Executive summary

What happened

On 23 May 2022, a De Havilland Canada DHC-8-102, registered VH-QQB and operated by Skytrans, was conducting a scheduled passenger flight from Brisbane to Chinchilla, Queensland. Approaching top of descent, the flight crew were alerted to an engine control unit (ECU) failure on the right engine. The ECU failure meant that reverse thrust would not be available on the right engine to assist in decelerating the aircraft on landing, but they assessed it was safe to continue with the planned approach.

During the landing, the aircraft veered to the left of the runway centreline. Towards the end of the runway, the left main landing gear ran off the runway.

What the ATSB found

The ATSB found that, after experiencing an ECU failure on the right engine, the flight crew opted to continue with the planned flight in accordance with the guidance in the available operator’s procedures.

Upon landing with a tailwind and further down the runway than usual, the flight crew experienced reduced braking effectiveness when the anti-skid system activated after the outboard right main wheel locked up after touchdown for unknown reasons. The system released brake pressure on the outboard wheel on both main landing gears, extending the landing roll.

While assessing the available braking performance, the crew missed a standard call that would have prompted the captain to transition to the tiller to provide directional control as the aircraft decelerated. In an attempt to slow the aircraft, the captain applied reverse thrust on the left engine which produced asymmetric deceleration. The aircraft veered slightly left, and the captain elected to use the emergency brake to slow the aircraft on the relatively short runway. Due to the runway being narrow, the left wheels departed the sealed runway surface in the final stages of the landing roll.

The investigation identified that the procedures permitting the flight crew to continue the flight after the ECU failure did not include consideration of other factors that could increase the required landing distance, including a tailwind and a wet runway, or that a narrow runway increased the risk of a veer off due to asymmetric thrust.

The investigation also found that the acceptable means of compliance guidance material for the Civil Aviation Safety Regulations 1998 relating to required landing performance did not clearly convey the intent of the regulations relating to the discontinuation of an approach to a runway when surface conditions were unexpectedly wet.

What has been done as a result

In response to this incident, the operator updated their procedures for continued flight following an ECU failure to prohibit the use of a narrow runway unless operationally required in an emergency.

Revisions to the operating procedures also prohibited the use of short runways with a tailwind.

The Civil Aviation Safety Authority have also added extra explanatory text to the guidance material to better explain the intention of the regulations around the assurance of landing performance and how these requirements can be met.

Safety message

Pilots and operators should remain mindful that unexpected events can combine to produce undesirable outcomes. Procedures for managing an equipment failure should take into account factors that may influence performance or other operational considerations. These could include tyre lock up, runway surface condition or the presence of a tailwind when landing on a short and narrow runway. Increased safety margins in procedural documentation can help ensure flight crew make appropriate decisions when managing unexpected events.

 

The investigation

Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.

The occurrence

On 23 May 2022 at 0720 local time, a De Havilland Canada DHC-8-102 aircraft, registered VH‑QQB and operated by Skytrans, departed Brisbane Airport on a scheduled passenger flight to Chinchilla Airport, Queensland with 3 crew and 26 passengers on board. The captain was pilot flying (PF), and the first officer was pilot monitoring (PM).[1]

At 0740, when approaching the top of descent, the flight crew noticed the engine control unit (ECU) warning light illuminate alerting them to an ECU failure on the right engine. Failure of the ECU meant reverse thrust would not be available on that engine on landing. The flight crew consulted the company procedures for managing an ECU failure, which permitted continuing the flight to Chinchilla. The flight crew checked the weather conditions for landing and elected to conduct a straight-in approach to runway 32,[2] with a tailwind of about 5 kt that was within acceptable limits. They also noted that there were some showers in the area.

The aircraft landed at 0806 and both flight crew reported that the aircraft touched down further along the runway than intended, but still within the company’s permitted touchdown zone.[3] Upon touchdown, the PF reported putting both propellers into beta range[4] and applying the brakes, but little or no braking occurred. The PF announced ‘no brakes’ to the PM, and the flight crew verified the brake hydraulic pressure indicators were indicating within the normal range. The PM also attempted to apply the brakes, but the aircraft was not slowing at the expected rate. In response, the PF moved the left thrust lever to reverse, and the aircraft deviated left of the runway centreline.  

The PF reported the main concern at that point was stopping the aircraft. To avoid locking up the wheels, the PF made 3 applications of the emergency brake,[5]  which was effective at slowing the aircraft. The PM recalled that, as the aircraft decelerated, they did not make the standard 60 kt call that would have prompted the PF to release the control column to the PM and assume directional control using the tiller[6] once the aircraft had slowed to around taxi speed. The PF reported that they did not use the tiller to assist in maintaining directional control because at the time they did not think they were at risk of a runway excursion.

After stopping the aircraft on the turning pad[7] at the end of runway 32, the flight crew taxied the aircraft to the apron via the normal taxiway and the passengers disembarked. The crew were alerted by a cabin crew member that the outer right wheel did not rotate during the landing roll. The PF then conducted an inspection of the aircraft and noticed the outer tyre on the right-side landing gear was deflated, with a flat spot that extended fully through the tyre (Figure 1). There was also mud on the left wheels.

Figure 1: Deflated outer right tyre

Source: Skytrans

The PF then walked the length of the runway and saw tyre marks indicating that the aircraft had deviated off the left side of the runway just before the runway turning pad (Figure 2), and that the outer right tyre had ‘dragged’ on the runway from the point of touchdown.

Figure 2: Tyre marks showing runway excursion to the left of runway

Source: Skytrans, annotated by the ATSB

Context

Flight crew information

The captain had been flying for over 30 years and had about 20,000 hours of aeronautical experience with about 6,500 hours on DHC-8 aircraft. The first officer had been flying for about 20 years and had about 7,500 hours of aeronautical experience, which included experience flying DHC-8 aircraft. Both flight crew had experienced an engine control unit (ECU) failure in flight prior to this incident.

Aircraft information

General

The De Havilland Canada DHC-8-102 aircraft is a high-wing, pressurised airframe powered by 2 turboprop engines, each driving a four-blade constant speed propellor. Skytrans had operated VH‑QQB since 2007.

Engine control unit

Each aircraft engine was fitted with an ECU. The primary function of the ECU is for fuel flow regulation and torque management to optimise performance while protecting the engine from operational hazards such as exceedances of certain engine parameters, including temperature and RPM. The ECU monitors the engine operating condition through various engine and airframe inputs. It also commands the torque motor in the engine hydromechanical unit[8] to optimise fuel flow to the engine and set a reference torque indicator ‘bug’ on the associated engine torque gauge in the cockpit instrumentation.  

In the event of an internal fault, the ECU will drop offline, and engine management will revert to manual control. In manual mode:

• the pilot assumes fuel control
• the ECU MANUAL mode light will illuminate on the caution panel
• there will normally be a difference between the 2 engine power lever positions for the same torque
• engine response will be slower above 15,000 ft and for torque settings below 50%
• engine surging is possible above 15,000 ft
• there are limitations on the use of lower power lever settings, especially after landing, due to the engine under-speed governor, normally controlled by the ECU, being unavailable.

When the ECU is operating in manual mode, reverse thrust is no longer available for that engine/propeller on landing.

Anti-skid braking

Anti-skid systems are designed to minimise aquaplaning and the potential tyre damage that can occur when a wheel is locked or rotating at a speed which does not correspond to the speed of the aircraft. The system compares the speed of the aircraft with the rotational speed of each main wheel. If the speed of a wheel is too slow for the existing aircraft speed, the brake on that wheel is released momentarily to allow the rotational speed to increase and prevent the tyre from skidding. The anti-skid system in the DHC-8-102 is set for heavy airframe loads and when the aircraft is lighter or in slippery conditions, heavy braking may result in a short-term skid.

The system logic is activated by weight on wheels (WOW) proximity switches that close once the weight of the aircraft settles on the main landing gear after touchdown. These switches work in pairs through 2 channels (WOW 1 and WOW 2) to the skid control unit (SCU). There are 2 wheels on each main landing gear strut. The WOW 1 sensors provide input from the proximity switches of the inside wheel on each gear strut to the SCU. The SCU then controls the brakes on the inside wheel of each main gear strut. Similarly, WOW 2 sensors provide a signal to the SCU for the brake of the outside wheel on each of the main landing gear struts.

In addition, there is a ‘spin-up’ protection, ensuring brake pressure is not available to the braking system until the wheels are rolling on the runway surface at 35 kt. If a skid is detected, the skid control valve will provide a 3‑second delay to allow the wheels to spin up before braking is available. If the skid continues for more than 3 seconds, the system response is to release brake pressure on the corresponding wheel of the opposite gear leg through the WOW channels and the SCU, which reduces the braking performance and extends the landing roll.

Once the spin-up protection is no longer required, anti-skid protection is available down to a design limited minimum speed of 12 kt.  Activation of the emergency brake disables the anti-skid system.

Engineering inspection

Engineers visually inspected the right landing gear following the incident and did not identify any defects with the brake pack or axle that would have led to the outer wheel lock up. Both right wheels were subsequently replaced. Significantly, the operator identified that, as the ECU system and the brake system are not connected, the wheel lock up was almost certainly unrelated to the ECU failure.

Managing the ECU failure

The operator used the aircraft flight manual and quick reference handbook procedures to manage an engine with an ECU in manual mode.

The flight crew were alerted to an ECU issue by the illumination of the ‘#2 Eng Manual’ caution light on the caution/warning panel. They then consulted the quick reference handbook for ECU operating in manual mode to determine the required actions. The handbook indicated that the power lever for the affected engine should not be moved below ‘DISC’ on landing, which included to the reverse thrust position.

The flight crew then consulted the Minimum Equipment List in relation to 1 ECU inoperative which stated that:

One [ECU] may be inoperative provided:

a. operations are conducted in compliance with the Airplane Flight Manual (AFM) supplement 10 OPERATION WITH ONE ECU INOPERATIVE; and

b. nose wheel steering and anti-skid brake control system operate normally.

The AFM supplement 10 OPERATION WITH ONE ECU stated (in relation to approach/landing with 1 ECU inoperative):

During approach, a maximum torque difference of 10% may be used to reduce POWER lever asymmetry.

Meteorological information

The aerodrome forecast (TAF),[9] current at the time of the approach, included wind from 120° (true) at 6 kt and scattered cloud at 2,000 ft above the airport, with visibility greater than 10 km. The meteorological aerodrome report (METAR),[10] issued at 0800, indicated that the wind was from 140° (true) at 4 kt with overcast cloud at 10,000 ft. The 1-minute weather data from Chinchilla Airport’s automated weather station recorded a south‑easterly wind at 3–4 kt at 0740 (when the aircraft was at top of descent) and an east‑south‑easterly at 5–6 kt at 0806 (when the aircraft touched down). The maximum wind gust within that period was 6 kt.

Based on the METAR, TAF and recorded observations, the prevailing wind produced an approximate 5 kt tailwind for an approach to runway 32 around the time of landing. The maximum acceptable tailwind stated in the flight crew operating manual was 10 kt. The pilot flying elected to conduct a straight-in approach despite a light tailwind because they assessed it was easier to manage a stabilised approach with the failed ECU. The tailwind component was within the operational limits, and they assessed sufficient runway distance available for a safe landing. 

While no rain was forecast for the scheduled time of arrival, the area forecast indicated the presence of light showers in the area. These showers may not have produced sufficient rainfall to have been recorded with the METAR observations indicating there had been no rainfall in the 24 hours prior to the occurrence. The flight crew advised that at the time of landing, the runway was ‘damp’, and that the aircraft braking would be at or close to normal. Photographs of the runway taken after the occurrence (Figure 2) showed moisture on the runway surface. It was not shiny and there was no visible standing water.

A briefing note from the Flight Safety Foundation, FSF ALAR Briefing Note 8.5 – Wet or Contaminated Runways stated that a runway is considered damp when ‘the surface is not dry, but when the moisture on it does not give it a shiny appearance’.

Runway surface condition definitions

At the time of the occurrence, operators were required to operate in compliance with Civil Aviation Safety Regulations (CASR) Part 121 (Australian air transport operations - larger aeroplanes) performance requirements. During the 6-month transition period from the commencement of Part 121 on 2 December 2021, a deferral provision allowed operators to rely on their existing operations manual, written to comply with Civil Aviation Order (CAO) 20.7.1B Aeroplane weight and performance limitations – specified aeroplanes above 5 700 kg – all operations (turbine and piston-engined), supplemented by annexures to bring their document suite into compliance with the new Part 121.

CASR Part 121 MOS did not recognise ‘damp’ as a runway condition.

The runway surface condition definitions in Part 121 (Australian larger aeroplanes) Manual of Standards included:

dry: a runway is dry if the surface area required for a take-off or landing:

    a) has no visible moisture;

    b) is not contaminated.

wet: a runway is wet if the surface area required for a take-off or landing:

    a) is not dry; and

    b) is not contaminated.

contaminated: a runway is contaminated if more than 25% of the surface area required for a take-off or landing is covered by any of the following:

    a) water or slush more than 3 mm deep

    b) loose snow more than 20 mm deep

    c) compacted snow or ice.
 

Landing performance

A briefing note from the Flight Safety Foundation, FSF ALAR Briefing note 8.3 - Landing distances stated that actual landing distance is affected by various operational factors, with those relevant to this incident being: 

• runway condition (dry, wet or contaminated by standing water, slush, snow or ice)
• wind conditions
• type of braking (pedal braking or autobrakes, use of thrust reversers)
• anti-skid system failure
• system malfunctions (e.g. increasing final approach speed and/or affecting lift-dumping capability and/or braking capability).

Civil Aviation Safety Regulations (CASR) 1998 Part 121 Chapter 9 Division 2 – Landing performance outlined the required factors to be applied to landing performance calculations to account for runway surface conditions. This was based on approved weather reports or forecasts,[11] or a combination of weather reports and forecasts. CASR Part 121 – Dictionary defined what constituted an approved weather report and who could provide one. Licensed pilots were included in the list.

CASR Part 121 – Manual of Standards (MOS) Chapter 9 made the distinction between pre-flight and in-flight requirements when calculating the landing performance. This required the crew to obtain the latest forecast and reports to ascertain the runway surface conditions for the time of arrival. The Civil Aviation Safety Authority's (CASA’s) Acceptable Means of Compliance and Guidance Material for Part 121 of the CASR referenced the United States Federal Aviation Administration’s (FAA’s) Safety Alert For Operators (SAFO 19001) which defined ‘at time of arrival’ as a point in time close enough to the airport to allow the crew to obtain the most current meteorological and runway surface conditions considering pilot workload and traffic surveillance, but no later than the commencement of the approach procedures or visual approach pattern.

CASA advised:

It is not acceptable to do an in-flight landing performance check at top of descent (or earlier) that is based on an expectation that the runway should be dry and then land on a runway that is known to be wet (other than dry) without ensuring (by calculation) that the wet (other than dry) landing performance is assured.

The operator’s manual required landing distance calculations be conducted in-flight. These calculations were to be based on weather reports or observations from an approved source.[12] The procedure to complete the in-flight landing performance check was defined in the Regulated take-off weight manual (RTOW)[13]  for the DHC-8. The RTOW calculation required the use of the latest METAR and ATIS[14] or AWIS[15] information to assure the landing performance. The requirement to conduct this in-flight check complied with Part 121 MOS Chapter 9.13 Landing distance – in-flight requirements.

Recorded flight data

The aircraft had an onboard flight data recorder that had been modified by a previous operator. This resulted in difficulties extracting the FDR data, and inconsistencies found in some of the downloaded parameters brought the reliability of the data into question. Consequently, where suspect values could not be resolved and an alternate reliable source of information was available, the FDR data was not used.

The FDR did not record any parameters for the wind at Chinchilla Airport, however, the GPS data recorded the equivalent of a 12 kt tailwind when the aircraft touched down. This was inconsistent with the recorded weather observations (see the section titled Meteorological information), which indicated a steady 5–6 kt tailwind for a landing on runway 32. While both sets of data indicated that a tailwind was present for the landing, the magnitude of the FDR‑derived value was considered potentially suspect, so the Bureau of Meteorology recorded observations were utilised to determine the likely conditions. From the recorded data available the following key information was determined:

• the ECU failure occurred at 0740:30
• the aircraft touched down at 0806:15
• upon touchdown the indicated airspeed was about 90 kt which was consistent with the target airspeed.

The touchdown point could not be definitively determined however, the weight-on-wheels and squat switch parameters indicated the aircraft touched down approximately halfway down the runway (approximately 510 m beyond the runway 32 threshold). Further analysis of the data showed multiple vertical and longitudinal acceleration spikes along with GPS altitude reaching ground level coinciding with a large pitch rate oscillation approximately 4 seconds before that position. This indicated that touchdown may have occurred about 300 m beyond the runway 32 threshold. This was consistent with photographs of the main wheel skid marks on the runway.

The rotation speed at touchdown and the point that the right outer wheel deflated could not be determined from the recorded parameters.

The manufacturer was provided with a copy of the data from the flight data recorder for their analysis, however they were unable to interpret the data. Given the basic landing parameters that were available, the manufacturer calculated that the crew would have needed all remaining runway to stop from a normal approach if the touchdown point was as indicated by the weight on wheels squat switch parameters. This calculation was based on the flight manual performance data for a dry runway.

Runway dimensions

Chinchilla Airport is a certified non-controlled aerodrome located in south-eastern Queensland. The airport has 2 runways, one clay runway (runway 03/21) unsuitable for use by a Dash 8 aircraft, and one sealed runway 14/32. This runway was 1,069 m in length and 18 m wide with a turn pad at each end of the runway (Figure 3). Part 139 (Aerodromes) Manual of Standards (MOS) 2019 stated that 18 m was the minimum runway width for aerodrome design.  

Figure 3: Chinchilla runway 14/32 design

Source: Airservices, annotated by the ATSB

Runway 14/32 had undergone rehabilitation works that included resurfacing in 2015. Technical documentation indicated that a symmetrical crown existed for the first 300 m of runway 32 with a 5 cm drop from the runway centreline to both runway edges. The remaining 769 m possessed a uniform 1.5% downward slope from left to right across the runway. This transverse slope was within the permitted range specified in section 6.08 of the Civil Aviation Safety Regulations - Part 139 (Aerodromes) Manual of Standards (2019), and opposite the direction of the runway excursion.

A technical inspection of the aerodrome was conducted in February 2023 as part of the ongoing certification requirements of the airport. This inspection found that the runway surface contained minor rutting at the north-western end of runway 14/32 but the ruts did not hold water and were not considered a safety issue.

Safety analysis

After experiencing an ECU failure on the right engine during flight, the flight crew consulted the operator procedures and opted to continue with the planned flight based off that guidance. The pilot flying (PF) had also experienced ECU failures before and was comfortable managing the limitations associated with the failure. The flight crew knew they would not have reverse thrust available on the right engine to assist with slowing the aircraft upon landing, however they had a plan for how to manage that limitation.

The aircraft landed longer than the flight crew intended, but probably still within the touchdown zone. However, this reduced the runway length available to stop the aircraft. The tail wind and the wet runway may have also increased the stopping distance required.

Upon landing the outer right tyre locked up, causing the anti-skid system to activate and release brake pressure on both outboard wheels. The reason for the lock up could not be determined, but it resulted in only the inboard wheels providing a braking force. The reduced braking effectiveness was a surprise to the pilots as they were not expecting any issues with braking performance, other than the lack of reverse thrust on the right engine. In response, the main focus of the flight crew became stopping the aircraft before the end of the runway.   

That focussed attention resulted in the flight crew missing a standard call, which would have prompted the captain to transition to the tiller for directional control. As the crew did not assess that the aircraft was at risk of a lateral runway excursion, this missed call was not detected and their focus remained on stopping the aircraft in the remaining runway. However, as they were landing on a narrow runway the margin for error was reduced, and in the final stages of the landing roll the left landing gear departed the sealed runway surface. The flight crew were unaware of the runway excursion until after conducting a walk around of the aircraft and seeing mud on the tyres.

The operator’s procedures for managing an ECU failure that were utilised by the flight crew when assessing whether to continue with the planned flight were ineffective at prompting the crew to consider other unrelated factors that could affect landing distance. For example, there was no consideration of the impact of a tailwind, a wet runway, or the risk of a runway excursion off a narrow runway due to the asymmetric deceleration associated with the ECU failure.

The operator had a procedure that required the crew to calculate landing performance for the reported runway surface conditions. The expectation was that these would be checked in-flight and provide the assurance of landing performance prior to arrival.

Part 121 MOS that replaced the CAO under the regulatory reform, required the crew to perform an in-flight performance calculation based on reports and forecasts valid at the time of arrival. In explanatory documentation produced by CASA,[16] which included reference to FAA SOFO 19001, it was acceptable to conduct an in-flight planning check during the descent, but not after the commencement of the approach procedures or visual approach.

CASA advised that this should be interpreted to mean that where an arrival takes place to a runway that is forecast and reported to be dry, but upon arrival is found to have visible moisture on its surface, then the landing must not be continued until the wet landing performance is known. This may require a missed approach to allow time for the crew to confirm, by calculation, that the wet performance can be assured prior to landing.

However, the explanation in the acceptable means of compliance guidance material did not clearly convey this intention and did not make the requirement to discontinue the approach clear in the event the runway surface was unexpectedly wet.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the runway excursion involving a De Havilland Canada DHC-8, VH-QQB at Chinchilla Airport, Queensland on 23 May 2022.

Contributing factors

• After landing, the anti-skid system activated when the outer right main wheel locked up, resulting in reduced braking effectiveness.
• While managing the combination of unrelated technical failures affecting directional control, the aircraft veered off the narrow runway.

Other factors that increased risk

• The operator’s procedures for managing an ECU failure did not include consideration of other factors that could increase the required landing distance, including a tailwind and a wet runway, or that a narrow runway increased the risk of a veer off due to asymmetric thrust.
• The acceptable means of compliance guidance material did not clearly convey the intention of the Civil Aviation Safety Regulations 1998 - Part 121 (Australian larger aeroplanes) Manual of Standards 2020 subsections 9.10 – 9.13 that landing performance must be assured at all times.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Safety action by the operator

In response to this incident, on 25 May 2022, Skytrans issued 2 flight operations notices (FON) which have since been incorporated into the operations manual:

• FON 2022-11: Short runway operating requirements was issued to all pilots which included not to land on a short runway with a tailwind. A short runway was defined as less than 1,101 m for DHC-8 aircraft.
• FON 2022-12: Operations to narrow runways with ECU in manual mode was issued to DHC-8 pilots that stated that unless in an emergency, operations to a narrow runway with an ECU in manual mode was prohibited.

Safety action by the Civil Aviation Safety Authority

To clarify the expectation around the calculation of landing performance data, and to provide guidance on how the regulatory requirements can be met, the Civil Aviation Safety Authority has drafted an amendment to the Civil Aviation Safety Regulations 1998 - Part 121 (Australian larger aeroplanes) Acceptable means of compliance and guidance material (AMC/GM) for inclusion in an upcoming revision. This revision includes the following text:

In-flight monitoring of runway surface conditions (dry, wet or contaminated)

Section 9.13 of the Part 121 MOS requires the PIC to ensure, during the flight and before landing, that the landing performance requirements specified in this MOS section are met for the aerodrome of intended landing. An element of these requirements is determining whether the runway to be used is dry, wet or contaminated.

The determination of the runway surface condition is required to be based on any weather report or forecast, or any combination of weather reports and forecasts. For the avoidance of doubt, the words in the MOS “…during the flight and before landing…” do not indicate that a singular determination can be made once during the flight and relied upon for the entire remainder of the flight. To satisfy their obligations regarding ensuring the safety of the flight under regulation 91.215 of CASR, PICs [pilots in command] are expected to check for updated forecasts and reports at regular intervals throughout the flight and base their determination of runway surface condition on these reports and forecasts.

The intent is that landing performance is assured at all times. This can be achieved by the operator evaluating the effect of multiple runway surface conditions for the most limiting aircraft configuration and including appropriate procedures in the exposition. This is particularly recommended where the aircraft landing configuration is restricted due to, abnormal or emergency situations encountered during flight and/or a narrow runway and/or the runway length is minimal.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• flight crew
• aircraft operator
• aircraft manufacturer
• Bureau of Meteorology

References

Civil Aviation Safety Authority. (2019). Civil Aviation Safety Regulations 1998 - Part 139 (Aerodromes) Manual of standards 2019. Australian Government.

Civil Aviation Safety Authority. (2020). Civil Aviation Safety Regulations 1998 - Part 121 (Australian larger aeroplanes) Manual of Standards 2020. Australian Government.

Flight Safety Foundation 2000a ‘ALAR briefing note 8.3 – Landing distances’, Flight Safety Digest, August-November 2000

Flight Safety Foundation 2000b ‘ALAR briefing note 8.5 – Wet or contaminated runways’, Flight Safety Digest, August-November 2000

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

An initial draft of this report was provided to the following directly involved parties:

• the flight crew of VH-QQB
• Skytrans Pty Ltd
• Bureau of Meteorology
• The Transportation Safety Board of Canada
• DeHavilland Aircraft of Canada Limited
• Civil Aviation Safety Authority

Submissions on that draft report were received from:

• the flight crew of VH-QQB
• Skytrans Pty Ltd
• DeHavilland Aircraft of Canada Limited
• Civil Aviation Safety Authority

After changes, a revised draft report was provided to the directly involved parties.

Submissions on that draft report were received from:

• Skytrans Pty Ltd
• Civil Aviation Safety Authority

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     Pilot Flying (PF) and Pilot Monitoring (PM): Procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.

[2]     Runway number: The number represents the magnetic heading of the runway. Runway 32 indicates a heading of 320°.

[3]     Touchdown zone means the portion of a runway, beyond the threshold, where landing aeroplanes are to first contact the runway.

[4]     In beta range, the power lever directly controls propeller blade angle. Beta range of operation consists of power lever positions from flight idle to maximum reverse.

[5]     The emergency brake system provides a means for applying brakes should the normal brake system fail.

[6]     The tiller, located on the left side panel of the left seat, is used for directional control of the aircraft on the ground.

[7]     Turn pad: A defined area on a land aerodrome adjacent to a runway for the purpose of completing a 180-degree turn on a runway.

[8]     Hydromechanical unit: Regulates fuel flow to the fuel nozzles in response to power requirements and flight conditions.

[9]     Terminal Area Forecast (TAF): A TAF is a coded statement of meteorological conditions expected at an aerodrome and within a radius of five nautical miles of the aerodrome reference point.

[10]    Meteorological Aerodrome Report (METAR): A routine report of meteorological conditions at an aerodrome. METAR are normally issued on the hour and half hour.

[11]    Civil Aviation Safety Regulations 1998 Dictionary defines approved weather forecasts as those made by the Bureau of Meteorology (BOM), and approved weather reports as those made by the BOM for aviation purposes, an automatic weather station at an aerodrome approved by the BOM, a pilot or a person appointed by the aerodrome operator to make visibility assessments under CASR Part 139 – Manual of standards.

[12]    The operator’s manual defined approved sources of domestic forecasts and reports as those generated by Air Services Australia or the Bureau of Meteorology.

[13]    Regulated take-off weight (RTOW) manual – Document to determine the maximum weight in which an aircraft can take off from a particular runway under specific conditions (winds, weather, specific aircraft configuration, etc,).

[14]    Automatic terminal information services (ATIS): Operational information required by aircraft for take-off or landing is broadcast on a dedicated frequency and/or on the voice channel of radio navigation aids.

[15]    Aerodrome weather information service (AWIS): actual weather conditions, provided via telephone or radio broadcast, from Bureau of Meteorology (BoM) automatic weather stations, or weather stations approved for that purpose by the BoM.

[16]    Part 121 Australian air transport operations – larger aeroplanes AMC-GM

Executive Summary

What happened

On 10 June 2022, the flight crew of a Boeing 737-476SF freight aircraft, registered ZK-TLJ, noted a 340 ft discrepancy between the captain’s and first officer’s altitude when operating in reduced vertical separation minimum airspace after departing Perth Airport, Western Australia. They had also observed an airspeed and Mach number difference, but this was within the manufacturer’s stipulated limits. The aircraft was descended, and the flight crew completed the Quick Reference Handbook - Airspeed Unreliable procedure. It was determined that the first officer’s instruments were reliable for a return to Perth. After landing, ground crews found foreign residue adhered to the lower surfaces of all 4 pitot-static probes.

What the ATSB found

The ATSB established that, during an engine ground run 2 days prior to the incident, the pitot‑static probe covers were not removed, and the automatic pitot heat was not isolated as required by the ground run procedures checklist. As a result, the covers melted onto the probes. Although cleaned, residue remained on the probe surfaces, which had the potential to compromise the accuracy of the pitot-static instruments in-flight. It was also established that pitot‑static probe covers made from polyvinyl chloride material were used, which increased the risk of the covers melting onto the probes if left on during engine operation.

Air traffic control were not advised of the altitude discrepancy of 340 ft, which exceeded the maximum allowed altimetry system error for reduced vertical separation minimum airspace of 200 ft. Therefore, adequate vertical separation with other aircraft could not be assured by air traffic control.

What has been done as a result

The maintenance organisation has undertaken several procedural initiatives to reduce the likelihood of melted pitot-static probe covers in the future. The most notable being the use of high temperature resistant Kevlar™ covers replacing the extant polyvinyl chloride covers. They have also ensured that checklists are readily available, and the safety briefing conducted at the start of each day discusses threat and error management, and local hazards.

Safety message

Aircraft barometric air data sensing instrumentation components are extremely sensitive to damage and disruption. This incident highlights the importance of maintaining a high level of attention to damage and contamination when working on, and inspecting these components, particularly on aircraft certified to operate in reduced vertical separation minimum airspace. Where there is doubt, the probes should be removed and tested by an approved facility. Further, it demonstrates the need to appropriately action and complete checklists, and for flight crew to advise air traffic control of altimetry system errors.

The investigation

The occurrence

On 10 June 2022, an Airwork Boeing Company 737 aircraft, registered ZK-TLJ, was being operated as a freight service from Perth via Port Hedland, Western Australia to Christmas Island. On board were the captain as pilot monitoring, first officer (FO) as pilot flying,[1] an avionics licenced aircraft maintenance engineer (LAME), and load master.

At about 0951 Western Standard Time,[2] the aircraft departed Perth on climb to the designated cruising altitude of flight level (FL)[3] 330, operating in reduced vertical separation minimum (RVSM)[4] airspace. As the FO’s altimeter passed FL 320, the FO called ‘one to go’ in reference to the approaching designated cruise altitude. The captain noted that the call was made early according to their altimeter reading.

The aircraft levelled off at FL 330 (33,000 ft) using the FO’s altimeter coupled to autopilot B.[5] At that time, the flight crew noted the captain’s altimeter displayed 32,660 ft. They also noted differences between the captain’s and FO’s indicated airspeed and Mach number of 265 kt and 269 kt, and 0.745 M, and 0.762 M, respectively.

The flight crew, in discussion with the LAME and Airwork maintenance watch, decided to return to Perth for maintenance. At this stage, they assessed that the aircraft was overweight for a direct return and landing at Perth, so they decided to continue on the current heading and carry out troubleshooting to determine the accuracy of the altimeters. The Quick Reference Handbook (QRH) Airspeed Unreliable procedure was consulted to determine the validity of the displayed airspeed and altitude. The procedure makes use of a table, which required the aircraft to descend to FL 300, the flight crew to set the aircraft pitch attitude and Mach indications against the aircraft weight and adjust the engine N₁[6] speed to achieve level flight. By comparing the values displayed against the known configuration, the accuracy of the instruments could be assessed.  

An air traffic control (ATC) clearance was requested and provided for a descent to FL 300 and the flight crew completed the QRH procedure. They determined that the FO’s instruments were reliable, and the remainder of the flight was conducted using those instruments.

The flight crew notified ATC that they required a return to Perth for ‘operational reasons’, and a clearance was provided. On descent into Perth, the flight crew noted that the altitude discrepancy on their altimeters began to decrease until about 10,000 ft, from which point they provided consistent indications. The aircraft landed at Perth without further incident.

Post-flight inspection

After landing at Perth, engineering staff inspected the 4 combined pitot-static probes and found residue on all 4 probe surfaces (Figure 1). All of the probes were subsequently removed, and the pitot‑static lines were flushed with nitrogen. This was carried out in accordance with the manufacturer’s maintenance procedures, which did not require a sample of any debris to be collected and analysed. Therefore, the presence of debris in the pitot-static system was not determined.

The probes were replaced with serviceable items, the system was tested, assessed serviceable, and the aircraft returned to service. The pitot-static probe covers onboard the aircraft were also inspected and found to have had a temporary repair applied to them (Figure 1).

Figure 1: Pitot-static probe and covers

Source: Airwork, annotated by the ATSB

Context

Pitot-static system

The pitot-static system is a set of air pressure-sensitive instruments used to measure an aircraft’s airspeed and altitude. Erroneous altimetry indications can be induced by a partial or full blockage of the static air pressure sensing system, or by turbulent air over the static pressure sensing ports.[7] Static pressure sensing instruments are carefully designed to minimise the risk of turbulent air over the sensing ports, however a small amount of contamination or damage to the ports, or area surrounding the ports, can result in turbulent air and a reduction in instrumentation accuracy.

The 737-476SF has 4 combined pitot-static probes fitted to the nose of the aircraft, 2 alternate flush static ports for the standby altimeter, and connecting tubing. The pitot-static lines are self‑draining, and where this is impractical, drain traps are provided. The pitot-static probes are independently connected to the 2 independent air data computers (ADC1 and ADC2), which convert the barometric pitot-static pressures into a digital signal to be displayed on the captain and FO altitude, airspeed, and Mach instruments. The pitot-static probes are electrically heated to prevent the formation of ice on the probes which can disrupt or block the normal flow of air.

In April 2021, the aircraft was made compliant with United States Federal Aviation Administration airworthiness directive[8] 2019-09-10. This required completion of Boeing alert service bulletin SB737-30A-1064, which modified the pitot heat system to energise automatically on engine start to avoid inadvertent flight into icing conditions with pitot-static heat off. The system senses the engine running using the low oil pressure switch on either engine.

Pitot-static probe covers

Pitot-static probe covers are used to provide protection from contamination when on the ground. Covers were not routinely fitted to the aircraft during turn around inspections, except in locations where an increased risk of contamination existed. The covers generally travelled with the aircraft and were fitted and removed by ground crew as required. The covers were to be fitted during extended periods on the ground.

The aircraft maintenance organisation had substituted the Boeing recommended Kevlar™[9] pitot‑static probe covers with locally manufactured items, made from a commercially available polyvinyl chloride material. The Kevlar™ covers were specifically designed to withstand high temperature associated with the inadvertent application of pitot-static heat, without causing damage to the pitot-static probes.

Ground maintenance

On 8 June 2022, a scheduled engine wash was conducted on the right engine by Airwork maintenance personnel, assisted by contract maintenance personnel, at Brisbane Airport. The maintenance personnel comprised of a certifying LAME, a participating LAME, and an AME under supervision. The contract maintenance personnel operated the ground support equipment.

The engine wash procedure required several dry motors[10] of the engine for the introduction of the detergent solution and rinse, followed by operation of the engine at idle for 10 minutes.

The operator’s internal investigation established that the task was completed in stages, alternating between the certifying LAME and the participating LAME. Further, there was limited communications between the LAMEs, and they performed the task from memory without reference to the Airwork 737-300/400 ground run procedures checklist. This checklist required the pitot‑static covers to be removed, and the pitot-static heat circuit breakers to be opened to disable the heat system, prior to motoring or starting the engine.

Following completion of the wash, the participating LAME noticed that all 4 pitot-static probe covers had remained fitted during the dry motor and engine run operations, which resulted in the covers melting onto the probes. The covers were subsequently removed, and the tubes were cleaned using a plastic scraper, a scouring pad and solvent. A detailed visual inspection was carried out on the probes, and they were assessed serviceable. The aircraft was returned to service on 9 June 2022 and completed about 11.5 hours of flying over 7 sectors with no reported incidents, prior to the flight on 10 June 2022.

The damaged covers were hung on a board with a note describing the incident and that replacement covers had been ordered. Later that day, another engineer saw the covers, and put flame proof tape on them so that they could be reused until the replacements arrived.

ATSB examination

The 4 probes were sent to the ATSB’s technical facilities in Canberra for detailed examination. That examination identified varying amounts of foreign residue adhered to the lower surface of all 4 pitot-static probes. The right upper and lower probes presented with foreign object debris in the pitot drain ports. The source of this debris could not be determined.

The depth of the residue varied between almost none on the right upper probe, to a maximum of about 0.4mm in an uneven, rippled profile on the right lower probe (Figure 2). An internal examination was not conducted.

Figure 2: Pitot-static probe residue

Source: ATSB

Recorded information

Quick Access Recorder (QAR) data from the incident and previous flights was analysed by Boeing and the ATSB. By design, the QAR only recorded data from ADC1, which precluded the direct reading of the FO’s altitude indications. However, the QAR also recorded altitude data from the traffic alert and collision avoidance system,[11] which was acquired from the selected transponder. On the incident flight the transponder was set to acquire data from ADC2. From this the FO’s altitude indications were able to be indirectly determined.

The analysed data for the 7 flights between Brisbane and Perth showed minor discrepancies between the captain’s and FO’s altimeter during climb and descent, but no notable discrepancy in cruise flight was recorded. It could not be determined from this data if the transponder/ traffic alert and collision avoidance system was selected to acquire data from ADC1 or ADC2 during these flights. The recorded magnitude of the climb and descent altimetry error was small and unlikely to be noticed by flight crews. The source of these errors could not be determined from the recorded data and could have resulted for various reasons not linked to the ground maintenance incident on 8 June 2022.

The incident flight analysis showed that the FO’s altimeter indicated a higher reading than the captain’s, varying between 300 ft and 390 ft, throughout the cruise portion of the flight.  Information regarding the reported airspeed and Mach number discrepancy could not be obtained from the recorded data due to the ADC limitation described above. Using the values provided by the flight crew, the discrepancy was within the 20 kt or 0.030 M requirement specified in the QRH, for the airspeed indicators to be considered reliable.

Reduced vertical separation minimum airspace

The aircraft’s transponder was manually selected to use data from either ADC1 or ADC2. The altitude information passed from the selected ADC to the transponder was also used by ATC and the aircraft’s traffic alert and collision avoidance system to monitor aircraft altitude and maintain safe vertical separation between other aircraft.

During the incident flight, the aircraft was operating in reduced vertical separation minimum airspace (RVSM), which was between FL 290 and FL 410. In RVSM airspace, vertical separation is reduced from 2,000 ft to 1,000 ft. Aircraft are required to meet specified minimum accuracy requirements for airspeed and altitude, as well as a specific RVSM minimum equipment list, prior to being approved to fly in RVSM airspace. Flight crews are also required to closely monitor the altimeters for agreement prior to entering and throughout flight in RVSM airspace.[12] If there is a disagreement of greater than 200 ft and the flight crew believe that one of the primary altimeters is functioning normally, they must couple the autopilot to that altimeter and notify ATC ‘For information, operating on one primary altimeter only’.[13]

According to the International Civil Aviation Organization,[14] altimetry system errors may occur for various reasons including from damage to the pitot-static system. These faults can send incorrect data to ATC and the traffic alert and collision avoidance system, as well as the aircraft’s altimeters. In turn, this could result in a breakdown of vertical separation and increase the risk of collision, as depicted in Figure 3, if the error is not detected by the flight crew and reported to ATC.

Figure 3: Altimetry system error risk

Source: International Civil Aviation Organization
 

Safety analysis

Findings

Safety actions

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Investigation summary

What happened

On 30 May 2022, freight train 2BS4, operated by Pacific National (PN), departed from Acacia Ridge, Queensland (Qld), for Sydney Freight Terminal, Chullora, New South Wales (NSW).

At approximately 0030 on 31 May 2022, shortly after passing through Kyogle, NSW, a bogie of one empty wagon in the middle of the consist derailed, dragging for approximately 2.3 km before separating from the train. This led to the derailment of 11 empty wagons and caused significant damage to rolling stock and track infrastructure.

What the ATSB found

The section of track in which the initial wagon derailed had a known track geometry defect and was under a temporary speed restriction at the time of the derailment. 

The track geometry defect was not subject to increased monitoring beyond routine scheduled inspections and had likely degraded since it was last inspected. 

It was found that action taken to manage the geometry defect was largely informal and did not capture the information or data required to allow Australian Rail Track Corporation (ARTC) to make informed decisions on the management of the defect. 

The ARTC asset management system, along with track certification forms containing measurements from before and after temporary rectification works, were not used as required by procedures to inform ARTC management that major works were needed. 

It was also found that the geometry defect was not included in the plan for major works scheduled for the weekend following the derailment. The corridor management team was intending to rectify the defect during these major works by informally redirecting resources from another job.

Lastly, it was found that while ARTC did have compliance monitoring and auditing procedures in its safety management system, there was no evidence that these activities were being carried out in accordance with the relevant policies and procedures.

What has been done as a result

Following this incident ARTC implemented the Decision Support Platform (DSP), ensuring its availability across the entire ARTC network.

The DSP is described by ARTC as its centralised system for integrating and analysing asset condition data, imagery, and maintenance records, bringing together information from many systems into one source. The platform provides a visual dashboard of asset health, degradation trends, reoccurring issues and risk indicators, enabling more accurate forecasting, supports programs such as resurfacing, grinding and rerailing, and strengthens evidence‑based decision‑making across the entire ARTC network for tasks including: 

• track geometry analysis for resurfacing activities
• track geometry degradation modelling, and
• rail height management.

In August 2023, ARTC also established a dedicated engineering function within the Interstate Network Asset Maintenance business unit. This function included a cohort of 8 track and civil engineers to provide technical support for ARTC provisioning centres and maintainers in each section of the interstate network. Part of this function includes the monitoring of track condition and deterioration through physical presence on the AK car track monitoring vehicle and frequent review of defect data and trends, including geometry measurements, ultrasonic test results and Vehicle Track Interaction (VTI) records.

Additionally, ARTC described enhancements to assessment tools for identifying special locations with an increased risk of track instability. The requirements for managing these special locations were defined in the ‘Track and Civil Code of Practice – Section 6 Track Lateral Stability’ and associated procedures. ‘ETP‑06‑01 Managing Track Stability (ver. 1.1)’ was updated to incorporate the use of assessment tools in analysing and identifying potential special locations. An algorithm-based tool, Special Location Identification Program (SLIP), is also used to identify areas that may be classified as Special Locations, based on criteria defined in the relevant standards.

Following an internal assurance audit, ARTC also committed to the following safety actions:

• set up an asset integrity risk process to identify critical controls and their owners to mitigate each key risk. This will include an initial assessment of control health and any priority actions required to mitigate the key risks to a tolerable level. This will involve consultation with risk managers and relevant general managers across the organisation.
• review and update the operations asset services assurance ‘second line of defence’ guideline. This will be finalised as the ‘Asset Integrity Second Line of Defence Audit Procedure’, and will address accountabilities, authority and linkage to key risks.
• The current assurance framework procedure (AMT-PR-017) will be retired, and a dedicated asset maintenance assurance framework document will be created.

It is intended that the ‘Asset Integrity Second Line of Defence Audit Procedure’ will address the use of the enterprise asset management system and its usage for ensuring the data provided adequately informs the DSP, in turn ensuring ARTC is suitably informed of its asset maintenance needs.

Safety message

Asset management procedures and standards exist within a rail transport operator’s safety management system to ensure that assets are managed effectively and safely.

It is vital to the operation of a safe network that standards and procedures are followed, and that rail transport operators assure themselves that asset management activities are being managed in compliance with their procedures to achieve the best possible safety outcomes.

It is therefore essential that rail transport operators also have documented compliance monitoring processes in place, to verify that qualified workers assigned to complete safety critical tasks are consistently doing so, in accordance with standards and procedures, and opportunities for improvement in these areas are addressed. 

When used appropriately, asset management systems should accurately inform rail transport operators of the condition of their assets, and enable them to identify recurring issues, assess risk, allocate resources and ensure work is performed to ensure assets are safe and fit for purpose. 

Proactive analysis of data providing insight into asset condition and recurring issues is also crucial in managing risk and preventing incidents.

The occurrence

Events prior to the derailment

At approximately 2150 on 30 May 2022 Pacific National‑operated 2BS4 freight train departed Acacia Ridge, Queensland (Qld), for Sydney Freight Terminal, Chullora, New South Wales (NSW). 

The crew described the journey as relatively uneventful, aside from receiving an unrelated Condition Affecting the Network (CAN) warning for Casino, communicated to the crew by the ARTC Network Control Officer (NCO) at Junee, NSW. 

The track was described as ‘fairly flat’, with no heavy grades, however there were numerous speed boards indicating temporary speed restrictions to observe, which the crew reported was typical for this route.

At approximately 0025 on 31 May, 2BS4 approached a caution board indicating the approach to a temporary speed restriction (TSR). The driver reported slowing the train to between 16 km/h and 20 km/h when entering the 100 m, 20 km/h TSR area at track kilometrage 828.450 km.[1] The driver recalled noticing the track to be ‘visibly kinked’ at 2 locations within this area as they approached. 

Although the crew recalled being concerned with the condition of the track, the driver and Driver’s Assistant (DA) believed the existing speed restriction indicated that the condition was being managed and so proceeded through the TSR area at the signposted speed. CCTV footage from the front of the train showed a significant left to right shift and slight dip of the locomotive as it passed over the 2 separate, visible track defects.

Once 2BS4 passed the clearance board indicating the end of the TSR, at approximately 828.350 km, the driver activated a counter on the locomotive control panel to assist in determining when the rear of the train would be clear of the TSR. Once 2BS4 was clear of the 20 km/h TSR, the driver began to accelerate to the 70 km/h posted track speed.

The derailment

At approximately 0030, the driver described an audible warning and a red light on the locomotive’s dashboard, indicating that they had ‘lost the air’, referring to the loss of air pressure in the train’s braking system.[2] This caused the train brakes to automatically apply with the train coming to a stand at the 825.200 km mark.

The driver contacted the Junee NCO to report this unexpected stoppage, informing them that they would attempt to identify the cause with a visual inspection.

The DA exited the locomotive to investigate, walking towards the rear of the train in the down direction, and identified that the train had separated. They then advised the driver that there had been a derailment. 

There was approximately 500 metres of separation between the rear of the intact train and the derailed portion. The first derailed wagon identified was positioned sideways across the tracks, with further derailed wagons located on either side of the track.

A total of 11 empty wagons were found to have derailed in the incident, out of the consist of 56.

Figure 1: Top view of derailment

Source: YouTube (Drone footage by Kris McDonald)

Events post-derailment

Following the report of the derailment to ARTC network control from the crew of 2BS4, the line was closed by ARTC at 0102 hours.

Once removed from site, the derailed wagons were transported to a facility at Acacia Ridge for post-incident inspection and analysis.

Track repairs were completed and the North Coast line was certified for rail traffic at 1900 on 5 June 2022 with a temporary speed restriction of 40 km/h. 

Context

Location 

The North Coast line is a single, bi-directional line with several passing loops facilitating freight and passenger services between Sydney and Brisbane. This line forms part of the North/South corridor on the ARTC Interstate Network. The up direction is travelling towards Sydney, while the down direction is towards Brisbane. The incident occurred at a location known as Cedar Point while travelling in the up direction between Kyogle and Casino on the NSW North Coast. 

Figure 2: Map of area

Source: Google Earth, annotated by OTSI

Involved parties

The Australian Rail Track Corporation (ARTC) manages and maintains approximately 8,500 km of rail network across 5 states in Australia. In NSW, ARTC leases the mainline interstate corridors from the NSW Government through a 60‑year lease agreement signed in 2004. ARTC is responsible for managing and maintaining these rail corridors in accordance with its accredited safety management system.

The section of track between Telarah, NSW, and Acacia Ridge, Qld, was managed by a corridor manager based in Coffs Harbour, NSW. A local area manager overseeing the NSW North Coast, specifically Casino/Coffs Harbour including this incident location, was responsible for managing the maintainers and the maintenance and inspection activities they carry out, required for compliance and safety.

ARTC also had an asset management team responsible for asset lifecycle management, including monitoring asset performance and planning and executing major project and/or capital works.

ARTC conducted its own internal investigation into the incident, which was supplied to the ATSB as evidence for this report.

Pacific National (PN) was a freight and coal rail services operator, responsible for moving regional exports, bulk goods, grain, and agricultural products on the eastern seaboard. PN conducted its own internal investigation into the incident, which was also supplied to the ATSB as evidence for this report. 

NSW TrainLink (NSWT) was a train and coach operator in Australia, providing passenger services throughout New South Wales and the Australian Capital Territory, along with interstate services into Victoria and Queensland. While not directly involved in the incident on the day, NSWT services to Casino, NSW, and Brisbane, Qld, frequently used the North Coast line in the lead‑up to the incident. 

Environmental and weather conditions

The weather on the day of the derailment was clear and sunny with a daytime temperature of 17°C recorded at 0900 by the Australian Government Bureau of Meteorology (BoM) at Casino Airport, NSW, approximately 23 km from the incident location. There was no recorded rainfall in the preceding 24-hour period, however, greater than normal rainfall of 1,187mm was recorded in the local region in the 5 months leading up to the derailment.

Train information

The train consist provided by PN recorded 2BS4 comprised of 3 locomotives hauling 56 wagons. NR89 was the lead locomotive, with NR49 and 9323 assisting. The train was listed as 1199.327 metres in length, with 1728.996 of trailing tonnage. It was hauling a combination of containerised freight and empty wagons. 

Train crew

The train crew, consisting of a driver and driver’s assistant, signed on at approximately 2120, with the train departing at 2150. The driver and driver’s assistant each had over 30 years of driving experience and were both qualified and experienced in the operation of the locomotives, and on the route between Acacia Ridge and Sydney Freight Terminal, Chullora, NSW. 

Both crew members described being well rested and free from the effects of fatigue on the night of the incident.

Network control

The North Coast Line in NSW was controlled and monitored by the Coast B network control officer (NCO) situated in ARTC’s Network Control Centre South (NCCS) in Junee, NSW. 

A system of safeworking known as rail vehicle detection (RVD) was used in the derailment area. This system used continuous track-circuiting or axle counters to detect the presence of rail traffic in a block[3] and prevent following rail traffic entries into the same occupied blocks using signals.

Responsibilities of the ARTC NCO included the planning and management of trains over their area of control, including the control and recording of train performance, and the safe movement of trains and track vehicles in accordance with ARTC safeworking rules and procedures.

Train control reporting

A train control report (TCR) was typically created by network control if an incident or condition affecting the network reported to them was likely to affect train running or was a safety concern. 

According to the ARTC enterprise asset management system document AMT‑PR‑010 v1.0 p14, reportable incidents were usually identified by field maintainers, train controllers and train crews. For incidents or conditions reported by train crews the NCO was required to record the information on their train control graph or, where used, in the train register book, and notify the relevant maintainer.

TCR incidents that were related to ARTC managed assets were then required to be added to ARTC’s enterprise asset management system, Ellipse, by the responsible track maintenance personnel as a TCR work request. 

TCR work requests included information such as a TCR number, incident type and comments, and a work order number for investigation and review of the asset by maintainers and engineering personnel. 

Following a field investigation and a subsequent engineering review, corrective actions were identified and/or undertaken and recorded in Ellipse with failure codes assigned to the known condition.[4] This was done in accordance with ARTC’s code of practice, which prescribed the appropriate course of management for the known condition.

Reporting obligations of train crew

Rules and procedures prescribed by ARTC in ‘ANGE 206 Reporting and Responding to a Condition Affecting the Network (CAN)’ outlined the reporting requirements and obligations of all train crews using the ARTC network, relating to unsafe or abnormal conditions. Conditions that affected the safety of rail operations in the ARTC NSW network were to be reported by crew promptly to the NCO responsible for the affected portion of track. 

Pacific National (PN) Learner Technical Guides ‘TLIC 0024 Operate rail traffic with due consideration of route conditions’ and ‘TLIF 0028 Respond to abnormal situations and emergencies’ required PN train crew to report abnormal situations enroute to the network owner.

NSWT drivers were also required to adhere to NSW Trains’ train working procedure ‘NTTWP 100 Responsibilities of Train Crews’. This detailed a driver’s duties including to immediately inform the NCO or any other relevant employees of any incident, problem or defect relating to trains, signalling, track or overhead wiring, or any other problem affecting or likely to affect train services. 

NSWT drivers were also expected to adhere to the NSW Trains professional driving guide (PDG). This document advised drivers to report any operational issues that could cause concern to their supervisor and/or to the NCO.

Apart from an initial TCR recorded by ARTC network control in April 2021, only one other TCR was generated for the TSR site on 15 March 2022, approximately 2.5 months prior to the derailment. 

There were no other reports recorded as received by ARTC network control pertaining to this site, including on the day of the derailment.

Temporary speed restrictions

ARTC’s engineering procedure for TSRs, PP-163, stated:

infrastructure defects can be detected within the rail corridor during a planned inspection or work process. 

The procedure described that:

• all defects that require a temporary speed restriction shall be reported to train control by the person or persons identifying the defect

• when a train crew reports a fault, the network controller shall notify the relevant maintainer and prepare a TCR

• when a train crew reports a fault, the network controller shall notify the relevant maintainer and prepare a TCR

• the maintainer categorises the infrastructure defect condition based on criteria provided in ARTC Track and Civil Code of Practice and ARTC Engineering Standards and determines the speed restriction based on the defect level

• the maintainer estimates response times to conduct an unscheduled inspection or repairs the defect and records this information on ‘PP163F-01, Speed Restriction Notification’ form

• the maintainer positions speed boards around the fault site as soon as practicable (usually within 24 hours) and must notify the network controller immediately of any amendments to TSR’s via the ‘PP163F-01 Speed Restriction Notification’ form to ensure train crews are adequately informed

• the NCO was required to notify the crew of every train passing through the area of the speed restriction until this information was published.

The TSR could be removed once the defect had been rectified, however Engineering (Track and Civil) Procedure ‘PP-135 Mechanised Track Surfacing 7.5 Speed Restrictions – General’ specified that speed restrictions following surfacing, or levelling of track, may need to remain in place if: 

• track geometry was inadequate, or there was a risk of a geometry fault developing as the track settled, or

• track lateral stability had been reduced.

In this instance, a 40 km/h TSR remained on several occasions following corrective tamping[5] conducted by the local maintenance crew at the incident location. 

Records, correspondence and paperwork related to implementing, altering and the reasons for temporary speed restrictions between 828.350 km and 828.450 km, in the 3 months prior to the derailment of 2BS4 were limited to one ‘PP163F-01 Speed Restriction Notification’ form (Figure 3) along with several track certification forms (see Manual forms).

Figure 3: PP163F-01 Temporary Speed Restriction Notification form

Source: ARTC

ARTC asset management and assurance

Asset assurance framework

ARTC document INF‑PR‑002 Assurance Framework describes the 3‑level assurance framework applied to ARTC’s railway operations risk controls at the time of the incident.

Section 3.1.2, described as the ‘first line of defence’, defines line management monitoring requirements. Each line manager is responsible for determining how assurance reviews are conducted, including sample checks, staff discussions, and team meetings.

Section 3.2, as the ‘second line of defence’, assigns business units responsibility for developing annual assurance plans. For 2021–2022, an Annual Asset Assurance Plan was developed and implemented to monitor asset management activities.

Lastly, Section 3.4, or ‘third line of defence’ outlines that the internal audit plan incorporates all third‑line assurance audits. These audits are intended to provide assurance to ARTC management and the board that effective controls are in place to manage ARTC’s strategic risks. Relevant to asset assurance, the internal audit plan for this period included the following 7 asset maintenance and inspection‑related audits:

• HV 02A Inspection and Maintenance – Hunter Valley – Structures Management
• HV 02B Inspection and Maintenance – Hunter Valley – Points & Crossings
• HV 02C Inspection and Maintenance – Hunter Valley – Level Crossing Management
• IS 02A Inspection and Maintenance – Interstate – Structures Management
• IS 02B Inspection and Maintenance – Interstate – Points & Crossings
• IS 02C Inspection and Maintenance – Interstate – Level Crossing Management
• JBU 21 Automated Track Inspections – Continuous Ultrasonic Testing Car.

ARTC provided copies of ‘INF‑PR‑002 Assurance Framework’, extract of annual asset assurance plan and extract of the FY22–FY24 internal audit plan which were in place at the time of the incident.

Assurance auditing 

At interview, an ARTC representative responsible for management of the corridor between Telarah to Acacia Ridge at the time, indicated that historically, recurring defects had not been recorded very well, and that no proactive analysis was done on potentially recurring defects. 

The representative advised that track maintenance and safety‑related decisions were monitored by an assurance process, with an assurance team assigned to do checks on the maintainers. The representative explained these checks covered prework briefings, application of track geometry standards, adherence to procedures, and generally ensuring work was being carried out correctly, with paperwork in place and information recorded correctly.

It was also explained that assurance teams regularly went out and provided coaching if something wasn’t done correctly during regular site visits.

ARTC was subsequently unable to provide any evidence of compliance auditing and/or assurance activities taking place on maintenance personnel responsible for this area. 

ARTC track and civil standards and guidelines

Ellipse

ARTC maintained an enterprise asset management system (EAMS) to manage assets throughout their lifecycle and to ensure that assets were fit for safe and reliable operation of trains over ARTC infrastructure. The EAMS was designed to enable ARTC to manage the condition of network infrastructure as described in procedure ‘AMT-PR-010 - Enterprise Asset Management’. The EAMS computerised maintenance management system (CMMS), called Ellipse, was used by track maintenance personnel to record defects and manage maintenance and repairs.

Known conditions, a term used by ARTC to describe known track defects, initiated the bulk of the work orders in Ellipse. Condition data was to be recorded for all known conditions, with any deterioration recorded, including for those conditions which may not have reached a mandatory intervention point but would still benefit from monitoring. 

Once entered, known conditions were to be managed in Ellipse in accordance with ‘AMT‑WI-024 Known Condition Management’ by:

• recording the appropriate corrective action
• determining the urgency of the required work
• creating work orders for completion of repairs or condition monitoring activities
• planning, scheduling, and assigning of corrective works
• developing long term condition-based asset management strategies, and planning capital/project repair works.

The procedure for managing work orders, ‘AMT-WI-025 Work Order Management’, described the process, system (Ellipse) and operational requirements of how to create, plan, schedule, package, assign, execute and close out work.

Work orders were required for all work, and could originate from multiple sources, maintenance schedule tasks (MST), job estimates, known conditions or ad hoc situations. 

MSTs were system‑generated tasks, such as track inspections, and were based on predetermined schedules. The works management function within Ellipse was used to initiate and record the process. 

Timeframes for these tasks were set out in the code of practice and would vary based on the different types of infrastructure being monitored.

The system provided work orders to support the allocation of budget, the planning of resources, time and materials, and recording the details of works completed. All work performed was to be recorded against the asset in the Ellipse system.

Overall, the EAMS and its associated systems, specifically Ellipse, were intended to monitor scheduled inspections and the status of known conditions and defects to ensure that the planned and corrective work had been completed effectively and in the required timeframe as required by ARTC’s safety management system.

Recording requirements of known conditions

‘ETE-00-02 – Track Patrol, Front of Train, General and Detailed Inspections’ defines requirements for maintainers conducting track inspections to:

record essential information detailing the condition of the track; monitor variations of track conditions over time; prepare priority-based asset maintenance and renewal programs.

It also defines maintainers being responsible for recording and/or reporting the results of their inspections including defects found, and observations made. 

This data is then intended to be used to manage the rectification and inform the urgency of corrective maintenance and assists the asset management team in scoping of planned future refurbishment and replacement works, as described in the procedure, ‘AMT‑PR‑010 – Enterprise Asset Management System’.

Manual forms

Manual track certification forms recording completed tamping works were provided by ARTC, showing that the derailment site had been the subject of several maintenance interventions in the months prior to the derailment. 

These forms recorded track geometry measurements before and after various rectification works being performed. OTSI observed these forms were often incomplete, with missing details including the absence of sign‑off by a manager or supervisor, while others lacked supporting information to explain the reasons for temporary speed restrictions and other actions taken.

Maintainers conducting track patrols or inspections were required to report the results of their inspections including repaired defects on ‘EGP1001F-01 Inspection/Defects Found Report’ form, either using hard copies or electronic formats.

ARTC indicated that these manual forms were used as there was ‘no IT system per se’ for recording track geometry measurements during track inspections. It was explained that conditions are assessed in accordance with the code of practice and ‘any exceedants (sic) are recorded into the AMS’ (asset management system), in this case Ellipse. 

However, when requested, ARTC was unable to provide any inspection forms or evidence of exceedances recorded in Ellipse for the known defects located at the derailment site. 

Track and civil code of practice

ARTC track and civil code of practice response booklet ETW-00-01 is a work instruction which includes assessment and response tables to be used as a guideline by maintenance teams when responding to known conditions and defects. 

Section 1.1 of this booklet details response codes for defects based on applied speed restrictions. Notes specific to the codes assigned indicate ‘If repairs cannot be made prior to the passage of the next train, the speed restriction should be implemented along with an appropriate increase in the monitoring until actions are taken to restore the track’.

Track geometry

The Rail Industry Standards Board (RISSB) defined track geometry as ‘the horizontal and vertical alignment, cross level and cant of the track’.

Cross level was defined as:

the difference in level of the two rails in a track, and is also known as superelevation or cant. 

Top and line

ARTC’s procedures referred to top (vertical alignment), which is the relative level of the track top along the length of the rail. The limit is specified by a measurement of the variation in vertical line (height) of the top surface of the rail.

Figure 4: Vertical alignment – top

Simplified cross section of track structure showing loss of track top geometry measured on the rail head. Source: OTSI

Line measurement, also known as horizontal alignment, was a measure of the horizontal displacement of the track structure from the design alignment (Figure 5). 

Figure 5: Horizontal alignment – line

Source: OTSI

Superelevation and twist

Superelevation, also referred to as cant, or cross level on level track, was the difference in height between the outer and the inner rail.

Twist was the variation in the cross level between 2 track locations separated by a nominated distance interval. The maintenance twist tolerances were measured over short (2 m) and long (14 m) distances and were measured in mm (2 m twist measurement shown in Figure 6).

At slow speed on curves, any superelevation (mm) of the outer (high) rail decreases the gravitational forces on the wheels running on that rail because of the lean of the vehicle body and the shift in centre of gravity towards the inner (low) rail. This reduction in wheel load, together with the flange force acting on the outer rail, increases the wheel lateral over vertical (L/V) ratio and so increases the tendency of the wheel to climb the rail.

Figure 6: Cross level and twist

Source: OTSI derived from RISSB Standards

Track geometry standards

ARTC Track and Civil Standard ‘ETS-05-00 Section 5 - Track Geometry’ specified ARTC’s track geometry standards.

The document provided inspection guidelines for track maintainers and track geometry tolerances to be achieved following corrective maintenance tamping activities. 

Table 1: ETS-05-00 Table 5-10 – ARTC limits for line, top, twist post‑corrective action

Source: ARTC Engineering Track and Signal Standard – ETS-05-00 Section 5 Track Geometry 

The document also provided guidance on geometry parameters including the classification of defects against maintenance limits, and the required response category for the measurement.

Response categories defined the maximum period allowed to elapse before the next inspection, and/or repair of track geometry defects once assessed against specified limits. 

The response category was determined by a matrix (Table 2) comparing the measured track defect with normal track speed in the area. A defect in an area with higher track speeds would attract a higher response category than the same defect on track with a lower track speed. 

Table 2: ETS-05-00 Table 5-15 – Geometry defect parameters and response categories

Source: ARTC Engineering Track and Signal Standard – ETS-05-00 Section 5 Track Geometry 

The document also described how imposing a speed restriction may moderate the response category, and therefore the response requirements. For example, using a restricted line speed to determine the response category as though it were the original track speed, may reduce the response category and therefore the required inspection time, or delay the required repair. A defect that was re-inspected and found to have not increased in size may continue to be managed in the same way. 

Table 3: ETS-05-00 Table 5-16 ARTC inspection and repair response standards by response category

Source: ARTC Engineering Track and Signal Standard – ETS-05-00 Section 5 Track Geometry 

Temporary speed restrictions (TSR) could therefore be used to manage and prioritise the inspection and repair of defects. 

Use of a TSR to moderate the response category did not require civil engineer approval, and was a common method used by ARTC on the North Coast line at the time of the incident.

It is important to note the defect measurements defined in this guideline were based on isolated geometric defects. However, it also references that a more stringent response may be necessary if deterioration of the infrastructure both at the defect and on adjoining track was evident.

Other related standards

Stable track geometry requires the entire track structure to be designed and maintained to standards. This includes appropriate design and management of the track formation, track structure, ballast, and drainage, taking into consideration local and transient conditions.

Figure 7: RTS 3432 Figure 1 – grading requirements to improve drainage

Engineering Practices Manual Civil Engineering – RTS 3432 Track Drainage Inspection and Maintenance. Source: ARTC 

Track drainage standards

ARTC’s ‘RTS 3432, Track Drainage – Inspection and Maintenance’, provided similar guidance on the inspection and maintenance of track drainage as the ETS-05-00 document does for track geometry. 

Track drainage is described in this document as necessary, as ‘without adequate track drainage, track formation may become saturated leading to weakening and subsequent failure’, and formation failure may be indicated by ‘repeated top and line problems’ amongst other track instability defects.

Section 5.2.2 described that it is necessary to set priorities for drainage maintenance so that the worst locations can be repaired first, with ratings dependant on a number of factors, including mud pumping through ballast, foul ballast, water ponding and top and line problems. The document also suggested possible remedies for a list of typical problems encountered by type of drainage. 

Mud hole guidelines

ARTC’s ‘ETH-10-01 Mud Hole Management Guideline’ described mudholes as ‘areas where ballast had become contaminated with fine materials like dirt or clay’ and provided guidance on the management of mud holes.

The guideline explained that this contamination causes the ballast to retain water, creating a muddy, slurry-like substance around the track sleepers. This mud infiltration can then compromise the stability and integrity of the track structure, leading to uneven track surfaces, reduced load-bearing capacity, with the potential to be hazardous to train operation. 

The guideline described the different types of mudholes, their likely causes and possible prevention. 

‘Section 3, Assessment of Mudholes’ described that individual mud holes may require ongoing monitoring with increased regular general inspections scheduled. 

Ellipse, and the information recorded within it, was to be used for planning and controlling the remedial work in addition to planning and controlling any increased inspections.

Figure 8: Example – soft formation mud hole

Source: ARTC Safety and Systems Track and Civil Guideline – ETH-10-01 – Mud Hole Management Guideline

Ballast code of practice

Similarly, ARTC’s ‘Engineering (Track and Civil) Code of Practice Section 4 Ballast’ specified ballast standards and assessment responses which included increased general monitoring if required. 

The standard specified that a knowledge of local factors that may affect the track’s deterioration rate and performance history was required. 

If any increased monitoring was determined to be necessary, it would be required to be continued until rectification work was carried out. 

Earthworks code of practice

‘Engineering (Track and Civil) Code of Practice Section 8 Earthworks, General Inspection’ specified that scheduled general inspections should be of sufficient detail to observe and document earthwork conditions and changes in condition that affect their vulnerability to instability. This inspection was to include identification of defects and conditions.

General inspections were to be scheduled at intervals appropriate to each location dependant on its nature, condition and other seasonal factors but would not exceed 12 months or as otherwise specified by ARTC e.g. in an approved technical maintenance plan.

Sections of track with identified conditions indicating a vulnerability to earthworks instability were to be nominated and managed as special locations[6] until rectification or earthworks stabilisation work could be carried out. Specialist geotechnical advice together with detailed inspections may have been necessary for this purpose. 

Incident site observations and evidence

Track geometry

Onsite photographic evidence of the track at the initial derailment location showed a significant loss of top, line and superelevation/cross level.

Figure 9: Post-incident view of track at point of initial derailment, facing in the down direction

Source: OTSI

There was a sign posted temporary speed restriction in place of 20 km/h between 828.350 km and 828.450 km. 

Site photos post‑incident showed significant water saturation of the surrounding area, within the TSR boundaries. There was also notable sinking of the ballast at 2 locations, which had caused visible top depressions of the track.

Figure 10: Post-incident view of track at point of initial derailment, facing in the down direction

Side view of track, demonstrating the loss of top due to sinking soft formation. Source: OTSI

The initial point of mount was located within the TSR at 828.350 km with the wheel flange riding on top of the rail until the initial complete derailment of one bogie (2 wheelsets) at 828.346 km. 

Following this derailment, notable damage to track side infrastructure, such as wheel strikes to track sleepers, and impact damage to level crossing plates and guard rails[7] was evident for approximately 2.3 km, indicating that the derailed wagon remained connected to the train for this distance. Significant damage to the wheel treads of 2 wheelsets, examined by the ATSB post‑incident, was consistent with sustained ballast and sleeper strikes. 

A final separation event at approximately 826.280 km resulted in the remaining wagons derailing, coming to a rest on the up and down sides of the track.

The front and rear portions of the train which remained on track were then brought to a stand due the subsequent loss of air supply to the train’s automatic braking system following the separation.

Track foundation 

ARTC’s post‑incident track condition report noted that ballast condition around the area was observed to be severely fouled and of poor quality, with indications of crushed and undersized ballast, which can decrease water drainage. The formation exhibited areas of saturation consistent with a soft formation defect.[8] 

ARTC also noted in their investigation report a drain under the track at 828.420 km that was holding water on the up side (Figure 11). This same drain had water trickling from it on the down side indicating that the formation was holding water. 

Post incident, significant saturation within the formation was identified, requiring excavation to obtain a solid foundation on which to rebuild track. (Figure 12). 

Track maintenance records for scheduled track inspection and tamping activities that took place at this location prior to the incident made no mention of such significant formation issues, or that soft formation had been considered as the potential cause for repeated track geometry issues (see History and management of track defect).

Figure 11: Drainage culvert beneath initial derailment location

Drainage culvert directly below initial derailment site (828.420 km) showing pooled water beneath the track and formation. Source: OTSI

Figure 12: ARTC post-incident track works

A significant amount of mud and water was found under the formation during post-derailment rectification works. Source: ARTC

Track geometry measurements post‑incident

Post‑derailment track measurements taken by ARTC, and noted in its internal investigation report, detailed that the track exhibited a significant loss of top track geometry at 2 locations within the TSR with depressions of approximately 150 mm. 

Also, track measurements taken between 828.300 km and 828.509 km recorded a combination of twist and superelevation track geometry defects consistent with an E1 category defect as per ARTC Track and Civil Standards. An E1 Category defect required that the track be inspected and repaired prior to the passing of the next train.

Figure 13: Onsite track geometry measurements

Track measurements taken onsite post ‑incident, detailing point of mount, locations of categorised track geometry defects, temporary speed restriction limits and infrastructure details. X‑axis details track measurement station numbers at 2 m intervals from the point of mount at 0. Y‑axis details distance measurement in mm. Source: ARTC Data (graph constructed and annotated by OTSI)

Derailed wheels and bogie inspections post‑incident

Wheel profile measurements were taken by the ATSB at Acacia Ridge following the relocation of the derailed bogies and wheel sets. 

Wheel flange[9] height, angle and width measurements were taken with a standard wheel gauge (shown in Figure 14). The examined wheel sets were found to meet the operator’s minimum standards, although one wheelset was identified to have a flange width of 19.5 mm, close to the thin flange defect limit of 19 mm. 

This wheelset also exhibited some evidence of arrises[10] on both flanges, although these were also noted as being within tolerance, being less than 1.5 mm in height. 

Figure 14: Wheel limiting dimensions

Wheel condemning operational limits are guided by an industry code of practice. Measurement of derailed wheelsets. Source: Rail Industry Standards Board (RISSB) Wheel defects code of practice and ATSB

The wheel tread condition of the derailed bogies was also examined and identified bogie RRXE 649 (lead bogie of the 29^th vehicle RQRY 1011W) had sustained the most damage. 

A general inspection of that bogie was also carried out and did not identify any bogie suspension, bogie rotation or wheel tread defects outside of the rolling stock operator’s safe operational standard. 

Technical maintenance plan (TMP)

‘ETP-00-03 Civil Technical Maintenance Plan’ set out ARTC’s routine inspection requirements for rail track and civil infrastructure in terms of mandatory inspection tasks and inspection intervals. The TMP specified:

• which items were to be inspected
• what inspection tasks were to be carried out
• when inspection was required.

The inspection tasks and inspection intervals defined in this document were mandatory for all ARTC managed track.

The TMP referenced the applicable standards documents, manuals and codes of practice for the associated infrastructure element.

The TMP also contemplated that additional inspection scope or increased frequencies may be required in response to infrastructure condition or accelerated deterioration rates, noting that increasing frequencies could be authorised by the local maintenance management team. 

The factors below are what ARTC recommended should be considered when increasing inspection frequencies:

• rainfall
• rail condition
• measured track pump[11] under load
• fixed points within the local area (e.g. bridges, turnouts, etc.)
• previous track history
• effectiveness of local drainage
• curves
• existence of adjacent or multiple mud holes in the track sections.

These factors were to be considered to assist with the management of local conditions in accordance with the applicable standards and ensure that inspection and measurement of track geometry was done often enough to detect geometry defects and manage any deterioration.

ARTC Track and Civil Standard ‘ETE-00-02 – Track Patrol, Front of Train, General and Detailed Inspections’ set out the standards for the track and civil inspections which were to be carried out on ARTC track and civil assets. ‘Section 3’ detailed the types of inspections, such as track patrol and front of train inspections (see Types of inspections). It describes the purpose of each of these inspections, along with the scope, and reference to the applicable asset element maintenance standard. 

‘Section 2.2’ detailed the related responsibilities for maintenance personnel conducting track inspection activities and included specific responsibilities for the corridor manager, area manager and maintenance personnel, and the recording and reporting requirements for individuals in these roles. 

It was also specified within this document that during track patrol inspections, specific locations may be subject to General inspection. General inspections were typically visual and included the elements of a track patrol inspection plus inspection of all readily visible elements of the infrastructure and elements known to contain critical defects. 

An up-to-date defect list and a list of specific locations requiring attention was recommended to be obtained prior to carrying out the track patrol. Specific attention was to be paid to any deterioration at known defect locations.

Types of inspections

The types of inspections carried out on the ARTC network are detailed in Table 4:

Table 4: ARTC inspection guidelines

Source: ARTC Track and Civil Standard – Section 5 Track Geometry (Table 5-13 - Inspection Guidelines)

AK car inspections and data

The ARTC AK car[12] was a set of 3 converted passenger carriages equipped with technology to measure and record track geometry. The cars travelled over the ARTC standard gauge network measuring safety‑critical track parameters.

ARTC supplied data from Ellipse for all track inspections conducted between 13 April 2021 and 31 May 2022 near the derailment site. Three separate AK car inspections were conducted on 22 September 2021, 19 January 2022 and 11 May 2022. 

No track geometry exceedances were detected by the AK cars on these occasions in the area where the derailment occurred, between 828.350 km and 828.450 km. There were defects of varying degrees recorded by these AK car runs in the areas surrounding the initial derailment location. The closest to the derailment site was one gauge exceedance located at 828.254 km, approximately 150 metres from the site of the derailment of 2BS4.

The PP163F-01 speed restriction notification form for track between 828.350 km – 828.450 km (the initial derailment site) recorded tamping and resurfacing was performed on 29 April 2022, with an amended 40 km/hr speed restriction applied to the area. 

The 40 km/h TSR remained in place at the time of the AK car inspection on 11 May, with the speed board visible on the AK car end of train track recording CCTV. 

The PP163F-01 speed restriction notification form showed that on 26 May, 5 days before the derailment, the speed was reduced from 40 km/h to 20 km/h, citing poor track geometry as the reason for this further reduction.

The Ellipse system did not contain any track measurement data, or further information pertaining to these activities.

Noting that a speed restriction was in place when the AK car inspection was conducted, OTSI queried whether the track speed was materially important to the accuracy of the AK car’s track geometry readings. ARTC confirmed in writing that the speed at which an AK car is travelling does not affect its ability to detect rail geometry defects.

Specifically, ARTC indicated that there was not an optimal speed at which an AK car is required to travel to record accurate track data.

Track maintenance

Tamping

Spot tamping (tamping of short lengths of track to improve track geometry or remove specific defects), took place using an excavator with a fitted tamping attachment. This process involved the working and compressing of ballast into the voids beneath sleepers, intended to make the formation more stable and durable. This type of work is generally conducted by the local maintenance team and intended to correct minor defects or temporarily correct track geometry issues.

The ARTC document ‘Engineering (Track and Civil) Procedure PP-135 Mechanised Track Surfacing’ provided technical and operational procedures for mechanised track surfacing, including planning and carrying out surfacing, additional requirements for special situations, description of surfacing machines, guidelines for the operation of surfacing machines, and was referenced in conjunction with ARTC ‘Track and Civil Code of Practice – Track Geometry’. 

Engineering (Track and Civil) Procedure ‘PP-135 Mechanised Track Surfacing 2.1 Planning’ detailed that in planning, consideration should also be given to the available budget allocations, and the capabilities and/or limitations of the equipment to be used. In line with this procedure, it would need to be determined during planning by the maintainer whether or not the use of certain methods and equipment for corrective works were appropriate for the task.

Considerations when planning this work should aim to minimise the amount of between ‑cycle spot tamping and/or speed restrictions. 

Role requirements of a track maintainer

ARTC described[13] that a track maintainer was required to:

• Implement track maintenance, conduct mandatory systematic inspection, examination, condition monitoring and functional checks on the rail infrastructure and take appropriate action to ensure rail infrastructure was in a safe operational condition, including recording and reporting of defective infrastructure to maintain a valid defect recording system.

During interview the maintenance work group leader described being satisfied with the management of this defect using temporary speed restrictions and monitoring, however described:

• The section of track as ‘worse’ in comparison to others.
• They noticed that defects at the location would routinely reappear within weeks, sometimes days, of corrective works being undertaken.
• They were unclear in their requirement to permanently record information and observations relating to the changing track condition, and where hard-copy forms and notes were stored once submitted.
• They were unclear what the process was for escalation should they be concerned about a defect that was consistently deteriorating. 

While information was recorded sporadically across multiple entries pertaining to the defect at the initial derailment location, no specific information detailing the recurring fault, deterioration of track, specific corrective actions, TSR implementations or increased monitoring was recorded in the asset management system by the maintainers or area managers responsible for this location.

Project request and possession planning

The corridor managers responsible for infrastructure maintenance were required to submit requests for major works to the asset management team for approval and incorporation into the Asset Management Plan (AMP). 

Managers used data and dashboards generated from records in Ellipse to recognise trends and patterns to identify areas on the network that required further investigation and/or major works, and also to prioritise these works.

Requests for work were therefore generated from information in Ellipse recorded by the maintenance team.

Requests for work were required to be supported by appropriate evidence, such as:

• known conditions recorded in Ellipse
• information on the overall condition of the asset
• any other pertinent factors.

Requests for work that were approved by the asset management team were recorded as projects in the AMP interim database. Work Requests (or projects) residing in the AMP interim database were then reviewed and validated by the relevant stakeholders as part of the annual condition inspections.

Planned works of this nature were typically performed under Local Possession Authority (LPA), where a line is closed for a designated period of time, which required significant planning to be submitted and approved under the AMP before budgetary allocations and resources could be determined.

Procedures which define the process of identifying and authorising track access to the ARTC Network, including for possession work, were outlined in ARTC’s Corridor Access Management Procedure – COR-PR-028’. The procedure applied to ARTC workers, contractors doing work for ARTC, and third parties who enter the ARTC Network, and specified the requirements for planning to execute the work safely, and to keep the worksite safe including the method of protection to be used.

ARTC described the procedure as aiming to:

• improve safe and effective track access
• improve the efficiency of work and minimise impact on train running by effective planning of work, minimising mobilisations and maximising the use of track time
• provide details on how we plan on undertaking the work in a safe environment
• provide the ability to view all work in the Rail Corridor and address unauthorised access to keep all our staff, contractors and third-parties safe
• provide an integrated work plan, providing visibility of what work is occurring, where and when, removing the need for phone calls to provide this information.

Prior to 31 May 2022, no project work requests or formal possession planning had been generated, submitted or undertaken for work to be performed at the site of the derailment of 2BS4.

History and management of track defect

ARTC records indicated a significant increase in maintenance activity at the derailment location in the 2 months prior to the incident. A combination of temporary speed restriction records, tamping activities recorded in the Ellipse system and a train control report were noted in response to known geometry defects at this location. However, there was minimal detail on what was found or what actions were taken in many of these records.

Approximately 13 months prior to the derailment on 13 April 2021 the driver of NSWT XPT service NT31 reported rough riding due to a suspected dip in the track between approximately 828.300 and the 828.500 km mark near Kyogle. The condition was investigated by an ARTC maintainer later that day. The defect was determined to be in tolerance to continue with normal train running, however it was recorded that it would require repairs, and a work order to schedule and complete this work was raised the following day.

Temporary repairs were conducted at this site on 16 April 2021, described in the work order as ‘tamp, line and box up with excavator’, indicating that an excavator was used to correct the alignment of the track and formation supporting it. 

Further repairs were conducted at this location on 19 April 2021 under the same work order, where a 40 km/h temporary speed restriction was implemented. This was noted on the track certification form to remain in place for one week, however the 40 km/h TSR remained on this location until 25 May 2021. 

It was not noted or explained in the records why the TSR was to remain in place at the conclusion of the work, or why it remained in place for this amount of time.

Following these corrective actions, scheduled track inspections were conducted in this area, at an average interval of one week with the longest gap recorded as 8 days. These scheduled track inspection intervals were compliant with procedures. No further observations or references to any track geometry defects were recorded in the Ellipse asset management system against the assigned jobs for any of these inspection activities, aside from the closing of each work order to indicate the job was complete. 

Approximately 2.5 months prior to the derailment a front of train inspection[14] was conducted on 7 March 2022, followed by another scheduled track inspection on 11 March 2022, neither of which recorded any issues with the track.

On 15 March 2022 the driver of Pacific National train 2SB3 reported to the Junee NCO a track geometry issue at 828.400 km at Kyogle. The train was reportedly travelling at 55 km/h before reducing speed after encountering the defect. There was no temporary speed restriction in place at the time with the speed posted at 70 km/h for freight trains for this section of track.

A maintainer attended the defect location 30 minutes after the report and determined that the track would require adjustment and tamping. A 40 km/h temporary speed restriction was implemented. No track measurements were put on record to support this decision.

A scheduled track inspection took place on 18 March 2022, which recorded no issues or defects. There was no record of any works being done between the maintainer’s inspection on 15 March, that identified defects, and the scheduled track patrol on 18 March.

On 23 March 2022, a 20 km/h temporary speed restriction was implemented at this location, with the reason described in the speed restriction notification as ‘poor top and line’ (see Top and line). No other details or measurements were recorded in Ellipse or supplied to support this action, and scheduled track inspections immediately after this activity did not contain any further information.

Several more repair activities occurred at this location over the next 2 months, prior to the derailment, with limited detail recorded on what was done and why. The activities included track tamping conducted on 11 April 2022 and 21 April 2022. The work order related to the most recent TCR was closed, and subsequent scheduled track inspections provided no further detail on the condition of the line.

The area was again tamped with a resurfacing machine on 29 April 2022, one month prior to the derailment, and a 40 km/h temporary speed restriction was implemented. This was described in the ARTC ‘PP163F-01 Speed Restriction Notification’ as ‘tamped by resurfacing machines’, however, no documentation or measurements were provided to support this.

On 26 May 2022, temporary repair works were conducted at the site. A 20 km/h temporary speed restriction was implemented following this work and noted on the track certification form as due to ‘formation issues’, with sections of this form also incomplete. This was described in the ARTC ‘PP163F-01 Speed Restriction Notification’ as ‘poor track geometry’. No further documentation or recorded information was supplied. 

The final scheduled track inspection prior to the derailment was recorded in the ARTC asset management system as ‘fully complete’ on 27 May 2022, with no details of the track condition or any restrictions in place at this location, although the 20 km/h temporary speed restriction remained in place at this time, and the previous day’s track certification form showed defects remained in the track geometry.

Figure 15: Extract track certification form

Track measurements before and after corrective works on 26 May 2022 showing outstanding defects. Source: ARTC

Table 5: Notable dates in management of track defect

Although this section of track demonstrated it was vulnerable to earthworks instability, by way of repeated track geometry defects, and subsequent excavator tamping activities, ARTC did not provide evidence that the area was subject to any increased monitoring by the maintenance crew. 

There was also no evidence of changes to the standard inspection schedule, engagement of specialist geotechnical analysis or advice, or that the site had been nominated as a special location for additional attention.

Regulatory oversight

The Office of the National Rail Safety Regulator

The Office of the National Rail Safety Regulator (ONRSR) was the regulatory agency for rail in Australia. It was not a government agency, but an independent body corporate established under the Rail Safety National Law Act 2012. Its functions were to regulate the rail transport industry in Australia through its rail safety accreditation regime and the Rail Safety National Law (RSNL). ONRSR set requirements for rail safety management systems (SMS), conducted compliance activities including audits and inspections, and enforced the RSNL.

ONRSR routinely issued guidelines on its website designed to provide key information and clarification to both the rail industry and public on legislative, regulatory and technical matters associated with safe railway operations.

Asset management guidelines

ONRSR Guideline – ‘Asset Management, 13.3 Asset operation and maintenance’ stated in part that Rail Transport Operators (RTOs)[15] ‘should monitor ongoing compliance with their nominated standards and processes in order to ensure that their railway operations continue to be safe and perform efficiently.’

Also, ‘planning should be documented and controlled in a computer maintenance management system’ and that all maintenance tasks are signed off for compliance.

This document also detailed requirements for ‘monitoring asset performance’, ‘failure management and corrective action’ and the management of the life cycle of assets, such as track and signalling infrastructure.

ONRSR also expected RTO’s such as ARTC to have in place:

• evidence of ongoing compliance with the RTO’s nominated standards and processes, and management of identified risks
• asset maintenance plans and procedures
• evidence of identifying and eliminating safety risks
• evidence of reporting and managing any performance issues and corrective actions
• evidence of the use of trending performance against the predicted strategic life of an asset for tracking performance and planning for renewals
• processes for identifying faults and failures and undertaking corrective action
• evidence of the consideration of asset management in SMS provisions for: security and emergency management, notifiable occurrences, and interface management.

Safety management systems guidelines

ONRSR Guideline – ‘Safety Management Systems, 6.10 Safety audit arrangements’ described the requirement for a documented internal audit program which is focused around auditing those processes of the SMS which pose the greatest risk to safety.

ONRSR Guideline – ‘Safety Management Systems, 6.20 Process control’ described the requirement to ensure the organisation has a system to define, control and manage the operational and engineering processes to ensure assets are fit for purpose for rail infrastructure and rolling stock operations.

As a minimum ONRSR would expect:

Records of inspections are kept and form the maintenance history of the asset to confirm:

• effective monitoring to ensure compliance to standards, operating rules, processes and procedures
• the date the inspection has been carried out and by whom
• the defects or non-conformances detected (location, description)
• defects or non-conformances have been reported for rectification
• defects are prioritised, safely managed and reviewed until rectified
• condition of the infrastructure/rolling stock (and any restrictions) has been reported to staff responsible for the day’s operation
• defects are rectified, checked and dated by staff with the competence and responsibility for ensuring assets are returned to service fit for purpose
• the maintenance work carried out on each asset (both routine and rectifying defects) has been recorded (e.g. a maintenance log for each asset)
• assurance that technical maintenance plan requirements are met, and the review of work order process or inspection test plan process is undertaken to demonstrate evidence of work being conducted as per standards
• back to service, monitoring of human performance, random audits and inspections and other safety observations
• that general engineering and operational system safety requirements are complied with. 

ARTC indicated that it had various activities and functions in place related to the monitoring and oversight of maintainers responsible for the NSW North Coast corridor, however ARTC was unable to supply any evidence of maintenance team compliance audits or assurance activities specific to this area.

Other standards and guidelines

The Rail Industry Safety and Standards Board 

The Rail Industry Safety and Standards Board (RISSB) was a non-government, member ‑based, not-for-profit that developed Australian standards, guidelines, codes of practice and rules on behalf of the Australian rail industry.

RISSB supported the rail industry’s regulation model by providing standards, guidance, and advice which helps industry prove that it is meeting its safety obligations.

RISSB Infrastructure Standard ‘AS-7635 – Track geometry’ was developed to specify track geometry standards for design, construction, commissioning, monitoring, maintenance, and modification of rail tracks in Australia. ‘Section 4 Monitoring and maintenance, 4.1 Inspection’ – frequency and tasks stated ‘at locations with a known history of geometry defects, the frequency of inspections should be increased as determined by the Rail Infrastructure Manager (RIM), or ARTC in this instance.’

When describing the management of track defects using TSR, ‘Section 4.2.1 Speed restriction’ stated ‘speed restrictions may be used to manage the risk from track geometry defects, enabling the increase of timeframes for required response actions’.

The standard advised caution was required though when using speed restrictions to manage twist and cyclic defects, as lower speed can increase the likelihood of vehicle dynamic derailments and makes further mention when discussing geometry defects that reducing speed could increase the risk of derailment.

This guideline also advised that a combination of defects that are considered to act together should also require a more stringent response.

‘Section 4.2.3 Repeat faults’ recommended ‘the RIM may consider a mechanism for monitoring repeat track geometry faults, defined as those recorded during consecutive track inspections. For those sites where the geometry fault has increased in magnitude it is advisable for a supervisory site inspection to be conducted, to ensure that the right method of correction is applied’.

Similar occurrences

RO-2019-004 Derailment of Pacific National coal train MR280 – Baerami, New South Wales, on 6 February 2019

At 0325 Eastern Daylight saving Time on 6 February 2019, a Pacific National loaded coal train, MR280, travelling from Moolarben to Kooragang Coal Terminal, derailed near Baerami on the Ulan branch line on the Hunter Valley Network. All wheels of the leading bogie of the 88th wagon derailed and travelled in a derailed state for approximately 1.83 km. As the derailed train reached the points of the Baerami crossing loop, another 5 wagons derailed and 3 wagons rolled on their side, narrowly missing a stationary empty coal train UL369.

It was considered that the contributing factors to the derailment were a result of individual actions, where personnel had not executed the intent of the ARTC code of practice and/or had not followed procedures as required. As a result of this, and the safety actions taken by ARTC, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues or further important safety lessons for the enhancement of transport safety and the investigation was discontinued.

In response to the incident, the ARTC took safety action, including implementing a daily ‘known conditions review’ meeting at all provisioning centres so that call outs, TCR’s and known conditions could be frequently reviewed with other current information and ensure appropriate controls were in place for the management of defects

RO-2017-014 Derailment of grain train 8838N – Narwonah, New South Wales, on 1 October 2017

On 1 October 2017, a Pacific National loaded grain train 8838N was travelling on the ARTC rail network from Nevertire to Manildra in north-west New South Wales. The train consisted of 2 locomotives and 23 wagons. The train was travelling south at Narwonah when 11 loaded grain wagons located at the rear of the consist derailed. An emergency brake application occurred due to the uncoupling, which brought the front portion of the train to a stand. There were no injuries but there was substantial damage to 9 wagons and track infrastructure.

There were track defects identified in the vicinity of the derailment site prior to the derailment, and the maintenance of defects in this section of track was not successful in preventing the defects from re-occurring.

ARTC committed to several safety actions as a result of this incident, including changes made to the ARTC maintenance system to address systemic issues. ARTC also commenced a work program titled ‘Asset management improvement program’, which focused on improving the functionality of the enterprise asset management system and its supporting business processes.

Safety analysis

Introduction

On 30 May 2022, freight train 2BS4, operated by Pacific National, departed Acacia Ridge, Queensland, for Sydney, New South Wales. The train consisted of 3 locomotives and 56 wagons, hauling a combination of containerised freight and empty wagons.

At approximately 0030 hours on 31 May 2022, while traversing the North Coast line between Casino and Kyogle, New South Wales, 2BS4 encountered a temporary speed restriction of 20 km/h. While passing through this area, a wagon in the consist derailed, dragging for approximately 2 km, where the train then parted and a total of 11 wagons derailed.

It was determined that 2BS4 initially derailed due to a combination of track geometry defects, in an area under temporary speed restriction.

This safety analysis will discuss the track defects responsible for the derailment, and how the condition was being managed, including the use of ARTC’s enterprise asset management system.

Wheel examination of derailed vehicles

Due to the extensive damage to wagons, bogies and track infrastructure it was unable to be determined exactly which wagon separated from the consist first. However, it was likely, due to the damage observed on its wheelsets, that wagon number RQRY1011W, the 29^th wagon in the consist, initially partially derailed at the TSR site and dragged for approximately 2.3 km before derailing completely, pulling the 28^th wagon RKBY20455Q away from the consist. Once the wagons separated from the front of the train, the momentum of the trailing wagons has then contributed to the subsequent derailment and pile up of the remaining vehicles.

Wheel profile measurements taken by the ATSB at Acacia Ridge following the relocation of the affected bogies and wheel sets measured for flange height, angle and thickness with a standard wheel gauge. The overall condition of the examined wheel sets was found to meet the operator’s minimum standards for safe operation. 

One wheelset of bogie RRXE 649 was noted to have the flanges close to the thin flange defect limit of 19 mm and exhibited an arris on both flanges. This type of wheel tread condition was indicative of a bogie with a higher angle of attack, with this likely to produce an increased lateral flange force on the outside rail head in a curve. 

However, that condition was unlikely to have been a major factor in contributing to the derailment, as the flange steepness (worn but also within the operator’s standard for safe operation) likely counteracted the effects of an increase in lateral flange force arising from a higher angle of attack.

All bogies were also found to be within minimum operating standards. 

Track geometry condition at derailment site

A combination of multiple short and long twist E1 track geometry defects were found at the initial derailment site, along with 2 top defects in the vicinity of the point of mount. 

Had these defects been detected prior to the passage of 2BS4, ARTC would have been required to rectify the defects prior to the next train in accordance with their Track and Civil Standard (Table 3).

From the evidence obtained it is likely the derailment occurred due to a combination of track geometry conditions (multiple E1 short and long twists) that resulted in rolling stock wheel unloading, wheel climb onto the rail head and subsequent derailment of both wheels of a single bogie on vehicle RQRY 1011W. 

The derailment mechanism was consistent with the outer (high) rail wheels unloading on a single bogie at slow speed that was progressing into a curve with too much superelevation. Those conditions were likely to have decreased the force on those wheels leading to wheel climb and subsequent derailment. The multiple E1 twists over the TRS limit could also have induced vehicle body roll in advance of the point of mount further contributing to the wheel unloading experienced.

The track geometry conditions were due to a soft formation issue at the site as evidenced by poor ballast condition, water saturation, and repeated track geometry issues. 

The resulting degradation of the track structure at multiple locations prior to the derailment point of mount was considered to have resulted in both track top and alignment defects on the day, sufficient to initiate the derailment. 

Although the contribution of the rolling stock/track interaction was unable to be quantified, the extent of the track structure defects and the rate of their apparent deterioration following maintenance interventions became the central focus of OTSI’s investigation to identify safety learnings.

Progression of track formation defect

Observations of train crew

The driver’s assistant of 2BS4 recalled in interview that the track was worsening in condition since their last trip through the area approximately one week before and described this crossing as far worse than previous trips. 

The driver’s assistant described that, in their experience, a 20 km/h speed for this defect was not acceptable, and they had intended to report to network control that the track should have been closed, had the derailment not occurred.

The driver of a previous train to traverse this section the day before described it in interview as the worst TSR they had ever seen in their time, although explained that drivers are generally not qualified to make judgements on whether a track should remain open. 

The driver of 2BS4 suggested that, in their opinion, the track should have been closed to rail traffic and assessed, describing visible track geometry issues as it was traversed.

All train crew interviewed in relation to this incident confirmed a worsening of the condition of the track in comparison to their last trip and considered the track to be of an unacceptable standard.

Although there were no train control reports received by network control in the days preceding the derailment of 2BS4, it was suggested by various train crew in interview that driver reports for the same track faults repeatedly, especially when it is being managed by an existing speed restriction, were not taken as seriously by network control and generally not followed up. 

It was also suggested that drivers would typically be less likely to report a track defect that is under some form of speed restriction, as this would indicate that the issue with the track has been identified by ARTC and was ‘being managed.

Progression of defect

A track certification form indicated that a temporary and partial repair was conducted at the derailment location on 26 May 2022, 4 days prior to the derailment. This form noted that the track geometry post‑corrective action was suitable for full track speed but also recorded that the repair did not fully rectify the track defects at this location to desired limits after corrective maintenance (see Table 1). Despite the geometry being noted as suitable for full track speed, a 20 km/h temporary speed restriction was put in place citing ‘TSR imposed due to formation issues’. This level of speed restriction on a compliant track indicates that the maintenance team had assessed that the formation issues were severe and the geometry defects likely to re‑occur.

According to ARTC Track and Civil Response Booklet (ETW-00-01), ‘increased monitoring should be continued until rectification work is carried out’. Although the rectification work conducted on this day did not repair the defect, and a speed restriction remained in place, no further inspection or monitoring of this site was conducted, and no further information was entered into the EAMS to suggest that there was a concern over the condition of the track at this location.

Several of the characteristics identified by ARTC as typical of mudholes, or underlying soft formation issues, were consistent with the conditions observed by maintenance personnel in interview and train crews traversing this section of track. Those conditions included water saturation, failing formation and general track instability. However, the area was not subject to any additional monitoring in between routine scheduled inspections.

From the last temporary repair on 26 May 2022, until the derailment, 24 trains traversed this section of track. All trains using this section of track in this timeframe were doing so under a 20 km/h speed restriction, concluding in the derailment of 2BS4, 4 days later. 

Rapid deterioration of track geometry had been identified on at least one prior occasion, reported by train crew between the scheduled track monitoring cycle of 7 days, with the train crew’s report resulting in corrective action.

It was likely that the soft formation defect has caused the track geometry to degrade to an unsafe condition in the 4 days following the track’s last repair and inspection, unbeknownst to ARTC in the absence of heightened monitoring or further repair.

Planning for rectification works

ARTC advised that a track possession had been planned in which the work intended to correct the soft formation was scheduled to take place. However, ARTC was unable to supply documentation and pre-planning paperwork to support these plans, or evidence that the defect area concerned was included in any plans for the planned possession window. It was found during further investigation that no such documentation existed, and no formal planning had taken place.

Track inspection activities and temporary repairs to the track were not carried out in a systematic manner with inconsistencies in accompanying paperwork. This included track certification forms which were submitted with incomplete track measurements, ambiguous or absent descriptions of work completed, and the absence of manager or supervisor sign-off. 

It is unlikely that the information contained within the asset management system alone would have been sufficient to determine the extent of the issue, nor would it have provided the corridor or asset manager with an accurate indication of what resources, such as personnel and equipment, would be required to repair the defect, with no verifiable record of information to inform the severity of it.

Defect management records

OTSI’s review of maintenance records and track measurements taken before and after tamping activities by ARTC found that the TSR location had a history of significant superelevation/cross level loss prior to the derailment, but little information on the defect itself.

ARTC’s maintenance team managed the track defect between 828.350 km and 828.450 km by repeated temporary corrective maintenance and temporary speed restrictions. 

However, track condition was not recorded in Ellipse pre or post these activities or recorded after scheduled maintenance activities. 

The recording of track conditions within ARTC’s Ellipse system and detailed track inspection records was required by the ‘AMT-PR-010 Enterprise asset management system’ procedures. These records were required to support work requests to the asset management team and to prioritise major works. 

The maintenance work group leaders stated lack of familiarity with ARTC’s specific recording and escalation process, (see also Recording requirements of known conditions), along with ARTC’s inability to locate manual defect records likely impeded the dissemination of the defect details, and escalation within the organisation, hindering the ability of management to respond appropriately.

Information that should have been recorded in the Ellipse system as required by ARTC’s procedures may have been used to identify the deteriorating condition and instigate further investigation into the track geometry issues or initiate more stringent monitoring. However, in this instance, that information was either not recorded, or not available to provide reliable insight into the track condition. 

Corrective works and tamping

There was no evidence that planning or assessments had taken place in accordance with Engineering (Track and Civil) Procedure ‘PP-135 Mechanised Track Surfacing 2.1 Planning’ to support the ongoing use of tamping at the derailment site. 

According to the procedure consideration should be given to the capabilities and/or limitations of the equipment being used. 

The recurrence of track defects at the same location over a period of at least 12 months was an indication that the spot tamping approach was insufficient to address the repeated track geometry track defects, and that further exploration of the underlying cause was required to manage the defect. 

Track possession planning

In interview, ARTC senior management representatives acknowledged not being fully across the severity of the issue but explained that there was a plan to undertake further corrective work in an upcoming possession window.

In its investigation report ARTC also document that ‘plans to undertake corrective works on the embankment formation were in place to occur on the weekend of 4 and 5 June 2022’. 

However, no documentation or formal submission was supplied to the ATSB to support these statements. 

ARTC acknowledged in a further information request that the detailed planning for the formation reconstruction had not been completed prior to 31 May 2022. ARTC representatives described in interview that the actual plan was to reallocate resources from a nearby planned track possession and conceded that the necessary pre‑possession work rectification planning for this specific defect had not been completed.

An ad-hoc planning method was therefore being used to scope major works on the line. This may have compromised ARTC's ability to ensure work was being performed as per ARTC’s code of practice and in accordance with its asset management plan, and redirected resources assigned to repair another defect without appropriate risk assessment and prioritisation.

Methodical planning and documenting of planned track work, such as that described in ‘Corridor Access Management Procedure - COR-PR-028’ was, according to ARTC, essential to ensuring that the efficiency and integrity of the work can be monitored and adhered to, and the correct and necessary safety measures specific to the work location and environment can be implemented prior to work commencing. This planning was to ensure that all risks associated with planned work were accounted for and eliminated or mitigated where possible. 

Insufficient planning, scoping and resourcing had the potential to increase the health and safety risk to workers and create inefficiencies in work conducted when necessary and essential pre-work planning and risk assessment was not carried out. 

Detection and management of recurring defects

Track maintenance activities prior to incident

Evidence collected by the ATSB has indicated that scheduled track inspections were carried out in accordance with ARTC code of practice, although there was no evidence of increased monitoring of this site. 

There was no indication from information supplied by ARTC that these routine track inspections were detecting anything out of the ordinary occurring with this section of track, which is inconsistent with other sources of information supplied, indicating an increase in corrective work surrounding this defect.

For instance, irregular tamping activities took place to correct track geometry faults on numerous occasions, however evidence supplied to support the decision‑making behind these activities indicated an absence of information which would otherwise allow ARTC to make fully informed decisions. 

Enterprise asset management and Ellipse

The information entered into the ARTC Ellipse system relating to work undertaken onsite did not inform responsible personnel that this recurring fault required special attention. 

There was no detailed information found in asset management system records, against any of the scheduled track inspection activities at this location. An increase in tamping activities and a greater reliance on temporary speed restrictions may have indicated a more serious issue, which would normally have triggered a more stringent response. However, nothing was noted in these records which indicated it had been raised as a concern. 

Speed restrictions were implemented in response to the track condition, however, specific details relevant to the defect were not recorded in Ellipse. Scheduled track inspections conducted immediately before and after tamping, and the introduction or removal of speed restrictions, also recorded no information on the defect.

If track measurements were undertaken by civil staff to determine the level of response required for this defect, details of these were not recorded in the Ellipse asset management system.

The repeated implementation of a 40 km/h TSR at this location following corrective works indicates that the civil representative responsible for this location reasonably anticipated a recurrence of the fault, and that track stability was reduced or compromised. The information describing and explaining this action, however, was not documented in Ellipse as required on any of these occasions.

It was not clear based on the evidence supplied how the data that was retained from track patrols, inspections or corrective works could have informed ARTC of the presence of a defect which could be considered problematic or recurring. The information recorded was not in compliance with the requirements of ARTC’s ‘AMT-PR-010 – Enterprise asset management system’ procedure. 

With the limitations in data and information available in the Ellipse system in this case, it is unlikely that ARTC would have had a reliable and informative data set to highlight the necessity for increased monitoring of this defect, and or significant repairs, allowing the underlying soft formation condition to continue to degrade.

This hindered the ability for the necessary planning and resource allocation to take place, as the information needed to inform ARTC of the scale of work and resources required was not accurate, and in some cases non-existent.

These issues with record keeping, the quality of inspections and appropriate repair had been identified previously by the ATSB as safety issues requiring action based on previous similar incidents (see Similar occurrences), specifically the ATSB Narwonah investigation report identified similar issues such as: 

• ensuring that defect rectification work is undertaken to an acceptable quality
• ensuring that inspection activities are thorough
• network issues are captured within ARTC’s enterprise asset management system for planning and future rectification
• interrogating network data to identify where reoccurring issues are developing and request project work to rectify.

Monitoring and oversight of maintenance activities

Auditing and assurance of maintainers

Along with ARTC’s assurance framework and audit plan (see Asset assurance framework), to ensure the compliance of their maintainers conducting work on rail infrastructure and to inform corridor management on their effectiveness and performance ARTC detail their activities included:

• daily visual management centre (VMC) toolbox meetings
• scheduled and unscheduled inspections
• TCR and train control rail event functions

It was explained that this was how ARTC ensured work was being carried out ‘effectively’. However, no evidence was provided to demonstrate these assurance activities were being carried out, nor any evidence that they had been formalised in documents or procedures.

ARTC relied on a task being marked as complete within the asset management system to validate that the work was completed, with minimal follow up and verification of this task completion.

There was no evidence of any previous auditing activities on rail maintenance personnel conducting rail maintenance tasks in the North/South corridor, suggesting that any safety actions taken in response to previous incidents have likely been implemented in an informal manner.

This informality did not support a proactive approach to managing potential safety issues in the rail corridor, such as the treatment of track defects. 

The lack of evident auditing or verification of effective maintenance activities has resulted in a limited visibility at an organisational level within ARTC that the scheduled and unscheduled maintenance tasks being carried out were achieving the desired result. This did not provide the organisation with adequate insight into the thoroughness of its track inspection activities.

Informal meetings and discussions would not provide sufficient assurance that maintainers were applying the appropriate methods to reduce risks, or carrying out essential tasks to completion without a formal auditing or checking system in place as prescribed in the ONRSR guidance, especially where detailed data is lacking.

Findings

From the evidence available, the following findings are made with respect to the derailment involving Pacific National freight train 2BS4, near Kyogle, New South Wales, on 31 May 2022. 

Contributing factors

• 2BS4 derailed on a section of track which had progressed to an unsafe condition since the partial correction of a recurring defect 4 days earlier. The defect had a known history of recurrence but was not subject to increased monitoring.
• In the absence of appropriate records in the asset management system, no formal planning was in place to permanently rectify the known defect, which was in a state of deterioration
• ARTC did not reliably identify, monitor and analyse recurring track defects which resulted in a reduced capability to:
  • monitor deterioration of the track
  • recognise the need to conduct increased unscheduled track patrols
  • identify capacity to plan for its corrective maintenance. (Safety issue)
• While ARTC had a process for monitoring its maintainers when carrying out inspections and rectifications, it was unable to provide evidence of these activities being conducted. (Safety issue)

Safety issues and actions

ARTC ability to detect and manage recurring defects

Safety issue number: RO-2022-006-SI-03

Safety issue description: ARTC did not reliably identify, monitor and analyse recurring track defects which resulted in a reduced capability to:

• monitor deterioration of the track
• recognise the need to conduct increased unscheduled track patrols
• identify capacity to plan for its corrective maintenance.

ARTC monitoring and oversight of maintenance activities

Safety issue number: RO-2022-006-SI-04

Safety issue description: While ARTC had a process for monitoring its maintainers when carrying out inspections and rectifications, it was unable to provide evidence of these activities being conducted.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the driver and driver’s assistant of 2BS4 and another driver who conducted operations for Pacific National
• Australian Rail Track Corporation (ARTC)
• ARTC North / South rail corridor asset maintenance services personnel
• ARTC network control graphs and audio recordings
• Pacific National
• Bureau of Meteorology (BOM)
• Office of the National Rail Safety Regulator (ONRSR)
• Rail Industry Safety Standards Board (RISSB)
• New South Wales TrainLink
• Australian Transport Safety Bureau (ATSB), and previous ATSB rail investigation reports
• track maintenance data and track inspection footage
• ARTC network rules, procedures, standards and guidelines
• front-of-train CCTV footage, onboard event recorder and onsite photographs
• Google Earth.

References

ARTC Track and Civil Standards

ARTC Asset Management Procedures and Work Instructions

ARTC Train Control Reports

ARTC Safety & Environment Investigation Report- Derailment of Train 2BS4 826.350 km Kyogle, NSW- 31 May 2022- TCR 6218 2022

RISSB Infrastructure Standard – AS 7635:2023 Track Geometry

ONRSR Guideline - Asset Management

ONRSR Guideline – Safety Management Systems 

ONRSR Safety Message: Ad hoc systems and procedures vs Safety Management Systems

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• Australian Rail Track Corporation (ARTC)
• Pacific National (PN)
• NSW TrainLink (NSWT).

Any submissions from those parties will be reviewed and, where considered appropriate, the text of the draft report will be amended accordingly.

A submission was received from: 

• Australian Rail Track Corporation (ARTC).

The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.

Rail safety investigations in New South Wales Most transport safety investigations into rail accidents and incidents in New South Wales (NSW) and Victoria are conducted in accordance with the Collaboration Agreement for Rail Safety Investigations and Other Matters between the Commonwealth Government of Australia, the State Government of NSW and the State Government of Victoria. Under the Collaboration Agreement, rail safety investigations are conducted and resourced in NSW by the Office of Transport Safety Investigations (OTSI) and in Victoria by the Chief Investigator, Transport Safety (OCI), on behalf of the ATSB, under the provisions of the Transport Safety Investigation Act 2003. The Office of Transport Safety Investigations (OTSI) is an independent statutory body which contributes to improvements in the safety of bus, ferry and rail passenger and rail freight services in NSW by investigating safety incidents and accidents, identifying system-wide safety issues and sharing lessons with transport operators, regulators and other key stakeholders. Visit www.otsi.nsw.gov.au for more information. Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. Investigations under the TSI Act do not apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings.  Under the TSI Act investigations endeavour to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner.  TSI Act investigations are not for the purpose of taking administrative, regulatory or criminal action. About ATSB reports ATSB investigation reports are organised with regard to international standards or instruments, as applicable, and with ATSB procedures and guidelines. Reports must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2026 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 27 May 2022, a Singapore Airlines Airbus A350-941, registered 9V-SHH, was being prepared for a regular public transport flight from Brisbane Airport, Queensland to Changi Airport, Singapore. Just prior to the aircraft being pushed back for departure, a refueller on an adjacent bay informed the licenced aircraft maintenance engineer responsible for the aircraft turnaround that the pitot probe covers were still fitted. Subsequently, the covers were removed just before pushback.

What the ATSB found

The ATSB found that the procedural risk controls for the removal of the pitot probe covers were circumvented when a licenced aircraft maintenance engineer certified for the removal of the covers in the technical log and removed a warning placard from the flight deck without visual or verbal confirmation that the covers had been removed.

Further, a final walk-around of the aircraft by maintenance personnel to ensure it was correctly configured for flight was also not conducted. This represented the last procedural opportunity to identify that the covers had not been removed. Similarly, it was established from closed-circuit television footage of Singapore Airlines turnarounds at Brisbane Airport that the majority of flight crew pre-flight inspections observed around the time of this occurrence were truncated and not undertaken in accordance with company procedures. This included the occurrence flight.  

The ATSB also identified that Heston MRO had not yet implemented an acceptable method for accounting for tooling and equipment prior to aircraft pushback, although this had been identified as a safety issue in investigation AO-2018-053. Also, Heston MRO did not track the work hours of personnel who had dual roles within the company for fatigue management purposes, even though there was a requirement in the fatigue management policy to do so. 

Lastly, the pitot probe covers fitted to the aircraft were about 3 m above eye height and had relatively short streamers, which were not conspicuous and limited the possibility of incidental identification.

What has been done as a result

Heston MRO no longer requires the Brisbane regional manager position to undertake dual responsibilities, which included aircraft maintenance certification requirements, Further, Heston MRO now tracks the work hours of all employees for fatigue management purposes.

Singapore Airlines has communicated with flight crew about the requirements of their pre-flight walk-around checks and why they are important. In addition, Singapore Airlines has also provided Heston MRO at Brisbane with pitot probe covers that have longer streamers to ensure better conspicuity.

Safety message

Airspeed is a critical flight parameter, which is particularly important to flight crew during take-off and initial climb. It is the basis for their awareness of flight conditions such as the approach of aerodynamic stall and determination of critical decision points. This occurrence demonstrates how assumptions and procedural omissions can lead to unsafe conditions. In this case, the potential for an aircraft to commence a take-off with erroneous or absent airspeed indications due to the pitot probe covers remaining fitted. 

Fatigue is a known factor in maintenance errors and can have a range of adverse influences on human performance. Therefore, it is important that organisations appropriately track all hours worked by safety critical employees to ensure they are receiving adequate rest and safeguard against the effects of fatigue. 

Finally, this investigation recognises the positive actions of the refueller, who was working on the adjacent bay and had identified that the pitot covers remained fitted. This serves as a reminder that all line personnel have a safety role and should always speak up if they see or feel that something is not right.

The occurrence

On 27 May 2022, a Singapore Airlines Airbus A350-941 aircraft, registered 9V-SHH, was being prepared by maintenance personnel on bay 81 for a regular public transport flight from Brisbane Airport, Queensland to Changi Airport, Singapore, as flight number SQ256.

The engineering maintenance contractor had provided a licenced aircraft maintenance engineer (LAME) and an aircraft maintenance engineer (AME) to conduct its regular receipt, dispatch, certification, and maintenance duties during the aircraft’s scheduled 2-hour turnaround. The LAME (who was also the regional manager) was supervising the AME and assisting with the turnarounds of SQ256 and another aircraft on an adjacent bay. The AME had started with the contractor 3 weeks prior and had not completed all their induction training. On the day, the AME was conducting headset (turnaround coordinator) duties.[1]

Closed-circuit television footage from bay 81 showed that, between 0705 and 0727 local time, the LAME instructed the AME through the external walk-around inspection of the transit check for the aircraft. At 0732, the AME utilised an elevated work platform to install covers on all 4 pitot probes[2] in accordance with airline and company procedures specifically for Brisbane Airport. At about the same time, the LAME entered the flight deck to check the technical log for defects. As part of the pitot cover installation and removal procedures, the LAME made an entry in the technical log that the covers had been fitted and then placed a warning placard on the flight deck engine control pedestal to also show that the pitot covers were fitted.

Between 0852:18 and 0854:03, the first officer conducted a pre-flight walk-around. The walk‑around was truncated from the nose of the aircraft to the right engine, across to the left engine and back to the airbridge. From the footage, the first officer looked up at and likely observed the fitted pitot covers, however, they were required to be fitted at that time as per the operator’s procedure.

At 0859, the LAME arrived back on bay 81 after tending to an aircraft on an adjacent bay. The LAME conferred with the AME about fuel figures and talked to the flight crew via headset to confirm the fuel upload. 

About 5 minutes later, the LAME re-entered the flight deck, certified for the transit check in the technical log, cleared the technical log entry for the fitment of the pitot covers, and removed the pitot cover warning placard from the flight deck pedestal. The LAME then returned to the tarmac and placed the placard on the dashboard in their work vehicle. 

At 0913, the LAME returned to the tarmac at the nose of the aircraft and conversed with the AME for about 3 minutes. With 4 minutes remaining until the expected pushback[3] time, the LAME told the AME that they were going to the adjacent bay to complete the refuelling of another aircraft. The AME remained at bay 81 to conduct the pushback headset duties (Figure 1).

Around this time, an aircraft refueller on an adjacent bay observed that SQ256 appeared ready to pushback, but the pitot covers were still fitted. When the LAME reached the aircraft at the adjacent bay, the refueller immediately pointed to SQ256 and informed the LAME that the covers were fitted (Figure 2).

Figure 1: Security footage of bay 81 showing SQ256 4 minutes before pushback with the pitot covers fitted and the LAME moving towards the adjacent bay

Source: Brisbane Airport Corporation, annotated by the ATSB

Figure 2: Security footage of the refueller pointing towards SQ256 and informing the LAME that the pitot covers were fitted

Source: Brisbane Airport Corporation, annotated by the ATSB

The LAME returned to SQ256 and alerted the AME that the pitot covers were still fitted. At about the same time, the flight crew requested pushback approval from air traffic control and turned on the aircraft beacons. The aerobridge began to retract away from the aircraft. 

The flight crew then notified the AME on the headset that they were ready to pushback. The AME, having just been informed that the pitot covers were fitted, told the flight crew to standby as they were in the process of removing the pitot covers. 

With 2 minutes remaining until the expected departure time, the LAME positioned an elevated work platform on each side of the nose and removed the pitot covers (Figure 3).

Figure 3: LAME removing the pitot covers 

Source: Brisbane Airport Corporation, annotated by the ATSB

Context

Operator information

Operator arrangements for support services at Brisbane Airport

Much like other international airlines, Singapore Airlines had significantly scaled back services to Brisbane during the COVID-19 pandemic (2020 to 2021), halving its services from 28 to 14 flights per week. The airline had increased services to Brisbane to 21 flights from March 2022. 

Singapore Airlines’ Brisbane Airport engineering services were contracted to Heston MRO. The requirements for the services of Heston MRO were also significantly reduced across all airlines it serviced during the pandemic. Therefore, its workforce was significantly reduced, and the remaining engineering staff had their hours decreased considerably. In 2022, when the Australian Government opened its borders to international travel, Heston MRO abruptly returned to normal operations, which equated to a significant increase in demand from airlines requiring their service. 

Maintenance personnel information

Licenced aircraft maintenance engineer and regional manager 

Qualifications and experience

The LAME joined Heston MRO in July 2021 and had licence coverage on several large aircraft and engine types, and extensive line maintenance experience over several years. The LAME’s main role was as the regional manager for south-east Queensland. In that role, the LAME was responsible for managing engineering operations for Heston MRO at Brisbane, Wellcamp and Gold Coast airports. The LAME also had responsibilities that included certification requirements at Brisbane Airport, storage and movement of aircraft at Wellcamp, and regular LAME functions when there were unscheduled LAME absences. 

72-hour history

The LAME indicated that, in the 72-hours prior to the occurrence day (on Friday), they had:

• About 6 to 7 hours sleep on Tuesday after a workday average of 12 hours.
• On Wednesday, the LAME covered work spanning 2 shifts. One was conducting the return to service of an aircraft at Wellcamp with a commute starting at 0530 and a return to their residence at 1700. The second shift was line duties to cover another LAME’s absence starting at 1900 and working until midnight. Following those shifts, the LAME estimated that they had about 6 hours sleep.
• On Thursday, the LAME reported that they worked from home conducting administration duties and slept for about 7 hours before the occurrence shift.
• On Friday, the LAME commenced work at 0630.

During interview, the LAME was asked about their level of fatigue on the day of the occurrence utilising an alertness scale. The scale estimated alertness using descriptive anchors numbered from 1 to 7, with 1 being fully alert and 7 being completely exhausted. The LAME stated that they varied between 4 to 6 on the scale but seemed to be ‘moderately tired and let down’ on most days, which is 5 on the scale. 

Dual roles

In 2022, the LAME/regional manager's dual roles progressively became more demanding as turnaround services increased, and aircraft were being removed from storage post COVID-19. They were recorded in the roster as working 7.5 hours, Monday to Friday. However, they reported that their workdays were often up to 12 hours with work also being conducted on weekends. Further, in their capacity as a LAME, conducting turnarounds was often required to cover shifts for other LAMEs due to sickness. For example, they reported that they had recently covered a shift for another LAME, following their own long workday. That workday exceeded the maximum work hour requirement and prescribed rest period between shifts. 

The LAME also described that they seemed to be constantly in the state of being ‘moderately tired and let down’ due to the demands of their dual roles. The LAME mentioned that family and friends had expressed concern about the LAME’s stress levels and the amount of work they were doing. An internal company report into the occurrence had also noted that the LAME stated:

They could not remember the last time they had a full day of rest. In their own words, ‘’even when at home, they were working to catch up with their duties’’. 

The report concluded that:

Based on the statements provided, [the LAME] seemed distracted. It is not clear if this was due to the activities that he assisted the Malaysian Aircraft with or if [they] were struggling with fatigue.

As Heston MRO did not track the LAME’s work hours for fatigue monitoring purposes (as per Heston MRO fatigue management policy, refer to section titled Heston MRO fatigue management program) the ATSB was unable to fully ascertain the extent of the LAME’s level of fatigue and how it may have affected their performance.

Aircraft maintenance engineer

The aircraft maintenance engineer (AME) joined Heston MRO 3 weeks prior to the occurrence and had a total of 2 weeks line experience with the company. The AME had completed a partial induction program, and training that included coordination/headset duties. Prior to joining Heston MRO, the AME had experience working on defence and civilian aircraft (not including the Airbus A350) conducting heavy maintenance. Some turnaround functions were conducted for a period of 6 months, although this was 2 years prior to the occurrence. 

An internal Heston MRO report post-occurrence identified that, while the AME had completed a partial induction program and other training, they should not have been undertaking tasks unsupervised. 

The AME reported that, on the day of the occurrence, they had just returned from 2 days off, were alert and well rested.

Pitot probes and covers

Pitot probes

Pitot probes (or part of the multi-function probes) are components of the aircraft’s pitot-static system. The Airbus A350 has 4 probes, which are attached to the nose of the aircraft (Figure 4). The pitot probe consists of a tube pointing directly into the airflow, measuring the stagnation pressure called total pressure. This total pressure information and the static pressure delivered by static ports on the fuselage are used to compute the aircraft’s indicated airspeed and Mach number. If the tube is partially or completely blocked, airspeed indications will be inaccurate. Airspeed is a critical parameter for flight.

Figure 4: Airbus A350 aircraft showing left side probes with covers fitted 

Source: Airbus

Contamination by mud wasps at Brisbane Airport 

Historically, mud wasps have been known to build nests in aircraft pitot probes, entering through the forward-facing opening. Nesting and food material placed in the tube blocks the probe, to the point where it may no longer provide accurate airspeed information. A partial blockage, such as that resulting from the first addition of mud for a nest in the pitot, may be enough to cause anomalous airspeed readings as air flow is disturbed.

The Civil Aviation Safety Authority airworthiness bulletin 02-052 (Issue 6) Wasp Nest Infestation – Alert, stated that the potential for pitot probe contamination may arise within 20 minutes of availability. There may not be external signs of the presence of a nest or partial nest within the probe, and there have been numerous occurrences at Brisbane Airport where pitot probes were blocked during turnarounds. For that reason, the Brisbane Airport Corporation recommended the use of pitot probe covers during turnarounds. 

Pitot probe covers

Pitot probe covers provide protection from foreign object obstruction when the aircraft is on the ground. The need for pitot probe covers is dependent on several factors, such as the duration the aircraft is on the ground, and local factors such as wildlife and weather. There may be a formal requirement by operators to fit pitot probe covers in these circumstances. As pitot probes are heated in-flight, maintainers need to wait 15-30 minutes for them to cool after landing before fitting covers (Airbus 2016). 

Pitot probe covers typically incorporate a ‘remove before flight’ warning streamer (also known as a flag or ribbon) intended to alert relevant personnel of its presence. Several characteristics contribute to the conspicuity of the streamer. Red streamers can provide effective contrast against a white fuselage in good light but may not be as attention-attracting in poor lighting such as night, especially when they are dirty. Reflective materials may be helpful at night. 

Another factor is length. Streamers come in various lengths, but its visibility may be improved by fitting an extended streamer or incorporating a lanyard between the cover and its streamer. Shorter streamers are less likely to draw a person’s attention when in their visual field even if they are not paying particular attention to that area. A longer streamer, or one with a lanyard, is more likely to move if wind is present. However, it has been reported that the greater force on longer streamers in strong winds can occasionally drag the covers off. 

Figure 5 shows standard pitot probe covers fitted to the lower probes of an Airbus A350, which were estimated to be about 3 m above eye level. The Heston MRO internal report into this occurrence noted that:

The Pitot Cover streamers used at the station were short. They are not long enough to bring about attention to passers-by below the aircraft – refer photos [attached as Figure 5].

Figure 5: Airbus A350 aircraft showing lower pitot probe covers fitted

Source: Heston MRO, annotated by the ATSB

Pitot cover installation and removal procedures

Heston MRO and Singapore Airlines had a procedure for the installation and removal of the pitot covers at Brisbane Airport, which is summarised as follows:

• During the arrival procedures and after a short period of pitot cool down time, all pitot covers will be fitted.
• A warning placard will be placed on the flight deck pedestal stating that the pitot covers are fitted (Figure 6).
• An entry will be made in the aircraft technical log stating that the pitot covers have been fitted.
• The pitot covers are to be removed no earlier than 30 minutes prior to departure or as directed by the customer (Singapore Airlines is 20 minutes prior to departure).
• Following pitot cover removal, the entry in the aircraft technical log can then be closed and the placard removed from the flight deck and returned to the transit toolbox in accordance with Heston MRO’s transit toolbox procedure (below). 

Figure 6: Flight deck warning placard 

Source: Heston MRO

A review of the closed-circuit television (CCTV) footage for several Singapore Airlines turn arounds showed that the pitot covers were removed, on average about 30 minutes prior to departure, with the latest removal (other than the occurrence turnaround) being 15 minutes prior.

On the day of the occurrence, the LAME had placed the warning placard in the flight deck when the pitot covers were fitted. About 10 minutes prior to departure, CCTV footage showed that the LAME re-entered the aircraft. The LAME removed the warning placard and closed out the entry in the technical log. The CCTV footage also showed that, after leaving the aircraft, the LAME placed the placard on the dashboard of their vehicle rather than the tool control container. 

The LAME stated that they had not verified that the pitot covers were removed or requested that the AME remove the covers. However, when the LAME closed out the technical log entry, they had assumed the AME had removed the covers by that time. The AME reported that they had previously been told by another LAME that they should not remove the pitot covers without being instructed to do so and therefore had not removed them. 

Transit toolbox procedure

Heston MRO had a documented tool control procedure, which required maintenance personnel to:

• record the removal of company tooling from its storage location, and
• account for all tooling prior to certifying an aircraft for release to service and at the end of a shift.

It was the responsibility of the regional manager to review the movement of tooling and if any tooling was not returned to its storage location at the end of a shift it was to be recorded in a shift handover diary.

Heston MRO supplied basic tooling specific to aircraft turnarounds in a transit toolbox. This included a headset to communicate with the flight crew, marshalling wands, and a steering bypass pin[4] specific to an aircraft type. Additional items such as pitot probe covers and remove before flight placards could be added to the transit toolbox as required. The relevant procedure required the toolbox removal from its storage location be recorded, and for its return to be recorded along with a condition check of the items it contained. At the time of the occurrence, there was no requirement to check the toolbox for its contents (including pitot covers) before an aircraft was dispatched. 

General tool control procedure

Heston MRO had a general tool control procedure in its operational procedures manual titled Maintenance Certifications and Certificate for Release to Service, which stated:

A certificate for release [CRS] to service will only be issued after all tooling and equipment used in the maintenance event has been accounted for and removed from the aircraft. The certifier is to ensure that the aircraft has been returned to its original airworthy state before issuing the CRS.

Turnaround inspection procedures

Introduction

There were 4 walk-around inspections required between the aircraft’s arrival and its dispatch. These were the:

• post arrival walk-around inspection conducted by maintenance personnel (sometimes incorporated into the transit check)
• external component of the transit check conducted by maintenance personnel
• external component of the pre-flight inspection conducted by one of the flight crew
• final walk-around inspection conducted by maintenance personnel (sometimes included as the final component of the transit check). 

Post arrival check

The purpose of this inspection is to identify if there are any defects on the aircraft before or during the flight rather than during the post-flight ground handling functions.  

Transit check

Singapore Airlines’ procedures dictated that the aircraft undergo a transit check (a type of engineering general inspection) while in Brisbane. This required certification in the technical log when completed.

The transit check procedure began with tasks mainly related to verifying the aircraft’s airworthiness, and later tasks were primarily concerned with verifying the aircraft’s general condition (that no damage had been incurred during the turnaround) and readiness for flight. The final components of that inspection included the below.

Following the aircraft refuelling, the transit check takes on a preparation for flight aspect to ensure that the aircraft is correctly configured for flight. The inspection titled Final included:

• Remove the protective covers from the aircraft (if installed).

• Record the Transit Check in the aircraft technical log. Make sure an authorized person releases the aircraft [This is the point where the LAME certifies that the transit check has been conducted].

• Ensure Technical Log, Cabin Defect Log, IFE Defect Log, all Deferred Defect Logs, Refuelling Log, Notes To Pilots and Engineers (NPE) and Maintenance Work Sheets are reviewed and completed as necessary. Ensure spare logs stowed on board [This is the point where the LAME certifies for the pitot cover removal].

• Perform final aircraft walk-around:

     ◦ Make sure that all crew doors, cargo compartment doors and service panel doors are correctly closed and secured.

     ◦ Make sure that no damage has been caused by ground equipment, during loading and/or servicing.
…

Flight crew pre-flight inspection 

Singapore Airlines’ procedures stipulated that flight crew must conduct an exterior aircraft inspection (walk-around) about 30 minutes prior to departure. The procedure required that, during the walk-around, flight crew focus on safety critical areas of the aircraft to ensure:

…the general condition of the aircraft is satisfactory and that the visible aircraft components and equipment are safe for the flight… 

Maintenance personnel usually inspect the aircraft before the flight. In the absence of maintenance personnel, a flight crewmember performs this walkaround before the flight. Items marked by (*) must be performed again by a flight crewmember before the flight.

The procedure required the extremities of the wings, airframe, and tail section to be inspected. Figure 7 shows the path that flight crew should take when conducting the pre-flight walk-around inspection. The numbers represent pause points to inspect a particular section of the aircraft, and each are associated with certain check items. One of the items to be checked was the condition of the pitot probes. As per the procedure, some of the items did not require checking if they were already inspected by maintenance personnel. However, the inspection path to be followed remained the same. 

Figure 7: Schematic showing pre-flight walk-around path in blue with pause inspection points numbered

Source: Singapore Airlines

Maintenance final inspection 

A final walk-around inspection of the aircraft was required by Singapore Airlines and Heston MRO procedures. The final walk-around was the responsibility of the headset/turnaround coordinator (the AME) or the turnaround supervisor (the LAME) after all the passenger and cargo doors were closed. It can be combined as part of the final transit check inspection, which was certified by the LAME. The final walk-around inspection was the last opportunity to ensure:

• there were no aircraft defects or damage
• foreign objects were not located near, in or on the aircraft
• doors and panels were secure
• all covers and pins were removed.

There was also a reference to check for pitot cover removal in the Heston MRO departure procedures for Brisbane Airport, and the training and testing documentation for dispatching an aircraft.

The AME reported that they completed the final walk-around inspection. However, a review of CCTV footage showed that, while the AME had removed the aircraft chocks, they did not complete the inspection as per the procedure. Likewise, the LAME was not observed conducting the inspection.

Review of other walk-around inspections

A review of the CCTV footage of 5 Singapore Airlines turnarounds at Brisbane Airport around the time of the occurrence showed that none of the pre-flight inspections conducted by flight crew (including the occurrence flight) followed the complete path in accordance with the above procedure. As per Table 1, some of the inspections were substantially truncated and conducted with reduced diligence. For the final engineering walk-around, the day of the occurrence was the only time observed where the inspection was not conducted by maintenance personnel.

Table 1: CCTV footage assessment for flight crew pre-flight inspections and final engineering walk-around

Fatigue management 

Heston MRO fatigue management program

The Heston MRO safety management system included a section on fatigue management, which stated that:

The Fatigue Management program aims to identify and assess fatigue related risks and issues within the workplace and aid in the implementation of process and procedure to manage and control fatigue.

The Fatigue Management program applies to all HESTON MRO staff and specialist maintenance providers. Fatigue is generally associated with tiredness after work or effort, either physical or mental. 

Symptoms of fatigue include weakness, stress, depression, health problems and the tendency to make mistakes or errors. 

Excessive hours of work, poor planning, insufficient staff, bad shift scheduling and a work environment without proper control of temperature, humidity or noise are all known to contribute to fatigue.

The Heston MRO process for the management of fatigue was divided into key areas such as:

• roster design
• hours of work
• detection and monitoring fatigue in the workplace
• identification of fatigue risks and control measures
• fatigue risks strategies
• fatigue investigation
• training.

Heston MRO utilised a web-based program to manage maximum hours per period worked and the maximum hours per day worked through the establishment of rostered cyclic rules. The rules for the design of rosters included: 

• no planned shift to exceed 12 hours
• no actual (worked) shift to extend beyond 14 hours unless a risk assessment had been performed
• the hours of planned work are based on 38 hours per week, 76 hours per fortnight and/or 152 hours per month
• shift start times to move forward from one day to the next, that is, early starts and then progress through to starting in afternoons
• a requirement for a 10-hour minimum stand-down period between shifts. 

The requirements above were incorporated into the design of rosters with the aim of an equal distribution of work hours among employees and the tracking of hours worked for fatigue management purposes. 

Heston MRO management responsibilities and accountabilities

In accordance with the Heston MRO fatigue management program, the person in the role of regional manager was responsible for ensuring:

• All employees were provided with rostered shifts within the fatigue risk management guidelines.
• Employees were aware of the fatigue management procedures and familiar with their responsibilities and accountabilities. In addition, if an employee was required to work beyond the fatigue management guidelines an appropriate risk assessment was performed, with mitigation strategies implemented.
• That the hours of work were monitored to include overtime, shift allocation and shift changes with the aim of preventing unacceptable levels of fatigue accrual.
• Where there was an operational need to extend shift hours or alter personnel shift patterns, the regional manager was required to perform a risk assessment, implement mitigating strategies in consultation with the human resources manager. The human resources manager provided oversight governance to ensure compliance with legislative requirements.

Noting that the LAME/regional manager was conducting dual roles, the ATSB asked Heston MRO if their total work hours were monitored in accordance with the fatigue management policy. They stated:

[The LAME] is hired as and has the position of [Regional] Manager. As the manager, [the LAME] is required to manage the fatigue levels of all [their] subordinates, and this includes [themselves].

[They] do not sign in/out of work and there is no time monitoring. 

[They] are asked regularly about ensuring [they] are receiving sufficient rest – and if [they] are not – to ensure that [they] gets some.

The ATSB further asked if other personnel had dual roles and if all their hours were tracked for fatigue monitoring purposes. Heston MRO indicated that, at the time of the occurrence they had a total of 4 employees who had dual management and aircraft operational roles whose total hours were not monitored for fatigue management purposes. However, all other LAMEs and AMEs not undertaking dual roles had their hours tracked.

During the week of the incident, the LAME/regional manager conducted 2 shifts amounting to about 17 hours on the same day to cover for a LAME who was absent from work. While the LAME/regional manager notified the Quality and Safety manager about the extra shift, a risk assessment was not conducted as per the company’s fatigue management program. 

ATSB SafetyWatch - Fatigue management

The SafetyWatch is a set of broad safety concerns that the ATSB has identified through investigation findings and from occurrence data reported by industry. At the time of this report, the ATSB had identified fatigue management as a safety concern and stated: 

Despite increased awareness across the transport sector, fatigue remains one of the most relevant ongoing concerns for safe transport. Fatigue impairment has been identified as a contributory factor in numerous aviation, maritime and rail accidents. 

Human fatigue is a condition primarily caused by inadequate or bad sleep, or by staying awake for too long. Things like underlying health conditions, medication, and stress can amplify the likelihood and effects of fatigue. 

Fatigue can have a range of adverse effects on human performance, including: 

• decreased short-term memory 

• slowed reaction time 

• decreased work efficiency 

• reduced motivational drive 

• increased variability in work performance 

• increased errors of omission 

• increased risk tolerance. 

These symptoms can occur before an individual experiences the “feeling” of fatigue. 

Related occurrence

ATSB investigation (AO-2018-053)

On 18 July 2018, a Malaysia Airlines Airbus A330, registered 9M-MTK, took off on a regular public transport flight from Brisbane, Queensland to Kuala Lumpur, Malaysia. As the covers had been left on the aircraft’s 3 pitot probe’s, the instruments showed a red speed flag in place of the airspeed indication from early in the take‑off, and unrealistically low airspeeds afterwards. The flight crew did not respond to the speed flags until the aircraft’s speed was too high for a safe rejection of the take-off, and the take‑off was continued.

The ATSB investigation subsequently identified safety factors across a range of subjects including flight deck and ground operations, aircraft warning systems, air traffic control, aerodrome charts, and risk and change management. The report safety message stated:

The loss of airspeed data due to mud wasp ingress can occur even after brief periods, and the use of pitot probe covers for aircraft turnarounds at Brisbane is largely an effective defence. However, it introduces another risk, which is the potential for aircraft to commence a take-off with pitot probe covers still fitted…

For all individuals working in the aviation industry, the occurrence shows that coordination and diligence can make a difference. Several individuals on the night—as well as their counterparts on other occasions—all acted as though the conduct of various external aircraft inspections was someone else’s responsibility; in fact, all had separate, key roles in detecting problems with the aircraft before departure. Had all such inspections been conducted diligently it is very likely that the pitot probe covers would have been seen and subsequently removed…

As a result of the investigation, a safety issue for Aircraft Maintenance Services Australia (rebranded to Heston MRO in 2019) was identified: 

Aircraft Maintenance Services Australia did not have a reliable method to account for tooling and equipment (such as pitot probe covers) prior to aircraft dispatch when providing non-certifying engineering support.

In February 2022, in response to the safety issue, Heston MRO advised that it had implemented a procedure for all toolboxes taken to aircraft. Based on the below, the ATSB closed this safety issue. The procedure required that:

All toolboxes (including the transit toolboxes) will carry a notebook inside the box.

The above notebook will have the below drawn table.

An audit of the contents of the toolbox will be carried out and signed for prior to the use of any of the contents from the toolbox.

After all work on the aircraft and prior to pushback – the contents of the toolbox will be re-audited and signed for to ensure all contents have been returned to the box.

It should be noted that, at the time of this occurrence in May 2022, the procedure described above was not utilised or implemented as advised.

In addition to the above, the ATSB’s investigation also identified the following findings regarding the conspicuity of the pitot probe covers and inspections:

Although suitable for use in most situations, the streamers attached to the pitot probe covers supplied and used for A330 operations by Aircraft Maintenance Services Australia provided limited conspicuity due to their overall length, position above eye height, and limited movement in wind. This reduced the likelihood of incidental detection of the covers, which is important during turnarounds.

Malaysia Airlines flight crew and engineers did not fully complete the required aircraft inspections.

The Malaysia Airlines engineer did not perform a final walk-around inspection of the aircraft, including a check for pitot probe covers, as required by the transit check that the engineer had certified as complete. The engineer assumed that the walk-around would be completed by the support engineer and/or ground handlers.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.  Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.  The initial public version of these safety issues and actions are provided separately on the ATSB website, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website as further information about safety action comes to hand.

Tool control issues

Safety issue number: AO-2022-032-SI-01

Safety issue description: Heston MRO had not yet implemented a previously proposed and accepted method to account for tooling and equipment (such as pitot probe covers) prior to aircraft pushback. 

Fatigue levels not monitored 

Safety issue number: AO-2022-032-SI-02

Safety issue description: Heston MRO did not track the work-related hours of personnel with dual management and operational roles (including the licenced aircraft maintenance engineer) for fatigue calculation purposes. Therefore, there was an increased risk of a fatigue related incident involving those personnel.

Ineffective pre-flight inspections

Safety issue number: AO-2022-032-SI-03

Safety issue description: The majority of Singapore Airlines flight crews (observed around the time of the incident) did not fully complete the required pre-flight walk-around inspections. 

Pitot probe cover streamers

Safety issue number: AO-2022-032-SI-04

Safety issue description: Although suitable for use in most situations, the streamers attached to the pitot probe covers supplied and used for A350 operations by Heston MRO at Brisbane Airport provided limited conspicuity due to their overall length, position above eye height, and limited movement in wind. This reduced the likelihood of incidental detection of the covers, which is important during turnarounds. 

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.

Additional safety action Heston MRO

Heston MRO has advised the ATSB that they have implemented an additional procedure, which required the placement of a warning placard on the communications panel where the ground headset connects to (Figure 8).

Figure 8: Warning placard fitted to the ground communication panel

Source: Heston MRO

Glossary

 

AME	Aircraft maintenance engineer
CCTV	Closed-circuit television
LAME	Licenced aircraft maintenance engineer

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the aircraft refueller
• the licenced aircraft maintenance engineer
• the aircraft maintenance engineer
• Heston MRO
• Singapore Airlines
• Brisbane Airport Corporation
• Closed-circuit television footage. 

References

Airbus (2016) ‘Pitot probe performance covered on the ground’, Safety First, July, 22: 6–13.

McKee, S. P., & Nakayama, K. (1984). The detection of motion in the peripheral visual field. Vision Research, 24(1), 25–32.

Wickens, CD, Hollands, JG, Banbury, S and Parasuraman, R (2013) Engineering psychology and human performance, 4th Ed. Pearson, United States.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• aircraft refueller
• licenced aircraft maintenance engineer
• aircraft maintenance engineer
• Heston MRO
• Singapore Airlines
• Brisbane Airport Corporation
• Civil Aviation Safety Authority.

Submissions were received from:

• Heston MRO
• Singapore Airlines.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Findings

From the evidence available, the following findings are made with respect to the near grounding of Rosco Poplar off Bond Reef, Hydrographers Passage, Queensland on 4 May 2022. 

Contributing factors

• Rosco Poplar’s GPS unit probably malfunctioned due to a fault with its antenna, resulting in erroneous ship’s position data. This incorrect data was then provided to all navigational aids, including both electronic chart display and information system (ECDIS) units, automatic identification system (AIS) and the pilot’s portable pilotage unit (PPU).
• The PPU had not been configured as required to source position data independent of the ship’s GPS unit.
• The pilot and the ship’s bridge team were relying solely on the PPU and ECDIS units to monitor the ship's progress. Consequently, they did not identify that the ship had deviated from the planned track until the GPS unit reset and began indicating the correct position, which was about 200 m from Bond Reef.
• The pilotage was not conducted appropriately, including effective track monitoring and proper bridge resource management, due to a combination of:
  • an inadequate master and pilot information exchange
  • roles and responsibilities not being properly defined
  • an absence of monitoring using visual bearings and radar, including parallel indexing
  • non-essential tasks for the pilotage phase that distracted the bridge team
  • the absence of a shared ‘mental model’ of the pilotage. 

Other factors that increased risk

• The configuration of Rosco Poplar's electronic navigation equipment was vulnerable to single GPS unit errors because, at any given time, only one of the ship’s 3 GPS units could be selected to provide positional data to all the ship's navigational equipment.
• Following receipt of an unusual grounding alert display associated with the Rosco Poplar’s GPS malfunction, the vessel traffic service operator assessed it as erroneous. Consequently, the pilot/ship’s crew were not provided with timely advice of the indicated proximity to Bond Reef. 

• The check pilot system was ineffective in providing the Australian Maritime Safety Authority (AMSA) assurance of the competency of coastal pilots, mainly due to the inconsistent and unreliable application of assessment standards between different check pilots. Further, AMSA had not implemented a system to identify the inconsistent application of standards or the trends in assessment outcomes readily apparent in the data that it had held for many years. (Safety issue)

Safety issues and actions

Check pilot system 

Safety issue number: MO-2022-005-SI-01

Safety issue description: The check pilot system was ineffective in providing the Australian Maritime Safety Authority (AMSA) assurance of the competency of coastal pilots, mainly due to the inconsistent and unreliable application of assessment standards between different check pilots. Further, AMSA had not implemented a system to identify the inconsistent application of standards or the trends in assessment outcomes readily apparent in the data that it had held for many years.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Australian Maritime Safety Authority takes safety action to identify and address factors limiting the effectiveness of its check pilot framework as a system for coastal pilot competency assurance.
 

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot of Rosco Poplar
• the master, second mate and able seaman on board Rosco Poplar
• records, documents, manuals, and logbooks from Rosco Poplar
• records, documents and manuals from Auriga
• Australian Maritime Safety Authority
• Maritime Safety Queensland
• Great Barrier Reef and Torres Strait Vessel Traffic Service
• Bernhard Schulte Shipmanagement China
• recorded information from Rosco Poplar’s voyage data recorder
• Japan Radio Company 

References

International Hydrographic Organization, 2018, Publication S-66, Facts about electronic charts and carriage requirements, Edition 1.1.0, IHO, Monaco. Available at https://iho.int/.

International Maritime Organization, 2006, Revised performance standards for electronic chart display and information systems (ECDIS), Resolution MSC.232 (82), IMO, London.

Australian Maritime Safety Authority, 2014, Marine Order 54 – Coastal pilotage, AMSA, Canberra.

Focus on Bridge Resource Management, Washington State Department of Ecology, 2007.

International Association of Marine Aids to Navigation and Lighthouse Authorities, January 2022, Guideline G1089; Provision of a VTS, Ed 2.0.

International Maritime Organisation, Recommendations on training and certification and on operational procedures for maritime pilots other than deep-sea pilots, Resolution A.960 (23).

International Maritime Organisation, The International Convention on Standards of Training, Certification and Watchkeeping for Seafarers 1978, as amended, IMO, London.

Australian Maritime Safety Authority, 2014, Marine Order 54 – Coastal pilotage, AMSA, Canberra.    

Alexander L, Casey M J 2008, Use of Portable Piloting Units by Maritime Pilots, Canadian Hydrographic Conference.

Civil Aviation Safety Authority, Advisory Circular AC 61-09 v1.0, Competency-based Training and Assessment for Flight Crew, April 2002.

Professional Standards Councils, Competency-based Frameworks and Assessment.

International Marine Pilots Association, Guidelines on the Design and Use of Portable Pilot Units, 2016. 

Australasian Marine Pilots Institute, PPU Code of Good Practice – For the Implementation and Use of Portable Piloting Units, 2nd Ed. 2020.

Australian Maritime Safety Authority, 2019, Marine Order 63 (Vessel reporting systems) 2019, AMSA, Canberra.

Australian Maritime Safety Authority, Pilot Advisory Notes 10/03 and 01/04, Check Pilots and Check Pilot Voyages.

Civil Aviation Safety Authority, Advisory Circular AC 61-09 v1.0, Competency-based Training and Assessment for Flight Crew, April 2002.

Flin R, Martin L 2001, Behavioural Markers for Crew Resource Management: A Review of Current Practice, The International Journal of Aviation Psychology, 11(1), 95–118.

Franks P, Hay S, Mavin T 2014, Can Competency-based Training Fly?: An Overview of Key Issues for Ab Initio Pilot Training, International Journal of Training Research 12(2): 132–147.

Weber D E, Mavin T J, Roth W M, Henriqson E, Dekker S W A (2014), Exploring the Use of Categories in the Assessment of Airline Pilots’ Performance as a Potential Source of Examiners’ Disagreement, Journal of Cognitive Engineering and Decision Making, 8(3), 248–264.

Weber D E, Roth W M, Mavin T, Dekker S W A 2013, Should we Pursue Inter-rater Reliability or Diversity? An Empirical Study of Pilot Performance Assessment, Aviation in Focus – Journal of Aeronautical Sciences, 4. 34-58.

Gontar J, Hoermann H J 2015, Inter-rater Reliability at the Top End: Measures of Pilots’ Non‑Technical Performance, The International Journal of Aviation Psychology, 25(3/4), 171-190.

Civil Aviation Safety Authority, CAAP SMS-3(1): Non-Technical Skills Training and Assessment for Regular Public Transport Operations.

Australasian Marine Pilots Institute, Code of Good Practice – Marine Pilot Competence and Performance, 2nd Ed. 2020.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• Australian Maritime Safety Authority
• Maritime Safety Queensland
• The pilot of Rosco Poplar
• Auriga
• the master, second mate and able seaman of Rosco Poplar
• Bernhard Schulte Shipmanagement China 

Submissions were received from:

• Australian Maritime Safety Authority
• Maritime Safety Queensland
• Auriga.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
 

Investigation summary

What happened

NSW TrainLink passenger service ST21 was running from Sydney, New South Wales, to Melbourne, Victoria, on the ARTC standard gauge interstate network. The service departed Sydney on the evening of 23 May 2022 and was approaching Melbourne the following morning, 24 May. 

A temporary speed restriction (TSR) had been applied on the standard gauge track at the Moonee Ponds Creek Bridge, about 24 km from Melbourne. The TSR was an interim safety measure in response to a rough ride report made by the driver of an earlier train. Trains were being warned of the speed restriction by radio call from train control through a procedure known as a condition affecting network (CAN) warning. The CAN issued for the TSR advised of a 40 km/h speed restriction between 24 km and 24.4 km. 

On the standard gauge route to Melbourne, track distances between 27 km and 16 km were repeated to accommodate a divergence of the standard gauge and broad gauge routes on the approach to Melbourne. For Melbourne-bound trains on the standard gauge route (such as ST21), track kilometres decreased down to 16 km before stepping back up to 27 km and then again reducing towards Melbourne. Moonee Ponds Creek Bridge was located about 3 km after this step change in track kilometrage.

ST21 received the CAN warning for the TSR. However, the train was slowed at the wrong location and crossed the Moonee Ponds Creek Bridge (the location of the TSR) at about 0703 travelling at between 100 km/h and 110 km/h. Soon after passing over the bridge, the driver recognised they may have slowed at the incorrect location and contacted ARTC train control.

What the ATSB found

The CAN warning issued to the driver of ST21 was ambiguous as it identified only the kilometrage without any further location description. The kilometrage of between 24.0 km and 24.4 km specified in the warning occurred twice on the path of train ST21, about 11 km apart. ST21 was slowed at the first 24.4 km location encountered and subsequently proceeded at high speed through the TSR location at the Moonee Ponds Creek Bridge.

The method of warning trains of a TSR was an administrative control which relied on the effective communication of information between train controllers and drivers, and its correct application. It was found that the administrative processes used by ARTC to warn train crew about temporary speed restrictions were vulnerable to errors in creation and communication. There were opportunities to improve existing processes and to adopt technology-supported solutions to reduce risk associated with the implementation of temporary speed restrictions.

What has been done as a result

ARTC has implemented an electronic system for generating CAN warnings that prompts train controllers to provide 2 types of location identification information. This is now the primary method ARTC uses for generating CAN warnings and should reduce the risks associated with missed information during creation of the warnings. ARTC also plans to upgrade the electronic system to enable digital transmission of CAN warnings to train crew. When implemented, this has the potential to reduce the risks associated with communication of warnings.

In addition, ARTC has undertaken several associated actions including the briefing of network controllers to raise awareness of kilometrage changes and the importance of including location information in CAN warnings. Briefings have been supported by the dissemination of updated information to controllers and other rail safety workers.

Safety message

In the Australian rail context, administrative processes have often been established for long periods of time while technology has improved. Opportunities exist for safety improvement in rail safeworking through the modernisation of administrative controls and adoption of technology-supported solutions.

The occurrence

Prior to the incident

On 23 May 2022, at about 2120 local time, the driver of a V/Line train experienced a rough ride at the Moonee Ponds Creek Bridge in the local government area of Merri-bek[1] in Victoria (Figure 1). This occurred while the train was travelling towards Melbourne on the Australian Rail Track Corporation (ARTC) interstate network. 

Figure 1: A NSW TrainLink XPT on the Moonee Ponds Creek Bridge

Source: Schony747

The driver reported the rough ride to the ARTC network control officer (NCO) responsible for the section of standard gauge track which included the Moonee Ponds Creek Bridge. This NCO controlled train movements between Somerton which was north of the bridge, and Melbourne to the south. 

In response to the report and following discussion with maintenance personnel, the NCO placed a temporary speed restriction (TSR) of 40 km/h on a section of track between 24.0 track km[2] and 24.4 track km covering the Moonee Ponds Creek Bridge. For Melbourne-bound trains, the TSR commenced at 24.4 km and continued until the train passed 24.0 km.

The TSR location was on the standard gauge track about 3 km south of a step change in track kilometres at the Jacana flyover (see Location information). The step change was due to the longer route of the standard gauge line to Melbourne after it diverged from the broad gauge line at the flyover. This step change resulted in there being two 24.4 km locations about 11 km apart, one either side of the change at the flyover (Figure 2).

Figure 2: A schematic of the railway routes around the Jacana flyover

The schematic shows the kilometre change at Jacana flyover, the northern and southern 24.4 km locations and the northern limit of the NCO’s area of control. It is not drawn to scale. Source: Office of the Chief Investigator (OCI)

Journey of passenger train ST21

ST21 was a scheduled XPT passenger train service, operated by NSW Trains trading as NSW TrainLink,[3] from Sydney, New South Wales, to Melbourne in Victoria. It travelled from Sydney to Junee in southern New South Wales without incident, arriving at about 0228 on 24 May. At Junee, there was a driver change and the incoming driver was tasked to complete the journey to Melbourne. ST21 departed Junee soon after and crossed into Victoria about 2 hours later, continuing its journey to Melbourne.

At about 0605, while passing Seymour, the driver of ST21 was contacted on the railway network radio by the NCO responsible for the Somerton to Melbourne section. This was not the same NCO who had initially received the rough ride report as a shift change had occurred. This second NCO advised that they needed to provide the driver with a condition affecting network (CAN) warning for a location between Somerton and Tullamarine.[4] The driver replied that their train was currently a long way away from there and they would contact the NCO when the train was closer (Figure 3).

Figure 3: Map of train ST21’s route 

The map shows the Donnybrook to Melbourne section with the full journey from Sydney inset. It is not drawn to scale. Source: Digital Atlas of Australia, annotated by OCI

Subsequently at 0641, the driver stopped ST21 at Donnybrook (at about 38 km) and called the NCO to receive the CAN warning. The NCO issued the CAN warning to the driver, informing them that there was a 40 km/h TSR in place between 24.0 km and 24.4 km. This exchange involved the driver of ST21 transcribing the verbal advice received from the NCO onto their CAN form and reading it back. Descriptive location information, such as the applicable line section, or that the TSR was on a bridge was not discussed during this exchange.

After the radio exchange, ST21 resumed its travel towards Melbourne. The driver recalled that they placed their copy of the CAN warning form onto the driving console and began monitoring the kilometre markings that the train passed, comparing them to the kilometrage for the TSR location on the form. They recalled that they saw the 26 km post and prepared to slow their train.

At about 0653 the driver reduced the train’s speed to just under 40 km/h as ST21 approached the 24.4 km location north of the Jacana flyover. This reduced speed was maintained until, after passing 24.0 km, the speed of the train was increased to resume normal speed running.

ST21 continued its journey, passed Somerton and made a scheduled stop at Broadmeadows. It departed Broadmeadows with about 50 passengers on board and proceeded over the Jacana flyover, where the standard gauge track kilometres changed, resetting to 27 km.

ST21 overspeed

At about 0703, ST21 approached 24.4 km near the Moonee Ponds Creek Bridge (south of the Jacana flyover). The driver recalled seeing 2 track workers as the train approached the bridge. In response the driver sounded the horn to warn them of the train’s approach. The workers acknowledged the horn with an ‘all clear’ hand signal and the train proceeded across the bridge. The train’s speed was not reduced, and it went through the TSR location at between 100 km/h and 110 km/h. The driver recalled the transit felt rougher than usual.

Soon after, the driver sighted the 21 km post.[5] They recalled that this prompted them to consider their location, the rough ride, and the workers at the bridge. They realised that the CAN warning may have been for the section of track across the Moonee Ponds Creek Bridge, rather than the location where they had reduced speed earlier.

At about 0705 the driver called the NCO responsible for the section to clarify where the CAN warning applied and reported that they had reduced speed at the other 24.4 km location. This was a third NCO as another shift change had occurred.

The train continued and arrived at its destination, Southern Cross Station in Melbourne, at 0831. The CAN warning was cancelled at about 0836 by the duty NCO. This was done in response to a track work group reporting that they had found and repaired a track geometry issue associated with the rough ride report. No further trains passed over the location after ST21 while the CAN warning was in effect.

Context

Location information

Overview

The standard gauge route between Sydney and Melbourne is part of the interstate rail network managed by the Australian Rail Track Corporation (ARTC). For much of its length in Victoria, it runs parallel to (and east of) a broad gauge route that is used by both the Melbourne metropolitan network (to Craigieburn) and the Victorian regional network (to Seymour). However, when approaching Melbourne from the north, the standard gauge track took a more circuitous route to the south‑west that was 11 km longer than the broad gauge route (Figure 3).

North of the Jacana flyover, the same track kilometrage was used for the parallel broad gauge and standard gauge tracks. The kilometres on these parallel routes were based on the distance to Melbourne travelling on the broad gauge route. An adjustment was required on the standard gauge track to accommodate its longer route to Melbourne. This adjustment was made at the Jacana flyover at which point kilometrage changed from 16 km back up to 27 km in the direction of travel of ST21 towards Melbourne (Figure 4).

Figure 4: Kilometre change notification on the standard gauge track at Jacana flyover

The figure shows the standard gauge track a short distance after it had passed over the broad gauge tracks at the Jacana flyover. The signage indicates a change (from 16 km) to 27 km and then kilometrage decreasing towards Melbourne. Source: OCI

Location of the TSR

The Moonee Ponds Creek Bridge was a heritage listed steel trestle bridge which was first constructed in the 1920s. It carried a standard gauge track and a dual gauge track which formed part of the Tullamarine crossing loop. The dual gauge track was not used by either the V/Line train that reported the rough ride or ST21. 

The 40 km/h temporary speed restriction between 24.0 and 24.4 km encompassed the full length of the bridge (Figure 5). The normal speed for the standard gauge track in this location was 115 km/h. In the direction of travel of ST21, immediately prior to the bridge was a curve with a 95 km/h speed limit.

Figure 5: The location of the TSR at the Moonee Ponds Creek Bridge

Source: OCI

Network control

Sections of control

Train movements on the standard gauge route from Sydney to Melbourne were controlled by ARTC. The route was comprised of several sections with a network control officer (NCO) designated to each section. Within Victoria, there were 2 sections of control: 

• The section between Albury (New South Wales) and Somerton (Victoria). This section of control was referred to as ‘Main South C’ and was controlled by NCO located in Junee in New South Wales.
• The section between Somerton and Southern Cross Station (Melbourne). This was grouped with some other related sections that were together referred to as ‘Melbourne’. The group was controlled by NCO based at Mile End in South Australia.

The changeover between these 2 sections of control occurred at Somerton signal SOM 4, about 6 km north of the Jacana flyover. 

Safeworking

Rail safeworking describes the system of operating rules and procedures used to provide safe operation of rail traffic and protection of people and property. ARTC operating rules for Victoria were defined in the ARTC Code of Practice for the Victorian main line operations (CoP).[6]

Section 1 of the CoP included rules related to reporting and responding to a condition affecting network (CAN). This included the need for:

• train drivers and track workers to report ‘conditions that can or do affect the safety of rail operations’ to the responsible NCO
• NCO’s to ‘give written warning to rail traffic crews using a CAN form’ in circumstances where ‘temporary speed restrictions have been reported and no signs erected’. 

The CoP contained rules and procedures relating to the use of the CAN form and an example of the blank form. 

ARTC also published a procedure relating to temporary speed restriction (TSR).[7] The procedure described that when train drivers reported a fault, the NCO was to notify a maintainer. The maintainer was to determine the appropriate response including the speed of any required TSR and the time required for implementing speed warning signs and inspection.

Rough ride report

Train drivers could report a rough ride to the relevant NCO when they considered that the dynamic response of their train to the geometry of the track had been excessive. It was sometimes also described as a ‘rough track’. On the evening prior to the occurrence the driver of a V/Line train had experienced a rough ride. They reported to the NCO that this occurred ‘at the approach to the bridge at 24.2’. The NCO asked for and received clarification from the driver that the location was at the Moonee Ponds Creek Bridge.

In response, the NCO contacted the track inspector for this track section (the maintainer) and informed them of the reported rough ride at the Moonee Ponds Creek Bridge. The track inspector recommended that a 40 km/h TSR be applied between 24.0 km and 24.4 km until the track could be inspected. The NCO recorded the location of the TSR on the train control graph.[8]

Condition affecting network (CAN) warning 

The NCO prepared a CAN warning, to be issued to the drivers of trains that would pass through the location while the TSR was in place. The ARTC CoP required the CAN warning, as a TSR had been placed with no other method (such as signage) implemented to warn train drivers of the speed restriction. 

The blank CAN warning form[9] included spaces in the relevant section for the NCO to enter the speed and location limits of the TSR. Within the spaces for the location limits was light grey text that read ‘location and km’ (Figure 6). There was no further instruction that described how to fill out this section of the form or supported the need to provide 2 methods of identifying locations (location and kilometres).

Figure 6: Extract from a blank CAN warning form with boxes for specifying TSR limits

This CAN form extract shows the space provided for specifying TSR limits and some instruction on the required content in light grey text. Source: ARTC, annotated by OCI

The detail recorded by the NCO on the form was ‘40 km/h between km 24.000 and km 24.400’ (Figure 7). No other location information was included. The NCO had noted ‘no signs erected’ in section 5, to identify to drivers receiving the warning that speed warning boards were not present. 

Figure 7: Sections 4 and 5 of the CAN warning form, as prepared by the NCO 

Source: ARTC

Issue of CAN warning

The NCO who prepared the CAN warning form did not issue it to any train drivers as there were no rail movements through the location before the end of their shift. The NCO who replaced them on the following shift issued the CAN warning to 6 train drivers, the last being the driver of train ST21. A third NCO, on the subsequent shift, issued the CAN warning to a single train driver before cancelling the warning following advice from track workers that a track issue related to the rough ride report had been repaired.

In all cases, the CAN warning was issued to train drivers by voice communication over network radio. Recordings of the network radio communication indicated that the NCO who issued the CAN multiple times followed a pattern. On 4 of 6 occasions,[10] including for ST21, they first contacted the train to inform them that a CAN warning was required for ‘Somerton to Tullamarine’. The CAN warning was then issued in a separate radio call. For ST21, the time between radio calls was long, about 36 minutes. However, for the 3 other trains, the time between the first contact and issuing the CAN warning was short, ranging from less than 1 minute to about 6 minutes. 

Each time the NCO issued the CAN warning they read the contents of the form to the train driver. The driver transcribed it onto their own copy of the form and read it back to the NCO. The NCO then either confirmed that the readback was correct or appropriate corrections were made. Location information was not discussed during the issue of any of the CAN warnings other than the as written limits ‘between km 24.000 and km 24.400’.

Recorded information

Event recorder

The XPT train used Hasler RT data recorders fitted to the leading and trailing power cars. The tape from the leading power car (XP2003) showed the train speed from when the driver stopped the train to receive the CAN warning, at Donnybrook, until after it passed the location where the TSR was applied (Figure 8).

Figure 8: The tape recording from XP2003 showing train speed

This figure shows the approximate train speed after departing Donnybrook. The location where the train slowed to below 40 km/h (the northern location) is shown in blue, and the location of the TSR (the southern location) is shown in orange. Source: NSW Trains, annotated by OCI

ST21 slowed at the first 24.4 km location encountered (the northern location). After travelling over the Jacana flyover where the kilometrage reset to 27 km, it then passed the southern 24.4 km location, where the TSR started, travelling at between 100 km/h and 110 km/h. This was below the normal 115 km/h speed limit and consistent with ST21 accelerating out of a preceding curve that had a 95 km/h speed limit.

ICE radio GPS speed

All trains operating on the ARTC network were required to be fitted with an In-Cab Communication Equipment (ICE) digital train radio system. ICE was specifically designed for the rail industry and integrates both voice and electronic (data) transmission and a GPS unit. The equipment on board the trains broadcast position and speed information, which was received and recorded by ARTC. Although the GPS recording frequency and precision were low, it provided an estimate of train speed. 

Five other trains (all freight) were issued the CAN warning and passed over the rough ride location while the TSR was active and before ST21. The GPS recordings from these trains showed 3 had slowed to below 40 km/h while 2 exceeded this speed by substantial margins (Table 1).

Table 1: Estimated train speed

Track geometry

The vertical track geometry at the rough ride location was measured by track workers on the day of the occurrence. They recorded that a 25 mm vertical geometry irregularity was present when measured at the mid-point of a 6 m chord. When compared to ARTC’s defect limits,[11] this irregularity was a defect requiring maintenance. ARTC reported that it was subsequently repaired by hand tamping, a process of lifting the track and packing ballast under the sleeper to support it.

Track geometry was also regularly measured by the track recording vehicle (the AK car). The most recent measurement was on 4 April 2022, about 7 weeks prior to the occurrence. ARTC’s exceedance report for this measurement did not include a geometry defect at or near the rough ride location.

Electronic transmission of TSR

ARTC’s code of practice permitted CAN warnings to be issued ‘using electronic transmission’. However, this was not an implemented method on ARTC track in Victoria at the time of the occurrence. Instead, the NCO provided the warning to the driver of ST21 by dictation and readback of a written CAN warning form using radio voice communication.

The standard radio installed on trains on the ARTC network was the ICE radio which was capable of providing both voice and electronic (data) to train drivers. The electronic transmission capability of the ICE radio system could transmit safeworking information, including notification of TSR locations. If electronic transmission was used, the information could be provided to drivers to read and respond to on an in-cab display. As the system monitored train locations by GPS, it could also provide an alert to drivers when their train was approaching a location with a TSR applied.

At the time of the incident, another Australian railway was using the ICE radio electronic transmission capability as part of its safeworking system (Hjort 2015). The system, as implemented, provided an alert to train drivers when they were approaching a TSR location. 

Repeated track kilometres

The ARTC standard gauge network in Victoria contained at least 6 other locations where there was a step change in kilometrage at a fixed location. None occurred for the same reason as the change at Jacana flyover (alignment with a parallel track). However, at least 2 locations (at Pyrenees and Newport) created the realistic possibility of ambiguous location identification. This was because repeated kilometrage was separated by moderate distances.[12]

Some other railways have adopted kilometre identification processes that addressed this type of ambiguity. For example, a freight railway in the Pilbara region of West Australia used a prefix on kilometre markings that avoided duplication (Figure 9).

Figure 9: An example location marked using the ‘C’ prefix on an Australian railway  

Source: Monash Institute of Railway Technology

On the Pilbara network, 2 parallel tracks deviated from each other and took different routes (with different path lengths) before realigning. There was a step change in track kilometres on the longer route when the tracks realigned that resulted in repeated kilometrage. Ambiguity was avoided as the kilometres on the longer route within the deviation were described with a ‘C’ prefix. The second instance of the same kilometres that occurred after tracks realigned were described without a prefix.

Studies and other occurrences

RAIB Safety digest: South Wales overspeeds

In 2025 the British Rail Accident Investigation Branch (RAIB) published a report into overspeed occurrences during blanket speed restrictions (RAIB Safety digest 03/2025). The report emphasised the importance of robust and effective processes for delivery of safety-critical messages about speed restrictions. Additionally, it encouraged the use of available technology (such as automatic radio broadcasts) to reinforce existing processes.

ATSB Safety study: Safe work on track 

In 2017, the ATSB published the results of a safety issue investigation into reported notifiable occurrences while maintenance work was being performed on or near railway tracks (ATSB investigation RI-2014-011). 

The study considered occurrences over a 5-year period between July 2009 and June 2014. It found that incorrect identification of worksite location (either position or limits) was one of the highest occurrence categories in terms of risk exposure to track workers. More than 50% of the occurrences in this category were assessed as having increased or high-risk exposure. 

Although the study was related to work on track rather than train running, it quantified the risk associated with incorrectly identifying and communicating locations in systems of safeworking.

Relevant occurrences

Wallan derailment February 2020

In February 2020 near Wallan in Victoria, train ST23 proceeded through a turnout with a 15 km/h speed limit at high speed and derailed (ATSB investigation RO-2020-002). The investigation identified that the driver probably expected to remain on the straight track through Wallan (which was not speed restricted), rather than be routed through the loop at a restricted speed. Information on the routing of ST23 through Wallan Loop was provided to the driver in a paper document. The investigation highlighted an over‑reliance on administrative controls and the missed opportunities to use existing and emerging technologies to manage risk associated with human error.

TSR location errors in June 2023

On 8 June 2023, ARTC reported 2 occurrences[13] of incorrect location information being given to train crews on CAN warnings. They occurred in the context of a high workload for the NCO following track geometry measurements which required TSR’s at several locations at short notice.

In the first instance, at about 1100, a TSR was requested between 90.5 km and 90.7 km in the track section between Gheringhap and Inverleigh. However, the NCO recorded the location on the CAN warning form as between 95 km and 97 km. A train driver was issued the CAN warning and their train proceeded through the intended location of the TSR at normal speed before slowing at the location described on the CAN warning. 

About one hour later, another TSR was requested, this time between 161 km and 161.7 km, although no additional location description was provided to the NCO. The NCO recorded that this was within the Barwon Park to Wingeel Loop track section on the CAN form, however the kilometrage was not within this section. A train driver was issued the CAN warning and their train proceeded through the location of the geometry defect at normal speed. As the train approached Wingeel Loop the train driver realised that the kilometre and section descriptions given did not match and reported the issue. 

Safety analysis

Introduction

On 24 May 2022, the driver of train ST21 travelling from Sydney to Melbourne reported that they had unintentionally travelled over the Moonee Ponds Creek Bridge at high speed while a 40 km/h temporary speed restriction (TSR) was in place. 

This analysis discusses:

• the warning for the temporary speed restriction
• train driver response to the warning
• systems used for temporary speed restrictions
• reporting of speed exceedance.

The warning for the temporary speed restriction

The location of the required 40 km/h TSR was at the Moonee Ponds Creek Bridge. The first NCO established that this was the location in communication with the reporting V/Line train driver. The NCO also conveyed this to the track inspector who specified the kilometre limits of the TSR which encompassed the bridge.

A CAN warning was then prepared by the NCO with the limits of the speed restriction described as being between 24.000 km and 24.400 km. This was inconsistent with the CAN form design which indicated that the limits of the TSR should include both km and location information. It was probably not an uncommon practice to include kilometre limits only, and none of the drivers issued with the CAN warning questioned the absence of a location description.

However, the specified limits could apply to 2 locations for rail traffic, due to the step change in kilometrage that occurred at the Jacana flyover. These locations were about 11 km apart and both were on the path of train ST21 from the location where the driver received the warning.

Both the NCO who created the CAN warning and the NCO who issued the warning to ST21 controlled the ‘Melbourne’ area of the ARTC network. This area included the 24.4 km location south of the Jacana flyover. It did not include the other 24.4 km location north of Somerton. This probably contributed to a belief by both NCO’s that the kilometre limits alone adequately described the location.

Train driver response to the warning

The driver of ST21 described that, after receiving the CAN, they began monitoring the approaching kilometre posts. Around the 26 km post, they commenced slowing in anticipation of arriving at 24.4 km. The train’s event recorder indicated that it slowed to 40 km/h as it approached the first (northern) 24.4 km location. 

After observing the 24 km post, ST21 resumed normal speed. The driver believed that the CAN warning had been complied with and no longer actively monitored kilometre markings for the TSR location. Subsequently, they did not slow at the location of the TSR. Instead ST21 accelerated from 100 km/h to 110 km/h through the second (southern) 24.4 km to 24.0 km location. 

There was additional information available to the driver of ST21 relating to the location of the TSR. In a conversation about 36 minutes before receiving the CAN warning, the NCO advised the driver of the need to issue a warning for the section ‘Somerton to Tullamarine’. In addition, the communicating NCO was only responsible for the section south of Somerton which did not include the first (northern) 24.4 km location. It is unlikely that the driver considered the earlier conversation with the NCO or the NCO’s area of control when receiving and implementing the CAN warning.

Systems used for temporary speed restrictions

A CAN warning was the method used by ARTC to immediately slow rail traffic in response to the rough ride report. It was implemented until any potential risk associated with the rough ride report could be assessed and appropriately addressed. It was an administrative control which relied on the effective communication of information between NCOs and drivers, and the correct application of the information.

The hierarchy of controls is a commonly understood concept that describes the relative effectiveness of different types of risk controls. Administrative controls include work methods or procedures that are designed to minimise exposure to a hazard as well as the information, training and instruction needed to ensure workers can work safely (Safe Work Australia 2018). Administrative controls are recognised as having comparatively low effectiveness but are used when higher levels of control such as engineering controls or elimination are not available. They can be vulnerable to unintentional error including in implementation and communication. 

The vulnerability of administrative systems to unintentional error has been highlighted in research, other investigations and repeat events. A report into overspeed occurrences in the United Kingdom emphasised the importance of robust and effective processes for the delivery of safety-critical communication of speed restrictions. A further study showed that incorrect identification of location was one of the event categories that commonly exposed track workers to high safety risk. Occurrences on the ARTC network in June 2023 are further examples of the vulnerability of its administrative systems for applying TSR.

In this occurrence, the communicated location information was ambiguous. This was due to the presence of duplicated track kilometres in this area and the omission of other forms of location description. Opportunities to reduce the likelihood of ambiguity using existing controls included:

• the use of prefixes on duplicate kilometre markings to create distinction, as implemented by another Australian railway
• improvement in the CAN warning form design by creating separate fields for km and location, reducing the likelihood of omission
• greater clarity in work instructions to reinforce the requirement to describe location.

There was also opportunity to implement technology-supported solutions with the potential to reduce risk associated with the implementation of temporary speed restrictions. This included solutions utilising ICE radio (as fitted to all trains on the ARTC network). Another local network utilised ICE radio to alert drivers as they approached a TSR location. If well designed, such systems provide opportunities to reduce or eliminate many of the possible location‑related errors that may occur.[14]

Reporting of speed exceedance

The driver voluntarily reported the overspeed to train control immediately after becoming aware that it had occurred, as they were concerned that other trains may also overspeed through the TSR location. Their action, and the motivation for it, was representative of a commitment to safety.

Findings

From the evidence available, the following findings are made with respect to the exceedance of temporary speed restriction by XPT ST21 in Merri-bek, Victoria, on 24 May 2022.

Contributing factors

• The warning for the temporary speed restriction identified the location using kilometrage, without a location description. The specified kilometrage occurred twice along the path of train ST21, about 11 km apart.
• Train ST21 was slowed at the first 24.4 km location encountered and subsequently proceeded at high speed through the second 24.4 km location where the temporary speed restriction applied.

Other factors that increased risk

• The administrative controls used by ARTC to warn train crew about temporary speed restrictions were vulnerable to errors in creation and communication. There were opportunities to improve the effectiveness of existing controls and adopt technology-supported solutions. (Safety issue)

Other findings

• The driver of ST21 self-reported the overspeed to train control, promptly informing others of the risk.

Safety issues and actions

Implementing temporary speed restrictions

Safety issue number: RO-2022-005-SI-01  

Safety issue description: The administrative controls used by ARTC to warn train crew about temporary speed restrictions were vulnerable to errors in creation and communication. There were opportunities to improve the effectiveness of existing controls and adopt technology‑supported solutions. 

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• ARTC
• Driver of ST21
• Network Control Officer

References

Hjort, G., (2015). Implementation of electronic train order working on the NSW country regional network. AusRAIL 2015.

Safe Work Australia, (2018). Code of Practice – How to manage work health and safety risks.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to directly involved parties. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Rail safety investigations in Victoria  Rail safety investigations in Victoria are conducted by the Office of the Chief Investigator (OCI) in accordance with a collaboration agreement with the ATSB. OCI is the operational office of the Chief Investigator, Transport Safety, a statutory position established in the Transport Integration Act 2010 (Vic) to provide independent, no-blame investigation of transport safety matters in Victoria.  Under the collaboration agreement with the ATSB, OCI staff exercise powers and perform functions under the Transport Safety Investigation Act 2003 (Cth), and reports are approved for release under the TSI Act by the ATSB Commission. Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. Investigations under the TSI Act do not apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings.  Under the TSI Act investigations endeavour to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner.  TSI Act investigations are not for the purpose of taking administrative, regulatory or criminal action. About ATSB reports ATSB investigation reports are organised with regard to international standards or instruments, as applicable, and with ATSB procedures and guidelines. An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Investigation summary

What happened

In early May 2022, heavy rain fell across catchments of the Brisbane River. In response, the region’s water management agency performed several controlled water releases from dams located upriver from the Port of Brisbane. The subsequent high freshwater inflows resulted in increased current speeds through the port, exposing ships to the risk of breaking free from their berths. 

At 1313 local time on 16 May, the container ship OOCL Brisbane broke away from its berth at Fisherman Islands. All the ship’s mooring lines parted or paid out shortly after another ship, Delos Wave, passed OOCL Brisbane in the adjacent channel and berthed immediately ahead of it. 

At 0636 on 20 May, the container ship CMA CGM Bellini was working cargo alongside a berth at Fisherman Islands when 2 of its forward mooring lines parted and its bow drifted off the wharf. This breakaway also occurred shortly after another ship, APL Scotland, passed and berthed ahead of CMA CGM Bellini.

What the ATSB found

The ATSB found that the cause of the breakaways was a combination of increased ebb current flows and additional interaction forces and water flow disturbances introduced by Delos Wave and APL Scotland. These combined factors resulted in hydrodynamic forces which exceeded the berthed ships’ mooring arrangement capacities. 

The investigation identified that Maritime Safety Queensland (MSQ), the safety regulator, and the port’s pilotage provider, Poseidon Sea Pilots (PSP) did not have a process to jointly and effectively identify and risk assess the hazards to shipping and pilotage that were outside normal environmental conditions. As a result of this safety issue, MSQ and PSP did not identify and adequately address ship interaction as a hazard that increased the risk of a breakaway at Fisherman Islands. 

What has been done as a result

Following the breakaway of the oil tanker CSC Friendship in February 2022 further upriver in the port (ATSB investigation MO‑2022‑003) and these breakaways at Fisherman Islands in May, MSQ has taken the safety action summarised below. 

Between July and October 2022, MSQ commissioned several investigations and studies into the breakaways, which included analyses of mooring and river conditions, port operations and contingency planning arrangements.

Additionally, MSQ engaged with multiple port stakeholders, including PSP, terminal operators, the Australian Bureau of Meteorology and Seqwater to improve collaborative planning for, and response to, extreme weather events including river flood. Subsequently, MSQ has gradually amended its procedures for responding to extreme and adverse weather events. From late 2023, these procedures reflected the Queensland Government’s adoption of the Australian Warning System, which provides a nationally recognised set of warning levels and icons to communicate and manage dangers associated with extreme weather events.

In late 2024, MSQ established the Port of Brisbane Maritime Emergency Working Group (MEWG) and developed guidelines for the group’s role in responding to port emergencies, including severe weather, river flood and dam water releases. A stated function of the MEWG, which included representatives from MSQ, Port of Brisbane and PSP, was to facilitate timely and collective assessment of potential hazards to port safety posed by significant weather events and emergencies so that appropriate controls could be identified and implemented.

Capital improvements include the installation of 3 additional current meters in the river (with additional meters planned) and the provision of data from these meters to key stakeholders, including PSP. 

In December 2024, PSP advised the ATSB that it had worked closely with MSQ since the 2022 breakaways to establish a formal channel for all port stakeholders to collaboratively identify and risk assess hazards to shipping outside of normal environmental conditions. During this time, PSP progressively updated its pilotage operations safety management system to provide detailed procedures for preparing and responding to severe weather events. These procedures were developed in collaboration with MSQ and consistent with guidelines for the MEWG.

Additionally, PSP provided input for changes to MSQ’s standard port procedures. This included the joint development of procedures for movements to and from various berths under flood conditions using MSQ’s bridge/ship simulator.

Safety message

The breakaway incidents highlight the importance of structured and clearly defined emergency and risk management arrangements for managing port shipping movements outside of normal operating conditions. Such arrangements must facilitate accurate assessment of all the available information by the involved parties and provide for adequate assessment of all potential risks.

The occurrences

Background

In February and March 2022, areas of south‑east Queensland experienced unprecedented rainfall, which resulted in a series of destructive flooding events across the region, including the catchments of the upper and lower Brisbane River (Figure 1). The conditions over this period led to abnormally high currents (peaking at about 5 knots) in the Brisbane River and resulting in the breakaway of the oil tanker CSC Friendship from its berth on 27 February 2022 (see the section titled Previous occurrences).

Figure 1: The Brisbane River

Source: Queensland Government, annotated by the ATSB

While rainfall across the region eased during April, on 6 May 2022 the Australian Bureau of Meteorology (BoM) released advice of forecast significant rainfall for the following week. Subsequently, with catchments across south-east Queensland still saturated from the rainfall in February and March, Seqwater[1], as part of its strategy to manage dam water levels, issued advice on that same day that it would commence low-flow operational releases from Wivenhoe and Somerset dams, located upriver of the port. 

Later that day, following the Seqwater advice, Brisbane’s regional harbour master (RHM) directed the port’s vessel traffic service (VTS) to monitor river current meter readings against predicted flows every 2 hours and report any deviations. At the time, there was only one river current flow meter, located at the 2F beacon in Pelicans Banks Reach and immediately upriver of Fisherman Islands. (Figure 2).

Figure 2: Location of the 2F beacon current flow meter

Source: Australian Hydrographic Office, annotated by the ATSB

Additionally, the RHM directed VTS to notify port stakeholders, including terminal operators, ship masters (through the local agent) and the port’s pilotage provider, Poseidon Sea Pilots (PSP), of potential disruptions to ship movements in the coming days due to forecast rain and planned dam releases. Strong winds and rough seas and swell in the area of the pilot boarding ground (PBG) outside Moreton Bay at the port’s entrance were also expected to affect the pilot boat transfers. However, despite the predicted conditions, ship movements in and out of the port were able to proceed without disruptions over the following 3 days. 

On 11 May 2022, BoM forecast more significant rainfall across the region. At 0715, Seqwater’s flood operations centre advised that it had moved to its ‘stand-up’ activation level and was increasing dam releases to mitigate the risk of flooding. At 1145, Seqwater further advised that releases from Wivenhoe Dam would exceed 1,000 m³ per second overnight. At 1245, BoM issued a moderate flood warning for the upper Brisbane River.

In response to Seqwater’s notification of increased dam releases, the RHM directed VTS to suspend all immobilisation[2] permits and advise ships’ agents to ensure berthed and arriving ships deployed additional mooring lines. Ships berthed upriver from Pelican Banks were required to be at immediate readiness to depart and further arrivals to those berths were suspended. While movements at Fisherman Islands berths were to continue, nighttime pilot transfers were suspended later that day due to heavy swell at the PBG. 

On the morning of 12 May, BoM issued a minor flood warning for the lower Brisbane River, in addition to a series of major and moderate flood warnings for locations throughout the lower Brisbane River catchment. The RHM anticipated that flood waters from the lower catchment would result in stronger river current flows. 

Later that day, the RHM advised PSP via email that BoM had prepared a flood scenario outlook which indicated the lower Brisbane River would most likely experience minor flood levels at high tide on 14 and 15 May. This outlook also indicated that it was possible that the minor flood level could be reached on 13 May and remain at that level until 16 May. The RHM advised VTS and PSP that dam releases were being varied to manage the flood levels and therefore, unless there was significant rainfall over the lower river catchment, they did not expect a significant change to the increase in river current flow, which was observed to be about half a knot faster than normal spring ebb flows. By 1430 on 12 May, the last remaining ship berthed upriver from Pelican Banks had evacuated the river under the direction of the RHM. 

On 13 May, as rainfall over the lower Brisbane River catchments increased, releases from Wivenhoe Dam were temporarily stopped to allow peak inflows from catchments downstream of the dam to pass. Meanwhile, the maximum current flow recorded was 2.5 knots, about 1 knot faster than the normal predicted ebb (downriver) flow. With sea and swell conditions at the PBG continuing to disrupt pilot transfers, there were only a limited number of ship movements that day. 

That afternoon, the VTS manager advised PSP management, terminal operators, ships’ agents and other port stakeholders of the planned movements on the following day. Scheduled movements at Fisherman Islands were to proceed with additional restrictions in place due to the increased river current. The precautions prohibited the berthing of ships more than 300 m in length, with all others required to be berthed head-up (facing upriver). Only daylight movements were permitted, and with a minimum of 2 tugs. 

At 0300 on 14 May, releases from Wivenhoe Dam resumed. Meanwhile, sea conditions at the PBG had further deteriorated, preventing the resumption of pilot boat operations. Consequently, only a limited number of movements were conducted between Fisherman Islands and the inner anchorage, located within the relatively sheltered waters of Moreton Bay. 

OOCL Brisbane breakaway

By 15 May, conditions at the PBG had eased while the maximum ebb flow observed at the current meter was 2.3 knots. The RHM decided that these conditions allowed for the resumption of scheduled movements to Fisherman Islands. 

At 1058, a pilot boarded the container ship OOCL Brisbane at the PBG to conduct it to Fisherman Islands berth number 10. The pilotage proceeded normally and by 1725, the ship was berthed port side alongside (head-up) (Figure 3).

The ship was made fast with 16 polyamide mooring ropes – 4 head and stern lines, 2 breast lines fore and aft and 2 spring lines fore and aft, or 4-2-2 fore and aft. Of these 16 ropes, 12 were secured on their mooring winches held by a manual friction brake. The remaining 4  (both forward breast lines and 2 inboard stern lines) were turned up on bitts forward and aft. The ship’s outboard (starboard) anchor was lowered to the seabed as an additional precaution. The master ordered the moorings to be checked and tended every hour. Later that evening, cargo operations commenced. 

Figure 3: OOCL Brisbane mooring arrangement

Source: Maritime Safety Queensland and Seaport OPX, annotated by the ATSB

By the morning of 16 May, disruptions over the previous week had resulted in about 40 ships being anchored off the port limits, awaiting entry to the port. The maximum current recorded by the meter during the previous ebb tide had peaked at 2 knots, about 0.8 knots higher than predicted. The RHM decided that about 10 ship movements scheduled that day could go ahead subject to existing restrictions. 

At 0906, a pilot boarded the container ship Delos Wave, inbound to Fisherman Islands berth number 9, immediately upriver from OOCL Brisbane. At the time of the ship’s scheduled arrival alongside, the tide would be ebbing with high water (2.14 m) predicted for 0918 and low water (0.31 m) at 1537 (at the entrance to the Brisbane River). During the pilotage, VTS advised the pilot that the river current (ebb) was 2.2 knots. When the ship entered the river, the pilot estimated there to be an east-south‑easterly wind of about 7–10 knots. 

At 1116, VTS emailed port stakeholders advising that it was planning to resume further scheduled movements over the following days, also indicating that it was likely that some of the restrictions would be lifted from 17 May.

At 1239, Delos Wave was passing berth number 12 at a speed of 4.8 knots (over ground). The pilot planned to keep the ship close to the 212° (T) leading line for berthing that ran parallel to the Fisherman Islands wharf face (180 m from the face). The pilot had planned that by the time the ship was off berth number 9, its speed would have been reduced so it was stationary (over ground). The 2 tugs in attendance would then push it alongside the berth. 

At 1245, Delos Wave was passing OOCL Brisbane at a distance of about 113 m at 3 knots (Figure 4, Top). Five minutes later, Delos Wave’s speed was 0.9 knots as its stern passed the bow of OOCL Brisbane. The distance between the ships was about 100 m. 

Figure 4: Delos Wave passing OOCL Brisbane

Source: Australian Hydrographic Office and OOCL Brisbane’s voyage data recorder, annotated by the ATSB 

After Delos Wave passed OOCL Brisbane, the pilot began manoeuvring the ship towards its berth. At 1254, when Delos Wave was about 40 m from the berth, its first mooring line was passed ashore with the pilot directing the tugs as required. The pilot was also using short bursts of dead slow ahead on the ship’s main engine to counteract the current and keep the ship stationary off the berth. Astern of the ship, OOCL Brisbane had begun to surge and yaw. At about this time, a duty crew member on OOCL Brisbane’s deck reported to the second mate that the bow was moving away from the berth. The second mate immediately notified the chief mate (via UHF radio) and then instructed the crew to standby the forward and aft moorings. Meanwhile, stevedores working cargo noticed the ship moving away from the wharf and soon after, all 3 cranes stopped working cargo and raised their booms clear. 

When OOCL Brisbane’s master arrived on the bridge at 1258, its heading[3] was 218° (it had been 212° when alongside). One of its forward spring lines and both forward breast lines had parted and the remaining mooring lines forward had started to pay out.[4] 

At 1259, the master ordered the engineers to standby the main engine and bow thruster for emergency use, and then notified VTS (via VHF radio). Shortly afterwards, VTS advised the master that a tug (not one of those attending Delos Wave) was en route to assist. 

Meanwhile, the crew’s attempts to heave in the forward mooring lines had not succeeded and by 1303, the bow had swung about 15° away from the wharf. At 1304, the remaining forward spring line parted. Moments later, the master had the bow thruster at full port thrust. From 1307, the main engine was run (dead slow ahead and then half ahead) with the rudder hard to port to return the ship alongside. The ship, however, continued to move further away from the berth. 

By 1308, all forward lines had parted or fully paid-out (Figure 5). All the aft mooring winches had also begun to pay out and the 2 inboard stern lines turned up on the bitts parted at about this time. 

Figure 5: OOCL Brisbane breaking away (image shows the last headline parting)

Source: Maritime Safety Queensland

Meanwhile, Delos Wave had come alongside its berth and, by 1310, had one mooring line out at each end. Astern of it, OOCL Brisbane had broken away with its aft winches still paying out. The ship came close to the ship berthed astern of it before moving across to the other side of channel. By 1313, when the tug arrived to assist, all the ship’s aft mooring lines had parted or paid-out. One of the tugs attending Delos Wave was also released to assist OOCL Brisbane.

By 1323, OOCL Brisbane was near the opposite side of the channel with the 2 tugs assisting with controlling its movement (Figure 6). Shortly afterwards, the other tug attending Delos Wave was also released to assist OOCL Brisbane. The 3 tugs then aided OOCL Brisbane to remain within the channel while VTS arranged a pilot.

Figure 6: OOCL Brisbane at 1323

Source: Australian Hydrographic Office and OOCL Brisbane’s voyage data recorder, annotated by the ATSB 

At 1357, the master let go the starboard anchor to maintain position while waiting for the pilot. After boarding at 1418, the pilot agreed a plan with the master to take the ship to an anchorage at Moreton Bay (the ship had no usable mooring ropes). At 1505, after weighing anchor, the pilot conducted the ship to the anchorage.

As all OOCL Brisbane’s mooring ropes had parted and several mooring winches were damaged, it remained at the anchorage for several days while new ropes and spare parts were supplied. The RHM also required an independent surveyor to conduct an investigation and inspect the mooring equipment (see section titled OOCL Brisbane - Mooring equipment).

On 26 May, a pilot conducted the ship back to the same berth where 6 of its cargo hatch covers had remained after the breakaway.     

CMA CGM Bellini breakaway

Following the breakaway of OOCL Brisbane, MSQ continued to monitor river current conditions and reviewed ship mooring configurations using its NCOS[5] mooring tool, applying an assumed additional loading of 3 knots of current speed alongside the berths. Ship movements to and from Fisherman Islands berths continued, with existing restrictions still in place. Arrivals to berths upriver from Pelican Banks also resumed. On 18 May, the RHM decided that ships of more than 300 m in length could resume berthing at Fisherman Islands. While rainfall had eased, the continuation of controlled releases from Wivenhoe Dam was resulting in a greater ebb river current than during a normal spring ebb tide.

At 0836 on 19 May, the container ship CMA CGM Bellini berthed port side alongside (head‑up) at Fisherman Islands berth number 6 (Figure 7). The ship was made fast with 14 polyamide mooring ropes – 4 headlines, 3 stern lines, 1 forward breast line, 2 aft breast lines and 2 spring lines fore and aft. As an additional precaution, the starboard anchor was lowered to the seabed. Of the 7 forward ropes, 6 were secured on their mooring winches and held by a manual friction brake while the forward breast line was turned up on bitts. 

Figure 7: CMA CGM Bellini mooring arrangement

Source: Maritime Safety Queensland and Seaport OPX, annotated by the ATSB

At 0236 the following day, a pilot boarded the container ship APL Scotland at the PBG. The ship was bound for Fisherman Islands berth number 5, immediately upriver from berth number 6 where CMA CGM Bellini was working cargo. During the master and pilot information exchange, the pilot informed the master that a strong ebb current and south-easterly winds could be expected at the berth and additional mooring ropes would be necessary. 

At 0618, as APL Scotland entered the Brisbane River, a harbour tug attended the ship and made fast on its starboard quarter. At 0623, as the ship passed Fisherman Islands berth number 9 at a speed of 5 knots, another tug made fast on the ship’s starboard shoulder. The tide was ebbing, with the predicted high water (2.59 m) having occurred at 0028 and low water (0.61 m) predicted for 0725. At the time, the current meter recorded an ebb flow of 1.5 knots and the pilot recalled south-easterly winds of 16–19 knots. 

At 0625, APL Scotland’s speed had slowed to 4.2 knots as its bow came into line with the stern of CMA CGM Bellini. At this time, the distance between the ships was about 160 m. By 0628, APL Scotland was 120 m off CMA CGM Bellini’s beam, at a slight angle to the 212° leading line for berthing and its speed had reduced to 2.1 knots (Figure 8).

Figure 8: APL Scotland passing CMA CGM Bellini at 0628

Source: Maritime Safety Queensland

At 0634, CMA CGM Bellini began to surge and yaw at its berth as APL Scotland’s stern passed about 80 m from its bow. At about the same time, APL Scotland’s pilot ordered its main engine slow astern for a brief period to reduce speed. 

At 0635, as the pilot began manoeuvring APL Scotland towards the berth, one of CMA CGM Bellini’s inner headlines began to pay out. A duty crew member on deck saw the bow moving away from the berth and called the duty officer (the third mate) on the bridge (via UHF radio). The third mate alerted the chief mate via radio and then went forward. At 0636, the forward breast line partially parted, followed by the parting of one of its forwardmost headlines a few seconds later (Figure 9).

Figure 9: Headline parts at 0635

Source: Maritime Safety Queensland, annotated by the ATSB

By 0637, the ship’s bow had drifted about 8 m off the wharf face. On APL Scotland’s port bridge wing, the pilot had heard the headline parting and saw CMA CGM Bellini moving off the berth. The pilot alerted the shore mooring gang and asked the masters of the attending tugs to call another tug to assist CMA CGM Bellini. 

Meanwhile, CMA CGM Bellini’s third mate saw all except one of the headlines were paying out and, assisted by 2 other crew members, attempted to heave them in. On the bridge, the chief mate officer called the engine room and instructed the duty engineer to standby the main engine and bow thruster before calling the master. 

At 0642, a tug arrived to assist and began pushing up on CMA CGM Bellini’s starboard shoulder. At this time, APL Scotland was manoeuvring ahead of CMA CGM Bellini, and the pilot was using its engine intermittently at dead slow ahead to counteract the current and keep the ship stationary off the berth. When CMA CGM Bellini’s master arrived on the bridge at about 0650, its bow was slowly returning alongside the wharf. 

By 0655, CMA CGM Bellini’s bow thruster was being used and at 0705, the ship was alongside with the crew working with shore personnel to replace the parted lines. The master then contacted VTS and informed the duty VTSO of the situation while the chief mate attended to the mooring arrangements. 

By 0730, all mooring lines had been resecured. At 0800, the chief mate advised the master that the ship was again fast alongside before informing VTS that the situation was under control. The attending tug was released and shortly afterwards, cargo operations resumed. 

Context

OOCL Brisbane

OOCL Brisbane was built in 2009 by Samsung Heavy Industries, South Korea, registered in Hong Kong and classed with the American Bureau of Shipping. At the time of the occurrence, it was owned by Newcontainer No.138 (Marshall Islands) Shipping and managed and operated by Orient Overseas Container Line, Hong Kong. 

The 4,578 TEU[6] container ship had an overall length of 260 m, a moulded breadth of 32.25 m and a depth of 19.30 m. At its summer draught of 12.62 m, it had a deadweight of 50,575 t. 

Upon its arrival in port, OOCL Brisbane had a crew of 25 Singaporean, Chinese and Filipino nationals, all suitably qualified for their positions held on board. 

Mooring equipment

At the time of the breakaway, each of the 16 polyamide (nylon) mooring lines used to secure OOCL Brisbane alongside (Figure 3) had a minimum breaking load of 72.6 t, while each mooring winch had a brake holding capacity of 52.8 t. Following the breakaway, a surveyor inspected the mooring lines and equipment, as well as the service records relating to them, and determined that prior to the incident, the mooring lines, winches and gear had been properly maintained and were in serviceable order. 

Delos Wave

Delos Wave was a 2,824 TEU container ship built in 2007 by HD Hyundai Mipo, South Korea. The 222 m ship had a moulded breadth of 30 m, a depth of 16.80 m and a deadweight of 39,357 t at its summer draught of 12 m. 

The ship was registered in the Marshall Islands and classed with Nippon Kaiji Kyokai (ClassNK). At the time of the occurrence, it was owned by Box Carrier Corporation and managed and operated by Nautical Carriers Incorporated, Greece. 

Propulsive power was provided by a single Hyundai B&W 2‑stroke, single‑acting diesel engine that developed 25,270 kW at 104 rpm. The main engine drove a single, fixed-pitch propeller, which gave the ship a service speed of 22 knots. 

The ship was manned by 23 suitably qualified Ukrainian, Georgian, Moldovan, Greek and Filipino nationals. 

Pilot

Delos Wave’s pilot had trained and qualified as a licensed (unrestricted) Brisbane pilot when Poseidon Sea Pilots (PSP) commenced the provision of pilotage services for the port in January 2022. The pilot had previously been a pilot in the Queensland ports of Townsville and Gladstone for 6 years. 

CMA CGM Bellini

CMA CGM Bellini was built in 2004 by Samsung Heavy Industries, South Korea, registered in Malta and classed with Bureau Veritas. At the time of the breakaway, the 5,782 TEU container ship was owned, managed and operated by CMA CGM, France. 

The ship had an overall length of 277 m, a moulded breadth of 40 m and a depth of 24.33 m. At its summer draught of 12.53 m, it had a deadweight of 72,500 t. 

CMA CGM Bellini had a crew of 20 Croation, Montenegrin, Sri Lankan and Filipino nationals, all suitably qualified for their positions held on board.

Mooring equipment

At the time of the breakaway, each of CMA CGM Bellini’s 14 nylon (polyamide) mooring lines used to secure the ship alongside (Figure 7) had a minimum breaking load of 96.3 t. The ship’s maintenance records indicated they were in good condition. The mooring equipment maintenance records also indicated that the mooring winches and winch brake linings complied with the requirements of class and the ship’s safety management system. 

APL Scotland

APL Scotland was built in 2001 by Samsung Heavy Industries, South Korea, registered in Singapore and classed with Det Norske Veritas (DNV). The 5,510 TEU container ship was owned by CMA CGM Asia Pacific Liner and managed and operated by CMA CGM Asia Shipping, Singapore.  

APL Scotland had an overall length of 277 m, a moulded breadth of 40 m and a depth of 24.30 m. At its summer draught of 14 m, it had a deadweight of 68,017 t. Propulsive power was provided by a single Samsung-MAN B&W 2‑stroke, single‑acting diesel engine that developed 54,840 kW at 94 rpm. The main engine drove a single, fixed-pitch propeller, which gave the ship a service speed of 23.5 knots. 

The ship was crewed by 24 suitably qualified Chinese, Sri Lankan and Filipino nationals.

Pilot

APL Scotland’s pilot had extensive pilotage experience in various ports in Australia before obtaining an unrestricted pilot licence for Brisbane in 2021 after joining PSP.

Port of Brisbane

The Port of Brisbane (Figure 10) is located at the mouth of the Brisbane River in south‑east Queensland. It is one of Australia’s largest and most diverse multi-cargo ports, with 28 operating berths facilitating the handling of containers, general cargo, motor vehicles and bulk, as well as a dedicated international cruise ship terminal. 

Figure 10: The Port of Brisbane

Source: Port of Brisbane

Each year, approximately 2,150 ships visit the port, which handles approximately $55 billion annually in international trade, including 50% of Queensland’s agricultural exports and 95% of its motor vehicles and containers. In the 2021–22 financial year, the port handled 32 million tonnes of cargo, including 1.53 million containers. 

Under Queensland’s Transport Operations (Marine Safety) Act 1994, control of navigation in the port is the responsibility of the regional harbour master (RHM) appointed by Maritime Safety Queensland (MSQ). In 2010, the port was privatised and, under a 99-year lease from the Queensland Government, is managed and developed by the Port of Brisbane (PBPL).[7] MSQ and the PBPL were jointly responsible for managing the safe and efficient operation of the port. 

The Brisbane port limits encompass a significant area of Moreton Bay and extend to the northern end of the bay with about 45 miles[8] from the pilot boarding ground to river entrance beacons. The RHM’s area of responsibility extends beyond the port limits to include areas of other commercial and recreational activities, including Moreton Bay, the Brisbane River upriver from the port and the coastal sea area to about 45 miles further north of the port limits.

At the time of the occurrences, the port provided an equivalent of eight 300 m container berths (numbers 4 to 11) at Fisherman Islands (Figure 11). The design depth off the wharf face was 14 m and each berth pocket was 55 m wide. 

Figure 11: Fisherman Islands container berths

Source: Port of Brisbane, annotated by the ATSB 

Pilotage

All ships over 50 m in length calling at Brisbane were required to take a pilot. The pilot boarding ground was situated 3 miles south‑east from Point Cartwright. 

Pilot transfers were conducted by pilot boat, normally operating out of Mooloolaba Boat Harbour, located at the mouth of the Mooloolaba River near the north‑western shore of Point Cartwright. During rough sea conditions, the bar at the river entrance sometimes became hazardous for pilot boats to cross. In such circumstances, the boats operated from Scarborough, a short distance north‑west of Redcliffe. 

Vessel traffic service

The Brisbane vessel traffic service (VTS) was the principal resource available to the RHM to manage the movement of ships approaching, departing and operating within the Brisbane VTS area, which includes all areas within the Brisbane port limits and the compulsory pilotage area. 

The service was provided by MSQ and manned 24 hours per day by qualified vessel traffic service operators (VTSO). 

Brisbane River

The Brisbane River is the longest river in south‑east Queensland, travelling 344 km from Mount Stanley and flowing through the city of Brisbane and its port before emptying into Moreton Bay on the Coral Sea. 

The Brisbane River basin drains a catchment of about 13,560 square kilometres to the mouth of the river. The river system includes 2 water storage and flood mitigation dams – Somerset Dam on an upriver tributary, which drains to Wivenhoe Dam on the Brisbane River (Figure 12).

About half of the catchment is above Wivenhoe Dam, which is situated about 150 km from the mouth of the river. Seqwater estimated that water released from Wivenhoe Dam takes about 30 hours to reach the port. Wivenhoe Dam stores a significant volume of inflow water, reducing the Brisbane River level to mitigate the risk of flooding.   

Figure 12: Wivenhoe and Somerset dams

Source: Queensland Government

While the frequency and severity of floods has diminished since the 1985 construction of Wivenhoe Dam, severe flooding along the Brisbane River can still occur. Such events may result in widespread damage to surrounding areas, as documented during significant flood events in January 2011 and February 2022. 

Weather event

In early May 2022, onshore winds and a low-pressure trough across eastern Australia resulted in substantial rainfall in the east of the country, in addition to strong winds and hazardous surf conditions along much of its eastern seaboard. In south‑east Queensland, rainfall was significantly above average, with most locations recording more than twice the average for the month. In the Greater Brisbane area, rainfall was heaviest between 11 and 14 May, peaking on 13 May. By 16 May, the total accumulated monthly rainfall was 196 mm and by 20 May, this total had increased to 225 mm (Figure 13). Brisbane’s total rainfall for the month was 280 mm, 397% of the long-term average of 70.6 mm and the city’s wettest May since 1996. 

Figure 13: Daily and cumulative rainfall for Brisbane in May 2022

Source: Bureau of Meteorology, compiled by the ATSB

Impact on port and mooring conditions 

Following these occurrences, PBPL and MSQ engaged Seaport OPX, a specialist provider of hydrodynamic modelling and digital port solutions, to investigate the circumstances of the breakaways. This was to assist port management to evaluate existing mooring practices and procedures at Fisherman Islands. 

Seaport OPX used 3D hydrographic modelling and mooring analysis software to simulate and assess the environmental and dynamic conditions that may have contributed to each breakaway. In its investigation report, Seaport OPX noted that the complexity of the physical processes and their interactions on the moored ships were difficult to evaluate, even with the use of advanced numerical modelling tools. They were however able to provide insight into the factors that probably contributed to the breakaways.    

Increased river currents

Following heavy rainfall over the Brisbane River catchment areas, the resulting freshwater inflows to the river were observed to generate abnormally high currents in the port, including along the Fisherman Islands berths. These inflows coincided with a perigean[9] spring tide from 16 May, which resulted in a higher-than-average spring tidal range during the time of both breakaways, thereby further increasing ebb current flows.     

Seaport OPX estimated that at the time of both breakaways, freshwater discharges into the lower catchment were approximately 1,500 cubic metres per second (Figure 14).

Figure 14: Catchment inflows and subsequent water levels and current speeds

Source: Seaport OPX, annotated by the ATSB

The current meter at 2F beacon was installed at a minimum water depth of approximately 5 m. Simulation results produced by Seaport OPX for the time of the breakaways indicated that maximum surface current at the Fisherman Islands berths was greater than that recorded by the meter and estimated the ebb flows to be 1.5 to 2 knots higher than a normal spring ebb tide. Current speed was also found to vary across the channel, with lower speeds closer to the wharf. 

The report stated that hydrodynamic conditions ‘were complicated by the likely presence of a strong density-driven stratification of the flows over the draught of the moored vessels, with higher speeds and lower water density near the surface compared to at the bottom of the draught of the vessel’ (Figure 15). According to modelling, the vertical stratification of the flows over the draught of the moored ships meant that denser saline water could flow slowly upriver even while the freshwater surface layers were flowing seaward at up to 3 knots. 

Figure 15: Cross-section of simulated current speeds

Source: Seaport OPX, annotated by the ATSB

The report noted that these aspects could not be fully integrated into the mooring analysis software and increased the uncertainty of the analysis. While the forces simulated for the increased river current velocities introduced increased forces on both ships’ mooring systems, the model did not predict that the mooring line minimum breaking loads, nor the loads at which the mooring winches were expected to render, would be exceeded under those environmental conditions alone.

However, Seaport OPX also advised that limitations in the simulation software also probably resulted in the calculated line forces and the ship’s yawing motions being underestimated for each event.

Passing ship interaction

When a ship passes close to a berthed ship, there will be hydrodynamic interaction between them, potentially causing the berthed ship to move. The magnitude of the hydrodynamic forces, which may cause the berthed ship to surge, sway and/or yaw, will depend on factors such as the speed of the passing ship, the passing distance, both ships’ under-keel clearance and relative displacements and whether the berth is open to water on all sides or only on one side, for example, at a river berth.[10] 

The magnitude of these interaction forces and the risk of a breakaway can be reduced by the following measures as appropriate:

• ensuring ships pass at the minimum speed for steering
• providing a greater distance margin when manoeuvring in proximity to berthed ships
• reducing water flow disturbances through greater reliance on tugs to manoeuvre (as opposed to using the ship’s engine)
• in ports that experience fast-flowing water currents, planning ship movements to avoid peak ebb and flood tidal flows to reduce the risk of interaction with berthed ships.

Generally, these considerations are well known to pilots, who are experts in ship handling and have detailed local knowledge of the port, including factors related to tidal conditions and under‑keel clearances. 

Prior to each occurrence, OOCL Brisbane and CMA CGM Bellini had been berthed alongside for more than 20 hours. Each breakaway occurred shortly after another ship (Delos Wave and APL Scotland, respectively) had passed in the adjacent channel and started manoeuvring into the berth ahead. 

The Seaport OPX model indicated that the observed surging and yawing motions of OOCL Brisbane and CMA CGM Bellini were likely exacerbated by the effect of the passing ship’s surface displacement wave interactions. 

The interactions were also shown to be ‘enhanced by strong ebb currents, which effectively increased the through-water speed of the passing ships, resulting in additional squat and thus a greater drawdown wave.’ However, the model predicted that this effect alone was not significant enough in either occurrence to exceed the berthed ship’s mooring system capacities. 

Effect of a ship berthing ahead

In its analysis, Seaport OPX submitted that the increased surface currents at the berths were likely further accelerated by the berthing of Delos Wave and APL Scotland ahead of OOCL Brisbane and CMA CGM Bellini, respectively. The report stated that:

Hydrodynamic processes associated with strong surface currents generated during significant freshwater river discharges… were likely further accelerated locally by the berthing of a vessel immediately upriver… initiating lateral force and yaw moments on the moored vessels through mechanisms that could include: 

• inherent turbulence in the incident mean flows
• blockage effect interactions between the upriver berthing vessel and the berth structure and the seabed, resulting in uneven acceleration of flows and hydrodynamic forces around and under the downstream moored vessel
• vortex shedding around the blunt stern hull form generating alternating crossflow forces on the vessel hull
• variations in current speed forcing over the draught due to strong stratification and unequal forcing on the vessel hull
• internal wave effects

The report noted that the use of the main engine during the berthing of Delos Wave and APL Scotland introduced additional hydrodynamic interactions on the berthed ships which likely contributed to both breakaway occurrences. 

Wind

The Seaport OPX model simulation indicated that the mild to moderate winds observed at the time of each occurrence were unlikely to have contributed significantly to the breakaways. 

Maritime Safety Queensland

Marine legislation in Queensland is administered and implemented by Maritime Safety Queensland (MSQ), a state government agency within the Department of Transport and Main Roads (DTMR). As such, MSQ is responsible for safety oversight of pilotage, pollution protection services, vessel traffic services (VTS) and the administration of all aspects of ship registration and marine safety in the state.

The agency’s core focus is the preservation of life and property in the state’s waters and in the prevention of, and response to, ship-sourced pollution and other maritime emergencies and disasters. This includes the development of hazard‑specific plans.

Queensland’s 5 maritime regions, including the Brisbane region, are each controlled by a regional harbour master (RHM).[11] For their respective region, each RHM is responsible for:

• improving maritime safety for shipping and small craft through regulation and education
• minimising ship sourced waste and providing response to marine pollution
• providing essential maritime services such as pilotage, vessel traffic services and aids to navigation and
• encouraging and supporting innovation in the maritime industry.

Port Procedures and Information for Shipping manual 

The Port of Brisbane had a publicly available Port Procedures and Information for Shipping manual (PPM) which defined the standard procedures to be followed in the port’s pilotage area. The PPM also contained information and guidelines to assist the masters, owners, and agents of ships arriving in the port and traversing the area, including details of the services, regulations and procedures established for the port.

Port tidal and weather information

The PPM provided a basic description of the port and its facilities. A general description of environmental conditions that may be experienced in the port provided that:

The majority of berths at the port of Brisbane are located at Fisherman Islands, at the mouth of the Brisbane River which extends into Moreton Bay. The area is very exposed to the prevailing winds which include fresh to strong SE trades year-round, strong N/NE sea breezes in the afternoons during the summer months and strong to gale force SW/W winds in the late winter months.

Advice that the river on which the port was located was subject to dam releases and flooding was not contained within the manual.

General tidal information for the port was also provided in the PPM, including the mean spring tidal range (1.8 m) and the location of tide gauges. The PPM sought to remind port users that tidal ebb and flows can begin or continue after the times of high or low water at various localities in the Brisbane River, noting that ‘this should be borne in mind when booking ships in for ‘head up’ or ‘head down’ berthing’. 

The PPM advised that tidal stream information for the port was available from the office of the RHM. Additionally, VTS could provide real-time tidal/current conditions and weather information from tide gauges and weather stations within the port, as well as weather forecasts, shipping schedules, navigational warnings and any other special operational requirements. 

Fisherman Islands berth information

The PPM provided a description of the different berth locations in the port and any special requirements and precautions to be observed at each location. For Fisherman Islands berths, the PPM identified strong south‑easterly offshore winds as a factor requiring extra attention to ensure ships were moored safely. While the PPM highlighted that this responsibility lay with the ship’s master, it noted that pilots and terminal operators would provide support, including recommendations for mooring arrangements.

Ship interaction provisions

Berth surging and interaction in the Brisbane River was highlighted as a risk in the PPM for berths upriver from Pelican Banks. It stated that berth surge is caused by a variety of environmental factors, poor mooring arrangements and overall ship preparedness, and normally triggered by a ship passing the berthed ship. The PPM warned that surge events could result in parted mooring lines, damaged gangways, impacts to the environment and injury to persons. The PPM provided a list of berths within the port that were prone to ship interaction and detailed precautions that were to be taken by both passing ships and ships alongside. Berths at Fisherman Islands, where the adjacent channel is wider than for those upriver, were not included in the list.

To assist in the management of berth surge, the PPM stipulated an operational speed limit of 6 knots through the water for ships with draught of more than 3 m. This restriction applied only when passing ships upriver from Fisherman Islands berths.

Towage requirements

The PPM specified towage requirements for ships berthing and unberthing at Fisherman Islands. Two tugs were normally required for ships more than 150 m in length, while ships more than 300 m long required a third tug to be turned around in the channel. The PPM stated that tug requirements were based on the ship stemming the current when berthing and departing and that manoeuvring with the current on the ship’s stern may require the use of an additional tug. Under normal environmental conditions, a tug could be substituted by an efficient bow thruster. 

Extreme Weather Event Contingency Plan

The Queensland Government had published an Extreme Weather Event Contingency Plan (EWE) for each maritime region. Each plan detailed the response required from ship masters and owners to different warning and/or alert levels in that region.

The Brisbane EWE (2021–2022) was intended to address the range of adverse weather events that may affect the region, such as summer storms, river flooding or the effects of a cyclone. It was the responsibility of ship owners and masters to take the necessary action within the context of the official weather warnings to protect their passengers, crew and ships, and comply with any directions from the RHM. This included the requirement for all ships to have a safety plan.

The EWE noted that, at times, it may be necessary for the RHM to give directions in relation to the operation and movement of ships when entering, operating in or leaving the pilotage area. This included the evacuation of commercial ships to sea and closure of the pilotage area to all marine activities and operations.

The plan outlined an incremental response encompassing prevention, preparedness, response and recovery phases. The plan aimed to allow appropriate actions in response to the imminent threat to be planned and implemented. Under the EWE, the primary objective was to have the port area secure and safety plans enacted at least 6 hours before the weather event occurred.

Vessel traffic service extreme weather event procedure

An internal extreme weather event procedure provided information to VTSO’s for such events in the Brisbane region and the responses required. It stated that the procedure was informational in nature and was to accompany additional procedures outlining specific VTSO responsibilities and actions to be undertaken during extreme weather events.

The procedure outlined some general trigger points and related response actions for significant storm, wind and surf warnings, as well as notifications relating to potential dam release and flood warnings for the Brisbane River. 

General dam release and flood warning response actions included monitoring flood effects on tidal flows, debris in the river and weather warnings. Port users were to be kept informed of the situation through appropriate means of communication.[12] Individual, high‑risk commercial ships and facilities could also receive specific advice and instructions through direct messaging from the RHM. Other, relevant, flood-related precautions contained in the procedure are shown in Table 1.

Table 1: Selected VTS extreme weather event procedure flood warning related actions

Severe weather information

Advice for severe weather was publicly available via the MSQ website.[13] Among other information, this included links to state and regional extreme weather event contingency plans.

Weather monitoring

The principal source of weather forecasts, warnings and information for MSQ (via a subscription service) was BoM. Brisbane VTS received forecasts and warnings from BoM for weather, storm, rain, wind and flood conditions. The information received was passed on to port users by VTS via VHF channel 67 and other means such as email and phone messaging, as required.

In addition, MSQ obtained weather data from a network of 6 tide gauges and 12 weather stations located in the port and surrounding areas, as well as the single current flow meter. The current speed from the meter was prominently displayed on an electronic display board in the VTS centre. 

Brisbane VTS routinely received weather reports from several sources including Seqwater and the PBPL Nonlinear Channel Optimisation Simulator system (NCOS). The NCOS system provided wind forecasts and automated warnings to VTS for the port and surrounding Moreton Bay areas. Advice from Seqwater regarding water releases (forecast and actual) from Wivenhoe Dam was also provided to VTS. 

Risk management arrangements

The tools available to the RHM’s team for identifying and mitigating the risks that extreme or adverse weather posed to port operations consisted of the PPM, EWE and VTS extreme weather event procedure. The ATSB also reviewed email correspondence between the RHM and other MSQ officers between 5 and 23 May. The email archive documented MSQ’s response to notifications and warnings it received regarding forecast rain, dam releases and potential flooding. Further emails from the same period documented MSQ’s subsequent correspondence with port stakeholders such as PSP, ships’ agents, terminal operators and other government agencies. 

The correspondence indicated that MSQ began preparing for potential port schedule disruptions on 6 May, following receipt of the notifications and warnings. The preparation actions included increased monitoring of weather warnings and current meter readings, suspension of immobilisation permits, requesting that ships deploy additional mooring lines and the provision of information and advice to various stakeholders and port users. While these actions implemented by MSQ reflected those documented in the VTS extreme weather event procedure, they were developed in isolation rather than via the involvement of other stakeholders with specialist marine knowledge, such as PSP. Throughout this period, the RHM and PSP were also required to concurrently manage disruptions due to rough seas and swell at the pilot boarding ground (PBG).

As per the EWE, additional restrictions at Fisherman Islands, while not expressly provided in the PPM or VTS extreme weather event procedure, were implemented at the discretion of the RHM to mitigate the risk to port safety posed by the increased current flows. Ships more than 300 m long were not permitted to berth and all new arrivals were required to berth port side alongside (head‑up). New arrivals to berths upstream of Pelican Banks were also suspended.

Decisions relating to these restrictions were primarily informed by the RHM’s appraisal of current meter observations and the response measures implemented were consistent with the documented procedures in place at the time. The email correspondence did not refer to any specific pre-determined trigger points or safe operating limits at which additional measures might be required, or when river current strengths might be considered too strong for the safe continuation of ship movements. 

On the morning of 16 May, prior to the OOCL Brisbane breakaway, VTS notified port stakeholders, including PSP, that some of the restrictions at Fisherman Islands would be eased from the following day. This would allow some selected ships to berth starboard side alongside (head-down) at Fisherman Islands, subject to the specific berth, each ship’s particulars and observed current flow conditions. Movements to berths upriver from Pelican Banks were also to resume, subject to additional restrictions. 

Following the breakaway of OOCL Brisbane, the RHM decided that the restrictions that were to be lifted would instead be maintained, while planned movements upriver from Pelican Banks were permitted to proceed from 17 May. On 18 May, the RHM lifted the restriction on ships more than 300 m long berthing at Fisherman Islands. At the time of the breakaway of CMA CGM Bellini, restrictions and precautions for ships less than 300 m in length had not been changed or expanded on since the earlier breakaway 4 days prior. 

Pilotage

Pilotage is the key risk control to ensure safe movement of ships in the port. Pilots are competent ship handlers with detailed local knowledge, including currents, tidal variations and other relevant factors. Pilotage providers are responsible for managing the safety risks associated with delivering this specialist service and an essential resource for port authorities, particularly in abnormal weather conditions.

Since 1 January 2022, pilotage services for Brisbane have been provided by Poseidon Sea Pilots (PSP). 

Safety management system

As part of its obligations for ensuring safe delivery of pilotage services, PSP maintained a Pilotage Operations Safety Management System (POSMS). It was intended to complement the PPM and, in the event of inconsistency, the PPM was to take precedence. The POSMS was reviewed and endorsed by MSQ and subject to an annual audit schedule. 

The POSMS contained procedures and guidance for the preparation and conduct of pilotages, including passage planning. These provisions made it the responsibility of the assigned pilot to confirm the environmental conditions at the time of each scheduled pilotage, including current speed and direction. While some guidance was provided for wind conditions, including force calculations for wind speed versus exposed ship area, hazardous conditions associated with other factors such as river flood or abnormally fast current flows were not mentioned. 

The POSMS described general principles and processes for risk management and the responsibilities of key management personnel for managing issues related to the safe, effective and efficient delivery of the pilotage service. These responsibilities extended to engagement with pilots, PBPL, ships’ agents and VTS on operational issues and, where required, consultation with the RHM to discuss closure of the port during adverse weather events. Specific operational risks associated with environmental conditions were not included. There were no procedures contained within the POSMS to describe when and how PSP management would initiate its preparation and response to conditions which may negatively impact the safety of its operations.

The POSMS did not provide for any formal process or structure to address and document PSP’s participation in the management of wider port and regional safety to which the pilotage service provider is an important and major contributor. While PSP management supported decisions taken by MSQ and the RHM’s directions in response to the weather event, it was not directly involved in any formal process for assessing and addressing risks affecting pilotage, such as increased river current flows.

Previous occurrences

On 26 February 2022, the container ship S Santiago broke away from its berth at Fisherman Islands when its mooring lines parted as another container ship was being berthed ahead and upriver of it. S Santiago was resecured alongside its berth 30 minutes later, with tug assistance. At the time, the ship’s master stated that a 20 to 25 knot wind had pushed the stern away from the wharf, resulting in several mooring lines parting. At the time, the river was in flood following an extreme weather event.

The following day, as the weather event continued, the oil products tanker CSC Friendship broke free from its berth at the Ampol products wharf at Lytton, upstream of Fisherman Islands. At the time, a persistent ebb current was flowing at about 4.5 knots. The ship was swept across the adjacent channel and grounded about 400 m downstream, on the opposite side of the river. The ship remained fast aground until refloated at 0500 the next day.

A subsequent ATSB investigation (MO-2022-003) identified that the river current had exceeded the limits for the design of both the berth and the ship’s mooring arrangements. The investigation found that deteriorating conditions associated with the flood event and subsequent increased safety risk to shipping and the port were foreseeable. The BoM had issued warnings of the impending event from 21 February, which provided sufficient information to identify the increased likelihood of a breakaway. 

The investigation identified that MSQ did not have structured or formalised risk or emergency management processes or procedures and consequently, it was unable to adequately assess and respond to the risk posed by the river conditions and current. 

Additionally, PSP, as the port’s pilotage provider, did not have procedures to manage predictable risks associated with increased river flow or pilotage operations outside normal conditions. As a result, PSP had not properly considered risks posed by the increased river flow and taken an active role until after the breakaway.

Safety analysis

Introduction

In the early weeks of May 2022, areas of south-eastern Queensland, including catchments of the Brisbane River, experienced heavy rainfall that resulted in a series of controlled dam water releases upriver from the Port of Brisbane. The subsequent high freshwater inflows into the river resulted in increased current speeds through the port, exposing ships to the risk of breaking free from their berths. 

On 16 May 2022, the container ship OOCL Brisbane broke away from its berth at Fisherman Islands after its mooring lines parted. This occurred immediately after another ship, Delos Wave, had passed in the adjacent channel and manoeuvred to the berth immediately ahead of it. 

Four days later, another container ship, CMA CGM Bellini, was alongside a berth at Fisherman Islands when 2 of its forward mooring lines parted and its bow drifted off the berth. As in the breakaway on 16 May, another ship, APL Scotland, had just passed and berthed ahead of CMA CGM Bellini. 

The breakaways 

There was no evidence of any defective mooring equipment on either OOCL Brisbane or CMA CGM Bellini, which could have contributed to the occurrences. Each ship had been secured with sufficient mooring lines, including additional lines required by the regional harbour master (RHM) to mitigate the increased river current. 

At the time of the occurrences, freshwater inflows to the river from heavy rainfall and dam releases were estimated to be 1,500 cubic metres per second, resulting in ebb current flows at the port about 1.5–2 knots higher than observed during a normal spring ebb tide. The ebb tidal flows were also amplified by the advent of a perigean spring tide from 16 May which increased the average spring tidal range during the time of both breakaways.

Due to probable current variation with depth, surface current speeds at Fisherman Islands berths were likely higher than indicated by the port’s only current flow meter, located upriver from the berths. Both breakaways occurred on the mid to late ebb tide, when current flows were near their maximum. These conditions resulted in increased loads on the ships’ moorings. 

However, both OOCL Brisbane and CMA CGM Bellini had been berthed alongside for over 20 hours, during which time there had been no issues with the moorings of either ship. A mooring analysis conducted by a specialist hydrodynamic modelling company commissioned by port management later estimated that the additional mooring loads created by the strong ebb currents alone should not have exceeded the mooring equipment capacities of either ship.   

Significantly, each breakaway occurred shortly after another ship (Delos Wave and APL Scotland, respectively) passed in the adjacent channel and began manoeuvring into the berth ahead. Given the timings and the above finding of the hydrodynamic modelling specialist, it is almost certain that the interaction forces and water flow disturbances created by the proximity of the berthing ships contributed to both breakaways.

The speed and distance at which Delos Wave and APL Scotland passed the berthed ships were within the operating limits and usual pilotage practices for normal conditions, including usual river flow. The strong ebb current flow, however, meant the passing ships’ effective speed through the water (as opposed to speed over ground) increased the effect of surface displacement wave interactions associated with their movement, causing the berthed ships to surge and yaw. Further, the hydrodynamic modelling indicated that the forces associated with the ships passing were probably insufficient on their own to have led to the breakaways.  

When Delos Wave and APL Scotland manoeuvred ahead of the berthed ships, the already high surface current speeds at the berths were further accelerated due to a complex range of hydrodynamic factors. These included interactions between the upstream berthing ship, the berth structure and the seabed, as well as disturbances created from the operation of the berthing ship’s main propulsion. These factors, combined with the prevailing environmental conditions at the berths, contributed to the yawing forces on OOCL Brisbane and CMA CGM Bellini and increased the load on their respective mooring systems until they ultimately failed.

Risk management

Maritime Safety Queensland

Effective risk management relies first and foremost on identification of all the relevant hazards. The involvement of personnel/organisations with subject matter expertise and knowledge in that initial process provides the best opportunity to mitigate the associated risk. 

Maritime Safety Queensland’s (MSQ) procedures for managing risks posed by extreme and adverse weather events provided general guidance on precautionary steps to be taken in the event of river flood and increased current flows. However, they did not provide for any formal risk assessment arrangements involving specialist input from key stakeholders, including the port’s pilotage provider, Poseidon Sea Pilots (PSP). The collective expertise of PSP’s pilots in respect to ship handling (including factors pertaining to ship interaction) was a valuable resource available to the regional harbour master (RHM) for consultation and advice. 

In this case, MSQ received dam water release and flood notifications and subsequently identified that resulting high river current speeds would increase the risk of a breakaway. In response, MSQ increased its monitoring of current meter data and implemented precautions and restrictions at Fisherman Islands. While these measures were aimed at addressing increased current flows, the more complex hazard of increased hydrodynamic interaction between passing and berthed ships was not identified. 

While that complexity meant that the hazard may not have been obvious prior to the OOCL Brisbane breakaway, it was readily identifiable following that initial occurrence. Had MSQ and PSP engaged in a re-assessment of the risk and existing precautions it would have probably resulted in considering additional controls such as:

• restricting ship movements during ebb tides
• minimising passing speeds
• maximising passing distances
• the greater use of tugs to minimise use of the ship’s engine.

However, the opportunity to identify such controls was missed as MSQ procedures did not require or prompt formal collaborative risk assessment with PSP and other relevant stakeholders. Consequently, no further controls were in place when CMA CGM Bellini broke away 4 days later in almost identical circumstances. 

Further, MSQ procedures did not identify current speed or catchment inflow trigger points to inform its response to the escalating situation. Its procedures for weather event preparedness could have benefited from the routine and early involvement of PSP and other key stakeholders to help establish specific limits and triggers to assist with identifying the need for additional risk mitigation.    

Poseidon Sea Pilots

Pilotage is a principal risk control for ensuring the safety of port operations and ship movements. Pilotage service providers should therefore be actively involved in preparations for, assessment of, and response to, any situation affecting shipping in the port. 

As weather and river conditions began to impact the port in the days leading up to the breakaways, PSP management received communications from MSQ relating to dam releases, potential flooding and high ebb current flows. These exchanges included information regarding observed current data, the requirement for additional mooring lines and movement restrictions implemented by the RHM.

While PSP complied with the RHM’s directions, as detailed above, it was not actively involved in any formal process to identify and assess potential risks that the conditions would pose to pilotage operations. Greater involvement of PSP would have increased the likelihood that all hazards associated with the increased river flow were identified and addressed, particularly following the initial breakaway. 

The ATSB found that the company’s pilotage operations safety management system (POSMS) only contained procedures for conducting ships in normal conditions. It did not identify flooding or high current flows as a hazard that might affect pilotage operations nor contain any guidance on how these conditions would be managed. Consequently, the POSMS did not address all the operational risks that PSP pilots could be expected to manage when conducting ships. 

Finally, while the POSMS identified the responsibilities of key management personnel for managing issues related to the safe, effective and efficient delivery of pilotage services, procedures detailing how these duties were to be discharged did not exist.

Findings

From the evidence available, the following findings are made with respect to the breakaway occurrences involving OOCL Brisbane and CMA CGM Bellini in the Port of Brisbane, Queensland on 16 May and 20 May 2022, respectively.

Contributing factors

• Heavy rainfall resulted in significant freshwater inflows into the Brisbane River, including from several controlled releases from dams upstream from the Port of Brisbane. The inflows resulted in strong ebb currents through the port which increased the loads on mooring arrangements for ships berthed at Fisherman Islands.
• The combined effects of high ebb current speeds and interaction forces introduced by Delos Wave and APL Scotland when passing and manoeuvring ahead OOCL Brisbane and CMA CGM Bellini, respectively, resulted in the berthed ships’ mooring arrangement limits being exceeded.
• Maritime Safety Queensland and Poseidon Sea Pilots did not have a process to jointly and effectively identify and risk assess the hazards to shipping and pilotage that were outside normal environmental conditions. (Safety issue)

Safety issues and actions

MSQ and PSP assessment of risk  

Safety issue number: MO-2022-004-SI-01

Safety issue description: Maritime Safety Queensland and Poseidon Sea Pilots did not have a process to jointly and effectively identify and risk assess the hazards to shipping and pilotage that were outside normal environmental conditions. 

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the master and crewmembers of OOCL Brisbane
• the master and crewmembers of CMA CGM Bellini
• the master and crewmembers of Delos Wave
• the master and crewmembers of APL Scotland
• Australian Maritime Safety Authority
• Maritime Safety Queensland
• Queensland Government
• Bureau of Meteorology
• Seqwater
• Poseidon Sea Pilots
• Port of Brisbane
• Seaport OPX

References

Maritime Safety Queensland 2021, Port Procedures and Information for Shipping – Port of Brisbane, Queensland Government. <https://www.msq.qld.gov.au/shipping/port-procedures/port-procedures-brisbane>

Maritime Safety Queensland 2021, Maritime Safety Queensland Extreme Weather Event Contingency Plan Brisbane – 2021/2022, Queensland Government. <https://www.msq.qld.gov.au/safety/preparing-for-severe-weather>

The West of England Ship Owners Mutual Insurance Association (Luxembourg), Interaction Damage to Vessels Moored Alongside. 

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the master and operators of OOCL Brisbane
• the master and operators of CMA CGM Bellini
• the master and operators of Delos Wave
• the master and operators of APL Scotland
• Poseidon Sea Pilots
• Maritime Safety Queensland
• Australian Maritime Safety Authority
• Hong Kong Marine Department
• Ministry of Transport, Singapore
• Transport Malta
• Maritime Administrator, Marshall Islands

Submissions were received from:

• Poseidon Sea Pilots
• Maritime Safety Queensland

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.