2018