Executive summary

What happened

On the morning of 6 August 2022, the pilot of a Robinson R22 Beta II, registered VH‑NKV, was flying at about 500–600 ft en route to conduct aerial mustering north-east of Karumba aerodrome, Queensland. After some time in cruise, the helicopter suddenly began to ‘shake and vibrate’. In response, the pilot conducted an autorotation, flaring the aircraft just above the trees in a heavily wooded area. The aircraft collided with trees and was destroyed. The pilot was uninjured, and there was no fire.

What the ATSB found

The ATSB found that the engine issues prompting the pilot to attempt a forced landing were likely the result of carbon deposits that had accumulated on the valve stem of the no. 2 cylinder exhaust valve and within its guide, reducing clearance to less than the specified minimum. The reduced clearance likely resulted in the valve binding in the guide, and not fully closing. While these deposits would have begun to accumulate from the time the cylinder entered service, its progression to the point where it resulted in a degradation in engine performance would not normally be detected by the aircraft’s existing maintenance regime.

Cylinder durability issues, predominantly affecting R22 and R44 helicopters used in mustering operations across the northern regions of Australia have reportedly increased since 2016. However, there was insufficient data available relating to the extent and nature of these failures to identify strategies for prevention.

What has been done as a result

The ATSB has released a safety advisory notice to strongly encourage maintainers, operators, and pilots of Robinson R22 and R44 helicopters fitted with Lycoming O-360 and O-540 series engines to complete a Lycoming cylinder durability investigation group defect report form any time engine cylinder issues are identified.

Safety message

The pilot responded appropriately to a sudden and unexpected emergency, greatly reducing the likelihood of injury. This accident highlights the importance for pilots to be cognisant of changes in performance during day-to-day operations, and always be prepared for the rapid onset of an in‑flight emergency.

The investigation

The occurrence

On the morning of 6 August 2022, the pilot of a Gulf Coast Aviation Robinson R22 Beta II, registered VH‑NKV, was preparing the helicopter to conduct mustering operations. The pilot had planned to rendezvous with another helicopter that had departed from a different location and then both would proceed north to the mustering area, which was on a property about 160 km north-east of Karumba aerodrome, Queensland.

After take-off, the pilot climbed to about 500–600 ft and tracked north. The pilot reported that initially the engine indications were normal, and that after some time in cruise, the helicopter suddenly began to ‘shake and vibrate’, and that this could also be felt through the cyclic.[1] The pilot observed the engine manifold pressure rise, along with a drop in main rotor and engine RPM.

In response, the pilot initially raised the collective, then after recognising the engine and rotor RPM continuing to decrease, rapidly lowered the collective to maintain rotor RPM. The pilot commenced an autorotation, flaring the aircraft just above the trees in a heavily wooded area. The aircraft collided with trees and was destroyed (Figure 1). The pilot was uninjured, and was able to exit the aircraft unaided. There was no fire, and after it was safe to do so, the pilot returned to the aircraft to shut the fuel and master switch off.

Figure 1: VH-NKV at the accident site

Source: Gulf Coast Aviation, annotated by the ATSB

Context

Pilot information

The pilot commenced flying in 2017 and was issued a Civil Aviation Safety Regulation Part 61 Commercial Pilot (Helicopter) Licence in 2018. At the time of the accident, the pilot had accumulated about 4,100 hours total aeronautical experience and had been flying for Gulf Coast Aviation for about 18 months.

Helicopter information

The helicopter was a Robinson R22 Beta II powered by a 4-cylinder, horizontally opposed, Lycoming O-360-J2A engine, which was fan cooled. VH‑NKV was manufactured in 2013 and first registered in Australia on 19 March 2014. At the time of the accident, VH‑NKV had about 5,778 hours total time in service and had flown about 64 hours since its last periodic inspection.

Airworthiness and maintenance history

The engine cylinder layout is shown in Figure 2. An overhauled engine was installed on 26 October 2020 and in the following 18 months, 15 cylinders were changed across the 4 cylinder positions because they were found to have low compression when tested[2] (Table 1). Cylinders fitted to positions 3 and 4, located closest to the engine firewall, had been changed on more occasions than cylinders fitted to positions 1 and 2. The last cylinder replacements (numbers 1, 2 and 4) were made during the periodic inspection carried out on 13 May 2022. The compressions on all cylinders were within limits when tested during subsequent periodic inspections carried out on 23 June and 20 July 2022 (Table 2).

Figure 2: R22 Beta II engine cylinder layout

Source: Robinson Helicopter Company, annotated by the ATSB

Table 1: VH‑NKV cylinder changes since overhaul

Table 2: VH‑NKV recent cylinder compression checks

Wreckage information

The accident site was located in a heavily wooded area with limited clearings to successfully complete an autorotation (Figure 3). The ATSB did not attend the accident site. The operator, Gulf Coast Aviation, recovered the wreckage, after which it was transported to an independent maintenance provider. The engine and a selection of components were removed for detailed examination by the ATSB. This examination revealed that multiple components showed evidence of the engine running at impact, however the level of power that would have been available could not be determined.

Figure 3: Accident site overview

Source: Google Earth, annotated by the ATSB

Engine examination

The engine was disassembled and examined at a Civil Aviation Safety Authority (CASA) approved engine overhaul facility under the supervision of the ATSB. The engine was in good overall condition, and the cylinders fitted to the no. 1, 3 and 4 positions were within the manufacturer’s specifications. However, the cylinder fitted in the no. 2 position had very low compression when tested. Further investigation showed that the exhaust valve was not fully closing, likely because of carbon deposits accumulated on its stem and within the valve guide. The deposits had reduced the clearance of the valve stem within its guide to less than the specified minimum. Additionally, the no. 2 cylinder inlet plenum showed discolouration, possibly from the abnormal presence of exhaust gas which could be the result of the inlet valve sticking. Valves that do not fully close or become stuck in engines installed in helicopters can result in airframe vibration and a reduction in power.

The magnetos were bench tested, disassembled, and examined at another CASA-approved facility. The magnetos functioned correctly, and there were no defects evident.

The air and oil filters, oil, oil pump, and carburettor showed no significant abnormalities and there was no evidence of internal damage. No other relevant defects were identified.

R22 and R44 engine durability issues in northern Australia

R22 and R44 series helicopters have been used extensively in northern Australia for the aerial mustering of livestock. From around 2016, some operators of R22 and R44 helicopters fitted with Lycoming O-320, O-360 and O-540 series engines[3] reported an increase in engine cylinder failures due to low compression.[4] This was typically detected by engine cylinder compression checks carried out during periodic inspections and required the affected cylinders to be changed. Undetected loss of compression on one or more cylinders can lead to a reduction in power, and the possibility of an in-flight emergency.

In response, CASA published Airworthiness Bulletins AWB 85-024 – Robinson R22/R44 Engine Exhaust Valve and Valve Guide Distress and AWB 85-025 – Robinson R22/R44 Engine Intake Valve and Valve Seat Distress (Civil Aviation Safety Authority, 2018). Both bulletins showed typical defects that prompted cylinder removals, a list of relevant technical publications from Robinson and Lycoming, outlined the investigations and testing carried out by the engine manufacturer and industry groups, and contained recommendations to reduce cylinder changes.

Additionally, the bulletins noted that:

In 2018 the ATSB received correspondence suggesting R22 and R44 engine serviceability issues may be linked to the December 2015 change of fuel supplied to the northern region of Australia from green-coloured Avgas 100/130 to blue-coloured Avgas 100LL (low lead). At the time, the ATSB analysed the available safety occurrence records and found there had been ‘no discernible increase in reported engine failures or malfunctions in northern Australia after the introduction of Avgas 100LL in December 2015’ (ATSB, 2018).

In 2019, the Lycoming Cylinder Durability Investigation Group (LCDIG) was formed by the following organisations to gather further information:

• CASA’s Airworthiness & Engineering Branch
• Lycoming
• Robinson Helicopter Company
• Viva Energy Australia[5]
• the Australian Helicopter Industry Association (AHIA).

The LCDIG subsequently published a 4-page defect reporting form[6] specific to Lycoming engine durability issues in R22 and R44 helicopters. This was sent to 597 R22/R44 operators via email, and 57 operators via traditional mail requesting their assistance. The response rate to this request was about 10%.

The AHIA convened a specialist panel to investigate the cylinder failures, and from that work published Durability issues – Lycoming O-320, O-360 and O-540 engines fitted to Robinson Helicopter Co R22 and R44 Models (Australian Helicopter Industry Association, 2019). This report stated:

The report identified other factors in relation to the issue, including:

• The accelerated wear was attributable to the cumulative effect of deposits on the valve stems and exposure to sustained high temperatures.
• These deposits had also been associated with the exhaust valve 'sticking' and preventing the valve from fully closing, where the free movement of the valve is inhibited by the stem accumulations.
• Changes to the constituents of aviation gasoline (Avgas) supplied to northern Australia had the potential to contribute to the engine durability issues.
• Ambient air temperature directly affected engine operating temperatures because of the ‘forced flow’ design of R22/R44 engine cooling.
• Aircraft operating in northern Australia would be routinely exposed to higher ambient air temperatures, particularly those involved in aerial mustering.

As part of this investigation, the ATSB reviewed reported R22 and R44 safety occurrences to identify examples of engine failures, malfunctions or abnormal indications resulting from engine cylinder compression loss. The review was hampered by a lack of data, and no conclusions were able to be drawn from it.

Safety analysis

Engine power loss

While in cruise, en route to conduct mustering, the helicopter began to vibrate, there was a rise in engine manifold pressure, and a drop in main rotor and engine RPM. This prompted the pilot to conduct a forced landing, during which the helicopter hit trees in a heavily wooded area and was destroyed.

Compression on the no. 2 cylinder was within limits when fitted, when tested on 23 June 2022, and when tested on 20 July 2022. Further, maintenance records show there was no significant degradation in cylinder compression over that time. However, in the 64 flying hours since the last periodic inspection, accumulation of carbon deposits on the valve stem and within the valve guide likely progressed to a point where the valve became stuck and did not fully close, reducing power and causing the rough running.

The accumulation of deposits on the exhaust valve stem and within the valve guide was consistent with one of the failure mechanisms identified in the AHIA report.  This would have begun from the time the cylinder entered service, and its progression to the point where it resulted in a degradation in engine performance would not always be detected by the aircraft’s normal maintenance regime.

Pilot response

The pilot’s initial response (raising the collective) reduced the rotor RPM, and was likely reflexive. Had this response continued, rotor stall and a loss of control would have been likely. However, the pilot recognised the decreasing engine and rotor RPM and rapidly lowered the collective to maintain rotor RPM and enter autorotation. The deliberate and timely application of this procedure almost certainly improved the outcome of this event for the pilot.

Engine cylinder changes

Since 2016, considerable investigation work has been carried out by Robinson, Lycoming, industry groups, and CASA to identify the factors contributing to cylinder failures affecting R22 and R44 helicopters used in mustering operations across the northern regions of Australia.

Although this is an ongoing concern, there was insufficient data available relating to the extent and nature of these failures to identify strategies for prevention. Only 10% of operators who were sent the Lycoming Cylinder Durability Investigation Group (LCDIG) request for data responded to it, limiting the group’s ability to identify a solution.

Given that more data could assist in determining the precise reason for increased cylinder failures, the ATSB is issuing a safety advisory notice (AO-2022-038-SAN-01). Its purpose is to encourage operators, maintainers, and pilots to complete and return the LCDIG defect report forms any time engine cylinder issues are identified, and to reiterate the importance of doing so.

Findings

From the evidence available, the following findings are made with respect to the engine malfunction involving Robinson R22 Beta II, VH‑NKV 85 NM north-east of Karumba aerodrome, Queensland, on 6 August 2022.

Contributing factors

• The no. 2 cylinder exhaust valve clearance had reduced well below the minimum due to carbon build-up, resulting in the valve not closing fully, reduced power, and rough running.

Other findings

• The pilot initially raised the collective which reduced the rotor RPM, however after recognising the decreasing engine and rotor RPM, rapidly lowered the collective to maintain rotor RPM and enter autorotation.  
• While there had been a reported increase in cylinder failures in Robinson R22 and R44 helicopters used in mustering operations across the northern regions of Australia, there was insufficient data available relating to the extent and nature of these failures to identify strategies for prevention.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk.

Safety advisory notice to Robinson R22 and R44 operators

SAN number:

AO-2022-038-SAN-01

The ATSB strongly encourages maintainers, operators, and pilots of Robinson R22 and R44 helicopters fitted with Lycoming O-320, O-360 and O-540 series engines to complete a Lycoming cylinder durability investigation group defect report form 1529 any time engine cylinder issues are identified.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot
• Gulf Coast Aviation
• Robinson Helicopter Company
• Lycoming.

References

Australian Transport Safety Bureau (2018), investigation AR-2018-058, Exploration of change in aviation gasoline lead content in northern Australia on reported engine–related occurrences.

Civil Aviation Safety Authority (2018a), AWB 85-024 – Robinson R22/R44 Engine Exhaust Valve and Valve Guide Distress.

Civil Aviation Safety Authority (2018b), AWB 85-025 – Robinson R22/R44 Engine Intake Valve and Valve Seat Distress.

Australian Helicopter Industry Association (2019), Durability issues – Lycoming O-320, O-360 and O-540 engines fitted to Robinson Helicopter Co R22 and R44 Models.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Civil Aviation Safety Authority (CASA)
• pilot
• Gulf Coast Aviation
• Robinson Helicopter Company
• Lycoming.
• Submissions were received from the pilot and Gulf Coast Aviation. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1] The cyclic is the primary helicopter flight control. Similar to aircraft control column, it is moved in the desired direction to move the helicopter about its pitch or roll axis.

[2] Compression checks are used to determine the condition of an aircraft cylinder and its components. It is accomplished with a differential compression tool which measures the leak rate of a cylinder compared to the leak rate through an orifice within the tool. Air is supplied to the tools regulator and adjusted to 80 psi on the air supply pressure gauge, and a measurement is read on a second gauge.

[3] The standard R-44 Raven II has an IO-540 series engine with a different cylinder head layout. This model was not reported to exhibit the same type of problem.

[4] Civil Aviation Safety Authority 2018a, Civil Aviation Safety Authority 2018b, and Australian Helicopter Industry Association 2019.

[5] A major fuel supplier.

[6] Lycoming cylinder durability investigation group defect report form 1529, available at https://www.casa.gov.au/lycoming-cylinder-durability-investigation-group-defect-report.

Executive summary

What happened

On 15 July 2022, a Bell Textron 505 helicopter registered VH-VTB was conducting a scenic flight near Double Island, Queensland, with a pilot and 2 passengers on board. About 30 minutes into the flight, the pilot heard 2 brief, loud ‘grinding noises’ and elected to proceed to Cairns Airport.

While over the airfield, the grinding began again and did not stop. After 10-12 seconds, approximately 10 ft off the ground, the pilot heard 2 loud bangs, and the helicopter yawed to the right. In response, the pilot moved the throttle to idle, which stopped the yaw. A run-on landing was performed on the grass short of the assigned helipad. Subsequent inspection of the helicopter revealed that the tail rotor driveshaft had failed.

What the ATSB found

A section of the tail rotor driveshaft failed due to a bearing that seized and overheated in flight. The reason for the bearing seizure could not be determined. An examination of the bearings 2 days previously found no problems, and the adjacent bearing was well lubricated, with some very small points of damage on the bearing race indicating potential contaminants.

The pilot’s decision to adopt a shallow approach into Cairns, and to reduce throttle immediately following the tail rotor failure both assisted in controlling the helicopter following the uncommanded yaw, and allowed a safe landing.

Safety message

Unusual sounds and responses from an aircraft can be an indication of an imminent system failure. In this instance, the pilot’s decision to return to Cairns was probably influenced by the initial short duration of the unusual noises and overwater operation. While a safe landing on an airfield resulted, the occurrence also illustrates how quickly failures can occur.

Therefore, pilots experiencing any unusual vibration or noise should land as soon as possible and have the aircraft inspected prior to further flight. If an immediate landing is not possible then pilot should be prepared to conduct an emergency landing or ditching if the situation deteriorates.

The investigation

Context

Managing tail rotor failures

The United States Federal Aviation Administration (FAA) recommends shallow approaches followed by a run-on landing in circumstances where there is insufficient power to hover.[2] This allows the helicopter to gain additional lift from its forward motion up until it touches down.

In the specific event of a tail rotor drive system failure the FAA notes that the severity of the resulting yaw is reduced by low power and high airspeed. Less power means a smaller reaction from the airframe due to main rotor torque, and more airspeed allows the aerodynamics of the fuselage and vertical stabiliser to mitigate the yaw effect. Following an in-flight tail rotor failure, the FAA recommends an immediate reduction of power and lowering of collective to land the helicopter (via an autorotation if necessary).[3]

Component examination

A section of the tail rotor driveshaft assembly known as the fan shaft was sent to the ATSB for detailed technical examination (Figure 1). This section of the driveshaft also drove the oil cooler fan, as well as cabin air-conditioning via a pulley and drive belt. In a functional fan shaft assembly, the engine drives the fan shaft which connects to the rest of the tail rotor driveshaft and ultimately, the tail rotor itself. The forward and aft hangers restrain the fan shaft via ball bearings that are clamped in each hanger using a nut.

Figure 1: The fan shaft and associated components removed from VH-VTB

Source: ATSB

The driveshaft failed adjacent to the bearing seated inside the forward hanger. Blackening of the hanger, shaft and bearing components was present, indicative of exposure to high heat. The fracture surface closest to the bearing also appeared to be deformed due to heat exposure (Figure 2, D). Metal transfer on the bearing seat was likely from the adjacent inner race. No grease was observed in the bearing, though it might have been slung out or dissociated due to the high temperatures.

The outer race of the bearing was intact, but showed signs of corrosion (Figure 2, A). The inner race of the bearing had disintegrated, and only a small portion was found, along with only 5 bearing balls (Figure 2, B). Deep rotational scoring was observed on the inner face of the hanger and the outside of the outer race—normally clamped together during operation (Figure 2, C). The nut used to clamp the hanger to the bearing was still present, and a stripe of torque seal on the nut indicated that it had not backed off since it was last tightened. Metal was transferred onto the surface of the fan shaft, where the inner bearing sat during operation.

Figure 2: Damaged components of the failed bearing (A, B), hanger (C), and fan shaft (D)

Source: ATSB

For comparison, the aft bearing was sectioned and examined for signs of damage (Figure 3). There were no signs of rotational scoring between the bearing and the aft hanger. The bearing contained sufficient grease, which had the same appearance as Mobilgrease 28. The grease showed no signs of contamination.

Figure 3: The aft fan shaft bearing, sectioned and disassembled.

Source: ATSB

On the aft bearing, surfaces of the inner and outer bearing race were in good condition, with some very small points of spalling damage[4] on the inner race where contact would be made with the balls (Figure 4). No other mechanical damage associated with bearing degradation was observed (Figure 3, A and B). Likewise, there was no damage to the bearing balls or the ball cage retaining them (Figure 3, C).

Figure 4: Inner race spalling damage seen through an optical microscope (left) and electron microscope (right)

Source: ATSB

Aircraft maintenance

At the time of the incident, the helicopter had accrued 1,392.5 hours total time in service. The tail rotor driveshaft and associated bearings were the original parts installed when the operator received the new helicopter from Bell. The forward and aft fan shaft bearings were lubricated 246 flight hours previously using Mobilgrease 28, as part of the helicopters most recent 300-hourly inspection. This was done in accordance with Bell Textron’s maintenance schedule.

Two days before the incident, a different pilot heard a strange noise coming from what was thought to be the engine of VH-VTB. After an engine shutdown and restart the noise persisted. The helicopter was grounded for an inspection by maintenance personnel, but the noise could not be replicated. The helicopter was examined, including the tail rotor driveshaft. Bearings were inspected for signs of heat damage, excessive temperature, or noise, but no abnormalities were found and the helicopter returned to service. The pilot from the incident flight heard a recording of the initial noise, but did not believe it was the same ‘metal-on-metal’ sound heard during the incident, describing it as more of a vibration.

Comments from Bell Textron

Bell was not aware of any previous instances of bearing failure in 505 fan shaft bearings. Nor was it aware of any bearing failures in the 206 model helicopters, which use a similar drivetrain. Bell raised the possibility of air-conditioner belt tension or damage to the air-conditioner pulley splines as potential contributing factors. However, the splines were found to be in good condition and the operator reported that the belt had been installed in accordance with Bell’s maintenance schedule.

Other bearing issues

The failed bearing on VH-VTB associated with this incident was replaced with one from another 505, but after some time in service, maintenance personnel heard a ‘slight rumbling sound’ coming from the replacement bearing. It was subsequently sent to Bell for examination. The bearings and fan shaft assembly from the incident flight were also sent to Bell following the ATSB’s examination. At the time of writing the results of these examinations were not available.

The ATSB was also notified of another instance where an operator informed their maintainer of a strange and intermittent noise coming from one of the forward fan shaft bearings of a 505. Water was also found in the bearing when it was purged. The maintainer replaced the bearing in question, and there was no further examination of the removed bearing.
 

Safety analysis

Findings

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot and operator
• Bell Textron Inc.
• United States Federal Aviation Administration

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the pilot and operator
• Bell Textron Inc.
• Civil Aviation Safety Authority
• Transportation Safety Board of Canada

Submissions were received from:

• Bell Textron Inc.
• Transportation Safety Board of Canada

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Investigation summary

What happened

On the morning of 9 April 2022, the fully laden capesize bulk carrier Hagen Oldendorff departed its berth in Port Hedland, Western Australia with a harbour pilot on board and 4 tugs assisting. The first of the tugs was cast off shortly after departure and the ship continued its passage of the port’s navigational channel. As the pilot navigated the ship through a turn in the channel, the 2 shoulder tugs were cast off and retained as passive escorts while the aft tug remained tethered as an active escort. Shortly after the turn was completed, the ship experienced a loss of electrical power supply to all the ship’s analogue rudder angle indicators and, a few minutes later, struck the western batter of the channel. The pilot manoeuvred the ship back into the centre of the channel and, with the assistance of additional tugs and a second pilot, resumed the outbound passage and conducted the ship to an anchorage outside port limits.

Subsequently, the ship was found to be taking on water in the number 1 and 2 port double‑bottom water ballast tanks. Surveys and inspections conducted over the following days identified substantial damage to the ship’s bottom shell plating including hull breaches of the shipside shell plating of the damaged tanks and the failure of the transverse bulkhead between the tanks. There were no reported injuries or pollution of the sea as a result of the grounding.

What the ATSB found

The ATSB investigation found that a short circuit in a bridge rudder angle indicator tripped the common circuit breaker for the ship’s rudder angle indicators resulting in a loss of electrical power and illumination to all the analogue indicators. Following the power supply failure to the indicators, the ship’s pilot initiated emergency procedures for a steering failure, with manoeuvring orders issued to maintain directional control of the ship resulting in an uncontrolled turn to port and the subsequent grounding.

The ATSB also identified that the pilot had cast off the ship’s port and starboard shoulder tugs, which limited their ability to reduce the ship’s speed or to arrest the turn to port. The pilot’s decision to cast off these tugs was found to be inconsistent with the recommended practices of the port’s implemented escort towage strategy. Furthermore, this best practice escort towage guidance was not integrated into the port user guidelines and procedures or into the pilotage provider’s safety management system.

Finally, the ATSB determined that neither the applicable international regulations, nor the responsible classification society’s rules, required that rudder angle indication systems be protected against a single point of failure in their electrical power supply, nor was there a requirement for audible or visual alarms to alert crew to such a failure.

What has been done as a result

Following this incident, the Pilbara Ports Authority (PPA) updated the port user guidelines and procedures to incorporate the tug retention and utilisation practices, and guidance recommended in the port’s escort towage strategy. The PPA also issued a marine notice requiring a suitably qualified and competent person be present in the steering gear room during ship transits of the Port Hedland channel. 

Port Hedland Pilots (PHP) advised that, following the grounding, pilots keep the forward 2 tugs fast as recommended for the relevant channel zones unless prevented from doing so by weather or other factors. The PHP safety management system procedures for towage requirements were updated to reflect the tug retention and tug utilisation guidelines of the port's escort towage strategy including specific directions to pilots on where, and under what conditions, tugs were to be released. 

Hagen Oldendorff’s ship managers, Wah Kwong Ship Management Hong Kong, advised the ATSB that an audible and visual alarm was fitted to the ship to alert crew if and when the ship’s rudder angle indicators lose electrical power. In addition, the ship managers installed closed circuit television cameras in the ship’s steering gear room to allow direct monitoring of the physical rudder angle from the bridge.

Lloyd’s Register advised that alternate design solutions may effectively address the risk associated with a single point of failure in electrical power supply for ship's rudder angle indicators and that the Machinery Panel of the International Association of Classification Societies (IACS) may consider a unified interpretation (UI) of SOLAS requirements.

The Liberia Maritime Authority (LiMA) advised the ATSB that the Liberian Administration was considering issuing a marine advisory and that it was addressing this safety issue with the ship's classification society, Lloyd's Register, and, if necessary, with the International Association of Classification Societies (IACS).

The Australian Maritime Safety Authority (AMSA) advised that it would consider any requests for support from the Liberian Administration should the Administration seek to take action to address this safety issue at the International Maritime Organization (IMO). However, due to the absence of detailed proposals and a timeframe to seek safety action aimed at the resolution of the safety issue, the ATSB has issued safety recommendations to Lloyd’s Register, AMSA and the LiMA. The ATSB will continue to monitor the safety issue while working to highlight and promote awareness of the issue. 

Safety message

Pilotage and towage often serve as primary risk control measures in ensuring the safety of port operations. Where demonstrated techniques and practices have been identified that increase the effectiveness of towage in preventing incidents and in mitigating the consequences when they occur, it is imperative that they are appropriately documented, disseminated and implemented.

Summary video

The occurrence

Overview

On the morning of 9 April 2022, the fully laden capesize bulk carrier Hagen Oldendorff departed its berth in Port Hedland, Western Australia with a harbour pilot on board and 4 tugs assisting. The first of the tugs was cast off shortly after departure and the ship continued its passage of the port’s navigational channel. As the pilot navigated the ship through a turn in the channel, the 2 shoulder tugs were cast off and retained as passive escorts while the aft tug remained tethered as an active escort. Shortly after the turn was completed, the ship experienced a loss of electrical power to all the ship’s analogue rudder angle indicators and, a few minutes later, struck the western batter of the channel. The pilot manoeuvred the ship back into the centre of the channel and, with the assistance of additional tugs and a second pilot, resumed the outbound passage and conducted the ship to an anchorage outside port limits.

Subsequently, the ship was found to be taking on water in the number 1 and 2 port double‑bottom water ballast tanks. Surveys and inspections conducted over the following days identified substantial damage to the ship’s bottom shell plating, including hull breaches of the shipside shell plating of the damaged tanks and the failure of the transverse bulkhead between the tanks. There were no reported injuries or pollution of the sea as a result of the grounding.

Pre-departure activity

On the morning of 7 April 2022, the 300 m Liberian-registered bulk carrier Hagen Oldendorff (Figure 1) arrived at Port Hedland, Western Australia, from Tianjin, China, to load a cargo of iron ore. By 0900 local time, the ship was all fast, port side alongside at Stanley Point berth number 2 (SP2), operated by Roy Hill Iron Ore. Shortly after, the ship commenced loading.

Figure 1: Hagen Oldendorff at anchor off Port Hedland

Source: Australian Maritime Safety Authority

By 1544 the following day, Hagen Oldendorff had completed loading 205,465 tonnes of iron ore and was drawing forward and aft draughts of 18.34 m and 18.42 m, respectively. The ship’s departure was planned for 0045 on 9 April.[1]

By 0001 on 9 April, Hagen Oldendorff had its main engine on standby for departure, having completed pre-departure checks, which included the testing of the steering gear, main engine, and other navigational equipment. At about 0018, a harbour pilot boarded the ship. Shortly after, the master-pilot information exchange was completed on the ship’s navigation bridge (bridge) and the pilot confirmed the master was satisfied departing with a minimum under keel clearance of 0.69 m. The steering gear checks and main engine ahead and astern movement were then repeated with the pilot observing. By 0031, 3 tugs were made fast in preparation for departure with a fourth to be made fast after unberthing.

At 0048, Hagen Oldendorff departed the berth and shortly after, the fourth tug was also made fast. Tugs RT Inspiration and RT Atlantis were fast on the port and starboard shoulders[2] respectively, RT Clerke through the centre lead aft, and RT Darwin on the starboard quarter.[3] The ship’s bridge team for the departure consisted of the master, third mate, helmsman and pilot, who was situated at the front of the bridge, separated from the rest of the bridge team by the bridge console. The engine room was manned by the chief engineer, second engineer and duty oiler. 

The weather at the time was fine with south-westerly winds at force 3 (between 7 and 10 knots),[4] 1 m seas and good visibility.

The pilotage

At about 0118, when Hagen Oldendorff was about 3.5 cables[5] (648 m) south of Hunt Point (Figure 2), RT Darwin was cast off and dismissed. The ship proceeded north-east along the channel. The pilot then offered RT Clerke’s master a training opportunity in helping turn the ship into the Goldsworthy channel using ‘indirect towing’[6] (a routine practice in the port to train, and maintain the skills of, tug masters). RT Clerke’s tug master accepted the pilot’s offer. 

At about 0126, the pilot commenced a turn to port using RT Clerke to provide steering forces (to pull the ship’s stern to starboard) and the ship’s rudder as necessary (port 10° and port 20°). At this time, the ship’s speed[7] was about 6.4 knots.[8]

At about 0133, the pilot ordered the release of the tug RT Atlantis on the starboard shoulder and by 0135, the crew of RT Atlantis had recovered the tug’s towline (Figure 2). RT Atlantis continued to maintain station off the ship’s starboard shoulder as a 'passive escort’.[9] Shortly after, the pilot ordered the release of the tug RT Inspiration on the port shoulder as Hagen Oldendorff approached beacons 36-37 in the Goldsworthy channel (Figure 2). Recorded data from the ship’s voyage data recorder (VDR)[10] showed that, at the time, the ship was turning to port at a rate of turn (RoT)[11] of about 9° per minute and its speed was 6.7 knots, with the main engine set to manoeuvring full ahead (51 RPM). 

By 0137:22, the RoT had reduced, and the ship was largely steady on the Goldsworthy leading lights (leads) line (aligned 156°‑336°), slightly to the west of the channel centreline. The aft tug, RT Clerke, was now positioned off the ship’s port quarter, having assisted with steadying the ship as the turn to port was completed.

Figure 2: Section of navigational chart Aus 53 showing location of key events

Source: Australian Hydrographic Office, annotated by the ATSB 

At 0137:25, the ship was steady on a heading[12] of about 334° with a course over ground of 336°, when the pilot ordered starboard 10° of rudder, likely to regain the channel centreline. At about the same time, the pilot advised RT Clerke’s master of the completion of the indirect towage training. The tug master acknowledged the completion of the training and asked the pilot for feedback on their performance.

Meanwhile, the ship had started to turn slowly to starboard at a RoT of about 2° per minute, and the pilot ordered the rudder to midships, followed immediately by a heading order of 335° (for a tabular sequence of events, see Appendix A). By this time, RT Inspiration had been cast off and had assumed the role of a passive escort. The starboard RoT increased to about 3.6° per minute and at 0137:47, the pilot ordered port 10° of rudder.

The grounding

At 0137:49, the pilot and bridge team heard ‘clicking sounds’ (from the electrical cabinet on the bridge), followed by the loss of illumination of the rudder angle indicators (see the section titled Rudder angle indicators). The pilot recalled that before the rudder angle indicator went dark it was indicating that the rudder was amidships. However, by the time illumination of the indicators was lost, the helmsman had executed the pilot’s previous order of port 10° and VDR data showed the rudder was at port 10° while the starboard RoT had increased slightly to 3.7° per minute.

The pilot then ordered port 20° of rudder and also ordered the aft tug, RT Clerke, to pull the ship’s stern to starboard with a force of 40 tonnes[13] (to counteract the ship’s starboard RoT). The helmsman immediately executed the pilot’s order of port 20° and RT Clerke began to move from the ship’s port quarter to the starboard quarter. 

Moments later, at 0138:08, the pilot ordered ‘non-follow-up, port 20°’ (see the section titled Steering gear) while the master and rest of the bridge team attempted to determine what had happened.

At 0138:10, the pilot informed RT Clerke’s master of a ‘rudder failure’ and ordered the tug to take the ship’s ‘stern to starboard, 60 tonnes’. This was followed by the pilot ordering RT Inspiration to make fast on the ship’s port shoulder. VDR data indicated that at 0138:21 non-follow-up (NFU)[14] mode was engaged. By this time, the starboard RoT had largely been eliminated and the ship was steady on a heading of 336° with the rudder at port 20°. 

By 0138:28, the ship had started turning to port. Closed-circuit television (CCTV) footage from RT Clerke and RT Inspiration showed the aft tug, RT Clerke, crossing the ship’s stern as it transitioned to the starboard quarter to execute the pilot’s last order of ‘stern to starboard, 60 tonnes’. At 0138:30, the pilot rescinded their previous order to RT Clerke by ordering ‘Clerke, no weight, Clerke’, which RT Clerke’s master acknowledged. About 5 seconds later, at 0138:35, the helmsman applied port NFU helm input, and the rudder angle slowly increased to port 27°.

At 0138:36, on the pilot’s orders, the master started reducing the main engine telegraph setting from ‘full ahead’ to reduce the ship’s speed which was about 6.9 knots. A few seconds later, the pilot ordered RT Clerke ‘stern to port, 20 tonnes’ and then, shortly after, ‘stern to port, full’, in an attempt to counteract the increasing port RoT which was now about 7° per minute. At 0139:20, RT Inspiration was ordered to push with full power on the port bow. 

At 0139:24, the pilot ordered ‘stop engines’ and the ship’s speed started to reduce. At 0139:28, the port RoT peaked at 13.6° per minute and then started decreasing. At 0139:30, RT Atlantis was tasked to push on the starboard quarter, after initially being instructed to make fast between cargo holds 2 and 3 on the starboard side. Meanwhile, the third mate and master had contacted the chief engineer (in the engine control room) and the second mate (manning the aft mooring stations) and directed them to the steering gear room to investigate. 

At 0139:35, the pilot queried if the rudder was responding and then ordered ‘hard to port’. The helmsman complied by applying port NFU input and VDR data showed that the rudder moved from its initial position of about port 27° to hard over to port (35°). At this time, RT Clerke was using full power to bring the stern to port and the ship’s port RoT was 13.4° per minute and decreasing. The ship’s master queried the pilot’s order of ‘hard to port’ while the pilot reported to the Port Hedland vessel traffic service (VTS) that the ship had experienced a ‘rudder failure’ and declared a ‘Port Emergency’.[15] About 15 seconds after the pilot’s order of hard to port, the master queried the rudder order again. The pilot immediately ordered the rudder amidships followed by an order of hard to starboard. VDR data showed that by 0140:11, the rudder was hard over to starboard.

Shortly after 0140, on the pilot’s order, the master put the main engine astern. At 0140:21 the pilot asked if the rudder was hard to starboard, and the master confirmed that it was, indicating that the ship’s steering gear room was probably manned. 

At 0140:30, Port Hedland VTS made a radio broadcast on the port’s very high frequency (VHF) working channel (channel 12) requesting available tugs to assist with Hagen Oldendorff’s emergency and notified the harbour master about the incident. Over the next 5 minutes, the masters of 5 tugs (FMG Dusky, Iron Ibis, IronWhistler, RT Darwin and Iron Kestrel)[16]confirmed they were responding. 

From about 0140:34 onwards, there was a sharp reduction in both the ship’s speed and its RoT to port. VDR data confirmed that the ship had contacted the western channel batter (the steep side of the navigable channel), about 4 cables south-east of beacon 35 (Figure 3) at a speed of about 6.1 knots. The ship’s bow then swung away from the side of the channel to starboard. 

Figure 3: Hagen Oldendorff at the time of the grounding

Source: Australian Hydrographic Office, annotated by the ATSB using VDR data

Response and recovery

At 0140:40, the pilot instructed RT Atlantis, which was pushing on the ship’s starboard quarter, to proceed to the starboard bow. The pilot also ordered RT Clerke to pull the stern to starboard using full power and instructed RT Inspiration, which was on the port bow, to stop pushing. RT Clerke’s master did not acknowledge the pilot’s order and continued pulling the stern to port while RT Atlantis proceeded forward. By about 0141, RT Inspiration was fast on the port shoulder and the pilot once again ordered RT Clerke to stop pulling, which the tug master then acknowledged. Meanwhile, the ship’s starboard RoT had increased to a maximum of about 19° per minute and then started reducing while the ship’s speed had decreased to about 4.3 knots.

Shortly after 0142, the pilot informed VTS that the ship may have grounded, that the engine was operational, that there was a rudder failure and the steering gear was not responding in any mode, including NFU. The pilot also asked VTS to call the duty pilot and the next pilot on the roster. At 0144, the pilot ordered RT Atlantis to make fast on the ship’s starboard shoulder.

At 0145:23, the master informed the pilot that the rudder indicator did not appear to be working. About a minute later, the master confirmed that the rudder indicator was not working, and that the ship’s crew had engaged the emergency local steering controls in the steering gear room. VDR data indicated that the changeover to emergency local steering control occurred at 0148:42.

In the meantime, the tugs FMG Dusky and Iron Ibis had arrived at the ship’s location. At 0147:20, the pilot informed VTS that the ship’s emergency steering system was available, and that they planned to take the ship to the anchorage.

By 0148, FMG Dusky and Iron Ibis were fast on the starboard quarter and centre lead forward, respectively. By this time, Hagen Oldendorff was stopped and had been recovered to the middle of the channel, south of beacon 35 (Figure 2). Shortly after, the tug Iron Whistler was made fast on the port quarter and RT Atlantis was fast on the starboard shoulder.

At about 0152, the ship began moving along the channel under its own power with 6 tugs fast. About a minute later, the pilot asked for the ship’s forward, port ballast tanks to be sounded (to check for water ingress). At 0157, Iron Kestrel arrived and was instructed to take up station amidships on the port side and follow the ship.

At 0158, VTS advised the pilot that the harbour master had been informed that the ship had engaged emergency steering, and it was cleared to proceed to the anchorage. At 0204, RT Darwin arrived and was directed to take up station amidships on the starboard side.

At about 0212, when the ship was past beacons 32-33, a second pilot boarded the ship by helicopter (Figure 2). The second pilot took charge of communications with external parties while the pilot maintained conduct of the ship. Shortly after, VTS advised the pilot that sufficient tidal window remained for the ship to proceed and exit the channel at the C1 beacon. 

At 0239, after several inquiries by the pilot, the master advised that the forward ballast tanks had been sounded and that the soundings indicated no water ingress. The pilot asked for the tanks to be sounded again after 30 minutes.

At about 0303, the ship cleared beacons 15-16 (about 8.8 miles north-north-west of Hunt Point). Shortly after, FMG Dusky was cast off and dismissed and Iron Kestrel was made fast in its place on the starboard quarter.

At about 0327, the master reported that the latest tank soundings had confirmed no water ingress.

Shortly after 0430, the ship cleared the channel (at beacons C1-C2) and all tugs, except RT Clerke, were dismissed. By 0530 on 9 April, the ship had anchored outside the port limits in a position 24 miles north-north-west of Hunt Point (Figure 4). Soon after, RT Clerke was dismissed, and the pilots left the ship by helicopter.

Figure 4: Hagen Oldendorff's track overlaid on chart of Port Hedland

Source: Australian Hydrographic Office, annotated by the ATSB

Post-incident actions

At 0530 on 9 April, the harbour master notified the Australian Maritime Safety Authority (AMSA) of Hagen Oldendorff’s grounding and that the ship was at the anchorage. At 0600, AMSA issued the ship’s master with a detention order.[17] 

At about 1000, the master notified Port Hedland VTS that the ship was taking on water in number 1 and 2 port double‑bottom water ballast tanks, had developed a trim by the head, and requested assistance. In response, the harbour master ordered 2 dive boats to the ship’s location and notified AMSA of the water ingress. Shortly after, the master reported that one ballast pump was coping with pumping out the water from the breached tanks. Later that day, the master advised that all other compartments (ballast and fuel tanks) were intact. 

On 10 April, an AMSA surveyor, accompanied by a representative of the ship’s owners, boarded the ship at anchorage by helicopter. The surveyor conducted an inspection of the ship and an assessment of the ship’s steering system, seaworthiness condition and crew’s welfare.

On 11 April, an underwater hull inspection identified substantial damage to the ship’s port side bottom shell plating. The hull was breached in 2 locations – a 0.65 m by 0.95 m breach and a 0.3 m by 0.4 m breach about 10 m forward of the first breach. Additionally, the transverse bulkhead between the 2 tanks had failed, allowing flooding between them. Subsequent inspections also identified extensive impact damage with the most significant damage extending over a length of about 53 m along the forward, port side of the ship’s hull near the turn of the bilge (Figure 5). Several structural frames and internal strength members had also buckled or fractured.

Figure 5: Damage to Hagen Oldendorff's hull

Source: Wah Kwong Ship Management HK, annotated and modified by the ATSB

On 18 May, following temporary repairs at the anchorage, the ship’s flag State (Liberia) approved the ship to undertake a direct voyage to its discharge port in China before proceeding to a shipyard for permanent repairs. 

At 2000 on 19 May, AMSA released Hagen Oldendorff from its detention. At 2154, the ship departed for Lianyungang, China, to discharge its cargo. After discharging the cargo, the ship sailed to a shipyard in Zhoushan, China, where permanent repairs were carried out. 

ATSB investigation

The ship’s initial incident alert and incident report notifications[18] submitted in April 2022 reported that Hagen Oldendorff had experienced an issue with its steering due to faulty rudder indicators during its outbound transit of the Port Hedland channel. An initial ATSB review of those notifications resulted in a decision not to investigate the occurrence. 

Subsequently, reports from AMSA’s Port Hedland port marine surveyors indicated that the ship had grounded in the channel and sustained hull damage as a result. A few weeks later, in May 2022, BHP[19] also reported to the ATSB (via telephone) that the ship had grounded and sustained substantial damage. In late July, BHP presented the ATSB with additional information, including recorded data.

The ATSB reassessed the available information, obtained further information from the Pilbara Ports Authority (PPA) and Port Hedland Pilots (PHP), and commenced an investigation into this serious incident. Subsequently, ATSB investigators attended the offices of PPA, PHP and BHP in Port Hedland in October 2022 to interview relevant persons and collect available evidence. The ATSB also obtained VDR and other relevant digital and documentary evidence from the ship’s managers, PPA, PHP and BHP.

Context

Hagen Oldendorff

The ship

Hagen Oldendorff was a Liberian-registered, capesize[20] bulk carrier built in 2020 by Cosco Shipping Heavy Industry (Yangzhou, China). At the time of the grounding, the ship was owned by CL Marina, managed and operated by Wah Kwong Ship Management Hong Kong (HK) and classed with Lloyd’s Register (LR). 

The ship was equipped with the necessary navigational and manoeuvring equipment required by the International Convention for the Safety of Life at Sea (SOLAS)[21] for a ship of its size. This included radar, electronic chart display and information system (ECDIS) and a Highlander HLD‑VDR600 voyage data recorder (VDR), from which information useful to the investigation was recovered, including bridge voice recordings.

The ship’s propulsion was provided by a 6-cylinder, MAN B&W G70ME-C9.2 engine developing 15,131 kW driving a single, 4-blade, fixed‑pitch, right-handed propeller.

Ship’s crew

At the time of the incident, Hagen Oldendorff was crewed by 20 Chinese nationals, including the master.

The master held a Chinese master’s certificate of competency and had about 28 years of seagoing experience, with about 11 years as master. This was the master’s first time working with Wah Kwong Ship Management HK and also their first time on board Hagen Oldendorff, having joined the ship about 5 months before the grounding. 

The third mate held a Chinese third mate’s certificate of competency and had about 15 years of seagoing experience, with about 6 months as third mate. This was also their first time working with Wah Kwong Ship Management HK and their first time on board Hagen Oldendorff, having joined the ship about 5 months before the grounding.

The helmsman held a Chinese able-bodied seaman’s qualification and had about 9 years of seagoing experience. This was also their first time working with Wah Kwong Ship Management HK and their first time on board Hagen Oldendorff, having joined the ship about 5 months before the grounding.

Hagen Oldendorff had previously called at Port Hedland in November 2021 with the same master, third mate and helmsman on board.

There was no evidence to indicate that the master, third mate or helmsman were experiencing a level of fatigue known to have a demonstrated effect on performance.

Steering gear

Hagen Oldendorff was fitted with a Kawasaki FE21-288 electro-hydraulic 4-ram steering gear. The steering gear consisted of a single rudder and 2 identical hydraulic systems (systems number 1 and 2), each powered by an LV-180 hydraulic pump. The rudder could be put hard-over to a maximum rudder angle of 35° on either side.

The steering gear could be remotely operated from the bridge in 3 main control modes:

• autopilot steering mode
• manual steering mode (follow‑up mode/wheel control)
• non-follow‑up (NFU) steering mode.

In an emergency, the steering gear could also be operated locally from the steering gear room. 

In autopilot mode, the autopilot compares the operator-selected heading against the ship’s heading and transmits rudder angle orders such that the ship remains on, or returns to, the selected heading. There were 2 rudder angle feedback units, which transmitted the rudder angle signal from the rudder to the bridge steering control stand unit. This rudder angle feedback signal was compared to the rudder angle orders issued by the autopilot with the deviation signal driving the torque motor and hydraulic pump to obtain or maintain the commanded rudder angle. 

Similarly, in hand steering mode, when the helm (wheel) is moved manually (Figure 6) to port or starboard, a signal is transmitted to move the rudder. A follow-up or feedback signal is received at the bridge steering control stand and compared to the helm order to stop the rudder at the commanded angle. 

In the NFU mode, when the spring-loaded lever (Figure 6) is operated in the port or starboard direction, the rudder moves in that direction until the lever is released or the mechanical rudder limit is reached. When operating in NFU mode, the helmsman depends upon the rudder angle indicator or other means of knowing what the rudder angle is so that the lever can be released when the desired rudder angle is reached.

The mode of steering operation was selected by means of push-button switches on the bridge console (Figure 6).

An examination of the ship’s planned maintenance system records for the steering gear identified no deficiencies and showed that the scheduled checks and maintenance had been performed.

Figure 6: Hagen Oldendorff's bridge console layout showing steering mode controls

Source: Wah Kwong Ship Management HK, annotated and modified by the ATSB

Rudder angle indicators

The ship was fitted with a Yokogawa RAIS 100 rudder angle indicator system, which included a rudder angle transmitter (in the steering gear room), and 6 analogue rudder angle indicators located as follows:

• a 3-face (omnidirectional) rudder angle indicator mounted on the bridge deckhead (along the ship’s fore and aft centreline and above the bridge manoeuvring console) (Figure 7)
• a rudder angle indicator mounted on the bridge front instrument cluster (Figure 7)
• port bridge wing
• starboard bridge wing
• engine control room
• steering gear room.

The 6 rudder angle indicators had a common power supply protected by one circuit breaker located in a junction box in an electrical cabinet on the bridge.

There were no audible or visual alarms installed to alert crew to the tripping of this breaker or of the loss of electrical power supply to the rudder angle indicators.

Figure 7: Hagen Oldendorff's bridge rudder angle indicators

Source: Wah Kwong Ship Management HK, annotated and modified by the ATSB

Rate of turn indicator

Hagen Oldendorff was equipped a rate of turn (RoT) indicator as required by the regulations. The bridge RoT indicator was mounted on the bridge front instrument cluster (Figure 7). The RoT indicator remained operational throughout the incident.

Shipboard investigation

The post-incident shipboard investigation identified that the tracking motor of the omnidirectional rudder angle indicator (Figure 8, inset) had burnt out and caused a short circuit. This short circuit tripped the common circuit breaker in the bridge cabinet resulting in a loss of electrical power to all the ship’s analogue rudder angle indicators. Consequently, all 6 of the ship’s analogue rudder angle indicators and their associated illumination stopped functioning. 

When the omnidirectional indicator was isolated post‑incident (when the ship was at anchor), all other rudder angle indicators were found to be functional.

Figure 8: Burnt out tracking motor of rudder angle indicator

Source: Pilbara Ports Authority, modified and annotated by the ATSB

Following the incident, Wah Kwong Ship Management HK conducted a survey of the rudder angle indicator power supply arrangement on all the ships managed or operated by the company. The survey identified that almost all the ships (over 20 ships) had a similar rudder angle indicator circuit breaker arrangement to Hagen Oldendorff.

Autopilot system

In addition to the 6 analogue rudder angle indicators, the ship’s Yokogawa PT900 autopilot system display unit (Figure 9) also displayed rudder order and feedback (rudder angle). The autopilot system’s power supply and rudder angle feedback signal were independent of the analogue rudder angle indicators’ power supply and rudder angle signal transmitter. The autopilot rudder angle display remained operational throughout the course of the incident. However, neither the ship’s officers, nor the pilot were aware of this functionality.

Figure 9: Autopilot rudder angle display

Source: Wah Kwong Ship Management HK, annotated and modified by the ATSB

Steering gear drills and tests

SOLAS regulations[22] required that the ship’s steering gear be checked and tested by the ship’s crew within 12 hours before the ship’s departure from port. The testing was to include, among other things, operation of the:

• steering gear and steering gear power unit failure alarms
• remote steering gear control systems and power failure alarms
• steering positions located on the bridge
• emergency power supply
• rudder angle indicators in relation to the actual position of the rudder.

The checks and tests were to include checking the movement of the rudder over its full range of movement, a visual inspection of the steering gear and the operations of the means of communications between the bridge and steering gear room. Hagen Oldendorff’s third mate conducted the ship’s pre-departure steering test with the assistance of a ship’s engineer (in the steering gear room) at about 2330 on 8 April, about an hour before the ship’s departure.

The steering gear tests were conducted using a steering gear test checklist and completion of the test was logged in the bridge and engine room pre-departure checklists. There were no steering gear deficiencies identified as part of the pre-departure steering tests. The steering, including NFU steering, was briefly tested once again in the presence of the pilot at about 0025 on 9 April with no issues noted.

The regulations also required crews to carry out emergency steering gear drills at least once every 3 months to practice direct control of steering gear from the steering gear compartment and the communications procedure with the bridge. Shipboard drill records showed that emergency steering gear drills were last carried out on 24 November 2021 and on 23 February 2022 (about 6 weeks before the grounding).

The drill record indicated that several crew, including the ship’s navigational ratings, practiced operating the local emergency steering and communicating with the bridge using the emergency telephone. Additionally, a review of shipboard training records showed that a training session on emergency steering was conducted on 21 March 2022 in preparation for the port call at Port Hedland.

Emergency steering procedure

The International Safety Management (ISM) Code[23] required shipping companies to develop, implement and maintain a safety management system (SMS), with instructions and procedures to ensure the safe operation of ships and to prepare for, and respond to, emergencies.

Hagen Oldendorff’s SMS included an emergency procedure manual, which contained procedures to be employed in various emergency scenarios, including for a steering failure and grounding. There was no specific emergency procedure for a rudder angle indicator failure.

The steering failure emergency procedure directed crew to carry out the ship-specific emergency steering procedure. It also directed crew to undertake other standard actions such as to inform the engine room and master, consider reducing speed and to make the appropriate broadcasts and communications. Hagen Oldendorff’s emergency steering procedure, posted on the ship’s bridge and in the steering gear room, provided a series of sequential actions and steps aimed at restoring steering control. At each step, crew were to check whether control had been restored and, if not, move to the next step.

The procedure stated that in the event of a loss of steering control:

• if in autopilot mode, change to manual steering mode 
• change from system 1 to system 2 (or vice versa)
• check both hydraulic pumps are ON [both pumps were kept ON for departure and the pilotage] 
• change to NFU steering
• public address system broadcast to crew to muster in the steering gear room
• change to local steering and steer using the pump control knob.

Following the loss of electrical power and illumination to the bridge omnidirectional rudder indicator and the bulkhead-mounted indicator, the ship’s bridge team assumed they had lost steering control of the ship. Subsequently, the pilot and master initiated actions consistent with a response to a steering failure, including ordering the steering gear room be manned and switching to NFU steering and then local steering. 

The ship’s bridge team were unaware of the autopilot’s rudder angle indicator display and the pilot could not see the display from their location forward of the bridge console. Furthermore, following the loss of rudder angle indication, there was no attempt to check whether any of the other rudder angle indicators (on the bridge wings or on the autopilot display) were operational before initiating steering failure response procedures. Therefore, the possibility of a rudder angle indicator failure was probably not considered, and it is unlikely that knowledge of the autopilot indicator display would have significantly altered the sequence of events that led to the grounding. 

Shipboard steering-related emergency procedures also do not typically distinguish between a steering/rudder failure and a rudder angle indicator failure, nor do steering failure procedures include a check to first rule out indicator failure before seeking to restore steering control. In emergency situations, where valuable time may be lost trying to first rule out a rudder angle indicator failure, initiating steering failure procedures and establishing a crew presence in the steering gear room is a reasonable response. 

Shipboard working language

Hagen Oldendorff’s bridge logbook documented that the ship’s working languages were ‘English’ and ‘Chinese’. 

SOLAS regulations[24] required that a working language be established and recorded in the ship’s logbook and that the crew be able to understand, give orders and instructions, and report back in that language. The regulations also required that English be used as the working language for bridge-to-bridge and bridge-to-shore communications as well as for communications between pilots and bridge watchkeeping personnel (unless they spoke another common language). This requirement was also reflected in the Bridge Procedures Guide,[25] an internationally recognised publication reflecting watchkeeping best practice.

The pilot stated that the master’s command of English was reasonable although the helmsman and third mate’s was less so. VDR audio recorded that the helmsman and third mate’s responses to the pilot’s rudder and main engine orders were intelligible and consistent with standard marine phraseology. 

Following the rudder angle indicator failure, communication between the master, third mate and helmsman was predominantly in Mandarin. Furthermore, communications with other crew over hand-held radios and conversations with engineers over the telephone were similarly in Mandarin. Although the master continued to address the pilot and respond to their queries in English, the pilot was unable to understand the operational communications between the rest of the bridge team and between the bridge team and engineers. 

SOLAS requirements impose an obligation on seafarers to learn and communicate in English when it may not be their native language. While most seafarers, in particular senior deck and engineering officers, can be expected to have a working knowledge of English, other crew such as ratings may not. During a shipboard emergency, quick, concise and clear communication is required when issuing orders to, or receiving reports from, crew. Under these circumstances, the master, and others in positions of authority, often resort to communicating with crew in the language they comprehend best. While this may optimise crew communications, it can leave the pilot out of the communication loop. 

A review of recorded VDR audio did not identify any critical information communicated among the crew and engineers in Mandarin that would have significantly improved the pilot’s mental model of the situation in the limited time before the grounding. However, this does not preclude the possibility that there were other conversations, radio traffic or telephone communications in Mandarin not captured by the VDR that may have been useful to the pilot. While the crew’s use of Mandarin excluded the pilot from the communication loop, it probably did not contribute to the grounding.

Rules and regulations

SOLAS regulations

Regulations for steering gear

SOLAS regulations, specifically Chapter II-1,[26] set out the requirements for ships’ steering gear arrangements. The regulations required that every ship be provided with a main steering gear and an auxiliary steering gear, arranged so that the failure of one will not render the other inoperative. In most merchant ships, including Hagen Oldendorff, the steering gear comprised 2 or more identical power units to meet the requirements for main and auxiliary steering gear. 

Steering gear control systems were required to be provided for the steering gear, both on the navigating bridge and in the steering gear compartment. Steering gear control systems were defined as the equipment by which orders were transmitted from the navigating bridge to the steering gear power units and included transmitters, receivers, hydraulic control pumps and their associated motors, motor controllers, piping and cables. Any steering gear control system operable from the navigating bridge had to be equipped with short circuit protection and with audible and visual alarms in the event of an electrical power failure.

SOLAS Chapter V[27] covered the carriage requirements for shipborne navigational systems and equipment. It required that ships of 500 gross tonnage and upwards be provided with rudder indicators or other means to determine and display rudder angle (to be readable from the conning position) and ships of 50,000 gross tonnage and above be provided with a RoT indicator.

The regulations stated that the angular position of the rudder was to be indicated on the navigating bridge and in the steering gear compartment. The regulations also stated that the rudder angle indication systems were to be independent of the steering gear control system.

Code on Alerts and Indicators

The International Maritime Organization (IMO) Code on Alerts and Indicators provided general design guidance to promote uniformity of type, location and priority for alerts and indicators required by SOLAS. The guidance in the Code stated that rudder angle indicators were to be powered from the main source of electrical power and should have an automatic changeover to the emergency source of electrical power in case of loss of normal power supply. 

The Code did not require rudder angle indicating systems be fitted with alarms to alert crew to a loss of electrical power.

Classification society rules

Lloyd’s Register rules

SOLAS regulations also required that ships be designed, constructed and maintained in compliance with the structural, mechanical and electrical requirements of a classification society recognized by the Administration.

Lloyd’s Register (LR) rules and regulations for the classification of ships replicated SOLAS requirements for steering gear arrangement, control systems and rudder angle indicators.[28]

LR advised that, while the automatic power supply changeover arrangements outlined in the Code on alerts and indicators was not reflected in the minimum requirements of LR rules, there were optional notations available to shipowners that allowed for increased resilience in navigational systems (including rudder angle indicator systems).

For example, ships bearing the ‘NAV1’ notation were required to have an automatic changeover to an alternative main source of electrical power supply for navigational aids. Similarly, LR advised that the rules for the integrated bridge systems, ‘IBS’ notation could be interpreted to require ships bearing that notation to have each item of electrically operated navigational equipment be individually connected to its distribution panel and that failure of any power supply to the distribution panels were to initiate an audible and visual alarm.

Hagen Oldendorff did not hold the NAV1 or IBS notations, nor was it required to.

Other classification society rules

Different classification societies had different requirements for rudder angle indicator systems. For example, Det Norske Veritas (DNV) rules for some ships included a requirement that the rudder angle indicating system be arranged such that a single failure in power supply or anywhere in the indicating system did not cause loss of rudder angle indication on the bridge.

Summary

Hagen Oldendorff complied with the minimum requirements of the SOLAS regulations and LR classification society rules for rudder angle indicators. 

The applicable rules and regulations did not require the ship’s rudder angle indicators be protected against a single point of failure, such as the tripping of the common circuit breaker, which resulted in a loss of electrical power supply to all the indicators. Additionally, they did not require installation of audible or visual alerts to notify the bridge team of a loss of power supply affecting the indicators.

Port Hedland

Introduction

Port Hedland, located in the Pilbara region of Western Australia (WA), is the world’s largest bulk export port, with more than 6,000 shipping movements (inbound and outbound) annually. The port predominantly serves the mining industry of the Pilbara and facilitates an annual throughput of more than 500 million tonnes of cargo.[29] While iron ore is the port’s dominant export trade, its trade base also includes salt, manganese, copper concentrates, livestock, lithium mineral and tourism (cruise ships).

Port Hedland has 19 operational berths. Of these, BHP[30] owns and operates 8 berths while Fortescue Metals Group (5 berths), Roy Hill Infrastructure (2 berths) and the Pilbara Ports Authority (4 berths) own and operate the remaining berths. Port Hedland is the sole export route for the Pilbara iron ore assets of BHP, Fortescue Metals Group (FMG) and Roy Hill Iron Ore. 

Port Hedland Channel

The port is served by a 22-mile (40 km) dredged channel that allows a single ship to traverse it at any given time. The 10-mile section of the channel closest to the port is highly confined with insufficient depths immediately adjacent to the channel to allow vessels to exit during an emergency. The channel is also tidally restricted for most laden ships including capesize ships such as Hagen Oldendorff. 

These characteristics make the risk associated with a channel blockage significant. Furthermore, given the time between consecutive ship departures, separation distances between ships and depending on where in the channel the ship experiences the failure and founders, there could be up to 3 other vessels committed to, or within the channel, that would also be at risk as the tide recedes.

The Port Hedland navigation channel was divided into 6 zones (Figure 10) based upon navigational or environmental characteristics that would impact the risk within that zone. These characteristics included location, channel alignment, bathymetry, channel slopes and sea conditions.

The channel was divided as follows:

• Zone 1 – the inner harbour and berths
• Zone 2 – the inner harbour and berths to the south-west of zone 1
• Zone 3 – from the outer limit of the inner harbour at Hunt Point to beacons 36-37
• Zone 4 – from beacons 36-37 to 30-31
• Zone 5 – from beacons 30-31 to beacons 15-16
• Zone 6 – from beacons 15-16 to the termination of the channel at beacons C1-C2.

Ships in zones 1 and 2 were generally manoeuvred at low speed, although subject to large tides and currents when manoeuvring or berthed. Depths in the inner harbour were reported to be maintained at about 14.9 m.

In zone 3, the channel is narrow with steep channel batters and the potential for strong currents. This zone features a turn requiring a 71° course alteration into the Goldsworthy section of the channel and water depths outside the channel can be less than 1 m deep at lowest astronomical tide (LAT). 

The section of channel in zone 4 is straight but also narrow with steep batters and the water adjacent to the channel is generally less than 6 m deep at LAT. Inbound vessels in ballast generally enter the channel from seaward of beacons 30-31. The channel depth in zones 3 and 4 are reported to be maintained at about 15 m. The transition from zone 4 into zone 5 involves an 18° course alteration into the Newman section of the channel.

The section of channel in zone 5 is relatively straight with a 13° course alteration of course for outbound vessels. The channel batters become significantly shallower from zone 5 onwards and water depths outside the channel are predominantly greater than 10 m with scattered shoal patches. 

In zone 6, water depths outside the channel are predominantly greater than 15 m and, in places, exceeds the maintained channel depths which vary between 16.2 m and 18 m. This zone has the added benefit of an emergency passing lane, along the western edge of the channel.

The channel has a minimum width of about 162 m in the Goldsworthy and Newman sections (zones 4 and 5). The batter slope along the channel margins are a significant factor influencing the risk of a ship grounding on the seabed, as opposed to the ship contacting the seabed and being deflected away from the channel batter. Zones 5 and 6 have shallower batter slopes compared to zones 3 and 4. As a result, if a ship grounds in zone 5, the contact area between the ship hull and seabed is larger, making the ship harder to re-float.

The wave conditions in the Port Hedland channel steadily increase from zone 3 through to the end of zone 5, which is generally where the most severe sea conditions are experienced. Wave conditions are generally most severe in December and January, and most mild in July and August.

Hagen Oldendorff grounded on the western side of the channel in zone 4, between beacons 37 and 35 (Figure 3).

Figure 10: Port Hedland channel zones

Source: Pilbara Ports Authority

Channel damage

On 11 April 2022, the Pilbara Ports Authority (PPA) commissioned a survey of the area of the channel between beacons 36-37 and beacons 34-35. The survey data identified that Hagen Oldendorff had impacted an area of the western batter about 500 m long (Figure 11) resulting in bank collapses extending between 7–21 m into the channel. 

Figure 11: Survey data showing channel batter impact damage

Source: Pilbara Ports Authority, modified and annotated by the ATSB

Management of channel risk

The Pilbara Ports Authority (PPA) (see the section titled Pilbara Ports Authority) maintained a risk management policy and a port strategic risk register (see the section titled Port strategic risk register) to identify and manage risks to the port, including the risk of a channel blockage. In order to effectively manage this risk, the PPA and other major stakeholders, including BHP, invested significant effort to define the drivers of incidents that could lead to a channel blockage and to identify preventative and mitigating controls. 

The primary drivers of a marine incident that could contribute to a blockage of the Port Hedland channel were assessed to be main engine failures/slowdowns, steering incidents, mooring failures and hull/structural failures. Of these, incidents arising from main engine failures/slowdowns and steering incidents resulting in a loss of navigational control were assessed as being most likely to result in a channel blockage.

The port’s assessment of past incident and near-miss data showed that engine-related incidents were far more likely than steering incidents but that steering incidents were more likely to result in a channel blockage. A 2019 channel blockage mitigation study by BHP identified that the likelihood of steering incidents was about 0.024% per manoeuvring hour with past incident data indicating an incidence of about 1–2 steering incidents per year. However, the study also acknowledged that there was insufficient information to identify the root causes of these steering incidents and that they broadly included rudder failure, system fault and human error.

A review of the port’s risk register identified that the PPA had several risk controls in place to prevent incidents that could result in a loss of navigational control and to mitigate the risk of a ship grounding or stranding blocking the channel in the event such an incident occurred. These controls included:

• pre-arrival declarations by ships to confirm the operational status of all critical machinery
• testing of emergency engine and steering control systems (such as NFU steering)
• vessel traffic services
• the use of a dynamic under keel clearance system
• vessel quality assurance processes
• incident emergency response procedures 
• emergency exercises to train pilots and tug masters
• pilotage 
• towage.

Towage in Port Hedland

The tugs in Port Hedland were operated under towage licences granted by the PPA to BHP Towage Services (BHPTS) and Pilbara Marine (a subsidiary of FMG). Rivtow were contracted to operate the tugs under the BHPTS licence, while KOTUG operated tugs under the Pilbara Marine towage licence. Table 1 below outlines the composition of the Port Hedland tug fleet at the time of the grounding.

Table 1: Port Hedland tug fleet

The Z-Tech tugs were equipped with 2 azimuth thrusters[31] located aft, each driven by a 1,864 kW main engine in a z-drive configuration.[32] The tugs were designed with a relatively low forward sheer to allow the tugs to work in close proximity under the flare of ship’s bows. 

The RT80-32 rotortug used a propulsion arrangement with 2 azimuth thrusters forward and a third azimuth thruster aft in place of the traditional skeg arrangement. Each azimuth thruster was driven by a 1,654 kW main engine in a z-drive configuration.

The ART80-32 advanced rotortug used a similar propulsion arrangement to the RT80-32 but with hybrid propulsion, enhanced manoeuvrability and greater redundancy. The ART80-32 tug’s azimuth thrusters were each driven by a 1,765 kW main engine in a z-drive configuration.

The ART85-32W evolved from the ART 80-32 design and offered a modified hull form for increased stability during escort duties, improved manoeuvrability and higher bollard pull.[33] 

The RAstar85 tugs were azimuth stern drive tugs with 2 azimuth thrusters located aft, each driven by a 2,550 kW main engine in a z-drive configuration. These tugs were designed with improved winches and with an increased bollard pull similar to that of the ART85-32W tugs.

Environmental conditions

The prevailing environmental conditions at the time of the grounding were within normal operating parameters for ship movements at Port Hedland. 

A PPA monitoring station at beacon 42 recorded conditions at the time of the incident as being south-south-westerly winds at about 6 knots, with a south-south-easterly near-surface current of about 0.45 knots and estimated wave heights of about 0.5 m. The monitoring station further north at beacon 31 recorded southerly winds at about 10 knots, gusting to 14 knots and a south‑south‑easterly near-surface current of about 0.4 knots with estimated wave heights of about 1 m.

Anemometer readings recorded on Hagen Oldendorff’s VDR showed that wind in the inner harbour at the time of the ship’s departure was south-south-westerly at about 6 knots while the wind at the time and location of the grounding was west-south-westerly between 10–12 knots.  

Port Hedland escort towage strategy

Background

In 2008, following the grounding of the capesize bulk carrier Iron King in Port Hedland (see the section titled Similar occurrences), the port authority identified that in emergency situations under adverse operating parameters the benefit of the port’s then 65 tonne tugs was marginal, even when fast. With projected increases in ship size and numbers calling at Port Hedland, escort towage was identified as a viable mitigating strategy against channel blockage due to incidents such as Iron King’s grounding. 

In 2013, BHP developed a detailed risk framework to quantify the channel blockage risk at Port Hedland and to recommend a mitigation strategy. The study identified adequate escort towage as the most effective strategy. BHP subsequently commissioned Baird Australia to review and assess the towage capacity requirements for Port Hedland. This project included extensive analyses and consultation to determine the size, type and number of tugs necessary to mitigate potential channel blockage incidents. The analyses included:

• physical modelling of vessel grounding at the Council for Scientific and Industrial Research (CSIR) in South Africa
• desktop and full-mission navigation simulations of emergency scenarios involving capesize ships at FORCE Technology in Denmark
• sea trials at Port Hedland.

The physical modelling assessed the outcomes of grounding and contact with the channel batter at various speeds and impact angles. The results indicated that at higher speeds and greater angles of impact, greater damage resulted, and a larger force was required to remove the vessel from the channel batter.

The results of the analyses identified that optimisation of the use and configuration of the port’s existing tug fleet could reduce the impacts of main engine or steering failures of capesize ships during departures. Additionally, data from sea trials indicated that tug towlines were experiencing shock loads of up to 40 t when towing in sea states over 1.5 m. Analysis of the safe working loads (SWL) of bitts[34] on capesize ships showed that the most common SWL was between 65­–70 t and that the port’s tugs could generate tow forces well in excess of this value. 

The project recommended that BHP invest in tugs with improved escort towage capability (RAstar85 tugs) to further mitigate the risk of channel blockage and, in the meantime, develop and implement an interim escort towing strategy. The port subsequently also mandated an increased SWL for bitts on ships calling at Port Hedland.[35] 

Interim escort towing strategy (2013)

The interim escort towage strategy provided guidance to optimise the use of the port’s existing Z‑Tech and RT80-32 tugs while the RAstar85 tugs were built. The number of tugs and their configuration were based on the channel zone that the ship was navigating in. The tug arrangements recommended as part of the interim strategy for departing capesize ships in zone 3, zone 4 (where Hagen Oldendorff grounded) and zone 5 were:

Zone 3 

An RT80-32 tug was to be tethered to the stern of the ship and a Z-tech or RT80-32 tug tethered to either shoulder of the vessel. All tugs were to remain tethered to the ship until beacons 36-37.

The escort tug utilisation procedures in the event of an emergency (such as a steering failure) in zone 3 called for the pilot to initially use the main engine and the 2 tethered shoulder tugs as a brake, to reduce the ship’s speed. The aft tug could then be used in the indirect towing mode to control the RoT and, once the ship was under control, to provide steering forces to conduct the ship to a safe location.

Zones 4 and 5

In zones 4 and 5, an RT80-32 tug was to be tethered to the stern of a departing ship until beacons 15‑16 with an untethered tug (a Z-Tech or RT80-32 tug), off either the port or starboard quarter.

The procedures in the event of a steering failure in zones 4 or 5 were largely dependent upon the prevailing sea state, specifically, the significant wave height (Hs).[36] The conventional (static brake) winches installed on board the Z-Tech and RT80-32 tugs generally resulted in a reduction in effective towline force as sea states increased. Additionally, actively operating tugs with such conventional winches in moderate sea states presented safety hazards for the tug and crew.

When wave heights were less than 1 m, the pilot was to use the tethered aft tug in indirect towing mode to control the ship’s heading and then slow the ship to allow the passive escort tug to make fast at the bow. In wave heights between 1 m and 1.5 m, the aft tug was to initially provide indirect braking forces only (to avoid shock loading of the towline) until the ship had been slowed sufficiently to apply direct steering forces.

Once the vessel’s heading was controlled and the ship’s speed was less than 6 knots, the passive escort tug could be tethered at the bow. In wave heights above 1.5 m, the aft tug was to provide whatever assistance was deemed possible by the tug master until the ship’s heading was controlled, and speed reduced to less than 6 knots, when the passive escort standby tug could be made fast at the bow.

Other measures and outcomes

Other key measures recommended as part of the interim strategy included:

• restricting ship speeds to 8 knots when tugs were made fast
• ensuring pilots and tug masters were aware of the SWL of the aft towing bitts
• implementing indirect towing training programmes for tug crews.

Following implementation, the effectiveness of the interim escort towing strategy was reviewed and evaluated. After further studies and simulations, the specifications for the proposed RAstar85 tugs were refined. In September 2014, further simulations were undertaken to assess various tug configurations using the anticipated RAstar85 tug in the active escort role tethered aft of the ship. 

The simulations identified that a single escort tug tethered aft, and a tug tethered to each shoulder of the ship, was the preferred configuration in zones 3 and 4. A final design for the new tugs was submitted for construction tender in October 2014. 

Escort towage strategy (2015)

Introduction

In June 2015, construction of the new tugs and a new tug harbour in Port Hedland was approved. As part of the tug and tug harbour project, BHP developed an escort towage strategy to ensure that the future RAstar85 tugs were operated in conjunction with the existing tugs in a manner that would most effectively mitigate the risk of channel blockage from capesize ships. Additionally, BHP added 4 new ART80-32 tugs to the Port Hedland fleet that same year. The ART80-32 tugs were equipped with an improved sea-keeping and rendering winch with the capability to provide effective towage in sea states up to 1.5 m.

The BHP escort towage strategy (2015), developed by Baird Australia, documented the procedures, guidelines and tug allocations developed as an outcome of the various studies, simulations, exercises and consultation conducted as part of tug and tug harbour project and channel blockage risk mitigation initiatives. The document noted that the guidelines were developed with input from the PPA and Port Hedland Pilots (PHP), among others, and that adopting these guidelines could materially reduce the risk of a ship grounding and blocking the channel at Port Hedland.

The strategy required that, while tugs were tethered to the ship, the ship’s speed should not exceed 8 knots, and the ship was to be maintained on a track as close to the centreline of the channel as possible.

The document noted that, in the event of an emergency scenario, such as a rudder or engine failure, minimising the time between the onset of the emergency and the recognition and initiation of procedures by the pilot (stopping the ship’s engine and issuing commands to the tugs) was of extreme importance. In particular, it emphasised that measures to quickly assert control over the RoT of the ship was key to a successful outcome.

The strategy defined the following specific tug allocation guidelines and escort towing procedures for outbound capesize ships in zones 3 and 4:

Zone 3

A RAstar85 tug was to be made fast aft with a Z-Tech, RT80-32 or ART80-32 tug fast on each shoulder.

During an emergency in zone 3, the vessel’s speed was to be reduced using the main engine astern and the shoulder tugs to pull back and provide a braking force. To control the RoT, the aft tug was to rapidly move into the required position and apply an indirect steering force. Once the RoT was controlled and the ship was aligned parallel to the channel batter, the aft tug could be used to provide further braking forces. Once the vessel was fully under control, and the speed less than 4 knots, the shoulder tugs could be used to manoeuvre the vessel towards the channel centreline, while the aft tug provided steering forces, as required.

Zone 4

The guidelines stated that a RAstar85 tug may remain tethered aft if required to provide steering forces. Additionally, providing sea conditions were suitable, the shoulder tugs were to remain tethered to the ship to provide braking forces or to tow a disabled ship to safety. The shoulder tugs could be cast off at the end of zone 4 (beacons 30-31) and one of the tugs dismissed with the other retained as a passive escort at the bow through zone 5.

In the event of a steering emergency in zone 4 in sea states less than 1.5 m, the aft tug was to rapidly move into the required position and apply an indirect steering force while the shoulder tugs were used as a brake. Once the vessel’s heading was controlled, the pilot could use the aft tug to further reduce the speed to less than 6 knots, allowing the shoulder tugs to move to a towing position.

The shoulder tugs could then tow the vessel to a suitable anchorage, or to the end of the channel, while the aft tug provided steering forces. The strategy document noted that the RAstar85 tugs should be able to effectively perform the same manoeuvres in sea states greater than 1.5 m, although the tug masters of the shoulder tugs would need to determine whether they could remain tethered during moderate sea conditions and the extent of the assistance possible.

Summary

The strategy recommended that, for all sea states up to 3 m, a RAstar85 tug remain tethered to the stern of departing capesize ships until beacons 15-16 (end of zone 5). Between Hunt Point and beacons 30-31 (zones 3 and 4), tugs were to be tethered to both shoulders and, under normal conditions, both these tugs could be cast off at beacons 30-31 (end of zone 4), with one dismissed and the other retained as a passive escort until beacons 15-16 (end of zone 5). At beacons 15-16, both the active escort tug aft and the passive escort tug could be dismissed. Ships were not generally escorted in zone 6, except in the case of an emergency or if the ship was deemed to require escort towage until clear of port limits. 

Implementation of the escort towage strategy

In 2016, a risk review was undertaken to assess the potential to further reduce the risk of, and impacts associated with, a channel blockage at Port Hedland. The study identified several initiatives to be explored for further channel risk mitigation namely:

• engineering controls, such as channel modifications and the possibility of a bypass channel
• operational controls, such as further towage improvements and mitigation plans to restore partial channel capacity in the event of a channel blockage.

In 2017, the Port Hedland working group (PHWG) was established with representatives from the PPA, BHP (and their technical representative - Baird Australia), PHP and other stakeholders, to review channel blockage risk, identify new risk management options and evaluate ongoing controls. That same year, the new tug harbour at Hunt Point and new RAstar85 tugs became operational with the first 2 tugs delivered in April 2017. The RAstar85 tug was equipped with a render/recover winch,[37] designed to be capable of performing the necessary indirect towing manoeuvres in sea states up to 3 m.

Following the introduction of the RAstar85 tugs in 2017, the recommended guidelines in the escort towage strategy began to be trialled and implemented to various degrees.

By April 2018, the BHPTS tug fleet at Port Hedland comprised 6 RAstar85 tugs, 4 ART80-32 tugs, 7 RT80-32 tugs and 2 Z-Tech tugs. 

On 23 September 2019, during a PPA forum titled ‘Safe Ships – Safe Ports’, a BHP presentation titled ‘Best Practice Towage Standards’ stated:

The Port continues to work in a collaborative way with Pilots and Towage to find operational improvements that can be implemented without significant cost or investment. 

Trials for enhanced escort towage include:

• Shoulder tugs being kept fast to B30/31 (where possible)

Similarly, on 18 November 2019, at a quarterly strategic review meeting of the BHP towage license, covering the quarter from August to October 2019, under the heading Continuous improvement – Channel risk reduction trials’, the meeting minutes recorded the following:

Shoulder tugs remaining fast to B30/31 

• No concerns have been raised during the quarter and this is being achieved where conditions are favourable.

Updated escort towage strategy (2020)

Introduction

In July 2020, BHP consolidated and updated the escort towage strategy into a stand-alone document titled ‘Escort Towage Strategy – Port Hedland Working Group’. The document’s stated intent was to present information and guidelines related to escort towage at Port Hedland and to assist the PPA, pilots, tug masters, towage operators and other stakeholders to understand the rationale for escort towage and provide guidelines to support effective escort towage operations.

The document noted that the strategy had been updated to reflect current and potential future escort towage practices as a result of a number of enhancements in the port’s towage capabilities, including:

• completion of BHP’s tug and tug harbour project and commencement of operation of the RAstar85 tugs
• commencement of Pilbara Marine’s towage under the FMG towage licence, including the use of the ART85-32W tugs
• improvements in tug master training and competency assessment
• incremental enhancement to escort towage practices led by the PPA, pilots, tug masters and towage operators
• increased knowledge, escort towage performance information and development of improved escort towage guidelines through the work completed to date by the PHWG on channel blockage risk.

Objectives

The strategy document’s listed primary objectives, among others, were to:

• provide a summary of the drivers behind escort towage at Port Hedland, which is to assist an escorted ship to maintain manoeuvrability and navigate within water of sufficient depth to prevent a ship grounding, and the potential consequential impact of channel blockage
• document escort towage procedures that have been identified as effective at preventing a ship grounding and potential channel blockage through research, simulation and on-water trials. 

The document noted that escort towage was a critical mitigative control to prevent a ship grounding in Port Hedland and that steering- or main engine-related incidents resulting in loss of navigational control were the likely causes for a grounding incident leading to channel blockage. 

Escort tug fleet

The updated towage strategy stated that the primary escort-capable tugs at Port Hedland were the RAstar85 tugs (6) and ART80-32 tugs (4) operated by Rivtow, and the ART85-32W (8) tugs operated by KOTUG. It also noted that, of these tugs, the RAstar85 tugs and the ART85-32W tugs were the primary aft active escort tugs for laden capesize ships.

Tug allocation guidelines

The escort towage strategy document stated that the most up-to-date information on tug allocations were those in the Port of Port Hedland - Port User Guidelines and Procedures available on the port’s website (see the section titled Pilbara Ports Authority).

The strategy largely replicated the tug allocations outlined in the 2015 escort towage strategy. 

Zone 3

It stated that, in zone 3, laden outbound ships would typically require 3 tugs and that the primary escort tug aft was to be the most capable tug asset available for the ship movement. It stated that the other 2 tugs should have their towlines tethered on the port and starboard shoulders of the ship prior to, and throughout zone 3, except where weather or other conditions made it unsafe to do so (Figure 12).

The strategy document noted that, in the event of a steering incident, navigation simulations had consistently demonstrated that pilots should initially instruct the aft escort tug to provide steering forces to counteract the rudder and control the heading before considering using the aft tug to provide braking forces to reduce speed. The shoulder tugs were to initially be used to provide braking forces and as ship’s speed reduced to less than 4 knots, the shoulder tugs could be used to control the ship’s bow.

The escort strategy emphasised that the shoulder tugs should maintain their towlines tethered as long as they could safely do so depending on the prevailing sea state. It also stated that, in all emergency scenarios in zone 3, having the shoulder tugs with their lines tethered was preferable so the tugs could immediately provide braking forces and assist with controlling the ship’s bow.

Zone 4

The towage strategy stated that the tug allocation in zone 4 was the same as zone 3 (Figure 12). Similarly, the escort towage procedure in the event of a steering incident in zone 4 was largely identical to that in zone 3, although the strategy noted that the channel was straight but narrower in zone 4 with ships generally making way at a higher speed (7–8 knots).

Importantly, the escort strategy stated that:

The shoulder tugs should maintain their towlines tethered as long as they can safely do so depending on their exposure to the prevailing sea state and interaction with the ship.

It also stated:

In all emergency scenarios in Zone 4, having the shoulder tugs with their lines tethered is preferable so that they can immediately provide braking forces and also be positioned to assist with controlling the position of the ship’s bow when the speed of the ship reduces.

Figure 12: Recommended tug configuration for capesize ships in zones 3 and 4

Source: BHP, modified and annotated by the ATSB

Stakeholder actions

The escort towage strategy directed the following actions, among others, be implemented by the key stakeholders involved in executing the strategy:

• Pilots to adopt the recommended escort tug configuration as presented in the strategy and use the escort tugs appropriately during emergencies
• Tug masters to seek towage practice opportunities and continually improve towing techniques
• Pilots and tug masters to conduct regular emergency training simulator sessions
• PPA to monitor pilot and towage operator competency and performance and conduct ongoing reviews of operating procedures and guidelines to support best practice pilotage and towage operations. 

BHP subsequently submitted the escort towage strategy document to the PPA for review and official endorsement (see the section titled Pilbara Ports Authority).

BHP towage scheduling guidance

The BHP towage scheduling guidelines directed that the ideal tug allocation for an outbound ship was to assign an RAstar85 tug as the active escort tug aft and ART80-32 tugs for the shoulder tugs. However, the guidelines also acknowledged there would be exceptions and circumstances when the ideal allocation could not be achieved (for example, assignment to other ships, unplanned maintenance or tug crew training and availability). Under those circumstances, ART80‑32 tugs could be used as active escort tugs and RT80-32 tugs could be used as passive escorts.

Hagen Oldendorff’s aft active escort tug, RT Clerke, was an ART80-32 tug. At interview, the ship’s pilot advised that while it was unusual not to be assigned a RAstar85 tug for the aft active escort role, they were satisfied that the assigned tugs were adequate for the pilotage.

Table 2 below details the specifications of the 4 tugs assigned to Hagen Oldendorff on the morning of the grounding:

Table 2: Hagen Oldendorff's tugs

BHP stated that RAstar85 tugs and ART80-32 tugs were both routinely deployed as the aft active escort tug for capesize ship movements. BHP advised that the capabilities of both tug types were largely similar in the relatively moderate sea conditions prevailing on the night and that the improved escort performance of the RAstar85 tugs was only significant on those days when sea and wave conditions in the channel were particularly adverse.

BHP also advised that both tug types were certified for open water escort with on-water escort performance notations (EPN) issued by Lloyd’s Register (see Appendix B) and that all 4 assigned tugs and their crews were appropriate, capable and experienced. Furthermore, during the indirect towage training, when RT Clerke was being used to assist Hagen Oldendorff’s turn in the channel, the tug master reported generating tow forces of up to 81 tonnes. This was not significantly different to the maximum bollard pull of the RAstar85 tugs and therefore, it is unlikely that the allocation of a RAstar85 tug for the aft active escort role would have resulted in a significantly different outcome on the night.

Escort towage performance

RT Clerke

Following the rudder indicator power failure, the pilot ordered RT Clerke to apply indirect steering force to pull the stern to starboard. RT Clerke’s master acknowledged the order and set about manoeuvring the tug to the starboard quarter. About 30 seconds later, the tug passed astern of the ship to starboard and although not in its optimal towing position probably started applying some tow force. The tug’s approximately 30-second transition time from the port quarter across the ship’s stern to the starboard side was reasonable, within the observed response times in BHP and the port’s towage studies’ sea trials.

Similarly, when the pilot ordered RT Clerke to take the stern to port, the time for the tug’s transition from the starboard quarter until it crossed the ship’s stern to the port side and began applying tow force was about 38 seconds. The tug was in its optimal towing position and likely applying full indirect steering forces on the port quarter about 20 seconds later. 

Following the ship’s impact with the channel batter, the pilot ordered RT Clerke to pull the stern to starboard. However, RT Clerke’s master did not immediately acknowledge the pilot’s order and continued pulling the stern to port possibly because they did not hear the VHF transmission, or because they were focused on the task at hand. About a minute later, the pilot ordered RT Clerke to stop applying any force, which the tug master then acknowledged. The ship was recovered to the centre of the channel and stabilised shortly after and therefore, it is unlikely that the brief period when RT Clerke continued to pull the stern to port unduly increased risk. 

RT Inspiration 

About 30 seconds after the power supply to the rudder angle indicators failed, the pilot ordered RT Inspiration’s master to make fast again. As the tug master and ship’s crew worked to reconnect the tug, the pilot ordered RT Inspiration to ‘push full’ on the ship’s port bow. The tug master acknowledged the order and immediately began pushing. RT Inspiration continued pushing on the ship’s port side until about 20 seconds after the ship struck the channel batter when the pilot ordered the tug to stop. Hagen Oldendorff’s master informed the pilot that RT Inspiration was made fast at 0141, just over 2.5 minutes after the pilot’s order to make fast. This was a reasonable response time and less than then the average time to make fast (3 m 52 s) observed in BHP and the port’s towage studies’ sea trials.

RT Atlantis 

About a minute after the indicator failure, the pilot ordered RT Atlantis to make fast on the starboard bow. However, before the tug could be made fast, the pilot ordered RT Atlantis to move to the starboard quarter and push. About 40 seconds later, as RT Atlantis was getting into position, the pilot ordered the tug to ‘push full’ on the starboard quarter. About 10 seconds later, the tug was in position and pushing. The tug continued to push until ordered by the pilot to stop and make fast on the starboard bow shortly after the ship struck the batter. The time taken by the tug to transition from the starboard bow to get into its optimal position to push on the starboard quarter was just under 1 minute.

Pilbara Ports Authority

The port of Port Hedland is managed by the Pilbara Ports Authority (PPA),[38] which has overarching responsibility for safety and efficiency of port operations and the environment under the Western Australia state legislation. The jurisdictional responsibilities of the PPA are exercised through the designated port harbour masters.

Port Hedland operated a vessel traffic service (VTS) delivering information, advice and instructions to vessels, including scheduling, berthing and pilot transfer information. The port also operated a dynamic under keel clearance (DUKC) system to optimise cargo loading and determine sailing windows.

The PPA published several documents providing information and guidance on port operations and shipping movements. These included:

• Port of Port Hedland – Port User Guidelines and Procedures
• Port of Port Hedland – Vessel Movement Protocols
• Port Handbook.

The latter 2 documents both directed port users to the port user guidelines and procedures as the authoritative document regarding shipping movements and towage requirements. 

Port user guidelines and procedures

The port user guidelines and procedures document was intended for use by all personnel and organisations engaged in shipping and provided guidelines governing the movement of vessels at the Port of Port Hedland. The PPA had the statutory authority to give effect to these guidelines and procedures within port limits.

The document included a section on tug allocation and towage strategy. The document advised that vessels departing the Stanley Point berths (where Hagen Oldendorff departed from) required a minimum of 4 tugs. The procedures stated that a dedicated active escort tug was to be positioned and secured aft for all departing deep-draught capesize vessels from the berth to beacons 15-16 (end of zone 5). It also stated that a dedicated passive escort tug may be positioned forward for all departing deep-draught capesize vessels from the berth to beacons 15‑16. 

The port procedures provided no further detail on the disposition, retention or use of the escort tugs.

Port strategic risk register

The port strategic risk register was formally reviewed on an approximately biannual basis by the port strategic risk review committee, which included representatives from the PPA, BHP, FMG, PHP and the towage providers. Channel blockage was an identified risk in the register with several associated risk controls documented including the escort towage strategy. 

The risk register documented that a business continuity plan (BCP) for channel blockage was first added as a proposed risk control in May 2018. In June 2019, a risk treatment action plan was added to the register relating to the channel blockage aspect of business continuity and in November 2019, the register noted that the PPA harbour master had presented the BCP to the committee. 

A review of records of minutes of the port strategic risk review committee from 2020, 2021 and 2022 showed that the channel blockage risk and associated risk controls, including the BCP, were a common subject of discussion. 

Business continuity plan (2020)

In May 2020, the PPA issued a document titled ‘Port of Port Hedland Business Continuity Plan for Channel Blockage.’ The business continuity plan (BCP) outlined the port’s risk management approach for channel blockage. It was intended as a summary document that provided information, options and recommendations to maintain continuity of operations in the event of a channel blockage and to guide ongoing preparedness for such an incident. The BCP noted that, in addition to a large array of information prepared by the PHWG, the BCP also utilised technical information from the various studies, simulations and trials conducted by BHP as part of the tug and tug harbour project and the development of the escort towage strategy.

The BCP reiterated risk assessment evaluations from previous studies, which confirmed that main engine slowdowns/failures and steering incidents that result in a loss of navigation control were the most likely incidents that could result in a channel blockage. It also stated that historical incident data and simulations indicated that the time available to respond to a steering incident and prevent a ship grounding was typically 60–90 seconds, if the escort towage risk controls were not implemented.

The BCP noted that there were 2 primary mitigating risk controls in the event of a ship control failure in the channel – shipboard emergency response procedures (initiated by the pilot and ship’s crews) and the tug fleet at Port Hedland. 

The BCP also stated that work completed by the PPA and the PHWG had identified a number of opportunities to further reduce the risk of channel blockage. Among these measures, the BCP identified improvements in towage procedures and stated the following as a ‘recently implemented towage practice’: 

In Zone 4, improvement in towage for inbound and outbound ship movements has been implemented. For outbound ship movements, tugs are tethered to each shoulder of the ship with their towlines remaining attached thru to B30/31, whenever possible. In so doing, simulations have indicated that the effectiveness of the deployed tug fleet improves, and Pilots have more options to manage ship control failures, including engine and rudder failures. In some moderate sea state conditions, certain tugs within the fleet may not be able to maintain their towlines on the windward side of the ship; however, for the majority of ship movements, shoulder tugs should be able to maintain their towlines to B30/31.

In the event of a channel blockage, the BCP stated that the PHWG had identified 2 options to provide partial business continuity – the development of a shallow water bypass channel and a slow speed passing of a grounded ship. The BCP documented considerations of the feasibility of the 2 options and identified further actions and recommendations to support the development and future implementation of these options.

Draft escort towage strategy (2020)

Following BHP’s submission of the escort towage strategy to the PPA in July 2020, the entire contents of the document was transferred to a PPA document template. This ‘draft’ PPA escort towage strategy document did not progress further and remained in draft format at the time of the Hagen Oldendorff grounding. 

During the ATSB investigation, the Port Hedland harbour master acknowledged receipt of the BHP escort towage strategy but advised that it remained a draft PPA document. The harbour master stated that towage allocation and strategy was to be conducted as directed by the port user guidelines and procedures and the BCP. The harbour master advised that, while pilots retained operational discretion, the contents of the BCP required that the shoulder tugs be kept fast until beacons 30-31 unless prevented from doing so due to environmental conditions. 

Port Hedland Pilots

Provision of pilotage services

Port Hedland Pilots (PHP) was established in 1995 and were contracted by the PPA to provide pilotage services in Port Hedland. The individual pilots were employed by PHP and licensed by the PPA. The PHP contract with the PPA provided for 14 permanent pilot posts, with 2 pilots employed to fill each post, for a total strength of 28 pilots. PPA consideration and approval for additional pilot posts was contractually linked to projected shipping movements and the PHP fatigue risk management plan.

PHP typically maintained 14 pilots in Port Hedland at any given time to provide pilotage services, although the actual number available for duty could be less due to pilots being away for training or due to delays in filling posts of pilots who had retired or resigned or due to other circumstances. 

Pilots typically worked a 4‑week duty period in Port Hedland followed by 4 weeks off and most pilots, including the incident pilot, operated on a fly-in-fly-out basis.

The pilot

The pilot on board Hagen Oldendorff had about 14 years’ sea going experience prior to taking up the role of a pilot in 2004. They had worked as a pilot in several ports around Australia, before joining PHP in 2015 and obtaining their unrestricted pilots license in 2018. At the time of the occurrence, the pilot held an Australian master’s certificate of competency, an unrestricted pilot’s licence for Port Hedland and had conducted over 1,700 ship movements in the port. 

The pilot had commenced a 4-week duty period in Port Hedland on 28 March 2022, 10 days before the Hagen Oldendorff grounding.

Fatigue

As outlined in Appendix C, the ATSB conducted a detailed analysis of the potential for pilot fatigue to have contributed to this serious incident. In summary, while there were factors that potentially reduced the pilot’s ability to obtain sufficient, restful sleep of the required quality, there was insufficient evidence to establish that the pilot’s sleep quantity and quality was impaired to the point where they were likely experiencing a level of fatigue known to have an effect on performance.

Safety management system

PHP operated under an SMS as a condition of the pilotage services contract with the PPA.[39] The SMS comprised various policies, procedures and forms relevant to PHP operations including procedures related to passage planning, conduct of towage and emergency procedures.

Passage planning procedure

The SMS procedure on passage planning was aimed at ensuring that all pilots met a minimum standard for pilotage passage planning. The procedure covered considerations for planning the ship movement, the content of the master-pilot information exchange and procedures for the pilotage transit, which stressed the importance of bridge resource management and communications. 

The passage planning procedure did not include any specific guidance or direction on the disposition, retention or use of towage assets. It directed pilots to refer to the port’s towage requirements, PPA guidelines and relevant marine notices on pilotage in Australia.[40]

Towage procedures

The SMS included several procedures on the subject of towage including the following (with the procedure’s approval date in brackets):

• Towage requirements (28 December 2016)
• Making tugs fast (1 July 2019)
• Tug escort towage requirements (1 July 2019)
• Indirect towage procedure (1 July 2019).

The SMS procedure titled Towage requirements stated that the harbour master advised tug requirements for different vessel categories and directed pilots to the PPA’s port user guidelines and procedures. It also stated that pilots should:

Maintain tugs in the position where they are most likely to be of greatest effect in the event of likely emergency situations.

Similarly, the procedure titled Making tugs fast directed pilots to:

Keep tugs fast for as long as it is safe for the tug to do so depending on environmental conditions, speed, and the particulars of the vessel. For capesize vessels the port’s recognised escort towage strategy should be adhered to.

The procedure titled Tug escort towage requirements covered the general procedures relating to escort towage. On the subject of capesize ship departures, the procedure stated that a RAstar85 tug (or an ART80-32 tug if a RAstar85 tug was unavailable) should be made fast aft and used in the active escort role until beacons 15-16. The procedure also stated:

One tug to be made fast on either shoulder in a position that is suitable for laying back alongside, i.e. two tugs fast forward. The shoulder tugs are to be kept fast until at least beacon 36/37 weather/sea conditions permitting.

The procedure also directed pilots to maintain the ship’s speed below 7 knots when the shoulder tugs were fast and less than 8 knots when the aft active escort tug was fast.

The Indirect towage procedure acknowledged the importance of pilots and tug masters practicing indirect towage during ship arrivals and departures to maintain competence. The procedure covered the circumstances under which indirect towage practice could take place and communication procedures for use during the practice. It stated that indirect towage practice could take place during the transit from the inner harbour to beacons 30-31 and between beacons 23-24 and beacons 15-16. It also required pilots to advise ship masters of the intention to conduct indirect towage practice, and to provide masters with an indirect towage notice form. The form identified the environmental parameters under which towage practice could occur, confirmed that the SWL for bitts and leads was adequate and directed the master to advise the pilot if there were any concerns.

There was no evidence that the pilot issued the indirect towage notice form to Hagen Oldendorff’s master. However, it is almost certain that the master was aware that indirect towage practice was taking place and did not object to it. Furthermore, Hagen Oldendorff’s aft bitts complied with the port’s SWL requirement of 120 t. Therefore, it is unlikely that the pilot’s oversight in not issuing the indirect towage practice notice to the ship’s master unduly increased risk.

Emergency procedures

The SMS included emergency procedures for various scenarios including groundings and steering failures. 

The emergency procedure for a steering failure directed pilots to:

• inform VTS
• notify tugs in attendance and direct them as required
• call for additional tugs
• consider stopping the main engine and consider indirect towage
• check that crew were standing-by at anchors and following their emergency steering procedures 
• look for a suitable anchorage or berth to avoid blocking the channel.

The emergency procedure for a ship grounding directed pilots to:

• inform VTS and any other affected vessels
• notify tugs in attendance, make fast and direct them as required
• call for additional tugs
• check that crew were standing-by at anchors and sounding spaces to determine damage
• have a tug or other vessel check for external damage and report ship’s drafts
• confirm which navigation and propulsion equipment was still functioning
• look for a suitable anchorage or berth to avoid blocking the channel (if the ship was still afloat or could be refloated).

About 2 minutes after the indicator failure, the pilot made a broadcast on the port’s working channel (VHF channel 12), which stated, ‘Port emergency. Rudder failure. Not looking good’. The pilot’s declaration of a port emergency did not specify the ship’s name, which prompted the duty vessel traffic services operator (VTSO) to issue a query, addressed using the pilot’s initials, to verify the origin of the broadcast. In response to the VTSO’s query, the pilot on board KN Amethyst,[41] an outbound ship ahead of Hagen Oldendorff, confirmed that it was Hagen Oldendorff’s pilot who had declared the port emergency. The VTSO subsequently broadcast a call directed to all ships advising that the pilot required assistance near beacon 35 and directed any available tugs to respond. At about the same time, Hagen Oldendorff struck the channel batter.

The pilot’s actions following the loss of rudder angle indication was broadly consistent with the emergency response procedures in the SMS for a steering failure (see the section titled Response to the rudder angle indicator failure). There was no specific emergency procedure for a rudder indicator failure. Similarly, the pilot’s actions following the grounding were largely consistent with the associated procedure in the SMS.

Implementation of the escort towage strategy

The pilot ordered both Hagen Oldendorff’s shoulder tugs to cast off their towlines before the ship had passed beacons 36-37. Table 4 below sets out the time when the tugs were ordered to cast off, when their towlines were recovered and the respective locations of the ship at the time.

Table 4: Hagen Oldendorff tug release times and locations

At interview, the pilot stated that the decision on where to cast off the shoulder tugs depended on several factors but was essentially at the discretion of each individual pilot. The pilot advised that their standard practice on outbound ships was developed over time and entailed having the shoulder tugs fast until about (or just before) beacons 36‑37. Both shoulder tugs would then be retained as a passive escort until beacons 30-31 when one would be dismissed and the other retained until beacons 15-16 when both remaining tugs (the passive escort tug forward and the aft active escort tug) would be dismissed.

Interviews with other pilots indicated a general consensus that decisions on tug retention and utilisation were largely at their discretion, with pilots variously casting off the shoulder tugs between beacons 38-39 and 30-31. While several of the interviewed pilots, including the incident pilot, expressed a general awareness the escort towage strategy and its recommended practices, they did not believe there was an obligation to comply with it. There was only a limited awareness of the BCP or of its contents among the interviewed pilots.

Check pilotage

The PPA undertook annual audits of pilots which took the form of a check pilotage and involved a PPA representative (usually the harbour master or a deputy harbour master) accompanying and observing the pilot’s conduct of a pilotage task. The pilot’s performance was assessed against several criteria and documented in a marine pilot audit form. The performance criteria included application of bridge resource management, clarity of conning orders and the management of tugs, among others.

A review of Hagen Oldendorff’s pilot’s check pilotage forms for 2020, 2021 and 2022 showed that they consistently performed satisfactorily with respect to the relevant performance criteria. The 2020 check pilotage involved an outbound ship movement while the 2021 pilotage involved an inbound ship. The 2022 check pilotage was conducted after the Hagen Oldendorff grounding, in June 2022. 

Simulation training

PHP pilots were required to undertake simulator training every 2 years. The training involved the pilot undertaking several exercises conducting various ship types in and out of Port Hedland with various pre-briefed emergency scenarios evolving during the exercise. The number and nature of the scenarios exercised were determined by an agreed training procedure with the scenarios drawn for a database of standard exercises. The training was typically conducted jointly with tug masters from Port Hedland towage providers and with a PPA representative present.

A review of the pilot’s simulator training report from their most recent simulator training session in July 2021 showed that the emergency scenarios exercised included main engine failures, steering failures (rudder lock at various rudder angles) and electrical blackouts. A rudder angle indicator failure was not among the exercised scenarios, nor was it part of the database of exercise scenarios.

Pilot equipment

The pilot was equipped with a Navicom Dynamics portable pilotage unit (PPU).[42] The pilot’s PPU was set up to comply with the requirements of a Class-A PPU. It provided very high accuracy, independent position, heading, speed and RoT data[43] while automatic identification system (AIS)[44] data was sourced from the ship by connecting the PPU to the ship’s pilot plug. 

The pilot’s PPU was set up to display RoT as a numerical value with positive values indicating a RoT to starboard and negative values indicating a RoT to port. The PPU also displayed the ship’s track and a ‘predictor’ to indicate where the ship would be 1 minute and 2 minutes into the future based on the vessel’s current course, speed and RoT. The pilot reported that their PPU was fully functional and was their preferred source of navigational data, both generally and during the Hagen Oldendorff pilotage. A review of the PPU replay of the pilotage and grounding determined that the data displayed by the PPU was accurate and consistent with that displayed on the ship’s equipment.

Similar occurrences

Iron King

On 31 July 2008, the fully laden, capesize, Isle of Man-registered bulk carrier Iron King, departed from its berth in Port Hedland with a pilot on board. As the ship made its way through the harbour, the towlines of the 4 assisting tugs were cast off. Shortly after, the rudder failed to respond to the pilot’s helm commands and the ship grounded to the east of Hunt Point, near beacon 44. The ship remained aground for about 12 hours until the next high tide when it was refloated, recovered to the centre of the channel and conducted to the outer anchorage. An underwater survey of the ship’s hull identified damage to the ship’s bow shell plating but no hull breaches or pollution of the sea.

The ATSB transport safety investigation report MO‑2008‑008 found that, on 2 occasions shortly before the ship grounded, Iron King’s rudder failed to respond to helm orders because the steering system hydraulic pressure was limited by a leaking actuator relief valve whenever the rudder moved to port. The investigation also found that it was normal practice for assisting tugs to be released before departing ships reached Hunt Point and that the pilot had not been provided with training in the implementation of a suite of ‘risk analysed’ responses to reasonably foreseeable emergency scenarios in a simulated environment.

Additionally, the investigation identified that Iron King’s SMS did not include procedures that adequately ensured that the ship’s master and crew were aware of, and drilled in, the emergency steering system change over procedure to be followed in the event of a loss of steering control.

Dumun

On 29 April 2011, the Panama-registered bulk carrier Dumun grounded while departing the port of Gladstone, Queensland with a pilot on board. After the ship departed the berth, the pilot released the 2 assisting tugs and dismissed them. About 30 minutes later, the ship’s steering appeared to stop responding to bridge commands. The bridge team assumed that the steering had failed, and the pilot ordered the main engine stopped and then started astern. However, these actions were not enough to prevent the ship from departing the Auckland Channel and grounding. There was no structural damage sustained by the ship, but the hull coating was scored and abraded with exposed metal in some areas.

The ATSB transport safety investigation report MO‑2011‑004 found that the ship's steering appeared to stop responding to bridge commands because the linkage between the tiller and rudder angle transmitter had become detached. The steering gear remained operational and continued to respond to helm orders, but the rudder angle transmitter lost its input signal and, as a result, the bridge mounted rudder angle indicator stopped working.

The ATSB determined that the ship's builders did not identify that the rudder angle indicator transmitter and tiller linkage were not installed correctly. The ATSB also found that the analysis of shipping operations in Gladstone, carried out by the relevant authorities, had not appropriately considered all that could be done to prevent the grounding of a ship as a result of steering gear or main engine failure. Additionally, a comprehensive SMS, with the aim of identifying, evaluating and controlling pilotage related risk, had not been implemented in the port.

Safety analysis

Introduction

On the morning of 9 April 2022, the fully laden capesize bulk carrier Hagen Oldendorff departed its berth in Port Hedland, Western Australia with a harbour pilot on board and 4 tugs assisting. The first of the tugs was cast off shortly after departure and the ship continued its passage of the port’s navigational channel. As the pilot navigated the ship through a turn in the channel, the 2 shoulder tugs were cast off and retained as passive escorts while the aft tug remained tethered as an active escort. Shortly after the turn was completed, the ship experienced a loss of electrical power supply to all the ship’s analogue rudder angle indicators and, a few minutes later, struck the western batter of the channel. The pilot manoeuvred the ship back into the centre of the channel and, with the assistance of additional tugs and a second pilot, resumed the outbound passage and conducted the ship to an anchorage outside port limits.

Subsequently, the ship was found to be taking on water in the number 1 and 2 port double‑bottom water ballast tanks. Surveys and inspections conducted over the following days identified substantial damage to the ship’s bottom shell plating including hull breaches of the shipside shell plating of the damaged tanks and the failure of the transverse bulkhead between the tanks. There were no reported injuries or pollution of the sea as a result of the grounding.

This analysis will consider the triggering event for the grounding – the loss of rudder angle indication – and the resilience of the system protections in place to mitigate such an event. The analysis will also cover the manoeuvring of the ship leading up to the grounding, the pilot’s use of the available tugs and, the port authority and pilotage organisation’s procedures and guidance for the effective use of those tugs. Finally, the effect of fatigue on the pilot’s performance was examined in detail however there was insufficient evidence to establish that the pilot was experiencing a level of fatigue known to have an effect on performance.

Events leading up to the grounding

Loss of rudder angle indication

As part of pre-departure checks, Hagen Oldendorff’s steering had been successfully tested in manual and non-follow-up (NFU) steering modes including under the observation of the pilot. After departure from the berth the ship’s passage through the inner harbour was uneventful, with all systems operating normally. However, following a turn to port, conducted with the assistance of the aft active escort tug (as part of routine training), the bridge rudder angle indicators stopped working and experienced a loss of illumination. While the autopilot rudder angle indicator display remained operational, neither the ship’s crew, nor the pilot were aware of it. Consequently, the bridge team, including the pilot, had no way of knowing the position of the rudder or if the steering gear was operational. 

In the moments leading up to the loss of rudder angle indication, the pilot was in the process of correcting a slight but developing turn to starboard using port helm. At the time of the power failure, the rudder (and rudder angle indicator) was at about midships. Subsequently, when the pilot’s helm order of port 10° was executed by the helmsman, the rudder indication remained amidships. The pilot, who remained concerned about the starboard rate of turn (RoT), increased their helm order to port 20°. Although unknown to the crew, the steering remained operational, and the rudder moved to port 20° while the indicator remained amidships. In the absence of any audible or visual alarms alerting the crew to an indicator failure, the bridge team reasonably perceived that there was a steering failure and acted accordingly. The loss of the rudder angle indication triggered the subsequent sequence of events which resulted in a turn to port and subsequent grounding. 

A shipboard investigation carried out over the following days identified that the tracking motor of the ship’s bridge-mounted omnidirectional rudder angle indicator had burnt out and failed. The motor failure resulted in a short circuit, which tripped the common protective circuit breaker in the bridge electrical cabinet. That in turn, resulted in a loss of electrical power supply to all 6 of the ship’s analogue rudder angle indicators without any associated audible or visual alerts. 

Response to the rudder angle indicator failure

The pilot and master’s response to the perceived steering failure included switching to NFU mode, applying port NFU input and ordering the steering gear room be manned. The helmsman’s port NFU input resulted in the rudder moving further to port, to about port 27°. However, in the absence of a working analogue rudder angle indicator and, being unaware of the autopilot indicator display, neither the pilot or the helmsman was able to determine what the rudder angle was or if steering control had been restored. The apparent ineffectiveness of the NFU input likely further convinced the bridge team that there was a steering failure. While the ship and pilot’s RoT indicators remained operational, it was probably challenging to infer that the steering remained operational based on the ship’s developing RoT alone. 

The pilot also issued orders to the aft active escort tug, RT Clerke, to take the stern to starboard, that is, to apply indirect steering forces at the stern to eliminate the starboard RoT. As the port rudder took effect, and the ship started turning to port, the pilot rescinded the tug’s order and instructed the tug to return to the port quarter and apply indirect steering forces to arrest the port turn. However, the pilot did not issue orders to return the helm to amidships. This may have been because the pilot believed issuing helm orders was futile or because they were now occupied with directing the available passive escort tugs, RT Inspiration and RT Atlantis.

The pilot also did not begin reducing the ship’s main engine setting until about 47 seconds after the rudder indicator failure. Nevertheless, once the main engine was stopped and the efforts of the 3 tugs began to take effect, the ship’s port RoT peaked at about 13.6° and then started decreasing. The initial order to RT Clerke to take the stern to starboard probably did not contribute to the ship’s port turn as the order was rescinded before the tug could get into optimal position for indirect towage on the starboard quarter. However, valuable time was lost as the tug moved from the port to the starboard quarter and then back again, which likely limited the pilot’s ability to arrest the port turn.

The port RoT continued to decrease slowly despite a subsequent order by the pilot, which resulted in the rudder being put hard over to port for about 20 seconds. This order was an error on the part of the pilot likely due to the combined effects of acute stress and high workload and was corrected shortly after upon being challenged by the master. However, by this time, the grounding was unavoidable, and the ship struck the batter shortly after at a speed of about 6.1 knots. 

Escort towage strategy

Use of tugs

Following the introduction of tugs with improved escort towage capability in Port Hedland in 2017, a documented escort towage strategy was implemented to best utilise these tugs to mitigate the risk of channel blockage. For capesize ships, the towage strategy recommended pilots maintain the shoulder tugs fast on the port and starboard shoulders prior to, and throughout zone 3 and zone 4. The strategy acknowledged that, while weather or other conditions may render it unsafe to keep these tugs fast, it emphasised that the shoulder tugs should maintain their towlines tethered as long as they could safely do so. The weather on the morning of the grounding was relatively benign with winds at force 3–4 and 1 m seas and the conditions did not preclude the tugs being kept fast until beacons 30-31, as recommended by the strategy. 

The pilot had ordered Hagen Oldendorff’s shoulder tugs cast off well before beacons 30-31 (near beacons 36-37) as this was their preferred practice. While the pilot was aware of the escort towage strategy, they believed that adherence to its recommendations remained at their discretion. This view was also shared by other pilots with tugs being released at various locations between beacons 36-37 and 30-31 based on individual preferences. 

The escort towage strategy noted that, in the event of a steering incident, simulations had consistently demonstrated that initially, the aft escort tug should be used to provide steering forces to counteract the rudder and control the heading while the shoulder tugs were used to provide braking forces to slow the ship. However, when the rudder indicator failed, shortly after the ship passed beacons 36-37, both shoulder tugs, RT Inspiration and RT Atlantis, had been cast off and were passive escorts. Had these tugs been fast at the time, the pilot would have had more options at their disposal, including using both tugs to provide braking forces to slow the ship. 

Based on the ship’s speed and forward momentum, the shoulder tugs would likely have been of limited effectiveness in influencing the ship’s heading and it is also likely that using RT Atlantis to push on the starboard quarter was a more effective technique to reduce the port RoT than pulling on the starboard bow. Nevertheless, the ship’s port turn could not be arrested and the ship grounded, with consequent breaches of the hull and flooding. 

Hagen Oldendorff’s tug masters largely complied with the pilot’s orders effectively and within acceptable timeframes given the circumstances. It is reasonable to conclude that had the shoulder tugs remained fast and been used to provide braking forces as recommended in the escort towage strategy, that the ship may have struck the channel batter at a lower speed. Although difficult to quantify, even minor reductions in impact speed would likely have resulted in reductions in the impact energy thereby reducing damage to the ship. 

Port escort towage documentation

The blockage of the Port Hedland navigation channel was identified as a strategic risk to the port’s operations. Port Hedland is a key export port in the supply chains of several major Australian seaborne iron ore exporters and the economic consequences of a ship grounding and blocking the channel had the potential to be severe and far-reaching. Consequently, significant effort was invested into identifying and implementing measures to prevent, and to mitigate the effects of, a channel blockage. While these efforts identified several channel improvements and risk mitigation measures, the primary risk controls took the form of pilotage and escort towage for ships. 

As part of the procurement and introduction of escort-capable tugs at Port Hedland, BHP (one of the primary stakeholders with an interest in maintaining navigability of the channel), conducted various studies, simulations and trials aimed at identifying the most effective means of utilising these tugs. These studies, simulations and trials involved the assistance and participation of the Pilbara Ports Authority (PPA), Port Hedland Pilots (PHP), tug masters and other stakeholders. This core group of stakeholders evolved into the Port Hedland Working Group (PHWG), which oversaw the review, development and assessment of several channel blockage risk control measures including the escort towage strategy.

In 2013, an initiative was launched to procure tugs with improved escort towage capability and an interim escort towage strategy was developed to optimise the use of the port’s existing tugs. The interim strategy recommended that the shoulder tugs be kept fast until beacons 36-37 (end of zone 3). In 2015, an escort towage strategy was developed to supersede the interim strategy. The escort towage strategy identified that the most effective use of the escort tugs involved using an active escort tug fast aft until beacons 15-16 (end of zone 5) and 2 escort tugs tethered on the port and starboard shoulders until beacons 30-31 (end of zone 4) unless prevented from doing so by adverse environmental conditions. By 2017, a number of the improved escort towage tugs had been introduced and the measures in the escort towage strategy began to be implemented with evidence of shoulder tugs being kept fast by pilots until beacons 30-31 where conditions were favourable.

In 2020, BHP submitted an updated version of the escort towage strategy to the PPA for official endorsement as an operational port document. The strategy remained largely unchanged with respect to the use of tugs for capesize ships and recommended that tugs should have their towlines tethered on the port and starboard shoulders throughout zones 3 and 4, except where conditions made it unsafe to do so. However, the document remained in draft format with the PPA. The PPA directed port users to a public document, the port user guidelines and procedures, as the authoritative source of information on port operations including towage. However, the port user guidelines and procedures document did not include detail of the escort towage strategy’s recommended tug allocation and towage procedures or of the port’s expectations with regard to their implementation.

In 2018, a port business continuity plan (BCP) for channel blockage was introduced as a proposed risk control measure. Records of the port’s strategic risk review committee meetings, which were attended by PHP representatives, showed that the harbour master first presented a BCP to the committee in 2019 and in 2020, an updated version of the document was published. The BCP reiterated risk evaluations for channel blockage from previous studies and summarised elements of the escort towage strategy. It stated that the strategy had been implemented in the port and that in zone 4 tugs were tethered to each shoulder of outbound capesize ships with towlines attached through to beacons 30-31, whenever possible. It further stated that, in doing so, simulations indicated that the effectiveness of the deployed tug fleet was improved, and that pilots had more options to manage engine and rudder failures. The BCP was not a public document, and interviewed pilots expressed only limited awareness of its existence and of its contents. 

The PHP safety management system (SMS) included several procedures on the subject of towage. The procedures primarily directed pilots to the Port Hedland port user guidelines and procedures document for information on tug requirements. In general, the SMS directed pilots to maintain tugs where they would be of greatest effect in the event of an emergency and to keep tugs fast as long as it was safe to do so depending on factors such as weather, speed and the ship’s characteristics. 

The SMS also stated that, for capesize ships (such as Hagen Oldendorff), pilots were to adhere to the port’s recognised escort towage strategy and the PHP SMS procedure on escort tug towage requirements stated that tugs were to be kept fast until at least beacons 36-37. However, this reflected the practices in interim escort towage strategy and not the updated escort towage strategy implemented after the introduction of the improved escort tugs in 2017, which directed pilots to keep the shoulder tugs fast until beacons 30-31.

Neither the port user guidelines and procedures or the PHP SMS included clear directives or reference to the tug retention and usage recommendations of the escort towage strategy. Consequently, there was no consistent understanding or application by the pilots of the demonstrated, effective towage practices identified in the escort towage strategy. 

Regulations and standards

The International Convention for the Safety of Life at Sea (SOLAS) specified minimum standards for the construction, equipment and operation of ships to ensure an adequate level of safety. Flag States are responsible for ensuring that ships under their flag comply with the requirements of SOLAS. In practice, this is achieved by designing, constructing and maintaining ships in compliance with the requirements of a classification society recognized by the flag State and Hagen Oldendorff was classed with Lloyd’s Register (LR).

SOLAS regulations and class rules for steering gear required that steering gear control systems be equipped with short circuit protection and, audible and visual alarms to alert crew to an electrical power failure in the system. However, rudder angle indication systems were not considered a component of steering gear control systems and were required to be independent of control systems. 

Hagen Oldendorff was appropriately equipped with 6 rudder angle indicators spread across various locations on the ship. However, all 6 indicators were protected by a single circuit breaker located in the bridge electrical cabinet. Consequently, when the omnidirectional indicator on the bridge experienced a short circuit, it tripped the circuit breaker which removed power to all the ship’s rudder angle indicators. The protection of the ship’s mounted, analogue rudder angle indicators with a common circuit breaker constituted a single point of failure, which rendered the power supply to all the ship’s analogue indicators vulnerable to a fault in any one of them. 

Some classification societies, such as Det Norske Veritas (DNV), required that rudder angle indicating systems on some ships be arranged such that a single failure in power supply or anywhere in the indicating system did not cause a loss of rudder angle indication on the bridge. However, neither the minimum SOLAS regulations, nor the standard LR rules for ships, required such protection from single points of failure in rudder angle indication systems. 

Instead, LR offered optional notations, such as the ‘IBS’ notation, which could offer improved resilience by requiring each item of electrically operated navigation equipment be individually connected to its distribution panel. For example, had only the omnidirectional indicator failed, and the bridge front instrument cluster indicator remained operational, it is almost certain that the bridge team would have maintained awareness of the rudder angle and that the pilotage would have continued with only limited disruption. However, Hagen Oldendorff was not required to hold this notation and, in any event, the application of the requirement for individual connection to a distribution board to rudder angle indicators would rely on a favourable interpretation of the rules.

Furthermore, in the absence of protections against single points of failure, the rules and regulations also did not require audible or visual alarms to alert crew to a failure of power supply or to other failures in the rudder angle indication system. Hagen Oldendorff’s autopilot display offered a redundant source of rudder angle information, which remained operational after the electrical power to the analogue indicators had failed. However, this system was not required by either SOLAS or LR and neither the pilot, nor the ship’s crew were aware of this capability. While certainly a valuable resource had the pilot and crew utilised it, the ship’s bridge team assumed a steering failure and responded accordingly.

An audible/visual alarm that alerted crew specifically to a power failure of the rudder angle indicators would have provided the bridge team with assurance that the failure was limited to the indicators and that the steering gear remained operational. This would likely have inhibited the development of the sequence of events that culminated in the grounding.

Findings

From the evidence available, the following findings are made with respect to the grounding of Hagen Oldendorff in Port Hedland, Western Australia on 9 April 2022. 

Contributing factors

• During an outbound pilotage, the tracking motor of Hagen Oldendorff's bridge-mounted omnidirectional rudder angle indicator failed, resulting in a short circuit which tripped the common circuit breaker for all the ship's analogue rudder angle indicators with an associated loss of power to these rudder indicators. Consequently, the bridge team assumed that the ship’s steering had failed and implemented steering failure emergency procedures.
• Following the initiation of emergency procedures for a steering failure, the pilot's manoeuvring orders, aimed at maintaining directional control of the ship, resulted in an uncontrolled turn to port. Despite attempts to arrest this turn, Hagen Oldendorff's port bow collided with the western side of the channel, at a speed of about 6.1 knots.
• The pilot’s decision to cast off the port and starboard escort tugs before the ship passed beacons 30 and 31 was inconsistent with the port’s identified and implemented best practice escort towage strategy. Consequently, when the rudder angle indicator failed, the pilot was unable to make the fullest possible use of these tugs to either reduce the ship’s speed or arrest the turn to port.
• The Pilbara Ports Authority's port user guidelines and procedures did not reflect the best practice escort towage guidance detailed in the port's draft escort towage strategy and business continuity plan. The detail of these improved towage practices, designed to reduce the risk of channel blockages, were also not integrated into the Port Hedland Pilots' safety management system and were consequently, inconsistently applied by pilots. (Safety issue)
• Although Hagen Oldendorff’s steering and rudder angle indicator systems complied with the applicable rules and regulations, neither the SOLAS regulations, nor the rules of the ship’s responsible classification society, Lloyd’s Register, mandated protection of the ship's rudder angle indication systems against a single point of failure in electrical power supply, nor did they require installation of audible or visual alerts to notify the bridge team of a power failure affecting the indicators. (Safety issue)

Safety issues and actions

Escort towage strategy

Safety issue number: MO-2022-007-SI-01

Safety issue description: The Pilbara Ports Authority's port user guidelines and procedures did not reflect the best practice escort towage guidance detailed in the port's draft escort towage strategy and business continuity plan. The detail of these improved towage practices, designed to reduce the risk of channel blockages, were also not integrated into the Port Hedland Pilots' safety management system and were consequently, inconsistently applied by pilots.

Escort towage strategy

Safety issue number: MO-2022-007-SI-02

Safety issue description: The Pilbara Ports Authority's port user guidelines and procedures did not reflect the best practice escort towage guidance detailed in the port's draft escort towage strategy and business continuity plan. The details of these improved towage practices, designed to reduce the risk of channel blockages, were also not integrated into the Port Hedland Pilots' safety management system and were, consequently, inconsistently applied by pilots.

Rules and regulations for rudder angle indicator systems

Safety issue number: MO-2022-007-SI-03

Safety issue description: Although Hagen Oldendorff’s steering and rudder angle indicator systems complied with the applicable rules and regulations, neither the SOLAS regulations, nor the rules of the ship’s responsible classification society, Lloyd’s Register, mandated protection of the ship's rudder angle indication systems against a single point of failure in power supply, nor did they require installation of audible or visual alerts to notify the bridge team of a power failure affecting the indicators.

Safety recommendation description: The Australian Transport Safety Bureau recommends that Lloyd’s Register takes steps to approach the International Association of Classification Societies and seek safety action to address the risk associated with a single point of failure in electrical power supply for ship's rudder angle indicators.

Rules and regulations for rudder angle indicator systems

Safety issue number: MO-2022-007-SI-04

Safety issue description: Although Hagen Oldendorff’s steering and rudder angle indicator systems complied with the applicable rules and regulations, neither the SOLAS regulations, nor the rules of the ship’s responsible classification society, Lloyd’s Register, mandated protection of the ship's rudder angle indication systems against a single point of failure in power supply, nor did they require installation of audible or visual alerts to notify the bridge team of a power failure affecting the indicators.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Australian Maritime Safety Authority provides the necessary support and assistance to the Liberia Maritime Authority in its efforts to seek safety action at the International Maritime Organization aimed at addressing the risk associated with a single point of failure in electrical power supply for ship's rudder angle indicators.

Rules and regulations for rudder angle indicator systems

Safety issue number: MO-2022-007-SI-05

Safety issue description: Although Hagen Oldendorff’s steering and rudder angle indicator systems complied with the applicable rules and regulations, neither the SOLAS regulations, nor the rules of the ship’s responsible classification society, Lloyd’s Register, mandated protection of the ship's rudder angle indication systems against a single point of failure in power supply, nor did they require installation of audible or visual alerts to notify the bridge team of a power failure affecting the indicators.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Liberia Maritime Authority takes steps to formally raise this safety issue with the International Maritime Organization to seek safety action aimed at addressing the risk associated with a single point of failure in electrical power supply for ship's rudder angle indicators.

Safety action not associated with an identified safety issue

Additional safety action by Pilbara Ports Authority

On 29 October 2024, the Pilbara Ports Authority issued a local marine notice requiring all ships calling at Port Hedland to have a suitably qualified and competent person on stand-by in the steering gear room when the ship was navigating in the channel. The marine notice stated that the person on stand-by in the steering gear room was to be:

• trained and proficient in emergency steering procedures including switching to local steering and maintaining a direct means of communication to the ship's bridge
• able to identify and communicate the actual position of the rudder (rudder angle) to the bridge when requested
• able to steer the ship as directed from the ship's bridge
• dismissed from steering gear room only after consultation with the pilot.

The marine notice also recommended that ships calling at Port Hedland conduct an emergency steering test before arrival.

On 30 May 2024, the PPA issued a local marine notice requiring all capesize ships be equipped with a closed circuit television (CCTV) camera in the steering gear room with a monitor on the bridge to provide CCTV camera footage of the rudder angle for the bridge team.

On 18 June 2024, the PPA issued a further local marine notice clarifying reporting requirements for machinery events, equipment malfunctions and safety issues for ships calling at Port Hedland.

Additional safety action by Wah Kwong Ship Management Hong Kong

On 28 June 2024, Hagen Oldendorff's managers, Wah Kwong Ship Management Hong Kong, advised the ATSB that, in March 2023, an audible and visual alarm was installed on board the ship to alert crew in the event the rudder angle indicators' circuit breaker tripped resulting in a loss of power supply to the indicators. In addition, closed circuit television cameras were installed in the ship's steering gear room to allow direct monitoring of the physical rudder angle from the bridge.

Additional safety action by Port Hedland Pilots

Following the grounding and the Port Hedland Pilots (PHP) internal investigation, PHP advised that pilots keep the forward 2 tugs fast as recommended for the relevant channel zones unless prevented from doing so by weather or other factors.

On 29 July 2024, Port Hedland Pilots advised that in October 2023, the organisation's fatigue risk management procedure was updated to mandate additional risk fatigue risk controls including:

• a maximum FAID score of 75 for pilots who were more than 14 days into their 4-week duty period
• a maximum FAID score of 70 for the duty pilot
• a requirement that pilots obtain a minimum of 13 hours sleep in the 48-hour period before a pilotage
• a maximum of 3 consecutive nights of pilotage work before a mandated rest period from 1900 to 0800 hours
• self-declared sleepiness score of 6 to trigger an overnight rest period from 1900 to 0800 hours
• self-declared sleepiness score of 7 to trigger an extended overnight rest period acknowledging elevated fatigue risk.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Australian Maritime Safety Authority
• BHP
• directly involved officers and crew of Hagen Oldendorff
• directly involved tug masters 
• documents, drawings, manuals, logbooks and photographs from Hagen Oldendorff 
• Hagen Oldendorff’s pilot
• Lloyd’s Register
• Pilbara Ports Authority
• Port Hedland Pilots 
• recorded information from Hagen Oldendorff’s voyage data recorder (VDR)
• Wah Kwong Ship Management, Hong Kong.

References

Akerstedt, T., & Wright, K. P. (2009). Sleep loss and fatigue in shift work and shift work disorder. Sleep medicine clinics, 4(2), 257-271.

Australian Transport Safety Bureau, Report No. MO-2008-008, Independent investigation into the grounding of the Isle of Man- registered bulk carrier Iron King, Port Hedland, Western Australia, 31 July 2008, ATSB, 2009. Available at www.atsb.gov.au

Australian Transport Safety Bureau, Report No. MO-2011-004, Grounding of the Panama‑registered bulk carrier Dumun, Gladstone, Queensland, 29 April 2011, ATSB, 2012. Available at www.atsb.gov.au

Chambers, T. P., & Main, L. C. (2015). Symptoms of fatigue and coping strategies in maritime pilotage. International maritime health, 66(1), 43-48.

Costa G (1996) ‘Effects on Health and Well-Being’, In: Colquhoun WP, Costa G, Folkard S and Knauth P Shiftwork Problems and Solutions, Peter Lang, Germany.

Dismukes R, Goldsmith TE, and Kochan JA (2015) Effects of acute stress on aircrew performance: literature review and analysis of operational aspects, NASA/TM—2015–218930, NASA Ames Research Center, Moffett Field, California.

Folkard S and Tucker P (2003) ‘Shift work, Safety and Productivity’, Occupational Medicine, 53(2): 95-101.

Gregory, K., Hobbs, A., Parke, B., Bathurst, N., Pradhan, S., & Flynn-Evans, E. (2020). An evaluation of fatigue factors in maritime pilot work scheduling. Chronobiology International, 37(9‑10), 1495-1501.

International Chamber of Shipping 2016, Bridge Procedures Guide, Marisec Publications, London.

International Maritime Organization (IMO) 1995, International Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code) as amended, IMO, London. Available at www.imo.org

International Maritime Organization (IMO) 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London. Available at www.imo.org

International Maritime Organization (IMO), 2009, Resolution A.1021(26) Code on Alerts and Indicators, IMO, London. Available at www.imo.org

International Maritime Organization, 2019, MSC.1/Circ.1598 Guidelines on Fatigue, London, United Kingdom. Available at www.imo.org

Lloyd’s Register, 2019, Rules and Regulations for the Classification of Ships, London, United Kingdom.

Pilbara Ports Authority, 2020, Port handbook, Port Hedland, Australia.

Pilbara Ports Authority, 2021, Port user guidelines and procedures, Port Hedland, Australia.

Reale C, Salwei ME, Militello LG, Weinger MB, Burden A, Sushereba C, Torsher LC, Andreae MH, Gaba DM, McIvor WR, Banerjee A, Slagle J and Anders S (2023) ‘Decision-Making During High-Risk Events: A Systematic Literature Review’, Journal of Cognitive Engineering and Decision Making, 17(2): 188-212.

Riethmeister V, Matthews RW, Dawson D, de Boer MR, Brouwer S, and Bültmann U (2019) ‘Time-of-day and days-on-shift predict increased fatigue over two-week offshore day-shifts’, Applied Ergonomics, 78: 157-163.

Rosekind MR, Gander PH, Gregory KB, Smith RM, Miller DL, Oyung R, Webbon LL and Johnson JM (1996) ‘Managing Fatigue in Operational Settings 1: Physiological Considerations and Countermeasures’, Behavioural Medicine, 21: 157-165.

Tait, J. L., Chambers, T. P., Tait, R. S., & Main, L. C. (2021). Impact of shift work on sleep and fatigue in Maritime pilots. Ergonomics, 64(7), 856-868.

Van Dongen HP, Maislin G, Mullington JM and Dinges DF (2003) ‘The cumulative cost of additional wakefulness: dose-response effects on neurobehavioral functions and sleep physiology from chronic sleep restriction and total sleep deprivation’, Sleep, 26: 117-26.

Weaver, M. D., Sletten, T. L., Foster, R. G., Gozal, D., Klerman, E. B., Rajaratnam, S. M., ... & Czeisler, C. A. (2021). Adverse impact of polyphasic sleep patterns in humans: Report of the National Sleep Foundation sleep timing and variability consensus panel. Sleep health, 7(3), 293‑302.

Wickens CD, Hutchins SD, Laux L, and Sebok A (2015) ‘The Impact of Sleep Disruption on Complex Cognitive Tasks: A Meta-Analysis’, Human Factors, 57(6): 930-946.

Williamson A and Friswell R (2011) ‘Investigating the relative effects of sleep deprivation and time of day on fatigue and performance’, Accident Analysis & Prevention, 43(3): 690-697.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• Australian Maritime Safety Authority
• BHP
• directly involved tug masters
• Hagen Oldendorff’s pilot
• Lloyd’s Register
• Pilbara Ports Authority
• Port Hedland Pilots
• the ship’s flag State administration, Liberia 
• Wah Kwong Ship Management, Hong Kong.

Submissions were received from:

• Australian Maritime Safety Authority
• BHP
• Hagen Oldendorff’s pilot
• Lloyd’s Register
• Pilbara Ports Authority
• Port Hedland Pilots
• the ship’s flag State administration, Liberia. 

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Key orders and events leading up to the grounding

Appendix B – Escort Performance Notation

For escort tugs, Lloyd’s Register offers the specific notation EPN (F,B,V,C) to denote the escort performance numeral of the vessel obtained by full scale testing of the vessels. The EPN is made up of a series of values (F,B,V,C), defined as follows:

• F: Maximum steering force, in tonnes
• B: Maximum braking force, in tonnes
• V: Speed, in knots, at which F and B are determined
• C: Time, in seconds, required for the escort tug in manoeuvring from maintained oblique position of the tug giving it a maximum steering force on one side of the assisted vessel to a mirror position on the other side.

The EPN values of the Rivtow (BHP towage service) tug fleet at Port Hedland is detailed in Figure 13 below. In the table, the value of ‘F’ (maximum steering force) is denoted by ‘F_s’ and the value of B (maximum braking force) is denoted by ‘F_b’. The values of F_s and F_b are provided for a ‘V’ of 6 knots, 8 knots and 10 knots.

The value of ‘C’ (transition time from port to starboard or vice versa while providing maximum steering forces) for the RAstar85 tugs at 6 knots and 8 knots was 45 seconds.

Figure 13: Tug escort performance notations

Source: BHP

Appendix C – Pilot fatigue analysis

Fatigue

The International Maritime Organization (2019)[45] defined fatigue as:

A state of physical and/or mental impairment resulting from factors such as inadequate sleep, extended wakefulness, work/rest requirements out of sync with circadian rhythms and physical, mental or emotional exertion that can impair alertness and the ability to safely operate a ship or perform safety-related duties.

Fatigue is a hazard because it affects everyone regardless of skill, knowledge and training and its effects can be particularly dangerous in the transportation sector, including the aviation and maritime industry.

Fatigue can be caused by any one or more of a range of factors including:

• lack of sleep (or inadequate restorative sleep)
• poor quality of sleep and rest
• circadian effects
• stress
• excessive workload. 

Fatigue can have a range of effects on human performance, including:

• decreased short-term memory
• slowed reaction time
• decreased work efficiency
• reduced motivational drive
• increased errors of omission
• lapses in attention
• increased distractibility
• reduced vigilance and reaction time.

Inadequate quantity and quality of sleep is a primary contributor to fatigue. Most people generally require 7–8 hours of sleep to achieve a maximum amount of alertness and performance. 

Pilot rostering

The PHP pilot rostering system involved the rotational allocation of pilots to ships in an ‘endless belt’ rotation where a pilot was allocated a pilotage task, then dropped to the bottom of the list, moving up as pilots further up the list were allocated pilotage tasks sequentially. The pilotage schedule and individual pilotage assignments were usually finalised between 1600–1800 every evening. Hagen Oldendorff’s pilot preferred to be awake at this time to ascertain when their next pilotage task was so they could plan their sleep accordingly. 

Fatigue risk management system

Introduction

PHP operated a fatigue risk management system as part of the organisation’s contractual obligations to the PPA. The PHP fatigue risk management procedure (FRMP) formed part of the pilots’ SMS and compliance with the procedure was regularly audited. The procedure acknowledged that a channel blockage was a critical risk to the port, that pilot performance was a key mitigating risk control, and that fatigue-related impairment was a credible risk to pilot performance. The procedure identified that the most effective means to manage the effects of fatigue was to have restorative sleep and that the pilot’s work schedule was the primary means of managing pilot work and rest hours.

The FRMP provided a general overview of several methods, tools and criteria used in fatigue assessment. Of these, the procedure primarily applied the following 3 methods in assessing pilot fatigue and suitability for work:

• a biomathematical model fatigue assessment (FAID)
• a prior sleep wake model (PSWM)
• a fatigue self-assessment declaration. 

The outcomes of these 3 elements of the PHP fatigue assessment determined whether a pilot could be assigned a given pilotage task. In the event a pilot breached any of these criteria, other options were considered, with the most common measure being to rotate that pilot out of the roster to a task at a more appropriate time, with the next pilot in line being assigned the ship movement.

Biomathematical fatigue model

Biomathematical models are tools for predicting fatigue levels based on a scientific understanding of the factors that contribute to fatigue. PHP utilised a software tool called Fatigue Audit InterDyne (FAID). The FAID bio-mathematical model of fatigue assessed the predicted level of fatigue based on the pilots’ rostered hours of work. Pilots logged the start and finish times of their pilotage tasks, and the FAID tool generated a predicted score for the expected completion time of the pilot’s following task.

A FAID score of 75 was considered the upper threshold for ‘normal’ pilotage jobs[46] although pilots with FAID scores of up to 80 could be rostered under certain circumstances with additional controls and approvals.

The incident pilot’s predicted FAID score at the completion of the Hagen Oldendorff pilotage was 73. That score was based on the time of day and duration of the pilot’s pilotage tasks over the previous 7 days, subsequent rest opportunities and, time of day and expected duration of Hagen Oldendorff’s outbound pilotage. The ATSB’s biomathematical analysis of the pilot’s roster using FAID produced similar results to the PHP score.

Prior sleep wake model

The prior sleep wake model (PSWM) was designed to account for actual sleep obtained and used 3 simple criteria to estimate when fatigue became an unacceptable risk in the workplace. The PHP PSWM proposed that:

• pilots should obtain a minimum of:
  • 5 hours sleep in the previous 24-hour period 
  • 12 hours sleep in the previous 48-hour period
• time awake (the period from the pilot waking up to the end of their pilotage task) should not exceed the total sleep in the previous 48-hour period. 

An automatic phone calling system notified pilots of their scheduled pilotage tasks 90 minutes prior to the planned pilot-on-board time. The pilot’s ‘time awake’ parameter for each shift was therefore calculated from 90 minutes prior to pilot-on-board time. The incident pilot usually set an alarm an additional 15 minutes before the time of the expected automated call. 

A review of the pilot’s roster over the 72 hours before they woke to prepare for Hagen Oldendorff’s pilotage identified that the pilot had sufficient opportunity to obtain adequate, restful sleep. 

Table 3 below details the pilot’s sleep opportunity over the preceding 3 days. The rest opportunity was calculated from one hour after the completion of a pilotage (to allow for travel back to accommodation) to 105 minutes before the next pilot-on-board time (the 90 minute automatic callout plus the pilot’s 15 minute allowance). The pilot estimated they woke at about 2230 on 8 April and boarded Hagen Oldendorff at 0018 on 9 April.

Table 3: Pilot rest opportunity leading up to the Hagen Oldendorff pilotage

Based on the pilot’s recollection and the PHP investigation report, the pilot estimated they obtained at least 8 hours of sleep in the 24 hours preceding the grounding. About 3–4 hours was reportedly obtained immediately before waking up for the pilotage with the rest obtained earlier during the day. Similarly, the pilot estimated they had obtained at least 8 hours of sleep every 24 hours over the preceding 2 days. While the sleep opportunity identified in Table 3 above demonstrates that it was possible for the pilot to have obtained the reported sleep, the pilot could not recall the exact hours of sleep obtained. 

Fatigue self-assessment 

The final element in the PHP fatigue assessment involved a subjective pilot self-assessment of their fatigue levels. The self-assessment was made using the Samn-Perelli fatigue scale – a scale from 1 to 7 – where 1 is ‘fully alert and wide awake’ and 7 is ‘completely exhausted, not able to function’.

The pilot self-assessed a fatigue score of 5 (Moderately tired, let down) at the commencement of the Hagen Oldendorff pilotage. However, the pilot also self-assessed the same score of 5 at the conclusion of the pilotage, indicating that the fatigue self-assessment was likely an unreliable risk control for fatigue. 

Sleep quality

During their 4-week duty periods in Port Hedland, pilots generally resided in suitable accommodation that was quiet, temperature-controlled and conducive to restful sleep. Nevertheless, the nature of pilotage work meant that the sleep obtained was often not of optimal quality. Marine pilotage is typically characterised by irregular and unpredictable work periods (shifts) around the clock. This is particularly the case for pilotage in Port Hedland where most laden capesize ships can only be sailed out on the high tide.[47] 

Research demonstrates that working these types of shifts results in sleep that is significantly shorter and of inferior recuperative value, even though many shifts are not excessive in length (Gregory et al, 2020; Chambers and Main, 2015). Sleep under these circumstances is also fragmented and more difficult to initiate (Weaver et al, 2021: 300). A study of 40 Australian marine pilots found that sleep quality following a night shift, where pilots are attempting to sleep in the early morning or day time, was significantly worse compared to sleep that occurred before working a day shift (Tait et al, 2021).

The pilot’s reported 8 hours of sleep was likely segmented, and the pilot reported that it was often difficult to get to sleep when assigned pilotage tasks in the early hours of the morning. The pilot also acknowledged that their sleep that day was ‘broken’ and ‘not good’. Analysis of the pilot’s mobile phone activity during the day showed that their reported 8 hours of sleep was probably broken into periods of between 2–5 hours’ sleep at a time. Sleep during the circadian peak for alertness (daytime hours), when we are least likely to fall asleep, generally results in a significantly reduced amount of recovery sleep (Akerstedt and Wright, 2009).

Effects of circadian rhythm

The grounding occurred at about 0140, during the nighttime circadian rhythm trough, and just outside the window of circadian low (WOCL, 0200 – 0600). Circadian effects on alertness and performance are well documented. Performance during the circadian trough is associated with lower alertness, slower reaction time, reduced cognitive performance and poorer accuracy compared to during the circadian peak (daytime hours) (Van Dongen and Dinges, 2005; Folkard and Tucker, 2003). However, the pilot’s rest opportunity/sleep over the preceding 72 hours included a period over the nighttime circadian trough (from 1645 on 6 April to 0833 on 7 April). Additionally, the presence of circadian effects in an occurrence is not sufficient on its own to establish the existence of fatigue (Riethmeister et al, 2019:158; Williamson and Friswell, 2011). Nevertheless, the pilot’s ability to manage the increased workload arising from managing the response to the incident was likely affected by the circadian effects of operating in the early hours of morning, just outside the WOCL.

Workload, stress and decision-making

Following the rudder angle indicator failure and the development of the turn to port, the pilot’s workload in managing the emergency naturally increased. Effective decision-making during an emergency is inherently challenging due to the time pressure, uncertainty, novelty, and the dynamic decisional environment (Reale et al, 2023). Research has shown decision-making under stress becomes less systematic and more hurried; fewer alternative choices are considered; and communication is reduced and of poorer quality, disrupting effective team performance (Dismukes, Goldsmith and Kochan, 2015).

For example, shortly after the ship started turning to port towards the side of the channel, the pilot ordered the rudder hard over to port. However, this order conflicted with the orders previously issued to the 3 escort tugs aimed at arresting the turn to port. The pilot’s rudder order of hard to port was an error on the part of the pilot who almost certainly intended to say, ‘hard to starboard’ and not ‘hard to port’. While documented effects of fatigue include increased incident of human error (Wickens et al, 2015), and decrements in vigilance, reaction time, information processing, and decision making (Rosekind et al, 1996:158), these behaviours are also characteristic of the effects of acute stress on decision-making under uncertainty. 

Summary

The pilot’s FAID score of 73, PSWM hours of sleep and self-assessed fatigue score of ‘5’ was within the allowable limits of the PHP fatigue management procedure. Although, the pilot’s sleep history leading up to the grounding could not be definitively established, the pilot estimated obtaining at least 8 hours sleep in the preceding 24 hours and a similar amount of sleep each day over the previous 2 days. While the sleep in the 24 hours before the grounding was likely not of optimal quality, the 72-hour period before the grounding included an overnight rest opportunity when good quality sleep was most likely to be obtained. 

Therefore, while there were factors that potentially reduced the pilot’s ability to obtain sufficient, restful sleep of the required quality, there was insufficient evidence to establish that the pilot’s sleep quantity and quality was impaired to the point where they were likely experiencing a level of fatigue known to have an effect on performance. 

PHP fatigue trends

A PHP assessment of fatigue and roster data over a 3-year period from 2018–2020 identified that the number of alterations of the pilot roster sequence[48] due to unacceptable FAID and PSWM scores was increasingly trending upwards with an average of 21 changes per quarter.

The assessment acknowledged that while the FAID program considered sufficient sleep opportunity, it did not account for actual amount of sleep or sleep quality. Furthermore, it only considered the cumulative effects of a 7-day work history, rather than the entire 4-week duty period. The assessment also noted that the PSWM score did not differentiate between longer, better quality sleep and a series of shorter, lower quality sleep periods, which were often the case.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 20 July 2022, during planned track maintenance work, a track mounted excavator toppled when lifting an infrastructure trailer off the track near the Evandale Road level crossing, Evandale, Tasmania. The operator of the excavator was fatally injured and the spotter working with the excavator received minor injuries.

What the ATSB found

The ATSB found that, while conducting maintenance work, a track mounted excavator was being used to lift an infrastructure trailer when it became unstable and toppled laterally onto the adjacent ground. The operator, who was the site supervisor, was subsequently fatally injured by the excavator.

It was also identified that the total load being lifted, in combination with the configuration of the excavator, meant that the lift was overweight for the displayed civil and hi-rail modes. 

While the site supervisor was trained and qualified to operate the excavator, it was likely that they had limited experience and familiarity with this specific excavator. This, combined with a perceived sense of urgency with the work task, resulted in the incorrect configuration being selected for the lift.

During the lift, the spotter placed themselves in a dangerous location between the excavator and infrastructure trailer. When the excavator toppled, the spotter was glanced by the boom on their back. The position of the spotter increased the risk of a more serious injury.

Further, based on the available signage within the excavator being used, it was very likely that the excavator was regularly exceeding the working load limit in both civil and high-rail mode for the planned maintenance work, increasing the risk of instability.

What has been done as a result

TasRail, as the infrastructure manager with oversight of the principal contractor Global Rail, has taken several safety actions in response to concerns regarding the use of road rail vehicle excavators in rail mode. It immediately implemented an embargo on such usage across its entire network. Subsequently, it convened an industry forum to devise a safe approach for the resumption of excavator operations. This resulted in the creation of a process flow chart for using earth-moving equipment as a lifting device, accompanied by a compliance checklist. TasRail also shared the forum's outcomes with other rail infrastructure managers across Australia and New Zealand.

Safety message

It is critical that equipment is operated by qualified, competent, and experienced operators who actively validate the working load limits before commencing a task. Further, selecting appropriate equipment, fit for purpose, reduces the risk of administrative risk controls becoming a last line of defence.

The investigation

The occurrence

On the morning of 20 July 2022, track maintenance work, to be conducted by Global Rail, was planned to commence in the TasRail rail corridor between Leighlands Road and Evandale Road, Evandale, Tasmania (Figure 1). At about 0700 local time, prior to commencing work, the work team attended a pre-start safety briefing meeting about the day’s activities, including staying clear of working excavators. The work team consisted of a track protection officer, superintendent, site supervisor, 2 primary excavator operators (using a Doosan and a Hitachi excavator), and general labourers. The pre-start meeting was described by some of the work team as being tense between the supervisor and the primary Doosan excavator operator based on an incident that occurred the previous day. 

Following the pre-start safety briefing, planned track maintenance work commenced. The planned track work involved replacing sleepers and rail, using 2 rail mounted excavators with infrastructure trailers, interchangeable excavator head tools, and various other tools and supplies. The Hitachi ZX135US excavator was operating on track near the site meeting point/office at Leighlands Road. The Doosan DX140W excavator was ferrying tools, equipment and supplies using 2 infrastructure trailers coupled by draw bars between the main site staging area at Leighlands Road and throughout the worksite. At some point before the rail ferrying was completed, the work team had begun to unclip the old rail from the sleepers, restricting the excavator’s access to the main site staging area at Leighlands Road.

At about 1005, the primary operator of the Doosan excavator unexpectedly parked the excavator at the secondary site area near the Evandale Road level crossing and departed the worksite. The excavator was parked on the track, with the rail wheels disengaged and retracted, and 2 rail mounted infrastructure trailers attached with draw bars. 

Figure 1: Location overview 

Source: Google Earth, annotated by the ATSB 

The superintendent reported that the site supervisor was concerned about the excavator and 2 trailers remaining on the track, and the limitations it would place on the progress of the ongoing work. Following a short discussion, and before the superintendent could complete that discussion, the site supervisor walked off towards the excavator, asking a labourer to act as spotter on the way. 

On arrival at the Doosan excavator, the site supervisor climbed into the cabin and began preparing the machine, including lowering the rail wheels to place the excavator into the hi-rail mode, mounting it on the rails. The spotter disconnected the infrastructure trailer draw bars between the excavator and trailers and placed the draw bar on the trailer.

Based on the previous process used, the spotter explained the lifting process to the site supervisor via the cabin door, which was locked in the open position. Following this, the site supervisor positioned the excavator boom arm above the first infrastructure trailer and tried to hook the lifting chain with the rail threader head (Figure 4). Failing this, the spotter attached the lifting chain to a hook located on the tilt rotator head (Figure 4).

At about 1035, while stationary, the site supervisor used the excavator boom, at or near full extension, to lift the infrastructure trailer loaded with the infrastructure trailer draw bar and timber dunnage. The spotter was positioned between the excavator and infrastructure trailer being lifted. The infrastructure trailer was lifted just above rail level before the load gradually slewed laterally. 

The spotter reported that, at some point during the lift and slew, the excavator operator realised that the lift was out of control and immediately lowered the boom arm in an effort to stabilise the excavator and/or to avoid striking the spotter. The spotter recalled the rail threader attachment ramming the infrastructure trailer at this time. The spotter, standing between the excavator and the trailer, immediately evacuated the area as the excavator toppled onto its side (Figure 2). The spotter did not directly witness the topple. The excavator boom arm scraped down the back of the spotter as they evacuated the area, resulting in minor injury. 

Figure 2: Accident site 

Note: Track curvature is 650 m with an average track cant of about 8 mm.

Source: Tasmania Police, annotated by the ATSB 

Following the topple, the spotter walked around the excavator looking for the site supervisor, assuming they had escaped from the cabin as the cabin was empty. A short time later, the remaining work team responded, and the site supervisor was found under the excavator towards the rear, fatally injured. The accident was reported to TasRail, with emergency services attending the site shortly thereafter.

Context

Personnel information

Site supervisor

A review of the Global Rail personnel records identified that the site supervisor was experienced with work on and around the track, held the appropriate and up-to-date qualifications and competencies, and was assessed as medically fit. 

The site supervisor received the Doosan DX140W excavator operator competency assessment on 21 February 2022. Based on reports from work colleagues, the site supervisor had operated excavators on-site on an ad hoc basis when required. A work colleague suggested that the site supervisor had about 5-8 hours experience operating the Doosan excavator. It could not be determined if the site supervisor had lifted infrastructure trailers before.

Based on the working roster, information from colleagues, and the post-mortem toxicology results, there was no evidence that fatigue, illicit or prescription drugs, or alcohol likely affected their performance on the day.

Spotter

A review of the Global Rail personnel records identified that the labourer, acting as spotter, had about 2-3 years of experience working on or near the track, held the appropriate and up-to-date qualifications and competencies (including a valid construction white card), and had been assessed as medically fit. The labourer had attended a Global Rail safety briefing for the work and had been used as spotter when lifting infrastructure trailers on many occasions during this work.

Excavator information

The Doosan DX140W wheeled excavator was purchased new by Global Rail with an understanding that the working load limit was sufficient for rail infrastructure works. The excavator was subsequently modified by Melrose Mobile Hydraulics to include the addition of road-rail components and systems. This allowed the excavator to travel on both rails and road. It typically consisted of flanged wheels that engaged the rails, rubber tires for road travel, and a lifting system to raise and lower the excavator between rail and road (civil) modes. The rail wheels provided a longer, but narrower footprint compared to the rubber wheels. As result of the modification, the Doosan working load limits were revised using the Australian Standards, consequently reducing the limits.

The excavator was also equipped with a suspension oscillation lock system, which was designed to secure the upper structure (the part that houses the cabin, engine, and hydraulic systems) in a fixed position during a lift, providing stability and preventing unintended movement. It was also fitted with a red safety lock lever on the driver’s seat, which, when engaged in the horizontal position, activated the controls for operation. It was not fitted with a dynamic weighing system or overweight interlocked controls.

An operation and maintenance procedure document was supplied as part of the delivery process in early 2022, along with a training and competency assessment for operators, which included the site supervisor. The training and competency assessment included use of the road-rail system, narrow gauge operation, and use of the oscillation lock system when lifting. The operation and maintenance documented noted:

The Hi-Rail is designed for travel only on rail lines, if any operation of the boom, arm or attachment is to be performed outside of the rolling stock outline the hi-rail WLL [working load limit] chart must be strictly adhered to.

When the Hi-Rail is deployed the maximum allowable boom load is 1900kg. However, depending on the load centre distance from the excavator, this may need to be reduced so that the rail axle capacities are not exceeded. The front & rear hi-rail capacities are 12500 kg. Extreme care should be applied whenever slewing the machine with consideration given to the mass of any boom load or attachment fitted and the radius of boom/dipper arm, see Appendix A for the Hi-Rail W.L.L chart.

The working load limit chart shows how much weight can be safely lifted at various distances from the centreline (pivot point) of the machine, referred to as the lift point radius. Appendix A from that document, shown below in Figure 3, replicated the working load limit chart sticker located inside the cabin for operator reference. 

When in the hi-rail mode, with the boom arm (the lift point radius) fully extended, the maximum weight that could be lifted when stationary was 381 kg. This weight increased to 904 kg with a reduction in the boom arm length to 6 m. When in the civil mode, the lifting capacity was 1,214 kg at any boom arm length. These weight limits reduced when the excavator was moving (mobile) with the load. For both modes, these weights were based on 75% (stationary) and 66% (moving) of the tipping capacity respectively, which is the point at which the machine will begin to tip or lift off the ground.

The capacities presented in the chart are based on the excavator having a standard boom arm and a tilt rotator weight of 407 kg. Therefore, the tilt rotator was excluded from the working load limit weights. The tilt rotator and rail threader are shown in Figure 4.

Figure 3: Hi-rail and civil mode working load limit chart 

Source: Melrose Mobile Hydraulics Doosan DX140W Excavator Hi-Rail Operation and Maintenance Procedure, 7878 – DX140W HROP – REV 0

Figure 4: Tilt rotator and rail threader 

Source: ATSB 

Wreckage and site information

Following the accident, TasRail, Global Rail, the Office of the National Rail Safety Regulator (ONRSR), Tasmania Police, WorkSafe Tasmania, and the ATSB attended the site to collect evidence and conduct investigations. The following on-site observations were made by those parties:

• there was evidence of lateral wheel movement (teetering) on the rail head over about 4 m, which correlated with the excavator rear rail wheels (Figure 5)
• the excavator rail wheels were fully lowered in high rail mode
• the suspension oscillation lock was disengaged and selected off in the cabin (Figure 6)
• the boom arm was at or near full extension
• the excavator was fitted with tilt rotator and rail threader attachments
• the infrastructure trailer was connected to the tilt rotator hook via the lifting chain
• the infrastructure trailer had timber dunnage and a draw bar on top
• the cabin door was locked open
• the seat belt was unlatched and retracted
• the red safety lock lever was in the operational (horizontal) position
• there was no evidence of an equipment failure
• the accident occurred on slightly curved track with a post-accident cant measurement of about 17 mm
• the primary Doosan excavator operator and site supervisor had not signed the pre-start briefing sheet, as required
• the other excavator being used, the Hitachi ZX135US (tracked), did not have a working load limit chart sticker in the cabin.

Figure 5: Teetering evidence on the rail head

Source: Tasmania Police, annotated by the ATSB 

Figure 6: Oscillation lock disengaged and off

Source: Tasmania Police, WorkSafe Tasmania, ONRSR, annotated by the ATSB 

The excavator and associated equipment were further inspected at an off-site Police facility following recovery. The following observations were made by the ATSB:

• The excavator was fitted with a working load limit lift chart sticker, along with other operational stickers, on the boom-side cabin window. 
• Other current compliance labels (Global Rail, TasRail) were also identified.
• The boom was labelled ‘W.L.L. [working load limit] 1068KG’ (civil mode, mobile pick and carry).
• The rail infrastructure trailer, draw bar, and lifting chains, were fitted with compliance plates.
• The excavator was not fitted with a rail data recorder or similar, nor was it required to be.

The ATSB also took various measurements that were recorded between the tilt rotator, rail wheels, rubber road wheels, and pivot point.

On 26 July 2022, an ONRSR rail safety officer inspected the excavator at the storage facility, and the accident site. The officer concluded that, aside from accident damage, the excavator was in a good condition with no signs of poor maintenance. It was noted that the excavator’s front rail axle was in travelling mode during the inspection, suggesting it was pivoting rather than locked (suspension oscillation locking system).

The ONRSR officer noted that the accident happened on curved track, where the excavator would have leaned towards the inside due to the track's cant. Evidence such as flange marks and paint scratches indicated that the excavator likely rolled over towards the inside of the curve at a very low speed. ONRSR static overturning calculations indicated that the combination of factors such as the axle mode, track cant, and wheel position alone would not have led to the rollover. However, a significant lateral shift in the excavator centre of gravity, possibly resulting from the operator (site supervisor) rotating the boom, contributed to the rollover.

Stationary load limit calculations

Equipment weights

Table 1 below shows the equipment being used and their individual weights as shown on the respective compliance plates.

Table 1: Equipment weights

Equipment	Weight (kg)
Infrastructure trailer	1,780
Rail threader	330
Tilt rotator	407 (already included in the base weight of the excavator)
Draw bar long	176
Draw bar short	156

Actual working load limit

The excavator was lifting a combined equipment weight of at least 2,266 kg, consisting of the infrastructure trailer, rail threader, and short draw bar. This calculation did not include the timber dunnage or lifting chains. 

On-site observations indicated the excavator boom arm was at near or full extension. Referring to the lift chart for the stationary hi-rail mode (Figure 3), the maximum working load limit was between 904 kg at 6 m and 381 kg at maximum extension. Given the items being lifted from the track, the excavator was lifting between 1,362 kg (150%) and 1,885 kg (495%) over the working load limit (Figure 7).

The primary operators of both excavators recalled that, when lifting infrastructure trailers, they would normally be in the civil mode, with the boom arm close to the excavator, and without the rail threader being attached. It was reported that the lifting of the infrastructure trailers on and off the track would take place at the main site at Leighlands Road. In this configuration, the excavator would be lifting a combined equipment weight of at least 1,936 kg, consisting of the infrastructure trailer and short draw bar. Based on a working load limit when in the stationary civil mode (1,214 kg), the limit would also have been overweight by 722 kg (61%) without the rail threader installed or 1,052 kg (87%) in the accident configuration (with a rail threader installed).

Practical working load limit

Noting that the working load limit weight reduced as the boom arm was extended, for the Doosan excavator, the ATSB estimated the minimum possible lift point radius that could be achieved when lifting an infrastructure trailer. The ATSB measured between the pivot point and the leading edge of the hi-rail wheels to be about 3 m. The infrastructure trailer was 4 m long, meaning the lift point (in the centre) was 2 m from the trailer edge. This meant that the minimum possible distance from the pivot point to the lift point was about 5 m. 

Using the stationary hi-rail mode working load limit chart (Figure 3), the ATSB linearly extrapolated an indicative limit for a 5 m extension or lift radius as 1,568 kg.[1] This meant that, at the closest possible distance, the excavator would be lifting 698 kg (45%) above the working load limit (with an empty trailer, rail threader and short draw bar, similar to the accident (Figure 7).

Figure 7: Combined equipment weight, working load limit, lift point radius (boom arm extension), and tipping capacity for hi-rail mode

Source: ATSB

For comparison, and as noted above, the civil working load limits remained the same irrespective of the boom arm extension. Therefore, for the normal operating configuration as reported by the primary operators, it would be 722 kg (61%) overweight (Figure 8).

Figure 8: Combined equipment weight, working load limit, lift point radius (boom arm extension), and tipping capacity for civil mode]

Source: ATSB

TasRail comment

In response to this draft report, TasRail noted that thought should be given to having a separate industry standard or guidance regarding the use of road-rail vehicle equipment as a lifting device. This could include consideration of: 

• the risk profiles of different track gauges 
• the requirement for operators to conduct a detailed risk assessment and calculations prior to the deployment of such equipment where its capacities change depending on the task or environment, for example, when used in civil or hi-rail modes
• the human factors associated with swapping between modes of operation
• the possible control measures of limiters and alarms, for example, overlimit interlocking systems or overlimit alarms. 

TasRail also noted the importance of conducting a risk assessment to ensure fit for purpose equipment is procured and/or used.

Track work

The rail work being conducted at Leighlands Road was part of a larger scope of work in that rail corridor, and included replacing sleepers and rail, and removal of fouled ballast (mudholes) and associated re-railing and re-sleepering. TasRail, the rail infrastructure manager, had tendered the work, and Global Rail was awarded the contract. To enable the work to be completed efficiently and safely, elements of the work, such as rail and sleeper handling, were mechanised. 

As part of the scope of work, a risk assessment was developed, which identified risks associated with the planned work. To address these risks, a safe work method statement (SWMS 044 dated 07-03-2022, issue 7.0) was developed for the removal and installation of rail and sleepers. In that statement, a plant (such as excavators) hazard risk of rollover was identified. The risk control measures were:

• Plant operator must be ticketed and competent for his item of plant.
• All plant to be fitted with flashing lights and reversing alarms.
• When moving around plant and equipment eye or verbal contact with the operator must be made prior to any personnel entering the danger zone or changing locations.
• Plant operators must not use mobile phones at any time they are operating machinery on the site.
• Visually inspect the terrain to ensure there is no chance of tipping due to potentially hazardous surfaces uneven ground / embankments.

Furthermore, a plant sliding/tipping event during lifting operations was identified, and included the following control measures:

• Ensure level platform before commencing any lifting operations.
• Only operate to the OEM [Original Equipment Manufacturer] of the machine.
• Machine may need to be de rated when used to lift.
• A lift chart must be in the cabin for the operator to refer to.

In addition, lifting outside of the safe working limit (SWL) of plant was identified, and included the following control measures:

• Before commencing a lift check, Max load to be lifted (Delivery docket or Lift Study) SWL of plant and SWL of lifting equipment to ensure lift is within the SWL of all the plant and equipment.
• All plant including chains to display WWL (Working Weight Limit) / SWL (Safe Work Load) signage.
• Plant and lifting equipment used not to exceed registered WWL/ SWL- Only plant rated to load capacities to be used.

The above risks were identified as high inherent 16 (moderate consequence, likely likelihood) with a residual risk of low 5 (minor consequence, unlikely likelihood) after control measures were effectively applied by the site supervisor and operator (Figure 9).

Furthermore, safe work method statement (SWMS006 Operating an excavator, dated 29-04-2022, issue 5.0) was developed for the operation of excavators. The following control measures were identified:

• Working or traversing on sloping ground - No plant or equipment is to work or traverse on slope over designated gradient as outlined in manufacturers user manual. If traversing slope use low gear and ensure that attachments are slewed to the uphill side of the plant and packed in the travel position.
• Working excavator as a crane - Use dogman/rigger if required. Ensure all lifting equipment is inspected prior to use, is appropriate for the task and is within test dates. Check safe working load and condition of equipment prior to activity being undertaken. Safe working load of plant must be identified and load chart referred to for any variances. Inspect excavator and approved lifting lug. Check burst protection fitted for any loads in excess of 1 tonne. At no time will a suspended load be lifted over any persons. Ensure that all workers are outside the extended height and maximum radius of the plant.

The above risks were identified as high inherent 14 with a residual risk of high 10 after control measures were effectively applied. This meant that works could proceed on the basis that all controls were implemented, and workers onsite undertook a task hazard analysis where required. Global Rail advised that the task hazard analysis was contained in the pre-start briefing conducted on the day by the work site supervisor. Excavator operating duties were also assigned to specific individuals at that meeting, however, this was not recorded on the pre‑start briefing form. Global Rail further advised that there was an expectation that any change to those specific assignments would require a new pre-start briefing to be conducted, however, there was no documented evidence provided to support how this expectation was conveyed to the work team.

Figure 9: Risk scores used in Global Rail safe work method statements

Source: Global Rail

Safety analysis

Introduction

On 20 July 2022, a track mounted excavator became unstable and toppled laterally, fatally injuring the operator (the site supervisor). There was no evidence to suggest the site supervisor’s performance was influenced by drugs or alcohol, nor was there any indication of equipment failure that may have contributed to the instability or topple of the excavator. 

This analysis will examine the accident sequence and the weight of the load being lifted on this and previous occasions. It will also discuss the position of the spotter during the lift.

Instability and toppling of the excavator

Evidence found on-site showed the rear wheels of the excavator teetered along the rail head, leading up to the excavator toppling. The spotter observed that the site supervisor was in the cabin, with the door latched open, immediately before the excavator toppled. Following the topple, the spotter had assumed that the site supervisor had evacuated as the cabin was found empty. However, the site supervisor was found under the excavator. As the spotter did not witness the evacuation, it could not be determined if the site supervisor either evacuated the cabin during the topple sequence, or was ejected from the cabin during the topple, and subsequently received fatal injuries.

It was also noted that the seatbelt was found unlatched following the accident, but there was insufficient evidence to determine if the operator was wearing the seatbelt at the time. 

Lifting overweight and configurations

Based on weight information available within the cabin and on the equipment, and operating at near full boom extension in hi-rail mode, the total weight being lifted was significantly over the working load limits (between 150% and 495% above). This condition very likely contributed to the rear rail wheels of the excavator unloading and teetering along the rail head leading up to the topple. Consequently, the front rail wheels carried the total load, significantly affecting the lateral stability of the excavator and its ability to control the load, shifting the centre of gravity, and pivot point. Further, the suspension oscillation lock on the front axle was disengaged, further reducing lateral stability, and inducing more teetering and lateral load swing. In combination, these conditions resulted in the excavator becoming unstable. This was supported by the ONRSR review of the static rollover calculations, which demonstrated significant lateral shift in the centre of gravity, likely resulting from the slewing of the boom, was required to cause a topple.

Experience, familiarity, and sense of urgency

The superintendent on-site recalled speaking with the site supervisor to solve the issue with the parked Doosan excavator and infrastructure trailers. However, before the superintendent could complete the discussion, the site supervisor had walked off towards the excavator without considering alternative options for removing the trailer. Therefore, it was likely the site supervisor had a sense of urgency to resolve the issue so that they were not delayed. 

The training records showed the site supervisor was deemed competent to operate an excavator having completed competency training for the Doosan about 5 months prior to the accident. However, based on information supplied by witnesses, it was likely that the site supervisor had limited practical experience using the excavator and required some advice from the spotter in its lifting operation on the day of the accident. In addition, while the site supervisor had observed the other excavator operators performing similar lifting operations, it was possible that they would not have known the exact lifting configuration, or the weight of the trailers being lifted, on those occasions. Changing the excavator to hi-rail mode demonstrated that the site supervisor had some knowledge of how to operate the excavator, but also showed limited familiarity and experience as this configuration was not appropriate for the lift to be conducted.

Therefore, it was likely that the site-supervisor’s limited experience and familiarity with the Doosan excavator, and a perceived sense of urgency to progress the work task, set up the condition of being in the incorrect configuration, lifting overweight, inducing teetering, and eventually toppling.

Spotter location

The spotter was suitability qualified, trained and had experience with spotting. Further, the spotter had attended a Global Rail safety briefing for the work as well as a pre-start briefing on the day of the accident, which included information about operating near the excavators. Regardless, to communicate with the site supervisor, the spotter had positioned themselves between the excavator and infrastructure trailer. Consequently, this placed the spotter in a dangerous location within the swing radius of the boom. This increased the risk of the spotter receiving more serious injuries.

Working load limits and the planned track work

The Doosan excavator was acquired by Global Rail to assist fulfilling the track work contract with TasRail. Based on local information (stickers and compliance plates) available, there was sufficient information to determine that lifting infrastructure trailers exceeded the working load limit of the Doosan excavator in both civil and hi-rail modes. Further, the use of this equipment was known and planned for during the scoping stage, however, the working load limit exceedance was not identified. Consequently, the Doosan excavator was very likely routinely lifting infrastructure trailers that exceeded the working load limit. 

It was possible that the working load limit exceedance had not been identified previously due to the skill and experience of the primary operator, who configured the excavator to maximise its capability. This included lifting in civil mode, with the load as close as possible to the excavator and without the rail threader attached.

It was important, and a requirement of the safe work method statement, that the equipment load was calculated and compared to the working load limit declared in the machine cabin via the load chart. This was to ensure that lifting operations were not outside the safe working load limit, thereby increasing the risk of instability. If the working load limit cannot be determined, then the lift should not occur.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the fatality involving a track mounted excavator, Evandale, Tasmania, on 20 July 2022. 

Contributing factors

• During lifting operations, a track mounted excavator became unstable and toppled laterally onto the adjacent ground. The operator (site supervisor) was subsequently fatally injured by the excavator.
• The total load being lifted, in combination with the configuration, meant that the lift was overweight for the displayed civil and hi-rail modes. This resulted in the rear rail wheels lifting and the excavator becoming unstable.
• While trained and qualified, it was likely that the site supervisor’s limited experience and familiarity with this specific excavator, combined with a perceived sense of urgency with the work task, resulted in the incorrect configuration being selected.
• During the lift, the spotter was situated in a location between the excavator and infrastructure trailer, which increased the risk of a more serious injury.

Other factors that increased risk

• Based on the available signage within the excavator being used, which was one of the control measures for managing the risk of tipping and/or lifting equipment beyond the working load limits, it was very likely that lifting infrastructure trailers exceeded the working load limit in both civil and high-rail mode, increasing the risk of instability.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety action by TasRail

Since the occurrence, TasRail has undertaken a number of proactive safety actions, including:

• TasRail immediately implemented a self-imposed embargo on all RRV [rail road vehicle] excavator use whilst in rail mode across the entire network.
• Conducted an industry forum to determine a path forward for the safe return of excavator operations, and a process was developed to ensure that contractors /operators could assure themselves of the safety of their employees and equipment. 
• The output of the forum was the development of a process flow chart for the use of “Earth Moving Equipment Being used as a Lifting Device”. A supporting checklist was also developed to allow monitoring of compliance.
• TasRail has proactively shared the outcomes of the industry forum with other rail infrastructure managers throughout Australia and New Zealand.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• witnesses
• Global Rail
• Office of the National Rail Safety Regulator
• TasRail
• Tasmania Police
• WorkSafe Tasmania.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• Global Rail
• TasRail
• Office of the National Rail Safety Regulator
• labourer acting as spotter.

Submissions were received from:

• Global Rail
• TasRail
• Office of the National Rail Safety Regulator.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On the 18 July 2022, at 2110 Coordinated Universal Time, a Qantas Airways Boeing 737-838, registered VH-VZO and operated as flight number QF933, departed Brisbane Airport, Queensland, on a scheduled air transport flight to Perth Airport, Western Australia. There were 174 people on board, including 2 flight crew members.

During the approach to Perth, air traffic control (ATC) advised the crew there were significant delays, over and above the promulgated estimated delay time, for arrivals into Perth. The aircraft did not have enough fuel to hold for the extra time and the flight crew declared a fuel MAYDAY. The aircraft was then given priority for the approach and landed with their final reserve fuel intact.

What the ATSB found

The ATSB found the aircraft had departed with the required fuel onboard. During the cruise, when the aircraft descended from flight level (FL) 340 to FL 280, the aircraft was not flown at the speed schedule displayed on the flight plan. This resulted in the aircraft using more fuel than planned. The fuel burn returned to the planned rate later in the flight however, the aircraft had used an extra 600–700 kg of fuel. Despite that increased usage, as the aircraft passed the decision point, there was sufficient fuel to continue the flight to Perth.

The ATSB also found that ATC had applied the required priority to the aircraft. However, the timing of the advice of airborne delay greater than the promulgated estimate of 10 minutes resulted in the aircraft being unable to land with the required fuel reserve. This left the flight crew with no other option than to declare a fuel MAYDAY to receive priority landing and preserve their required fuel reserve.

Safety message

Sophisticated flight planning and monitoring systems allow fuel usage and aircraft movement to be accurately determined. While operational requirements may necessitate deviation from the plan, this incident illustrates that decisions by flight crew and air traffic controllers that result in higher‑than‑planned fuel usage can reduce available airborne options.

Where flight crew find that they may not have the required fuel reserve, it is vital, as in this case, that flight crew alert air traffic control and if necessary, declare a Fuel MAYDAY. This will ensure that the aircraft receives priority during the approach, preventing an unsafe situation from developing.

The investigation

Decisions regarding the scope of an investigation are based on many factors, including the level of safety benefit likely to be obtained from an investigation and the associated resources required. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report and allow for greater industry awareness of findings that affect safety and potential learning opportunities.

The occurrence

At 2110 Coordinated Universal Time on 18 July 2022, a Qantas Airways Boeing 737-838, registered VH-VZO and operated as flight number QF933, departed Brisbane Airport, Queensland, on a scheduled air transport flight to Perth Airport, Western Australia (Figure 1). There were 174 people on board, including 2 flight crew members.

Due to significant forecast headwinds, the flight was planned to fly south of the direct path, overhead Mildura, Adelaide, across the Great Australian Bight, then to Perth and estimated to take 5 hours and 30 minutes. Early in the cruise, the aircraft encountered stronger headwinds than forecast so the flight crew contacted air traffic control (ATC) and requested, and received, a clearance to fly slightly north of the planned track.

The aircraft was descended earlier than planned from flight level (FL) 340[1] to FL 280, due to turbulence and to also take advantage of lesser headwinds and remained at this level as it passed Adelaide.

Figure 1: Flight path

Source: Google Earth with Flightradar 24 data, annotated by ATSB

At this stage of the flight, the flight crew identified that they were using more fuel than planned and discussed diverting to Adelaide to load more. However, as they would be required to hold while they used fuel to reduce the aircraft’s weight to under the maximum landing weight, and they had sufficient fuel to continue to the destination, they decided to continue to Perth.

To assist their in‑flight planning, the crew assessed the wind speeds using an application on an iPad and requested reports of actual wind strength from flight crew in other aircraft, flying at different altitudes. As they were crossing the Great Australian Bight, they received a report from another crew, advising that the wind at FL360 was about 15 kt less than forecast and consequently they climbed from flight level (FL) 280 to FL 360, again, earlier than planned.

Subsequently, they discussed diverting to Kalgoorlie to load more fuel. However, due to the runway length at Kalgoorlie, they would still be required to hold to reduce the aircraft’s landing weight. The weather forecast for Kalgoorlie was also showing an INTER,[2] where the visibility was reduced to 5,000 m in rain with broken cloud[3] at 800 ft. Consequently, as they still had the required fuel to fly to Perth, they elected to continue.

As they passed the decision point all engines (DPA),[4] they again assessed that as there were no fuel‑related weather requirements at Perth and that they had sufficient fuel on board to continue the flight.

The flight crew continued to request, and receive, track shortening from ATC. Later in the cruise, ATC advised the crew there were significant delays for arrivals into Perth and they could expect around 13 minutes delay before passing BEVLY, a waypoint[5] on the arrival procedure (Figure 2). ATC instructed the crew to reduce to minimum speed and to temporarily turn off-track to delay the BEVLY passing time. The crew had estimated passing BEVLY at 0226 and asked ATC for the expected passing time and were subsequently advised it would be 0242. They advised ATC that they were carrying 10 minutes of traffic holding fuel, which was required for traffic holding at Perth. As such, they could cross the waypoint at 0236 however, they did not have enough fuel on board to cross BEVLY at 0242. They also advised they would need to remain at altitude until they passed HAMTN, a waypoint on the arrival procedure, and to descend at 230 kt in a continual descent to conserve fuel.

ATC advised the flight crew that the order of aircraft in the arrival sequence could not be changed unless they declared a fuel MAYDAY, which the crew subsequently did. The aircraft was then given priority for the approach.

Figure 2: Approach path

Source: Google Earth with Flightradar 24 data, annotated by ATSB

Prior to the approach, the crew briefed on the procedures for a low fuel warning.[6] During the approach, they received a FUEL LOW warning for the right fuel tank when there was about 930 kg of fuel remaining in the tank. The crew followed the non-normal checklist and selected the cross‑feed selector to OPEN and selected fuel pumps to ON. This resulted in fuel being used primarily from the right fuel tank.[7] The low fuel warning activated for the left fuel tank 38 seconds prior to landing. At that stage, there was 676 kg of fuel remaining in the right fuel tank.

The aircraft landed at Perth at 0248 with the required final reserve fuel intact plus 300 kg of fuel, 5 hours and 38 minutes after take-off.
 

Context

Flight plan

The flight was planned using the operator’s flight planning system. Fuel for the following was included:

• taxi
• trip (take-off, climb, cruise and descent to 1,500 ft above Perth)
• departure allowance to set heading (see the section titled Operator requirements)
• contingency fuel (see the section titled Contingency fuel)
• 10 minutes of fuel for traffic holding at Perth (see the section titled Traffic holding fuel)
• approach (see the section titled Operator requirements)
• final reserve fuel (see the section titled Final reserve fuel)
• extra fuel (see the section titled Operator requirements)

The crew advised that 300 kg of freight was removed from the aircraft to allow the minimum flight planned fuel amount to be carried. The weather forecast for the flight's arrival time was such that no extra fuel was required for weather holding, nor was an alternate airport required.[8]

Contingency fuel

According to the Civil Aviation Safety Regulations (CASR) Part 121 manual of standards (MOS) section 7.03, contingency fuel is ‘the amount of fuel required to compensate for unforeseen factors’. Further, Part 121 MOS subsection 1.04 definitions (1) defined unforeseen factors as

factors that could have an influence on an aeroplane’s fuel consumption to the planned destination aerodrome, including:

(a) the aeroplane’s deviation from the expected fuel consumption data for an aeroplane of that type; and (b) extended delays and deviations from planned routings or cruising levels.

The contingency fuel for a turbine-engine aircraft where a point of in-flight replanning is specified,[9] must include the higher of either:

• 5% of the trip fuel from the in-flight replanning point to the planned destination,[10] or
• not less than the amount of fuel required to fly, in ISA[11] conditions, for 5 minutes at holding speed, at 1,500 ft above the planned destination.

The flight plan included fuel to fly for 5 minutes at 1,500 ft, as this was the greatest amount.

Traffic holding fuel   

The Aeronautical Information Package En-route supplement provided an estimate for delays for flights into Perth. This stated that at the time the flight was due to land, they could expect up to 10 minutes airborne delay. This was an advisory time only and the actual holding time could vary.

The flight plan included 10 minutes holding fuel.

Final reserve fuel

A turbine-engine aeroplane is required to carry 30 minutes of fuel to allow the aircraft to fly at holding speed, at 1,500 ft above the aerodrome elevation. This must be available at the completion of the flight.

Operator requirements

The operator’s procedures provided a fuel allowance including:

• a departure allowance to allow for a departure from an airport where a known lengthy departure procedure is required prior to joining the flight planned track.
• an approach allowance of 300 kg of fuel.

Qantas also had a requirement that a Boeing 737 aircraft have 2,700 kg or 70 minutes of fuel when they arrived overhead the destination airport, whichever was greater. This amount was inclusive of the required contingency, traffic holding, approach and final reserve fuel. Once the aircraft had departed, there was no requirement to preserve the extra fuel to meet this pre‑flight requirement.[12]

The flight plan included almost 700 kg to fulfill this requirement.

Operator fuel planning procedures

According to the operator’s fuel planning procedures, the pilot in command (PIC) should only order discretionary fuel to cater for a known, but unplanned, operational reason. If the PIC believed payload should be offloaded to allow for extra fuel, they were required to consult with the integrated operations centre (IOC), who would assess the commercial implications. They were also required to submit a pilot report.

The pilot advised that as they had the required minimum fuel for the flight, they did not offload any further freight to load extra fuel. They advised if there had been space, they may have added extra fuel. They also advised that if they had decided to take extra fuel, they were confident they would not have encountered any pressure from management. They advised that since the COVID-19 pandemic began, Qantas management had advised flight crews to take their time when conducting pre-flight planning and to take extra fuel if they thought it was required.

Cost index

The cost index (CI) is the ratio between the operating cost of an aircraft and the fuel burn. The lower the cost index the slower the flight and therefore the lower the fuel burn, however the aircraft will be operating longer. Consequently, it will have a higher operating cost. The CI for the maximum range is 0.

Qantas flight administration manual advised that the cost index:

provided on the flight plan is derived from a number of data sources and policy requirements. Based on variations in operating conditions for each flight, the cost index balances various interrelated costs to minimise the total operating expense of the flight. While the pilot in command may vary the cost index, this should only be done based on sound command and commercial judgement.

The CI should be entered into the flight management computer (FMC) during the preparation for the flight and the aircraft should be climbed, cruised and descended[13] at the FMC generated ECON[14] speed/ Mach number. The CI on the flight plan for this flight was 10. The flight crew was required to enter this figure into the FMC prior to the flight.

Flight planning system

The Qantas flight planning system was designed to search for the most efficient route for the flight. The system would select enroute descents and climbs to take account the changing weight of the aircraft and the forecast wind. It would also display the Mach number[15] required for the most efficient cruise at the planned altitude, for the selected cost index. The flight plan showed the forecast wind for 1 flight level above and 2 flight levels below the planned flight level.

The flight plan also displayed the decision point all engines (DPA) (among other relevant decision points) with the expected fuel remaining and the minimum fuel required to fly from this point to the destination. The flight plan showed that the minimum fuel required at the DPA to continue to Perth was 2,600 kg.

Boeing flight plan check

The ATSB did not have access to flight planning software to check the accuracy of the Qantas fuel plan. As such, The Boeing Company (Boeing) was contacted to prepare an independent flight plan, using the forecast weather data. Boeing subcontracted the flight planning to another company. However, their software did not allow them to enter the actual forecast winds over the entire flight plan and consequently they used an average wind vector for the flight. Their flight planning system calculated that the required flight fuel[16] was 15,211 kg. The flight plan produced on the day by the Qantas flight planning system calculated that the flight fuel[17] required was 15,190 kg.

Flight plan track versus actual track

The ATSB downloaded the data from the aircraft’s flight data recorder. Figure 3 shows verified flight data for certain recorded parameters during the flight. The data showed the:

• aircraft took off with approximately 170 kg more fuel than planned.
• flight crew selected VNAV[18] speed during the climb segments.
• flight crew selected speed on the master control panel to control the speed during descent.
• FMC generated speed was utilised during the cruise segments.

At approximately 2242, the aircraft descended earlier than planned from FL 340 to FL 280, following assessment of the actual winds. The crew then engaged the FMC for the cruise at FL 280, however, the Mach number did not reduce to that planned, resulting in the aircraft using more fuel than expected in the flight plan.

Figure 3: QF933 flight data

Source: ATSB

The data also showed that at 2348, when the aircraft climbed early from FL 280 to FL 360, the aircraft had approximately 800 kg of fuel less than planned. The actual fuel burn then reduced while the aircraft was flown at a higher level than planned however, the fuel quantity remained approximately 600/700 kg below the planned level for the remainder of the flight.

The review also identified that the Cost Index parameter was not correctly recorded in the flight data.[19]

Table 1 shows the planned Mach number versus the average Mach number for the different altitudes flown.

Table 1: Planned Mach number versus the average Mach number flown

Elapsed time (hr)	Altitude (ft)	Planned Mach	Average Mach
0.37 – 1.47	34,000	0.785	0.792
1.55 – 2.59	28,000	0.713	0.770
3.08 – 4.05	36,000	0.781	0.792
4.14 – 4.50	38,000	0.782	0.788*

*Before speed reduction for sequencing into Perth

The fuel plan in the FMC identified to the flight crew that the aircraft was using more fuel than planned during the first part of the flight and then later in the flight, returned to approximately the expected fuel burn (Figure 4).

Figure 4: Fuel plan as displayed in the aircraft flight management computer

Source: Operator, annotated by ATSB

Data supplied by Qantas showed that at the DPA (KATHI) there was 2,800 kg of fuel remaining on board.

Adherence to the flight plan

The Qantas Flight administration manual (FAM) stated:

Subject to airmanship and other operational influences flight crew are to utilise mid-segment climb (MSC)….

No deviations from flight plans are to be initiated by the pilot in command other than those occasioned by normal operational requirements (e.g. deviations due to weather, safety considerations, etc.).

The operator confirmed that they would expect a flight crew to deviate from a flight plan where there were operational reasons to do so. They also advised that the crew was expected to fly the appropriate speed for the selected level - generally this would be the FMC generated ECON speed for the flight planned cost index.

Perth Airport forecast

The terminal area forecast for Perth at the time of arrival showed that from 2300 the wind was from 100° at 8 kt with visibility greater than 10 km, showers of rain, scattered cloud at 1,500 ft and broken cloud at 2,500 ft.[20] From 0300 on the 18 July, the wind was from 150° at 8 kt with visibility greater than 10 km, no significant weather and scattered cloud at 3,000 ft.

The alternate minima for Perth were a cloud base of 400 ft and 1,600 m visibility.[21]

Air traffic arrival sequence

As the air traffic flow management system[22] was not in operation at the time of this occurrence, there were no pre‑arranged arrival times into Perth.

In accordance with AIP Enroute 1.4 – 8 Assessment of Priorities, during the approach, an aircraft with an emergency will get priority in all circumstances. ATC will then apply priority to ‘an aircraft which is first able to use the desired airspace in the normal course of its operation. Consequently, regardless of where an aircraft departed from, they would be placed in the arrival sequence for an airport in order of their actual time of arrival at the relevant approach points. ATC then used speed control, vectoring or holding to achieve an orderly flow of aircraft. 

Order of landing

Table 2 shows the order of landing and the delays[23] applied around the time QF933 arrived.

Table 2: Aircraft order of landing when QF933 landed

Aircraft	Departure	Estimated time due (UTC)	Actual time landed (UTC)	Delay
F100	Paraburdoo	0237	0244	392 seconds
B737 (QF933)	Brisbane	0242	0248	400 seconds
F100	Bunbury	0241	0251	607 seconds
F100	Newman	0247	0253	369 seconds
A320	Newman	0244	0256	725 seconds
DHC-8	Golden Grove	0244	0302	1045 seconds
F100	Coondewanna	0248	0304	975 seconds

QF933 received an actual delay of 400 seconds (6.67 minutes), however they had been allocated a delay of 16 minutes at BEVLY.[24]

Emergency fuel state

Civil Aviation Safety Regulations Part 121 MOS 7.08 stated that the pilot in command (PIC) should advise ATC of a minimum fuel state if they are committed to land at an airport and where any changes to the clearance will result in the aircraft landing with less that the final reserve fuel. The MOS also stated that the flight crew should not expect any form of priority handling as a result of declaring minimum fuel.

Where the PIC has calculated that the aircraft will land with less than the final reserve fuel, the flight crew

must declare a situation of ‘emergency fuel’ by broadcasting ‘MAYDAY MAYDAY MAYDAY FUEL’.

As this is a distress message, the aircraft will be given priority to land.
 

Safety analysis

The Boeing 737-838 departed Brisbane on a scheduled air transport passenger flight to Perth with the operator‑required minimum fuel onboard. The planned flight fuel was verified independently as being sufficient for the flight. The fuel plan included extra fuel to meet the Qantas requirement that a 737 arrive at 1,500 ft above the destination airport with 2,700 kg or 70 minutes of fuel.

During the cruise segments, a Mach number faster than the planned value was flown, resulting in the aircraft using approximately 700–800 kg of extra fuel in the first part of the flight. The FMC was most likely selected to the ECON speed, which will use the selected cost index to set the best economy speed. The ATSB could not verify what cost index value was selected by the flight crew prior to the flight, as this parameter was not correctly recorded in the flight data.

During the flight, the flight crew detected the extra fuel burn and after consultation with a flight crew in another aircraft climbed the aircraft early. While this resulted in the aircraft having a stronger headwind, the fuel burn reduced to approximately the planned rate.

As the aircraft passed the decision point all engines, the crew assessed that, while less than the planned amount, they had enough fuel to meet the requirements and continued to Perth. They were later advised by air traffic control (ATC) that longer than expected traffic delays were anticipated and they would be delayed by approximately 16 minutes.

A review of the Airservices Australia data indicated ATC had applied the required priority to the aircraft. However, the airborne advice from ATC that the aircraft’s approach would be delayed for longer than the promulgated advisory of 10 minutes, resulted in the aircraft having insufficient holding fuel. Additionally, at the time of that advice the aircraft was relatively close to Perth so there was no opportunity for the crew to reduce fuel consumption by any significant amount over the remaining flight time to comply with the increased holding.

This left the flight crew with no other option than to declare a fuel MAYDAY to receive priority landing and preserve their required fuel reserve.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.  These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the fuel MAYDAY declaration involving Boeing 737-838, VH-VZO abeam Wave Rock, Western Australia on 18 July 2022.

Contributing factors

• When the aircraft changed flight levels during the cruise, the speed for the lower altitude specified in the flight plan was not flown, resulting in a higher fuel burn than planned, although still sufficient to meet the requirements of the flight as the aircraft passed the decision point.
• As the aircraft approached Perth, the crew received a delayed arrival time over and above the published 10 minutes estimated airborne traffic delay, resulting in insufficient fuel to meet the extended delay. This necessitated the declaration of a fuel MAYDAY as the aircraft would have landed with less than the required fixed fuel reserve.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew
• Qantas Airways Pty Ltd
• Airservices Australia
• The Boeing Company

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew
• Qantas Airways Pty Ltd
• Airservices Australia
• United States National Transportation Safety Board
• The Boeing Company.

Submissions were received from:

• the flight crew
• Qantas Airways Pty Ltd
• Airservices Australia
• Civil Aviation Safety Authority

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 340 equates to 34,000 ft.

[2]     INTER: an intermittent deterioration in the forecast weather conditions, during which a significant variation in prevailing conditions is expected to last for periods of less than 30 minutes duration.

[3]     Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘broken’ indicates that more than half to almost all the sky is covered.

[4]     Decision point all engines: The waypoint or waypoints nominated on the flight plan, but not beyond the top of descent, from which the aircraft may divert to a different airport with all engines operating while meeting all inflight fuel requirements.

[5]     Waypoint: A defined position of latitude and longitude coordinates, primarily used for navigation.

[6]     Due to a Federal Aviation Administration requirement for a low fuel alert when there was 45 minutes of fuel remaining, Boeing had set this alert at 907 kg of fuel remaining in each fuel tank.

[7]     The fuel pumps in the aeroplane have allowable variations in output pressure. If there is a sufficient difference in pump output pressures and the cross-feed valve is opened, fuel feeds to the operating engines from the fuel tank with the highest pump output pressure. This may result in fuel unexpectedly coming from the tank with the lowest quantity.

[8]     Qantas had a dispensation under arrangements allowing operators to transition from legacy fuel requirements to the requirements of CASR Part 121 (which came into effect on 2 December 2021). This dispensation allowed Qantas to operate under their previous permission in relation to alternate aerodrome requirements and a fuel operational variation. This meant that on the occurrence flight a destination alternate aerodrome was not required, whereas it would have been required for a Part 121 operation. This also allowed Qantas to operate without the 15 minutes holding fuel required under section 7.02 where the destination aerodrome did not require an alternate aerodrome.

[9]     Point of in-flight replanning is a point en-route, determined by the operator before the flight commences, at which the aeroplane can:

(a)  if it arrives at the point with adequate fuel to complete the flight to the planned destination aerodrome while maintaining the required fuel—continue to that aerodrome; or

(b)  otherwise—divert to an en‑route alternate aerodrome while maintaining the required fuel.

[10]    Qantas have advised that their flight planning software has not been updated and calculated 10% of the trip fuel from the in-flight replanning point to the planned destination.

[11]    International Standard Atmosphere (ISA): hypothetical meteorological conditions that provide standard temperatures and pressures at specified altitudes. ISA conditions are used as a datum for calculating aircraft performance data.

[12]    This did not remove the requirement that all regulated fuel requirements must be preserved during the flight.

[13]    During the descent, when the aircraft goes below 5,000 ft above ground level, the maximum speed is 250 kt.

[14]    The ECON speed uses CI as an input that is based on a detailed accounting of actual costs.

[15]    The ratio between the true air speed (TAS) and the local speed of sound (LSS). This ratio, which equals one when the TAS is equal to the LSS, is known as the Mach Number (M) and is very important in aircraft operating at high speed.

[16]    Flight fuel included fuel from commencement of take‑off to Perth Airport.

[17]    Qantas flight fuel included fuel from commencement of take‑off to 1,500 ft at the destination.

[18]    When VNAV is selected, the autopilot will fly the FMC‑programmed speed.

[19]    Qantas advised the parameter for the cost index was not recording correctly for all flights.

[20]    Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘scattered’ indicates that cloud is covering between a quarter and a half of the sky.

[21]    As the flight was operating under the Qantas fuel dispensation, they were not required to comply with the alternate minima requirements for Part 121. For a Boeing 737 aircraft these would be a cloud ceiling of 1,200 ft and visibility of 5,000 m.

[22]    Air traffic flow management is a system where depending on the forecast traffic, aircraft are given a departure time to ensure a managed traffic flow to an airport and to reduce airborne delays.

[23]    Airservices Australia calculate the flight delay by comparing the estimated flight time (using nominal system track information and nominal aircraft performance data for specific aircraft types) and actual flight time for the portion of the flight within 250 NM of the destination aerodrome.

[24]    The flight crew advised the FMC‑generated time of arrival at BEVLY was 3 minutes earlier than the estimate ATC had in their system, possibly due to the track shortening requested by the flight crew and approved by ATC.