Executive summary

What happened

On 6 January 2022, freight train 5446, operated by Southern Shorthaul Railroad (SSR), departed from Narrabri West for Bullock Island at Newcastle, New South Wales. Due to a steep uphill gradient en route, three additional (banking) locomotives were attached to the rear of 5446 at Werris Creek.

Shortly after departure from Werris Creek, the banking locomotives separated from the rear of the train. Although the brakes automatically applied on both the lead portion of 5446 and the separated banking locomotives, the driver of the banking locomotives released this brake application. As a result, after the lead portion of 5446 had stopped, the banking locomotives collided with the rear of 5446. Significant damage to rolling stock resulted from the collision. 

What the ATSB found

The cause of the train separation was highly likely due to the knuckle on the bottom operated coupler of the lead banking locomotive remaining unlocked after coupling. A stretch test, which would have identified the unlocked state of the knuckle, was not performed. It was found that the crew member who performed the shunt did not have a full understanding of automatic coupler operation. In addition, it could not be determined that the banking locomotive crew had previously demonstrated a sufficient level of competence in a stretch test procedure, either with SSR or previous operators. 

After the separation event, the response taken by the banking locomotive’s driver in relation to the sudden loss of brake pipe pressure was, while inappropriate for the situation, consistent with their training and SSR’s emergency response procedures. These procedures did not differentiate between head end only and banking train operations. The appropriate response during an emergency for these differing operations can be vastly different. 

Lastly, it was found that SSR’s risk assessments for this operation were mostly performed by members of the management team. While the team had varying levels of operational experience, consultation with operational staff directly affected by the operation did not occur. This had the potential for risks to be missed during the risk assessment process.

What has been done as a result

In response to the safety issues raised, SSR took safety action to:

• provide train crew with reference materials related to coupler functionality
• defined the process for a ‘stretch test’ after coupling and other shunting terms
• contextualised emergency procedures for banking operations
• further defined the need for adequate consultation during material change.

While not related to a safety issue, both Southern Cross Civil and Rail Training and Pacific National took the opportunity to review and update their training materials in shunting operations, in response to safety factors identified within the report.

Safety message

The competence of rail safety workers is critical to safe railway operations. Where competency assessments are aligned to the Australian Qualifications Framework (AQF), certain standards must be met. These include, in part, that sufficient assessment evidence be collected to ensure a reliable competency decision can be made. In the absence of an alternative and equivalent method, rail transport operators should follow these same principles when delivering enterprise‑based assessments.

Further, during assessment of risk, consultation consisting of effective and meaningful engagement with stakeholders is key to ensuring risks are identified and appropriate controls are implemented. In instances of unique operations, this engagement becomes critical in identifying novel risks which may not be immediately apparent. Particular attention should be given to procedures utilised in past operational environments, to ensure their ongoing appropriateness in these unique operational circumstances.

The occurrence

Arrival at Werris Creek

On 6 January 2022, freight train 5446, operated by Southern Shorthaul Railroad (SSR), departed from Narrabri West (565.750 km),[1] New South Wales for Bullock Island (170.298 km) at Newcastle, New South Wales. The train was powered by three diesel electric locomotives hauling 49 wagons loaded with export wheat.

About 0620,[2] train 5446 stopped on the mainline at Werris Creek (410.800 km) clear of the station platform to allow for a crew change and the attachment of three banking locomotives,[3] based at Werris Creek. The banking locomotives were to be attached to the rear of 5446 to provide additional traction power for the heavy uphill grade from Chilcotts Creek (372.300 km) to Ardglen (363.300 km) (see Figure 1).

Figure 1: Location of banking operations

 Source: John Holland, annotated by OTSI

The crew of the banking locomotives consisted of a trainee driver (driving) who signed on at Muswellbrook at 0315, and a mentor driver (supervising), who signed on at Werris Creek at 0445. 

At 0623, the network control officer (NCO) cleared the signal to allow the awaiting banking locomotives on the Armidale side of the station platform to proceed onto the rear of 5446 and attach. The trainee driver of the banking locomotives then moved the locomotives towards the rear of 5446, stopping about 20 m short to allow the mentor driver to alight and perform the on-ground coupling duties.

The trainee driver, under radio instruction from the mentor driver, then moved the banking locomotives onto the rear of 5446 and coupled. Closed circuit television (CCTV) showed that the banking locomotives moved slightly away from the rear of 5446 after coupling, with the mentor driver briefly looking away from the train at this time. The locomotive’s data logger confirmed that the banking locomotive’s independent brake[4] was partially applied. The direction controller remained in reverse which meant a stretch test[5] of the couplers was not performed at that time. The CCTV also showed that the weather was fine, with morning daylight conditions.

The mentor driver then coupled the brake pipe hoses between the last wagon of 5446 and the lead banking locomotive (L277) for train braking purposes. The lead crew of 5446 then performed a brake pipe continuity test[6] with the banking locomotive crew, which verified the brakes were continuous and working throughout the train.

At 0640, the lead crew of 5446 was changed. The rear banking locomotive crew remained unchanged.

Departure from Werris Creek

At 0642, train 5446 departed Werris Creek with three locomotives at the front hauling the 49 loaded grain wagons, and three locomotives attached at the rear for banking purposes. The trainee driver and mentor driver were in the banking locomotive at the very rear of the train, facing the track in the opposite direction of travel. Communications between train crew en route (between the lead and banking crews) regarding signal aspects observed at the front and power requirements from the banking locomotives at the rear, was conducted using radio communications on a discrete SSR channel. The driver of the lead locomotive initiated all train braking commands.

As there was an uphill grade for almost 4 km on departure from Werris Creek, both the front and banking locomotives had power applied on departure, with full power (eight notches) selected at both the front and back of the train about one minute after departure.

After about 407.000 km, the gradient peaked in height and changed to a downhill grade, with two short sections of level/near level grade en route to Quipolly (402.000 km). As a result, at 0647 the lead locomotive commenced a reduction in traction power setting, with idle selected at about 406.500 km. The banking locomotives remained temporarily in full power before the trainee driver commenced traction power reductions, which kept the train under compression.

At 0648:31, with the train now on a downhill gradient, the driver of the lead locomotive engaged dynamic braking[7] and made an automatic brake application at 63 km/h. This enabled a test of the effectiveness of the train’s brakes, in preparation for the steep downhill grade from Ardglen to Pages River. This automatic brake application took effect on the banking locomotives 4 seconds later (Figure 2).[8]

Figure 2: Track profile from Werris Creek to Quipolly 

Overview of the track gradients on departure from Werris Creek, and coinciding events relating to the banking locomotives on 5446.  
Source: ARTC, annotated by OTSI

At 0649:09, with the train’s speed stable at 64 km/h and, coinciding with the banking locomotives tractive power being reduced to a minimum (one notch), the driver of the lead locomotive released the train’s brakes. Seven seconds later, this brake release command took effect on the banking locomotives at the rear of the train.

Separation event

Coinciding with reaching a relatively level piece of track and slowing slightly, at 0649:46 the banking locomotives separated from the rear of train 5446, 7 mins and 5 kms from departure. Most of the train was now on a downhill grade towards Quipolly. 

The consequent separation of the brake pipe hose between the banking locomotives and the train resulted in a sudden loss of all brake pipe pressure on the banking locomotives, resulting in a power control switch (PCS)[9] warning light activation and the three banking locomotives’ brakes automatically applying. The trainee driver observed the PCS warning light and advised the mentor driver of the light activation, with both checking their rear-view mirrors for any issues along the length of the train. As the train was on straight track the separation event was not observed. As no issue had been identified, the trainee driver ‘bailed-off’[10] the brake application to avoid flat wheels[11] as per their training. During this time, the speed of the banking locomotives reduced from the 51 km/h at the time of train separation to 26 km/h. 

Meanwhile, the driver of the leading portion of 5446 observed that the flowmeter[12] on the lead locomotive was registering an air pressure loss to the brake pipe. Although a high brake pipe pressure was maintained, the loss of some brake pipe pressure resulted in the brakes beginning to slowly apply on the wagons, and the train to gradually reduce speed. The driver of the leading portion of the train believed there had been a false activation of the vigilance penalty[13] on one of the trailing lead locomotives, a situation they had encountered with a previous rolling stock operator.[14] The driver, based on this assumption, elected to maintain dynamic braking in anticipation of 5446 coming to a stop. 

At 0650:21, almost 40 seconds after the train separation event, the brakes automatically reapplied on the banking locomotives. The variation in speeds between the two portions of the train had now resulted in a separation distance of 129 m between the rear of 5446 and the banking locomotives. The trainee driver again bailed-off this brake application releasing the brakes on the banking locomotives at 23 km/h. 

At 0650:39, 5446 came to a stop at 404.239 km due to the uncommanded automatic brake application. A 58 m distance now separated the rear of 5446 from the banking locomotives. 

Eight seconds later, as the lead portion driver contacted the banking locomotive crew by radio to advise that 5446 had stopped due to a suspected false vigilance penalty, the banking locomotives collided with the rear of 5446 at 28 km/h. The trainee driver on the banking locomotives immediately advised the lead portion driver that they believed they had derailed. Upon inspection, the banking locomotive crew identified there had been a collision between the banking locomotives and the rear of 5446. 

As a result of the collision, the mentor driver on the banking locomotives suffered a minor head injury, after being struck by an unrestrained item in the locomotive cabin. In addition, severe damage occurred to the rear grain wagon of 5446, and the lead banking locomotive.

Context

Weather and environmental information

The nearest weather observations were taken at Quirindi, about 12 km from the accident site. On the morning of the accident sunrise was at 0559, almost one hour prior to the incident. Later, at 0900, there were light winds recorded, with clear conditions and no cloud cover for the area. No rain was recorded for the day.

Weather and environmental conditions were not considered contributory to the accident.

Train crew information

Mentor driver

The mentor driver commenced in the rail industry in 1999. In 2015, after working in various depots, the driver was based at Werris Creek with another rolling stock operator (RSO). In mid‑2020, the driver joined Southern Shorthaul Railroad (SSR), operating trains on the Narrabri North, New South Wales to Sydney corridor, including over the Ardglen Bank. In December 2021, the driver became a mentor driver in preparation for becoming a driver trainer once they had completed the required training.

The mentor driver held a Certificate IV in Train Driving, which was obtained under recognition of prior learning. As this was issued prior to the mentor driver joining SSR, they undertook a driver’s practical assessment on joining SSR to ensure that they met SSR’s specific operational competency requirements. In addition, the mentor driver held all required route and safeworking qualifications.

On the day of the accident, the mentor driver started at Werris Creek at 0445 after a 4 day break, which included both rostered days off and shifts on standby. Fatigue was not considered a factor for the mentor driver on the day. 

Trainee driver

The trainee driver commenced in the rail industry in 2017 as a driver’s assistant at Werris Creek, which included operations over the Ardglen Bank. In August 2020, the trainee driver joined SSR as a driver’s assistant, becoming a trainee driver two months later.[15] They were based at Muswellbrook and Ulan, New South Wales, before transferring back to Werris Creek in June 2021. Since that time, the trainee driver had mainly operated the banking engines between Werris Creek and Pages River/Murrurundi.

The trainee driver held a statement of attainment for units of competency which could apply to a driver’s assistant. As this was issued prior to the trainee driver joining SSR, they undertook a driver’s assistant practical assessment to ensure that they met SSR’s specific operational competency requirements. In addition, the trainee driver held the required safeworking qualification for the route.  

On the day of the accident, the trainee driver started at Muswellbrook at 0315 after a 3 day break, which included both rostered days off and a shift on standby. Fatigue was not considered a factor for the trainee driver on the day. 

Train information

General

Train no 5446 consisted of three locomotives (controlled by the lead driver) hauling 49 x BGKF wagons loaded with export wheat, weighing an estimated 4,263 t. At Werris Creek, three additional locomotives were attached at the rear of 5446 for banking purposes (controlled by the trainee driver). The train length on departure from Werris Creek was 943.60 m. 

Locomotive cabin 

The banking locomotives’ train crew were in locomotive C506, which was at the very rear of the train. They were facing opposite to the direction of travel. Visibility of the train was limited to that available from the rear facing side mirrors.

At the driver controls was the trainee driver, who could observe several warning light indications and pressure gauges to monitor the train consist. These included pressure changes in the train’s brake pipe and C506’s brake cylinders, and warning lights associated with C506’s PCS function and brake cylinder pressure (Figure 3).

Figure 3: Locomotive C506 control indications

Control indications on C506 as applied during banking operations.
Source: OTSI

The mentor driver, who was seated in the observer’s seat, had access to basic functions such as the locomotive horn and light switches. Although the speedometer had a side panel to enable speed monitoring by the mentor driver (Figure 3), they relied on the trainee driver to advise them of gauge and warning light indications. 

Network information

General

The section of track between Werris Creek and Quipolly (the accident section), was managed by the Australian Rail Track Corporation (ARTC). Network control services were provided by ARTC’s Upper Hunter no 2 control board, based at Broadmeadow, New South Wales. The safeworking system that applied was ‘rail vehicle detection’, using track circuits to detect trains and colour light signals.  

Werris Creek Yard

On most occasions and on the day of the accident, prior to the arrival of 5446 at Werris Creek, the banking locomotives exited the yard and waited at the platform on the Armidale side of the station, as depicted in Figure 4. On arrival from Narrabri, 5446 proceeded via the northwest main line onto the main line at Werris Creek, stopping at signal 15-34 and clear of signal 15-39 at the rear. Once 5446 had stopped, the banking locomotives proceeded on the authority of the shunt signal attached to signal 15-44 and coupled to the rear of 5446, clear of signal 15-39.

Figure 4: Routes taken by 5446 and banking locomotives

The route taken by the banking locomotives prior to the arrival of 5446 at Werris Creek is depicted by the light green dotted line, with the route taken by 5446 on arrival shown by the light blue dotted line. Once 5446 had stopped clear of signal 15-39, the banking locomotives attached to the rear of 5446 as depicted by the purple dotted line. 
Source: ARTC, annotated by OTSI

The distance between signals 15-34 and 15-39 was 1,012 m, with the length of 5446 (including the attached banking locomotives) being about 944 m. When interviewed, the mentor driver described this as problematic. At least a ‘couple of times’ stretch tests were unable to be performed due to the proximity of the banking locomotives to signal 15-39 in the rear, after the grain train had stopped a greater distance than usual from signal 15-34 on arrival (Figure 5). This was not a factor on the day of the accident.

Figure 5: Banking locomotives’ attachment location

Source: ARTC, annotated by OTSI

Werris Creek to Murrurundi

The track profile from Werris Creek (410.800 km) to Willow Tree (375.735 km) was undulating with interspersed short sections of uphill gradient. As depicted in Figure 6, from Willow Tree a moderate uphill grade was encountered to Chilcotts Creek (372.302 km), from where a steep 1:40 uphill grade[16] applied to the Ardglen Tunnel (362.572 km).

Figure 6: Track profile from Willow Tree to Murrurundi

Dotted vertical lines are in 1 km increments.
Source: ARTC, annotated by OTSI

From Ardglen Tunnel, the track commenced a steep downhill grade of about 1:45 to Pages River (354.915 km), where it reduced to a moderate downhill grade to Murrurundi (352.327 km). 

The track speed was generally 115 km/h on the straight sections between Werris Creek and Chilcotts Creek, however, grain trains were limited to 80 km/h. From Chilcotts Creek to Ardglen Tunnel, banked trains were limited to a maximum of 50 km/h. As there was a steep uphill gradient on this section, grain trains operated up the grade substantially below the speed limit.

Ardglen banking operations

General

ARTC general train operation requirements were included in its train operating conditions (TOC) manual. Section 2 of the TOC manual (locomotive operations) described locomotives placed throughout a train consist as a ‘distributed power’ configuration. Where there was insufficient tractive effort available to haul the train up a steep grade, additional locomotives could be temporarily placed at the rear of the train to assist. In this instance, the configuration was considered a ‘banking’ operation. Limits on tractive power at the rear and minimum wagon mass within the consist applied to banking operation trains. These restrictions were in place to prevent excessive L/V ratio[17] in-train forces that may result in wagon lift and derailment if not observed.

For the Ardglen Bank, specific banking requirements between Chilcotts Creek and Murrurundi were contained in ARTC’s Route Access Standard (RAS) H2 (Muswellbrook–Werris Creek). As discussed further in this section, SSR’s banking operations were required to commence at Werris Creek, rather than Chilcotts Creek. To facilitate this, ARTC published supplementary instructions in TOC waiver 18060 (Operation of SSR grain trains between Newcastle and Moree & return) in April 2018, which was replaced by TOC waiver 21004 (Operation of SSR trains and light engines between Newcastle and Moree & return) in January 2021. These waivers were partly based on an independent assessment of in-train forces during banking, which was provided to ARTC in June 2017.

Chilcotts Creek based operators

In addition to SSR, two other rolling stock operators (RSOs) banked trains on the Ardglen Bank. Their banking locomotives were stowed in sidings at Chilcotts Creek provided for this purpose. As their banking locomotives were attached to the rear of their trains at the commencement of the steep uphill grade, the banked train was always in a compressed state to the Ardglen Tunnel.

Consistent with the requirements of ARTC document RAS H2, the knuckle of the automatic coupler on the banking locomotives pressed against the train to be banked was not required to be locked during coupling. Rather, an anti-locking device was placed around the top lifter pin of the banking locomotive’s coupler to prevent this from occurring (see Automatic couplers for further information). In addition, the brake pipe was not connected between the train and the banking locomotives (see Automatic brake). 

When the banked train reached the summit of the Ardglen Bank on the western approach to the Ardglen Tunnel, the banking locomotives for these operators slowed to a stop, automatically separating from the rear of the train. This allowed the banked train to continue its journey without stopping.

Southern Shorthaul Railroad

History

SSR commenced grain train banking operations between Werris Creek and Pages River in about October 2017, ceasing about 6 months later due to drought conditions impacting loading availability. It recommenced banking operations in October 2020, and changed the location of the train crew from the lead banking locomotive to the rear banking locomotive.[18] This change altered the vision of the banking locomotive train crew from viewing the rear wagon and coupler during banking operations, to a rear view of the track, in the opposite direction of travel.

As there was no spare siding accommodation at Chilcotts Creek to store SSR’s banking locomotives between duties, the locomotives were stored and attached to the rear of SSR’s grain trains at Werris Creek. In October 2020, SSR approached ARTC to change its banking locomotive stabling location from Werris Creek to Willow Tree (see Figure 6). The change request was made to improve operational efficiency by reducing non-revenue running of the banking locomotives. ARTC did not agree to this request, and the stabling location of SSR’s banking locomotives remained at Werris Creek.

Operation

Although banking was only required between Chilcotts Creek and Ardglen, the banking locomotive crews would take the opportunity to assist loaded trains over other uphill grades on the undulating terrain between Werris Creek and Chilcotts Creek. In addition, to limit instances of slack[19] run‑out,[20] it was common practice to maintain 1­–2 notches of traction power to assist in keeping the banking locomotives compressed against the rear of the train being banked.

Consistent with TOC waiver 21004, SSR required the banking locomotive’s automatic coupler to be connected and locked to the rear grain train wagon’s coupler during banking operations. This was due to the train traversing the undulating grade between Werris Creek and Chilcotts Creek (Figure 7), to ensure that the banking locomotives would not separate from the rear of the grain train en route. In addition, the brake pipe was also connected between the banking locomotives and the rear grain wagon, with all train braking and release commands on the train being initiated by the driver at the front of the train.

Figure 7: Track profile from Werris Creek to Chilcotts Creek

Source: ARTC, annotated by OTSI

Once the grain train had reached the Ardglen Tunnel, the banking locomotives would cease assisting with traction power. On arrival at Pages River, the grain train would stop, and the banking locomotives would be uncoupled to allow for their return to Werris Creek for storage in preparation for their next banking duties.

Automatic couplers

General

Couplers are fitted to both ends of most rolling stock to enable coupling to adjacent vehicles when marshalling a train. Automatic couplers are frequently fitted to freight rolling stock, automatically closing and locking the knuckle/s of open couplers when rolling stock are pushed together (Figure 8), at which point the rolling stock are ‘coupled’. 

Figure 8: Open and closed automatic coupler

An open knuckle (left image) and a closed and locked knuckle (right image). The locking block keeps the knuckle from opening once closed. If adjacent rolling is coupled, the pairing knuckle of the adjacent rolling stock would lock in behind the pictured knuckle.

Source: OTSI

To couple up to other rolling stock, either one or both automatic couplers on the rolling stock to be coupled should have their knuckles fully opened prior to coupling the rolling stock together. When uncoupling, at least one of the knuckles is to be unlocked to allow this to occur. 

Although automatic couplers perform the mechanical function of coupling, any air, electrical and hydraulic connections are required to be manually performed by the shunting personnel. 

Operation

When shunting, the person conducting shunting operations on the ground operates the control rod which acts on the lifter (Figure 9). This either pulls or pushes the locking block clear of the knuckle (Figure 10), thereby unlocking it. 

Figure 9: External coupler components

Main external coupler components. The area circled orange is magnified in Figure 11.
Source: ATSB

Figure 10: Locking block and lifter

Source: OTSI

Figure 11 illustrates the sequence of mechanical events internal to the coupler body when performing coupling operations, as follows:

• Image 1: As the locking block moves upward during unlocking, it contacts with and thereby engages the kicker, which assists in pushing open the unlocked knuckle. In addition, the tongue of the locking block (see also Figure 10), rests on the set shelf within the coupler, keeping the locking block raised and the knuckle in an unlocked state. This allows the shunting personnel to release the control rod without the knuckle immediately re-locking. The purpose of this safety design feature is to allow shunting personnel to: 
  • manually open the knuckle for coupling in instances where the kicker has not sufficiently opened the knuckle
  • stand clear of the rolling stock profile while uncoupling operations occur. 
• Image 2: As the knuckle opens fully, a raised contact point on the top side of the inner knuckle contacts the locking block, pulling the locking block and its tongue outwards, dislodging it from the set shelf. This effectively arms the locking block to automatically drop in front of the inner knuckle once the knuckle is closed.
• Image 3: Once the locking block drops in front of the inner knuckle, it locks it in place, preventing it from reopening (see also right-hand image in Figure 8). 

Figure 11: Internal coupler mechanisms

This image shows operation of the internal mechanisms within the coupler body. Image numbers 1 and 3 have had the knuckle physically removed to allow visibility of the locking block.

Source: OTSI  

Importantly, once the locking block tongue has come to rest on the set shelf, the knuckle must be fully opened to dislodge the tongue from the set shelf, thereby enabling the knuckle to be relocked. If the knuckle remains closed but unlocked, it will not lock again regardless of how much inwards pressure is exerted, as the locking block tongue will not dislodge from the set shelf. So, if both automatic couplers on adjacent rolling stock are unlocked for coupling, but only one knuckle is fully opened, only the fully opened knuckle will lock when the rolling stock are pushed together regardless of the buff (compressive) force applied. This will result in the closed but unlocked knuckle remaining in an unlocked state after coupling, and a train separation when the train is next moved with a draft (stretched) force.

Top versus bottom operated couplers

While the operation of the automatic coupler remains the same, there is a subtle design difference in the way the locking block is lifted for a top versus a bottom lifter operation. The top lifter pulls up the locking block when operating the control rod, whereas bottom lifter pushes up the locking block. While top lifter operation is more common, the bottom lifter design allows for a lower control rod and lifter position, providing clearance from pipework (on locomotives) and reduced obstruction during loading (container wagons) (Figure 12). 

Figure 12: Comparison of top lifter (left) versus bottom lifter (right) automatic couplers

Source: OTSI

As described in Operation, although the locking block can be visually observed in the locked position when uncoupled (Figure 8), this is not possible when coupled to another knuckle on adjacent rolling stock. 

For top lifter operation, the lifter and control rod linkage are mounted on the top of the automatic coupler body. As shown in Figure 13Figure 13, the lifter gives a clear and reliable visual indication of the position of the locking block. Unless the locking block has fully engaged in the locked position in front of the inner knuckle, the lifter will appear in a raised position. 

Figure 13: Top lifter operated automatic coupler

Visual appearance of the lifter in various operational knuckle states for a top lifter operated automatic coupler.

Source: OTSI

For bottom lifter operation, conversely the lifter and control rod linkage are mounted on the bottom of the automatic coupler body. As shown in Figure 14, the lifter provides almost no appreciable difference in indication of the position of the locking block, irrespective of whether it is in the locked or unlocked position. There is no reliable visual representation of the position of the locking block available for a bottom lifter operated automatic coupler.

Figure 14: Bottom lifter operated automatic coupler

Visual appearance of the lifter in various operational knuckle states for the bottom lifter operated automatic coupler that was fitted to locomotive L277, the accident locomotive. Note: the coupler has been bent downwards from the accident.

Source: OTSI

Shunting requirements

As a result of the visual limitations of the status of the locking block on bottom lifter operated automatic couplers, a common industry practice for these types of couplers is to perform a stretch test after coupling. This ensures that the locking block has fallen into place in front of the inner knuckle, locking it in place. If the couplers separate during a stretch test, it indicates that one or both knuckles remained unlocked after the coupling operation. Alternatively, if the couplers remain coupled, it indicates that both knuckles have been locked correctly.

As with many rail industry procedures, how a stretch test was conducted was determined by individual rolling stock operators (RSOs), rather than detailed within an industry standard. Two of the largest rail freight RSOs in Australia required that light locomotive traction power be applied in the direction away from the coupled location to perform a stretch test. This was to provide assurance that sufficient tension had been applied to the knuckles, thereby ensuring physical train separation in the event one or both couplers had not locked.

SSR advised that it considered sufficient strain on the couplers could be provided by a ‘… gravitational “bump”’, not necessarily with the application of accompanying traction power. 

SSR shunting procedures

SSR had several procedures relating to its shunting requirements, which were supported by training and assessment, including:

• WIM 63001 (Policies and general train operations work instruction manual), section 20 ‘coupling and uncoupling rolling stock’ which described shunting operations, including the requirement for stretch tests to be performed. The instruction did not detail SSR’s process for a stretch test.
• Notice 62269 (Ardglen banking procedures), which specified banking engines were to be hard coupled to the rear of banked grain trains. After coupling, the bank engines were to ‘…“ease off” to ensure that the coupler on the bank engine has become coupled’ to prevent uncoupling while the train was in transit. In this case an ‘ease off’ rather than a stretch test was referred to. The process as applied to SSR operations was not described. 

For new employees without prior shunting qualifications, SSR provided training and assessment aligned to the national unit of competency TLIC4074 (shunt, couple and uncouple rail vehicles).[21] The assessments included theoretical questions regarding the purpose of a stretch test, and a practical evaluation of the tasks involved.

The training and assessment aligned to TLIC4074, the supporting instructions contained within WIM 63001 and notice 62269, did not explain details of:

• the coupler safety design feature, which required an unlocked knuckle to be fully opened to allow relocking
• visual limitations relating to the locking block position on bottom operated couplers
• SSR’s process for a stretch test/ease off.

Of note, the SSR learner’s resource material for TLIC4074 stated that locking blocks could ‘jam’, resulting in the coupler knuckle remaining unlocked. In these instances, employees were required to separate the train and investigate the cause. However, it did not detail what the possible causes were, or how these may be rectified.

Coupler inspections

The coupler on the accident end of L277 had a casting date of August 2002 and was likely fitted shortly after casting by its then owner, Rio Tinto. SSR acquired L277 in 2020, with the couplers inspected and deemed compliant during the locomotive’s previous 30-day inspection. 

Both couplers on BGKF 1122F (the accident wagon) were replaced in November 2019. A major biennial ‘B service’ was conducted on the wagon 3 months before the accident, which included a full wagon lift. The couplers were inspected during this service and deemed compliant.

An inspection of the couplers after the accident by Bradken at Newcastle, New South Wales, found that the:

• Accident end coupler of L277, while worn, was within wear limits and was mechanically fully functional.
• Accident end coupler of BGKF 1122F showed minimal signs of wear, but due to significant deformity resulting from the accident was no longer functional. 

Accident site

A review of evidence taken at the accident site was used to determine the mechanical state of the automatic couplers leading up to the accident. After the accident, the air brake hoses were found to be undamaged and disconnected consistent with separation having occurred between the banking locomotives and the rear of the train prior to the collision. The automatic couplers of locomotive L277 and BGKF 1122F were found to be coupled together and the knuckles locked (Figure 15), indicating that the physical structure of the couplers was sound and the knuckle locking mechanisms functional.[22] In addition, both couplers were fitted with bottom interlocking shelves, which prevented vertical disengagement of the knuckles while in transit. 

Figure 15: Coupling between L277 and BGKF 1122F

Note: Both the locomotive and wagon’s brake pipe taps were closed post-accident.
Source: SSR, annotated by OTSI

All coupling components were accounted for at the accident site including the coupler, yoke pin, follower, draft pack and yoke, indicating that there had not been a catastrophic mechanical failure of the coupling mechanisms en route (Figure 16). 

Figure 16: Wagon BGKF 1122F coupler components

Note: The wagon’s brake pipe tap was closed post-incident.
Source: SSR, annotated by OTSI

Finally, the bent nature of the striker, sheared-off pin carrier plate and upward bend of the coupler and yoke of BGKF 1122F, was consistent with the coupling mechanism being located within the wagon body at the time of the collision and upward lift of the wagon as it lodged into the long hood of locomotive L277.

Damage to 5446 was limited to the rear wagon of the grain train (BGKF 1122F), including a significant grain spill, and the leading banking locomotive (L277). ARTC advised that there was no track damage from the accident which required repair.

Training and assessment

Introduction of the national system in the rail environment

In 2006, the National Transport Commission (NTC) released the model Rail Safety Bill as a first step in rail safety legislation harmonisation across all the Australian states and territories. One aspect of the harmonised laws was the requirement for rail transport operators to assess rail safety worker competence[23] against available national competency units (see Australian Qualifications Framework (AQF)). This requirement was embedded in s.21 of the Rail Safety Act 2008 No 97 (NSW) that subsequently followed. 

In January 2013, the Rail Safety National Law (NSW) (RSNL) came into effect and was administered by the Office of the National Rail Safety Regulator (ONRSR). For compliance with the RSNL,[24] ONRSR advised, in part, that once a position was identified as rail safety work, a rail transport operator was required to:

• Perform a task analysis to understand the competence requirements of the position, specifically, a defined list of tasks and, required technical and non-technical knowledge and skills.
• Assess the risk of the tasks to determine appropriateness and applicability of training as a risk control.
• Ascertain the extent to which competency gaps could be addressed through an AQF unit of competency.
• Utilise enterprise assessments to assess competence where an AQF competency did not exist or fully meet requirements.[25]

Australian Qualifications Framework (AQF)

The AQF provided the standards required for nationally recognised qualifications through policy and the standardisation of learning outcomes for each qualification type. This ranged from a Certificate I (level 1) to a Higher Doctoral Degree (level 10). For Vocational Education and Training (VET), AQF levels 1–8 applied for qualifications ranging from a Certificate I to a Graduate Diploma. 

At the time of the accident, training packages were developed by skills service organisations in consultation with industry. Approved training packages were endorsed for use by the Council of Australian Governments Industry and Skills Council. For the rail industry, the TLI10 (transport and logistics training package) applied, which detailed available units of competency which could be packaged into a nationally recognised, portable qualification. 

National recognition of VET units of competency and qualifications was the result of quality assurance by the national VET regulator, the Australian Skills Quality Authority (ASQA),[26] through:

• registration of registered training organisations to authorise delivery and assessment of VET 
• monitoring of compliance to the VET standards[27]
• accreditation of nationally recognised courses, where a training package did not apply. 

A VET qualification typically comprised of a minimum number of core and a mix of elective units of competency. At the time of the accident, the VET qualification TLI42621: Certificate IV in Train Driving was available for train crew. This qualification consisted of 21 units of competency, as follows:

• 12 core units.
• 5 units aligned to specialised elective groupings, which contextualised the operational environment, i.e. A) freight, B) urban electric, C) country passenger operations, D) steam locomotive and E) heritage motive power.
• 4 units from a list of 35 electives, chosen by the registered training organisation as determined by the operational requirements of the employing rail transport operator. 

There was no equivalent VET qualification for the driver’s assistant position. Instead, units of competency from TLI42621 were selected by the registered training organisation to reflect the competencies required by the operator, based on the knowledge and skills necessary to perform the role specific to its operations. In this case, a Statement of Attainment was issued allowing national recognition of these individual units of competency.

In relation to competency assessment of skills and knowledge for shunting operations, the AQF provided the unit of competency TLIC4074 (shunt, couple and uncouple rail vehicles). This unit was available as a general elective within TLIC42621.

AQF assessment

The requirements for assessment when imparting VET competencies and qualifications, including through recognition of prior learning,[28] was detailed in the Standards for registered training organisations 2015 (Cwlth).[29] These consisted of:

• Principles of assessment: where assessment was fair, flexible, valid and reliable.
• Rules of evidence: where evidence collected was valid, sufficient, authentic and current.

This ensured integrity of the competency assessment decision and judgments and, gave confidence that assessments of competence were sound, reliable and consistent across the VET sector.

To ensure these requirements were met, registered training organisations (those delivering and assessing VET)[30] were required to undertake assessment validation activities. This involved periodically reviewing a sample of assessments previously undertaken to ensure the assessment tool, process and judgements reliably met the requirements of the principles of competency assessment and rules of evidence. Registered training organisation validators were required to be independent of the training delivery and competency assessments being reviewed.

In relation to assessment judgements, sufficient assessment evidence was to be retained to enable review and validation of the competency judgement decision. The purpose was to ensure that assessment decisions would be consistent across assessors (‘reliable’), based on the evidence gathered (‘sufficient’), thereby allowing sound competency decisions to be made. Guidance for this and other requirements of registered training organisations in meeting their VET obligations was contained in ASQA’s guidebook Users’ guide to the standards for registered training organisations 2015.[31]

For theory assessments, the ASQA user’s guide suggested that model answers could be provided to assessors to enable evaluation against responses provided. For practical assessments, it was recommended that ‘practical skills are well described and include observable behaviours’, in addition to assessing the underpinning knowledge of the observed task by ‘asking the student why they are doing something’. This assured the assessor that the person being assessed was not solely mimicking a previously demonstrated task.

Enterprise attainment

VET units of competency could be used as transportable qualifications for rail safety work. However, individual rail transport operators were required to ensure that competency was assessed for all its specific knowledge and skill requirements, such as:

• the contents of the operator’s safety management system 
• specific operational task risks and risk controls
• safeworking[32] for the operator’s particular operation and geographic location
• local track route knowledge
• motive power and rolling stock operations (types of locomotives and wagons in use)
• train operations (whether they be passenger or freight operations).

Further, the Rail Safety National Law (RSNL) allowed rail transport operators to assess competency through other means where complying with the AQF was not reasonably practicable,[33] for example, where:

• not all units of competency within the qualification were necessary
• a suitable VET unit of competency or qualification was not available
• the costs associated with complying with the AQF were prohibitive.

While formal requirements for assessment of VET qualifications applied to registered training organisations when issuing a VET qualification (see AQF assessment), it did not apply to enterprise-based assessments (that is, enterprise attainment) conducted by rail transport operators. Even so, ONRSR’s policy Application of the AQF to rail safety worker competence assessment did provide guidance to rail transport operators in this regard. ONRSR’s expectations in this case included that:

• training and assessment remained ‘consistent with the principles of competence-based training and assessment’
• sufficient assessment evidence to ensure ongoing consistent performance was obtained
• competence assessment was conducted by a person with a Certificate IV in training and assessment (or equivalent), who was independent of the person who conducted the training.

Competence retention

The ONRSR guideline, safety management system, outlined ONRSR’s expectation that there was periodic reassessment of rail safety worker competency. This was consistent with correcting degradation of worker knowledge, skill and competence, particularly where safety critical tasks were conducted irregularly (Vlasblom et al. 2020). These expectations applied to competencies achieved through both VET and enterprise attainment.

Of interest, VET attained qualifications and units of competency in rail safety work did not expire and were recognised across industry. Importantly however, the proven competency at time of qualification did expire – irrespective of how the initial competency in rail safety work was achieved (either through AQF based or enterprise attainment). As such, periodic reassessment of competence was to be conducted. The operator’s safety management system (SMS),[34] determined the intervals for reassessment to ensure workers remained competent to carry out rail safety work.

Credit transfer and additional training

As previously described, the Standards for registered training organisations 2015 (Cwlth) required national recognition and therefore portability of VET units of competency previously achieved.  

The mentor driver of 5446 held an earlier qualification TLI42615: Certificate IV in Train Driving, which they had obtained while working for Pacific National in September 2019. While this qualification had been superseded by TLI42621 by the time of the accident, it remained an equivalent qualification. The mentor driver’s TLI42615 included the unit of competency TLIC4074 (shunting).

The trainee driver of 5446 held a Statement of Attainment, which they had obtained as a driver’s assistant through Southern Cross Civil and Rail Training (SCCRT) in September 2017. It included assessed competence in 18 units of competency which were aligned to TLI42615. Their Statement of Attainment also included assessed competence in TLIC4074 (shunting).

While a rail safety worker was required to demonstrate competency against performance criteria (defined in the unit of competency) and provide performance and knowledge evidence (defined within the assessment requirements), the VET requirements were generic in nature. This allowed registered training organisations to contextualise the training and assessment of a unit of competency to the unique operating environment within which the work was conducted.

As such, although SSR (which was both a rolling stock operator and registered training organisation), recognised the previously attained VET competencies and qualifications of both the mentor driver and trainee driver, this did not satisfy its requirements for the demonstration of competence regarding its own operations; for example, SSR policies, procedures, instructions, and its unique operating equipment and environment. SSR advised OTSI that after training in SSR’s requirements, all new employees were assessed to ensure they met and were therefore current, in all required rail safety worker competencies. These assessments were enterprise‑based rather than aligned to AQF qualifications. Where competency gaps were identified during this process, further training would occur prior to reassessment of competency. 

Of note in relation to TLI42621, were the units of competency specialist elective groupings. As previously described in Australian Qualifications Framework (AQF), these five groupings contextualised the operational environment in which the qualification was originally obtained. This was important due to the specific train driving skillsets which applied to different motive power operations. For example, the method of operating a steam locomotive (specialist elective group D) was entirely different to that of an electric passenger train (specialist elective group C). Through a review of the units of competency achieved in TLI42621, a rail transport operator could determine the specific train driving skillset a driver presenting a VET qualification had previously demonstrated. During the investigation, it was identified that specialist elective groupings A (freight) and C (country passenger) were identical. This meant that a VET qualification in train driving held by a country passenger train driver, for example, a self-propelled 2-carriage diesel multiple unit, had the potential to appear identical when presented to a hiring rail transport operator as that of a heavy-haul freight train driver.

ATSB observation While VET qualifications were theoretically portable across industry, in practice this was of limited value due to the significant operational differences between rail transport operators. Though specialist elective groupings (including for the Certificate IV in Train Driving) gave further context, this too was problematic and was not necessarily reflective of the rail operating environment within which it was obtained. Further, reliability of the VET qualification in demonstrating competency in rail safety work quickly diminished due to the requirement to periodically reassess these initially proven competencies.  Given these limitations, additional enterprise-based training and assessment was always required by rail transport operators.

Training and assessment of shunting duties 

Unit of competency TLIC4074

As previously described, the VET unit of competency TLIC4074 provided a nationally recognised shunting qualification. Within this unit of competency were several assessable requirements related to coupler operation, understanding of coupler design features and testing of a successful coupling activity (a stretch test). These were:

• coupling systems are identified and applied appropriately to couple and/or uncouple rail vehicles in accordance with manufacturer and organisational requirements [performance criteria]
• operating and adapting to differences in equipment in accordance with operating procedures [performance evidence]
• shunting, coupling, uncoupling and securing rail vehicles [performance evidence]
• principles of operation for protective devices, air and electrical couplings, handbrakes, derailers and coupling equipment [knowledge evidence].

Mentor driver

The mentor driver’s assessment of competence against TLIC4074 (within their TLI42615) was achieved through recognition of prior learning (RPL). The purpose of RPL was to assess competence which had been achieved through prior formal, non-formal or informal learning.[35] This avoided training and assessment against a unit of competency where skills and knowledge were already achieved. The RPL assessment was conducted by Pacific National in September 2019. The assessment included consideration of a prior VET qualification, prior enterprise assessments, and an RPL checklist, interview and third-party report; specifically:

• Recognition of a Statement of Attainment previously issued by Asciano (Pacific National) in March 2013 which included a Certificate III aligned unit of competency TLIC3017A (shunt rolling stock). 
• In July 2016 and September 2017, Pacific National assessed the mentor driver using an enterprise-based verification of competency checklist. The mentor driver was found competent in different coupling systems and performed a stretch test on both occasions however, evidence was limited to a checkbox that this was ‘performed correctly’. There was no evidence recorded that described their understanding of these or what actions were observed.
• In July 2019, Pacific National conducted an RPL checklist, interview and third-party report which found the driver competent in shunting. As with prior assessments, evidence was limited to checkboxes that did not describe the mentor driver’s understanding of coupling systems or observed actions during a stretch test. 

Pacific National advised OTSI that the RPL checklist and interview were aligned with the training materials for TLIC4074 as delivered by it in July 2019. A review of these training materials found that while coupler operation and stretch tests were referenced, it did not describe the principles of operation of a coupling safety design feature or explain how a stretch test was conducted. Pacific National did not at that time have an instruction detailing the process for conducting a stretch test.

As mentioned in Credit transfer and additional training, SSR recognised the mentor driver’s TLI42615 issued by Pacific National. However, it required the mentor driver to be practically assessed for rail safety worker competency in its own operations. It conducted this assessment in August 2020, finding the mentor driver was competent in ‘shunting the train together’ and ‘performing a train inspection’ in accordance with the requirements of WIM 63001 (see Shunting requirements). However, evidence was again limited to checkboxes that did not describe what actions were observed, or record the underpinning knowledge that was assessed. 

In relation to a stretch test, the mentor driver advised during interview that for the previous 20 years they had been taught that this was conducted by gravity/roll back. That is, where the newly coupled portion of a train rolled back from the rolling stock it had coupled to, and remained coupled, this indicated a successful coupling. The mentor driver advised that newer staff often used a notch of power during the stretch test for purposes of recording an action on the data logger, but no SSR procedural document required this. Since the accident, the mentor driver advised that SSR required the application of power as part of a stretch test. 

In a follow-up conversation, the mentor driver advised they had been previously taught that the knuckle would only be manually opened in instances where there had been trouble in locking it. In this case the problem knuckle was to be fully opened and then closed (locked), with the other coupler’s knuckle then used to perform the coupling manoeuvre. Further, the mentor driver advised that while stretch tests had been assessed as part of their practical competency assessments, it was unclear to them what functions the assessor was observing during the test.

Trainee driver

The trainee driver was assessed as competent as a driver’s assistant against TLIC4074 by Southern Cross Civil and Rail Training (SCCRT) in September 2017, which formed part of their Statement of Attainment. The assessment consisted of both theory questions and on the job observations. A review of the theory assessment found that it did not address coupler operation, design features or the method of conducting a stretch test. The practical assessment indicated that two successful demonstrations of shunting had been observed. However, these observations did not describe the driver’s assistant’s understanding of coupling systems or, if a stretch test had been conducted, and if it had, what actions were observed.

SSR conducted a practical assessment of the trainee driver’s competence for driver’s assistant rail safety work in its operations in August 2020. On three occasions, it was recorded that the trainee driver could correctly ‘couple and uncouple rolling stock in a safe manner’ in accordance with the requirements of WIM 63001. The evidence of this was limited to nominating the yard where the actions had been observed and a checkbox of completion. The assessment did not describe what actions were observed, or the underpinning knowledge that was assessed.

Specifically, in relation to a stretch test, the trainee driver advised during interview that they understood this to be conducted by gravity. However, if the coupled rolling stock did not roll back after coupling, the trainee driver advised power would then be applied for the stretch test. 

Train braking systems

General

On SSR banked grain trains, the driver of the lead portion operated the controls from within a locomotive cabin at the front of the train consist. Tractive effort to move the train was commanded from the front of the train, with the banking locomotives (at the rear of the train) providing further tractive effort (separately commanded by its driver) when uphill gradients were encountered. For train braking however, all braking commands to slow and stop the train were commanded by the driver of the lead portion only. 

There were two pneumatically operated, ‘airbrake’ control systems fitted to 5446:

• automatic brake (controlled brakes on the entire train)
• independent brake (controlled brakes on the locomotive/s only).

The use of each of these two braking systems depends on the circumstance during which braking effort is required. For both airbrake systems, braking is achieved by the application of brake blocks directly to the locomotive or wagon wheels.

The following sections provide basic detail of these two braking systems and how they interact.[36] 

Automatic brake

The ‘automatic brake’ controls the brakes on the entire train, including the wagons and locomotive/s. Central to this system is the brake pipe, which runs along the length of the train. Changes to air pressure within the brake pipe regulate the application and release of the train’s brakes. When fully charged (brakes released), the brake pipe pressure is about 500 kPa. 

The driver regulates the pressure within the brake pipe through operation of the automatic brake handle in the driver’s cabin. To apply the brakes, the driver reduces pressure in the brake pipe. Equipment which is fitted to the locomotive/s and wagons senses this brake pipe pressure reduction and effects a corresponding air pressure increase in the locomotive and wagon brake cylinders. This pressure increase results in application of the vehicle’s brakes through the brake rigging mechanism.

It is termed the ‘automatic’ brake because the brakes will automatically apply when brake pipe air pressure is lost, such as in a major derailment or train separation where the brake pipe is broken.

Independent brake

The ‘independent brake’ applies pneumatic brakes to the locomotive/s only, independently of any trailing wagons. It is operated by the driver using the independent brake handle in the driver’s cabin. In the ‘apply’ position, air pressure is increased in the locomotive’s brake cylinders, whereas in the ‘release’ position, locomotive brake cylinder air pressure is exhausted to the atmosphere.

When pressure is reduced in the brake pipe, for example, during an automatic brake application, the locomotive’s brakes will also apply. For train handling purposes,[37] this brake cylinder pressure is usually released by the driver on hauling locomotives, without affecting the brake application on any trailing wagons. This is known as ‘bailing-off’ the automatic brake application and is achieved by the driver depressing the independent brake handle. 

Dynamic brake 

The electrical dynamic brake provides a supplementary means of train-speed control that complements the train’s pneumatic automatic brake. When selected by the driver, it alters the locomotive’s traction motor fields from a tractive power to a generator configuration, resulting in a retarding force. This retarding force is limited to the locomotive wheelsets only, rather than dispersed across the entire train. 

Operation of the dynamic brake suppresses any locomotive brake cylinder pressure which applies during an automatic brake application. This is to prevent excessive braking effort on the locomotive wheelsets, resulting in wheel lock and slide.

Banking requirements

While all train braking commands (apply and release) were commanded by the driver on the lead portion via the brake pipe, the driver of the banking locomotives also had duties to perform in relation to the airbrake system. These were described in SSR work instruction WIM63001 (Policies and general train operations work instruction manual): 

• Section 26 ‘losing the air’, in instances of sudden loss of brake pipe pressure to 0 kPa, the driver was to bail-off the automatic brake‑applied locomotive brake cylinder pressure and allow the train to stop. This procedure was generic and did not distinguish between the driver requirements for lead only consists versus banked train consists.
• Section 81 ‘3-man push pull operations’ (also banking),[38] the banking locomotive driver was to bail-off the automatic brake‑applied locomotive brake cylinder pressure en route ‘…to prevent wheel skidding on trailing locomotives’. 

In interview, the trainee driver advised that they bailed off auto applications as per Section 81 and also recalled that they bailed-off the banking locomotives’ brake cylinder pressure on two occasions prior to impact in accordance with Section 26. That action was taken having observed the sudden loss of brake pipe pressure and checking the mirrors for any issues. The trainee driver advised that bailing-off banking locomotive brake cylinder pressure was common practice to prevent the brakes from applying and causing locomotive wheel lock, slide and resultant flat spots. 

The trainee driver added that about a month prior to the accident, they had encountered another sudden loss of brake pipe pressure while on the banking locomotives and also bailed-off during that event. In this instance, the brake pipe had parted between the two lead locomotives, with bailing-off preventing unnecessary wheel skid on the banking locomotives.

In interview, the mentor driver advised that bailing-off banking locomotive brake cylinder pressure was accepted practice, stating ‘… all the [SSR] training is, if you get a penalty, you always bail-off because you don’t want to skid the wheels [cause flat spots]’. While a sudden loss of brake pipe air pressure and PCS light could indicate a broken brake pipe, the mentor driver had not considered that the train could have separated. The mentor driver advised that like the trainee driver, they would have bailed-off the banking locomotives’ brake cylinder pressure, given the same circumstances. However, they stated that in hindsight although this was what was trained, in this circumstance it wasn’t the right action to take. 

Wheel skid events

SSR advised that locomotive wheel lock, resulting in slide and flat spots (wheel skids), was a significant operational concern. While minor flat spots could be addressed through trim blocks,[39] flat spots requiring repair by a wheel lathe could cost up to $100,000 per locomotive due to reduced wheel life.

As a result, SSR trained its drivers to ensure locomotive brake cylinder pressure was bailed-off during all automatic brake applications, including on banking locomotives. As a result, it had not had a ‘class 3’[40] or worse wheel skid event in over 10 years. The last major wheel skid event had occurred in 2011, when the driver on the rear locomotive of a push-pull consist had not consistently bailed-off the automatic brake applications. 

Emergency response procedures

Several events may result in a sudden loss of brake pipe pressure[41] on a train including separated brake pipe hoses, derailment, vigilance penalty or train separation. In certain circumstances a train separation can result in an emergency event, namely a collision. This is due to the separated portions separating from each other by a distance, followed by a collision in circumstances where the front portion stops prior to the detached rear portion coming to a stop (as in this accident). To prevent this, RSOs have procedures in place to deal with train separation events.

SSR’s procedure WIM 63001 section 26 (losing the air), which related to sudden loss of brake pipe pressure stated:

If there is a sudden reduction in brake pipe pressure to zero [kPa] whilst a train is underway, bail off with the locomotive independent brake [handle] and allow the train to come to a stand. Keep the independent brake [handle] bailed off for a short period after your train comes to rest in case the rear portion of the train collides with the now stationary front portion of the train. 

This process was to be followed in all cases where there was a sudden loss of brake pipe pressure. Where the cause of the pressure loss was not immediately known, drivers were to presume a derailment had occurred and take immediate protective actions. The driver’s assistant was then to walk the train to ascertain the cause of the sudden pressure loss. Both the mentor driver and trainee driver were aware of this procedure.

SSR advised that this instruction applied to all operations, with no specific instruction related to banking locomotive actions when observing a sudden loss of brake pipe pressure. However, SSR added that it had by that stage obtained extensive experience in both banking and push-pull operations. SSR advised its push-pull arrangements alone totalled more than 100 services per year since 2004. Also that this accident was the first instance of a separation between its banking/push-pull locomotives and the previously coupled train in an estimated 3,000 banking and push‑pull events.

Risk management

General

For the purposes of the Rail Safety National Law (RSNL), a Rail Transport Operator (RTO) was required to ensure the safety of its railway operations ‘so far as is reasonably practicable’.[42] The Office of the National Rail Safety Regulator’s (ONRSR’s) guideline Meaning of duty to ensure safety so far as is reasonably practicable, provided RTOs guidance on how to apply this concept to their operations. Within this guideline, ONRSR considered ISO 31000 (Risk management – guidelines) as ‘good practice’ in the management of risk, in addition to requirements of the RSNL. ISO 31000 described risk management as:

…the systematic application of policies, procedures and practices to the activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing, recording and reporting risk. 

RTOs were required to implement a safety management system (SMS) to comply with their risk management obligations. This was to include formal processes for the identification, assessment, control, monitoring and review of risk.[43]

Communication and consultation

A key component of the risk management process was communication and consultation with internal and external stakeholders. ISO 31000 described the aims of communication and consultation as bringing together different areas of expertise and views, and to gather sufficient information during the risk management process. It was an integral part of:

• establishing the scope and context within which the risk to be managed resided
• identification, analysis and evaluation of the risk
• identification and implementation of effective risk controls.

A companion handbook HB 327:2010 (Communicating and consulting about risk) applied to ISO 31000.[44] It described the benefit of effective communication and consultation as ‘… a shared and better understanding of the risks faced and the range of treatment options.’ It further noted that consultation would help to comprehensively identify risks, increase acceptance of implemented controls and encourage feedback of effectiveness after implementation.

The importance of consultation was recognised within the RSNL, with an objective of the Act ‘to promote the effective involvement of relevant stakeholders, through consultation and cooperation, in the provision of safe railway operations.’ To achieve this, the RSNL advised that participation and consultation in establishing, reviewing or varying an RTO’s SMS (risk management), should include:

• those who may be affected by the SMS, such as rail safety workers 
• health and safety representatives (where applicable)
• relevant unions
• other RTOs (where interface agreements were required) 
• the public (where appropriate).

It was a requirement of the Rail Safety National Law National Regulations 2012 that an RTO’s SMS contained systems and procedures to ensure this consultation occurred.[45]

SSR risk assessments

Shunting

SSR conducted a risk assessment for train operations including shunting in February 2017, which was reviewed in March 2019. The review team consisted of an executive general manager, general manager, director and assistant general manager, most of whom had previous experience as either a driver or driver’s assistant. Stakeholders such as rail safety workers were not identified within the risk assessment.

Hazards of general shunting duties, for example, incorrectly set points, insufficiently secured rolling stock and communications failure were assessed. The hazard of incorrect / unsuccessful (unlocked knuckles) after coupling was not identified or assessed. SSR advised that the hazard of incorrect/unsuccessful coupling was addressed through:

• the shunting procedure contained in WIM 63001 (Policies and general train operations work instruction manual)
• competency of rail safety workers in shunting tasks
• experienced traincrew performing shunting tasks (addressed through assessed competency).

As discussed in Shunting requirements, WIM 63001 described the need for a ‘stretch test’ after shunting, but not how this was to be conducted. 

More information relating to competency assessment of the mentor driver and trainee driver in SSR’s shunting procedures is contained in Training and assessment of shunting duties.

Banking operations

SSR conducted a risk assessment for its Ardglen banking operations in November 2018, with a review coinciding with recommencement of its banking operation in October 2020.[46] The review team consisted of an executive general manager, general manager, director and service manager. In addition to the review team holding either current or prior driver or driver’s assistant qualifications, in the case of the executive general manager and service manager, the former had operated over the route as a driver’s assistant in 2008, and the latter as a driver in 2018. Identified stakeholders were SSR traincrew, SSR service planners and ARTC train control.

At this time, SSR changed the location of the banking crew from being in the lead banking locomotive to the rear banking locomotive. This eliminated the requirement for the traincrew to change ends after detaching from the grain train at Pages River before returning to Werris Creek. The change was in response to a runaway event which occurred after another RSO’s crew had changed ends at Ardglen after banking operations were complete 4 months previously.[47] 

In this assessment the risk of ‘separation and collision’ during banking operations was identified, with potential causes being:

• undulating terrain between Werris Creek and Ardglen, likely resulting in separation without crew awareness
• couplers not engaged correctly (knuckles unlocked) after coupling at Werris Creek 
• lack of awareness of train separation en route due to both the lead train locomotive and banking locomotives having simultaneous control of the braking system.

The implemented risk controls for these hazards were, respectively:

• hard coupling with, and the brake pipe air connected between the banking locomotives and the rear of the banked train
• stretch test and confirmation of the coupler condition after coupling
• the lead locomotive on the banked train to be in full control of the braking system, with a brake pipe continuity test after coupling.

Train parting occurrences

One of the operational occurrences that RTOs were required to report to ONRSR related to instances where trains separated while in service, that is, an unintended uncoupling event. A review of these reports over the 5 year period from 2017 to 2021 inclusive, found that there were 1,261 train separation events nationally. These were attributed to:

• mechanical failure of the coupling – 44%
• the knuckle opening through various means – 27%
• track anomalies causing vertical disengagement of the knuckles – 6%
• a shunt having just been completed – 2%
• cause not determined – 21%

Of the 25 instances of train separation occurring immediately after a shunt had been completed, 7 were attributed to the locking block not having dropped fully in front of the inner knuckle after coupling, that is, the knuckle had remained unlocked.

Safety analysis

Introduction

On 6 January 2022, freight train 5446, operated by Southern Shorthaul Railroad (SSR), departed from Narrabri West for Bullock Island at Newcastle, New South Wales. The train was powered by 3 locomotives hauling 49 wagons loaded with grain.

Due to the steep uphill gradient from Chilcotts Creek (about 40 km south of Werris Creek) to the Ardglen Tunnel, extra traction power was required to assist the 3 locomotives to ascend the gradient. As such, on arrival at Werris Creek a further 3 ‘banking’ locomotives were attached to the rear of the grain train. After the banking locomotives were coupled to the rear of 5446, airbrake tests were conducted to ensure braking system continuity. Once confirmed, the train departed Werris Creek.

This safety analysis will discuss the train separation and collision which occurred shortly after departure from Werris Creek, including aspects of procedure, training and assessment of risk.

Train separation event

Separation of L277 from the rear of 5446

Although banking was only required between Chilcotts Creek and Ardglen, in practice, the banking locomotive crews would take the opportunity to assist loaded trains over other uphill grades en route. In this case, the gradient leaving Werris Creek (410.800 km) was uphill for about the first 4 km. As was common practice, on the day of the accident the trainee driver on the banking locomotives assisted 5446 with additional traction power after leaving Werris Creek. Full traction power (eight notches) was provided by the banking locomotives, in addition to full traction power at the lead of the train. Consequently, the banking locomotives were in a compressive state against the rear of 5446.

After about the 407.000 km mark, the gradient changed to a downhill grade. As a result, the lead locomotive driver commenced a reduction in traction power setting, with the trainee driver on the banking locomotives also commencing traction power reductions shortly afterwards.

At 0648:31, the driver of the lead locomotive engaged dynamic braking and made an automatic brake application at 63 km/h to test the effectiveness of the train’s brakes. At this stage, the entire train was on the downhill grade. At 0649:09, with the train’s speed stable at 64 km/h and, coinciding with the banking locomotive’s traction power being reduced to a minimum (one notch), the driver of the lead locomotive released the train’s brakes. Seven seconds later, this brake release command took effect on the banking locomotives. 

The trainee driver on the banking locomotives maintained the one notch of traction power on the banking locomotives to limit any slack runouts that may have resulted as the grades changed. However, while this maintained a level of compressive force against the rear of 5446, this was insufficient when the banking locomotives reached a relatively level piece of track at about 405.700 km, allowing them to slow slightly. This slight reduction in speed resulted in the banking locomotives separating from the rear of train 5446 at 0649:46.

Release of automatically applied banking locomotive brakes 

As the brake pipe was connected and continuous between 5446 and the coupled banking locomotives at Werris Creek, the separation of the banking locomotives from the rear of the train resulted in a disconnection of the brake pipe and sudden loss of air pressure as recorded on the locomotive dataloggers. At the lead of the train, the driver observed this loss of brake pipe pressure as a flow rate on the cabin flowmeter. Consistent with the SSR procedure contained in WIM63001 (policies and general train operations work instruction manual), the driver maintained dynamic braking to assist in stopping the lead portion of the train.

Concurrently, on the banking locomotives, the trainee driver observed a loss of traction power and all brake pipe pressure with a resultant rise in locomotive brake cylinder pressure. The trainee driver and mentor driver advised at interview they checked their rear-view mirrors, but due to the straight nature of the track were unable to identify that a train separation had occurred. Consistent with their training and WIM63001, the trainee driver ‘bailed off’ the automatically applied locomotive brakes. SSR’s analysis of the data logger data indicated that the distance between the lead portion and the detached banking locomotives was now 47m. After a short period, the locomotive brake cylinder pressure again started to rise, applying the locomotive’s brakes. In response, the trainee driver again bailed off this locomotive brake cylinder pressure, with the distance between the lead portion and the detached banking locomotives now 126 m. As there were no wagons which had separated with the banking locomotives (the brakes of which would not have been affected by bailing off), this resulted in a loss of all braking effort on the detached rear portion. Although the datalogger indicated the speed of the banking locomotives reduced from 51 km/h to 23 km/h due to the 2 momentary applications of locomotive brake cylinder pressure, the banking locomotives continued to roll.

By this time the automatically applied brakes on the lead portion of 5446 were starting to take effect causing it to slow. The gap between the front and detached rear portion of 5446 started to reduce. Once the lead portion had stopped and, without any braking effort on the still rolling banking locomotives, collision between these and the stationary lead portion of the train was inevitable.

By contrast, had the banking locomotive’s brake cylinder pressure been retained and not bailed off by the trainee driver after the separation event, it is certain that the banking locomotives would have stopped relatively quickly, and the collision avoided.

Emergency response to brake pipe pressure loss

SSR notice 62269 (Ardglen banking procedures) contained specific requirements for the Ardglen banking operation for their train crew. While it contained instruction on coupling and the banking operation, it did not contain any contextualised emergency response procedures unique to this operational environment. 

Rather, the procedure to be followed by drivers when confronted with a sudden loss of brake pipe pressure en route, such as during a train separation or derailment, was contained in SSR’s general operational document WIM63001, Section 26 (losing the air). It did not differentiate between head end only or banking train operations. In all cases of a sudden loss of brake pipe pressure en route, drivers were required to:

• bail off any locomotive brake cylinder pressure
• allow the train to come to a stop.

Of note, WIM63001 Section 81 (3-man push pull operations), did contain instructions specific to banking operations. This section required drivers on the banking locomotives to bail off all automatic brake‑applied locomotive brake cylinder pressure en route during routine operations to prevent wheel skids. SSR explained that this was due to wheel skids causing significant operational costs during wheel lathe rectification, including substantial loss of wheel life. Both the trainee driver and mentor driver on the banking locomotives were aware of the requirements within WIM63001 as applied to banking operations. During interview, both advised these instructions had informed the decision to bail off the banking locomotive brake cylinder pressure in response to the sudden loss of brake pipe pressure. This resulted in loss of braking on the banking locomotives after the separation event.

Wheel skid events can cause significant operational expense and SSR’s procedures were specifically designed to avoid any unnecessary occurrences. However, there are significant differences between head end only and banking operations which were not covered in the procedures. For example, a sudden loss of brake pipe pressure in transit, resulting from a derailment, was not an identified scenario within a banking operations context, so the procedures were missing risk controls to address the most appropriate response to this type of event. 

Banking locomotives were required to be hard coupled to the train

Due to the steep uphill gradient between Chilcotts Creek and Ardglen, several rolling stock operators (RSOs) banked their trains over this section. Two storage sidings were provided at Chilcotts Creek for accommodating banking locomotives between banking duties – both storage sidings were used by SSR’s competitors. 

In this case, as the banking locomotives were attached to the rear of the trains at the commencement of the steep uphill grade, the banked train was always in a compressed state to the Ardglen Tunnel. Consequently, the knuckle of the automatic coupler on the banking locomotives pressed against the train to be banked was not required to be locked during coupling. Once the banked train reached the summit of the Ardglen Bank, the banking locomotives slowed to a stop, automatically separating from the rear of the train. This allowed the banked train to continue its journey without stopping.

When SSR commenced banking operations on the Ardglen Bank in about October 2017, no spare storage siding accommodation was available at Chilcotts Creek. Approaches were therefore made by SSR to ARTC for use of a storage siding at Willow Tree. These approaches were unsuccessful. As a result, SSR’s banking locomotives were required to be attached to the rear of its trains at Werris Creek. 

The grade between Werris Creek and Willow Tree was undulating, which meant the train forces would alternate between compressed (bunched) and tensile (stretched) states en route. For this reason, both SSR’s notice 62269 (Ardglen banking procedures) and ARTC train operating conditions (TOC) waiver 21004 (operation of SSR trains and light engines between Newcastle and Moree & return), required the banking locomotives to be hard coupled to the rear of the train being banked, with the brake pipe connected. 

The hard coupling requirement was a control for the bespoke risk of SSR’s Ardglen banking operations, when compared to that of its competitors, of a potential separation between the banking locomotives and the rear of the banked train while traversing undulating territory. However, this risk control introduced an added risk: a train separation en route if the hard coupling at Werris Creek was performed incorrectly, such as on the day of the accident.

Drivers did not perform a stretch test 

Inspections onsite and post-accident testing found that the couplers on locomotive L277 and wagon BGKF 1122F were mechanically sound, intact and in place at the time of the collision. As such, it is highly likely that the cause of the separation was that one or both knuckles of the couplers, on L277 or BGKF 1122F, had remained unlocked after coupling of the banking locomotives to the rear of 5446 at Werris Creek. 

The design of automatic couplers requires that the locking block be moved clear of the inner knuckle to allow the knuckle to be opened to uncouple or couple. Operating the coupler’s control rod acts on the lifter, moving the locking block clear of the inner knuckle. After coupling, the locking block falls back in front of the inner knuckle as the knuckle closes, locking it in place. The lifter can be either top or bottom operated. The lifter fitted to L277 was bottom operated, whereas the lifter on BGKF 1122F was top operated.

While a top operated lifter provides a clear visual indication of the position of the locking block, a bottom operated lifter does not always do so. For the latter, the visual difference of the lifter between a locking block in a locked versus unlocked state can be difficult to confirm, due to both limited lifter movement and obstructed view of the positioning of the lifter underneath the coupler. As a result, the lifter position on a bottom operated coupler is not a reliable indicator of the locking block position, requiring a stretch test to prove the knuckle is locked.

In interview, both the mentor driver (who was on the ground for the shunt) and the trainee driver (who was operating the banking locomotives), advised that they had performed a gravity stretch test after coupling to the rear of 5446. They stated they had observed the banking locomotives roll away slightly from the rear of 5446 until the slack in the coupler knuckles had stretched out, with the couplers remaining coupled.

A review of the CCTV at Werris Creek, which recorded the coupling of the banking locomotives to the rear of 5446, showed that:

• after coupling to the rear of 5446, the banking locomotives rolled away slightly
• at the time of this slight roll back, the mentor driver had momentarily looked away from the coupler and locomotive, meaning they did not observe this movement.

A review of the data logger found that after coupling:

• the direction controller stayed in reverse and was not placed in neutral or forward, which would be expected if conducting a gravity stretch test
• brake cylinder pressure was present on the banking locomotives during and after coupling, meaning its brakes were partially applied, limiting movement.

Due to the brake cylinder pressure on the banking locomotives at time of coupling, it is highly likely the slight movement observed after coupling related to a spring back of the coupler draft packs, rather than a stretch out of slack between the coupler knuckles. The latter was required to verify that the knuckles had locked in the closed position.

Based on the above information, it is highly likely that the bottom operated coupler on L277 had remained unlocked after coupling to the rear of 5446 at Werris Creek. This was not identified at the time of coupling due to limited visual cues of the locking block state, nor was it verified by performing and observing the outcome of a stretch test. 

Knowledge and competency in shunting  

Assurance of competency 

Procedural differences between rolling stock operators 

Had a stretch test been performed at Werris Creek, L277 would likely have separated from the rear of 5446 verifying that the knuckle on the coupler was unlocked. This would have allowed a re‑coupling to occur until the knuckle on L277 was proved to be locked.

During interview, both the mentor driver and trainee driver advised that they understood a stretch test to be conducted by gravity. That is, if the rolling stock rolled apart after coupling but remained secured, it was proved to be successful. However, there was an awareness that low traction power could be applied in instances where gravity was insufficient to create a roll apart force.

While this was consistent with SSR’s stated expectations, by contrast, two of Australia’s largest rail freight operators required the application of low traction power during a stretch test to ensure a sufficient tensile force was applied to the knuckles. Irrespective of method, the purpose of a stretch test is to provide confidence that the knuckle is fully locked and will not separate on entering traffic. 

The difference in stretch test method between RSOs illustrates that, as with many rail industry procedures, it was determined by individual operators rather than by an industry standard. Given the frequent procedural differences between operators the assessment of competence against and thereby meeting the RSO’s specific procedural requirements becomes of particular importance. This is particularly relevant in instances where personnel have transferred into an organisation holding previously attained qualifications from another operator, which may be aligned to different procedural requirements to that of the new organisation.

Assessment evidence

The mentor driver formally received shunting qualification TLIC3017A (shunt rolling stock) in 2013. This competence was later verified through verification of competency checklists (2016 and 2017), recognition of prior learning assessments to align with TLIC4074 (shunt, couple and uncouple rail vehicles) in 2019 with Pacific National, and a practical assessment when joining SSR in mid-2020. In all instances, the mentor driver was found competent in performing a stretch test. However, a review of the assessments found that evidence was limited to checkboxes that the task was completed, rather than recording detail of the mentor driver’s understanding of the stretch test process, or their observed actions when conducting it.

The trainee driver was initially qualified in shunting qualification TLIC4074 in 2017. On joining SSR in August 2020, they undertook a practical assessment in shunting where they were found competent in performing a stretch test. As with the mentor driver, a review of these assessments found that the assessments were limited to the checkboxes that the task was completed, rather than recording detail of the trainee driver’s understanding of the stretch test process, or their observed actions when conducting it.

For nationally recognised units of competency such as TLIC3017A and TLIC4074, assessments were required to follow the ‘principles of assessment’ and ‘rules of evidence.’ Key to these principles and rules was that sufficient evidence was gathered at the time of assessment to enable a sound, reliable and consistent competency decision to be made by all assessors. That is, based on the evidence collected, other assessors would come to the same competency assessment decision. By contrast, in the absence of following these protocols, sound, reliable and consistent competency decisions were unlikely to be made by assessors, which had the potential to undermine the integrity of the VET qualifications that were subsequently issued. 

To assist in meeting assessment requirements, the Australian Skills and Quality Authority (ASQA) provided a guidebook. It suggested that for a:

• Theory assessment, model answers could be provided to enable the assessor to evaluate against responses provided.
• Practical assessment, well described skills and observable behaviours should be defined, with underpinning knowledge of the task assessed by questioning how the task was being performed and why. The latter provided assurance to the assessor that the candidate was not mimicking a previously demonstrated task.

While these requirements for assessment applied to nationally recognised units of competency and qualifications, it did not apply to enterprise-based assessments conducted by rail transport operators. This included the practical assessments of the mentor driver and trainee driver performed by SSR in 2020. For these assessments, it was up to SSR to satisfy itself that the practical assessment adequately proved competence of its rail safety workers. It is worth noting that SSR was a registered training organisation and therefore familiar with the national assessment requirements. As such, it would be reasonable, and consistent with ONRSR’s Application of the AQF to rail safety worker competence assessment policy, that SSR would follow these same assessment principle and rule requirements during the delivery of its own enterprise‑based assessments, in the absence of any comparable alternative. 

In short, assessments which limited recorded evidence of demonstrated competency to a checkbox of successful completion, were not compatible with the requirements of VET assessments or, with ONRSR’s expectations in instances of enterprise attainment.  

Underpinning procedures

Critical to the training and assessment process is an underpinning procedure with which to benchmark these against. Without a formal procedure to reference, it is not possible to reliably deliver consistent training or assessment; rather, it relies on an individual trainer or assessor’s knowledge, skills, experience and judgement. This is not consistent with competency-based training and assessment principles and, has the potential to result in impartment of non-standard work practices and deficient skill sets.

While Pacific National expected light traction power during a stretch test, this was not contained in formal procedure, training, or assessment documents at the time the mentor driver was assessed as competent in shunting. Of note, after the accident the mentor driver stated that they had always understood stretch tests to be conducted by gravity/roll back, with light traction power used where there was a desire to capture the action on the data logger. This is at odds with what should have been trained and assessed while the mentor driver worked for Pacific National.

Similarly, while SSR stated to OTSI that it considered a successful stretch test could be conducted by a gravitational ‘bump’, without necessarily applying traction power, this too was not contained in any formal procedure, training, or assessment documents. As such, it is unclear how SSR’s trainers, assessors and train crew could have been aware of SSR's expectation, and therefore been consistently applying its expectations in practice. 

In summary, the mentor driver and trainee driver were assessed by several organisations as competent in the stretch test process, utilising both VET and enterprise-based assessments. It is acknowledged that, according to SSR, their understanding of the stretch test process was consistent with its expectations. However, assurance they did so prior to the accident was largely ineffective given that:

• no benchmark existed to inform these competency judgements
• insufficient evidence of competency had been collected
• SSR’s unwritten procedural expectation (on which the competency was stated to be based) differed somewhat to other larger rail freight operators. 

In the case of the latter, this applied to the mentor driver given they were employed by one of these operators immediately prior to commencing with SSR.

Driver knowledge of coupler functionality

An integral design characteristic of automatic couplers is for the knuckle to remain unlocked after the control rod has been operated and released. The purpose of this safety design feature is to allow the knuckle to be manually opened by hand for coupling where it has not sufficiently opened, and to allow workers to stand clear of the rolling stock profile during uncoupling. 

However, this safety design feature requires the knuckle to be fully opened to dislodge the locking block tongue outwards off the set shelf, allowing the locking block to again drop and lock the knuckle when it is again closed. If this does not occur, the knuckle will remain closed but unlocked at the end of coupling operations regardless of how much inwards pressure is exerted. As a result, the train will separate when it is next moved with a draft (stretched) force as occurred in this accident.

The mentor driver’s previous shunting competency assessments (2016, 2017, 2019 and 2020) and associated training materials from both their previous employing operator and SSR, did not contain an explanation or operational requirements of this safety design feature. This was confirmed in a follow-up conversation with the mentor driver, who advised they had been taught only to open the knuckle in instances where there had been trouble in locking it during a coupling operation. In this case the ‘problem knuckle’ was to be fully opened and then closed (locked), with the other coupler’s knuckle then used to complete the coupling manoeuvre. As such, it is quite possible that identified instances of knuckles not locking previously may well have been related to the safety design feature operating as designed, that is, keeping the knuckle unlocked as it had not yet been fully opened.

In summary, the mentor driver had a misunderstanding of how an aspect of the automatic coupler’s safety design features operated. The knowledge and competency in operation of this would be a reasonable expectation for the role. 

Coupler instruction, training and assessment

A full understanding of the equipment is key in ensuring its correct operation. With this consideration, a review of SSR’s training and assessment materials was undertaken for the national unit of competency TLIC4074 (shunt, couple and uncouple rail vehicles) in relation to automatic coupler functionality and stretch tests. This unit of competency would be delivered to new employees who did not have prior shunting qualifications. 

It was found that the training materials did not explain:

• a coupler design safety feature, which required an unlocked knuckle to be opened to allow relocking
• visual limitations relating to the locking block position on bottom operated couplers.

While the training materials referenced an ability for locking blocks to jam, resulting in a knuckle remaining unlocked, it did not provide an explanation as to a possible cause (for example, the tongue of the locking block remaining on the set shelf), or how to rectify the situation. 

To identify situations where the locking block had not dropped, multiple references to stretch tests were made throughout the training materials. However, they did not describe the process by which these stretch tests were to be conducted. This was also reflected in the practical assessment of a stretch test, where no detail was provided of which skills and observable behaviours were to be demonstrated, or a record made of the underpinning knowledge of the task. SSR’s TLIC4074 training and assessment materials did not contain details of how to conduct a stretch test, as it did not have a procedure which described how it was performed. Therefore, there was no benchmark with which to underpin this competency. 

As a result, it was possible that learners could misunderstand the process of a stretch test and automatic coupler operation at the completion of their training. Further, it would be possible to go an extended period without these knowledge deficiencies being detected, given that SSR’s driver and driver’s assistant practical re-assessments did not contain these provisions. 

Risk identification and assessment

SSR, as an accredited rail transport operator (RTO), was required by the Rail Safety National Law (NSW) to manage its risks ‘so far as is reasonably practicable.’ Management of risk requires a formal process of identification, assessment, control, monitoring and review of all risks as they apply to the assessed task. A key component of this process is communication and consultation with internal and external stakeholders. For this reason, the Rail Safety National Law (NSW) stated that risk management consultation should include:

• those that may be affected by the SMS, such as rail safety workers 
• health and safety representatives (where applicable)
• relevant unions
• other RTOs (where interface agreements were required) 
• the public (where appropriate).

SSR conducted a review of the risk assessment for its shunting operations in March 2019. The review team consisted of SSR managers and directors, most of who had previous experience as either a driver or driver’s assistant, with no stakeholders identified. Although incorrect coupling was not identified as a hazard, a risk control of competency in shunting was noted within the risk assessment. Issues surrounding the assurance of this competency are discussed in Assurance of competencywithin this safety analysis.

In relation to its Ardglen banking operations, SSR conducted a risk assessment review in October 2020. Although stakeholders for this operation were identified as SSR traincrew, SSR service planners and ARTC train control, the review team consisted of SSR managers and directors, who had a variety of previous operational experience. While this risk assessment identified the risk of train separation due to incorrect coupling, the risk control was limited to a stretch test at the time of the shunt. That is, the possibility of a train separation en route from other causes, such as rough track or mechanical failure, resulting in a collision was not considered. 

SSR highlighted during the investigation that it had extensive experience in both banking and push-pull operations, with this being the first accident due to a train separation during that time. An analysis of 1,261 rolling stock operator reports to ONRSR of train separation events nationally during the 5 year period of 2017 to 2021, found that the cause of 21% (264) could not be determined, with a further 44% (560) attributable to mechanical failure of the coupling. With an average of over 200 separation events a year, train separation events are a foreseeable risk in rail operations. 

For the SSR banking operation between Werris Creek and Pages River, the crew of the banking locomotives were seated in the rear locomotive, facing opposite to the direction of travel. Given the separation event happened on a straight section of track, the crew did not identify the separation when checking the rear facing mirrors at the time of the brake pipe pressure loss. Instead, had the crew been in the lead banking locomotive, facing the rear of 5446, the separation would have been identified and appropriate action taken to avert a collision. 

It is critical to note however, that a train separation can occur at any location within a train. If the separation were to have occurred on one of the last few wagons, the crew would similarly have had no vision of the separation event. In this case, while any detached wagons on the rear portion would have retained their braking capacity if the crew had bailed off the banking locomotive’s brake cylinder pressure, the wagon brakes would have needed to act not only on their own weight, but also the added weight of the banking locomotives with brakes fully released. That is, deceleration would have been at a reduced rate to that if the banking locomotive’s brake cylinder pressure had been retained.

As discussed in Emergency response to brake pipe pressure loss, SSR had not considered emergency response procedures for banking locomotives and the uniqueness of that operating environment in the case of train separation or derailment. It cannot be said with certainty that these risks during banking operations would have been identified and controlled had consultation with operational stakeholders occurred, given that the SSR managers and directors involved generally came from operational backgrounds. However, the risk of reasonably foreseeable risks such as these being missed during the risk assessment process is increased when consultation is limited to predominantly management staff, without the inclusion of those directly affected by the operation, and with recency in similar tasks.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the separation of, and subsequent collision between, banking locomotives and grain train 5446 near Werris Creek, New South Wales, on 6 January 2022. 

Contributing factors

• As the banking locomotives were placed on the rear of train no 5446 at Werris Creek and not Chilcotts Creek, the lead banking locomotive was required to be hard coupled to the train. This added an additional risk to SSR’s operations compared to that of other banking operations conducted on the Ardglen Bank.
• After coupling the banking locomotives to the rear of train no 5446 in Werris Creek Yard, the trainee driver and mentor driver did not perform a stretch test for the bottom operated coupler to confirm the knuckle was locked.
• While en route and shortly after cresting the hill leaving Werris Creek, coinciding with a release of the grain train's brakes, the banking locomotives separated from the rear of train no 5446.
• After separation of the banking locomotives from the rear of train no 5446, the banking locomotive's brakes automatically applied. The trainee driver of the banking locomotives released the automatically applied locomotive brakes on two occasions before the collision.
• The risk assessments conducted by Southern Shorthaul Railroad (SSR) for shunting and banking operations did not include consultation consisting of effective and meaningful engagement with all relevant stakeholders. This increased the potential that risks could be missed during the risk assessment process. (Safety issue)
• Southern Shorthaul Railroad's (SSR's) emergency response procedures did not include requirements for banking locomotive operations. (Safety issue)

Other factors that increased risk

• Southern Shorthaul Railroad's (SSR's) training and assessment did not include coupler functionality and the process to ensure correct coupling had occurred. Further, an underpinning procedure for the stretch test (effectively coupled) process did not exist. (Safety issue)
• The mentor driver was not aware of the safety design feature in automatic couplers which required the knuckle to be opened fully to ensure it would lock after coupling. 
• Several rolling stock operators (RSOs) assessed the mentor driver and trainee driver as competent in shunting operations through both VET and enterprise-based assessments. However, assurance that the skillset demonstrated had met all the RSO’s competency requirements was largely ineffective, as:
  • there was an absence of national procedures in shunting, resulting in differing procedural requirements between RSOs 
  • RSO procedural guidance for shunting was not always complete, resulting in undeterminable assessment benchmarks
  • competency decisions were reached with insufficient evidence collected to support these assessment decisions, whereby skills and observable behaviours were not defined and the underpinning knowledge of the task observed was not assessed.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.  Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.  Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Coupler instruction, training and assessment

Safety issue number: RO-2022-001-SI-01

Safety issue description: Southern Shorthaul Railroad's (SSR's) training and assessment did not include coupler functionality and the process to ensure correct coupling had occurred. Further, an underpinning procedure for the stretch test (effectively coupled) process did not exist.

Safety advisory notice to rolling stock operators

SAN number: RO-2022-001-SAN-01

Knowledge of the design features of automatic couplers, their differences and limitations, particularly with regards to locking mechanisms, is key to understanding the importance of conducting a positive stretch test at the conclusion of a coupling manoeuvre. The ATSB advises that rolling stock operators should ensure their operational staff are advised and assessed on coupler locking design features which assist in maintaining a knuckle in an unlocked state and methods required to ensure the knuckle has again locked after coupling has occurred.

Emergency response to brake pipe pressure loss

Safety issue number: RO-2022-001-SI-02

Safety issue description: Southern Shorthaul Railroad's (SSR's) emergency response procedures did not include requirements for banking locomotive operations.

Risk identification and assessment

Safety issue number: RO-2022-001-SI-03

Safety issue description: The risk assessments conducted by Southern Shorthaul Railroad (SSR) for shunting and banking operations did not include consultation consisting of effective and meaningful engagement with all relevant stakeholders. This increased the potential that risks could be missed during the risk assessment process.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Additional safety action by Southern Cross Civil and Rail Training

In mid to late 2019, SCCRT reviewed and updated all TLI42615 (Certificate IV in Train Driving) materials to meet the individual units of competence. Prior to that time, legacy training materials were facilitated as grouped modules with a clustered approach. Included in the 2019 updates was the requirement for supporting evidence to be provided with on-job workbooks demonstrating the trainee had undertaken each task, for example, photographs and video footage of the performance of shunting tasks. Since 2020, further amendments have been undertaken to reflect changes to TLI42621 and TLI42622 (Certificate IV in Train Driving).

In addition to the above, after reviewing the draft report, SCCRT plans to make further amendments to its training materials for TLIC4074 (shunt, couple and uncouple rail vehicles) to strengthen student learning, knowledge, understanding and competence in relation to a ‘stretch test’.

Additional safety action by Pacific National

Pacific National advised that after reviewing the draft report, it had reviewed its training content regarding ‘stretch tests’. As a result, it was in the process of compiling new training materials to incorporate findings with the report.

ATSB comment

ATSB/OTSI welcomes the proactive safety action taken by both Southern Cross Civil and Rail Training and Pacific National, in response to findings within the report.

Safety advisory notice to rail transport operators

SAN number: RO-2022-001-SAN-02

The Australian Transport Safety Bureau strongly encourages rail transport operators, and registered training organisations acting on their behalf, to review and validate their rail safety worker competency assessments. This is to ensure these assessment tools, processes and judgements are reliably meeting the principles and requirements of competency-based training and assessment.

Glossary

AQF	Australian Qualifications Framework. Provided standards and policy for nationally recognised qualifications.
ASQA	Australian Skills Quality Authority. The regulator of the VET sector (except in Victoria and Western Australia).
ARTC	Australian Rail Track Corporation. The rail infrastructure manager for this accident.
CCTV	Closed-circuit television.
NCO	Network control officer. Coordinates and manages train paths and track occupancy authorities.
OTSI	Office of Transport Safety Investigations. Based in Sydney, NSW, OTSI undertakes rail accident/incident investigations in NSW on behalf of the ATSB. In this capacity it operates under the provisions of the Transport Safety Investigation Act 2003 (Cwlth).
ONRSR	Office of the National Rail Safety Regulator. Administered and enforced compliance with the Rail Safety National Law and Regulations.
PCS	Power control switch. Caused by low brake pipe pressure, this automatically removes traction power and dynamic brake from the locomotive.
RPL	Recognition of prior learning. Allowed for the assessment and recognition of competence which had been achieved through prior formal, non-formal or informal learning.
RSNL	Rail Safety National Law. Legislation which provided for safe railway operations in Australia.
RSO	Rolling stock operator. Operates above rail assets, for example locomotives and wagons.
RTO	Rail transport operator. Encompasses both rail infrastructure managers (track, signalling etc.) and rolling stock operators (locomotives, wagons etc.).
SCCRT	Southern Cross Civil and Rail Training. A registered training organisation that could impart VET qualifications.
SSR	Southern Shorthaul Railroad. The rolling stock operator for this accident.
SMS	Safety management system. A systematic approach to organisational safety encompassing safety policy and objectives, risk management, safety assurance, safety promotion, third party interfaces, internal investigation and SMS implementation.
TOC	Train Operating Conditions.
VET	Vocational Education and Training. A practical alternative to university (higher education) studies, it provided workplace skills and technical knowledge.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Aurizon
• Australian Rail Track Corporation 
• lead driver of 5446 
• Office of the National Rail Safety Regulator
• onsite visits by OTSI
• Pacific National
• photographs taken on the day of the accident
• recorded data from the locomotives on 5446 
• Southern Cross Civil and Rail Training
• Southern Shorthaul Railroad
• trainee driver and mentor driver on the banking locomotives attached to 5446
• various documents and resources available in the public domain.

References

Vlasblom J, Pennings H, van der Pal J and Oprins E (2020) ‘Competence retention in safety‑critical professions: a systematic literature review’, Educational Research Review, 
(30):1–40, doi.org/10.1016/j.edurev.2020.100330.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• Australian Rail Track Corporation
• Australian Skills Quality Authority
• driver of the lead portion of 5446
• mentor driver of the banking locomotives
• Office of the National Rail Safety Regulator
• Pacific National
• Southern Cross Civil and Rail Training
• Southern Shorthaul Railroad
• trainee driver of the banking locomotives.

Submissions were received from:

• Australian Skills Quality Authority
• Office of the National Rail Safety Regulator
• Pacific National
• Southern Cross Civil and Rail Training
• Southern Shorthaul Railroad

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Rail safety investigations in New South Wales Most transport safety investigations into rail accidents and incidents in New South Wales (NSW) are conducted in accordance with the Collaboration Agreement for Rail Safety Investigations and Other Matters between the Commonwealth Government of Australia and the State Government of NSW. Under the Collaboration Agreement, rail safety investigations are conducted and resourced in NSW by the Office of Transport Safety Investigations (OTSI), on behalf of the ATSB, under the provisions of the Transport Safety Investigation Act 2003. The Office of Transport Safety Investigations (OTSI) is an independent statutory body which contributes to improvements in the safety of bus, ferry and rail passenger and rail freight services in NSW by investigating safety incidents and accidents, identifying system-wide safety issues and sharing lessons with transport operators, regulators and other key stakeholders. Visit www.otsi.nsw.gov.au for more information. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     Distances measured from Central station in Sydney, NSW.

[2]     All time references in this report are in local time (Eastern Daylight-saving Time).

[3]     Banking is the process of temporarily attaching additional locomotives to a consist for additional traction power up steep uphill gradients. See Ardglen banking operations for further information.

[4]     The independent brake applies and releases the brakes on the locomotive/s only.

[5]     Stretch test: a test in which the couplers are physically verified to have locked securely. See Shunting requirements for further information.

[6]     Brake pipe continuity test: a train brake application and release conducted at the front of the train which is verified as also occurring to the rear of the coupled portion, thereby proving a continuous brake pipe without obstructions.

[7]     Dynamic brake alters the locomotive’s traction motor fields to a generator configuration. This results in a retarding force on the locomotive wheelsets, slowing the train.

[8]     The automatic air brake system operates through changes in air pressure in the train’s brake pipe, which runs the length of the train. Consequently, there is a time lag between brake commands initiated at the front of the train taking effect at the rear of the train.

[9]     PCS: automatically removes traction power from the locomotive when low brake pipe pressure is detected. It is designed to stop traction power working against an emergency braking event.

[10]    Bail-off: the action of releasing a locomotive’s brake cylinder pressure from an automatic brake application (see Independent brake).

[11]    Excessive braking can result in wheel lock. When this occurs, the wheel sliding/skidding along the rail head can result in flat spots on the wheel tread. These can result in wheel damage, rail damage, or derailment. 

[12]    The flowmeter (i.e. brake pipe charging flow indicator) indicates a flow of main reservoir air to the brake pipe in response to a brake release command or, uncommanded drop in brake pipe pressure. See Automatic brake.

[13]    Vigilance penalty: an automatic brake application will occur if a control command is not made or, an acknowledgement button is not pressed periodically on the locomotive. It is designed to stop the train if the driver becomes incapacitated. 

[14]    A rolling stock operator (RSO) that operated above rail equipment, for example, locomotives, wagons etc.

[15]    A driver’s assistant was a second person in the locomotive cabin who was to assist the driver with various tasks, for example signal sighting and obeyance, fault rectification, on-ground operational activities etc. A trainee driver (in addition to driver's assistant responsibilities), was in the process of gaining the knowledge and skills necessary to operate a train.

[16]    That is, 1 m rise in elevation for every 40 m travelled.

[17]    L/V ratio: the ratio between the outward lateral forces of the rail wheel against the rail and the downward vertical forces of the rail wheel to the top of the rail.

[18]    See SSR risk assessments in the section Banking operations for further information.

[19]    Slack: both ‘free slack’ (a small gap between successive coupler knuckles) and ‘spring slack’ (draft gear movement to allow for coupler shock absorption), allows free movement which increases as train length is increased.

[20]    Run-out: a ‘stretching out’ of slack (draft force), where the lead of the train is travelling faster than the rear. 

[21]    Further information relating to nationally recognised qualifications is provided in Training and assessment.

[22]    The act of separation resulted in the knuckle on L277 fully opening, allowing it to lock onto the coupler of BGKF 1122F on impact (see Automatic couplers for further information). 

[23]    Competency: the skills, knowledge and/or qualifications that a person performing the task is required to possess to enable them to perform the task without risk to themselves, others or the safe operation of the railway. Source: ONRSR guideline – identifying rail safety work under the RSNL.

[24]    Rail Safety National Law (NSW), ss.52 & 117.

[25]    See Enterprise training and assessment.

[26]    In Victoria and Western Australia, regulation of VET for domestic students (i.e. not overseas or online students), was provided by the Registration and Qualifications Authority (Vic.) and Training Accreditation Council (WA).

[27]    See AQF assessment.

[28]    See Training and assessment of shunting dutiesfor further information.

[29]    This standard was an enforceable legislative instrument, created under the provisions of the National Vocational Education and Training Regulator Act 2011 (Cwlth).

[30]    Registered training organisation: approved by ASQA to issue nationally recognised qualifications and Statements of Attainment once competence of the candidate was proven.

[31]    Version (2.2) was released in October 2019.

[32]    Safeworking: procedures and technology used for the safe separation between trains, people and plant.

[33]    Rail Safety National Law (NSW), s.117(4).

[34]    Rail Safety National Law National Regulations 2012, Sch.1(15).

[35]    Formal, e.g. non-aligned AQF competency; non-formal, e.g. on-the-job training; informal, e.g. structured enterprise‑based training.

[36]    For a more detailed explanation of train airbrake systems, refer to OTSI/ATSB investigation: RO-2020-022, Derailment involving loaded grain train 3966 near Dombarton, NSW on 15 December 2020.

[37]    The braking capacity on locomotives is higher than that of wagons, which will result in the trailing wagons running into the lead locomotive/s if the locomotive brakes are not bailed-off.

[38]    Push-pull: locomotives located at both the front and the rear of the train to enable ease of change in train direction.

[39]    Trim blocks: brake blocks made of a harder compound, designed to remove minor defects from wheels.

[40]    Class 3 skid: identified by SSR as a 40–60 mm skid, maximum 40 km/h to clear the track section only.

[41]    A description of the train airbrake system and its operation is provided in Train braking systems.

[42]    Commonly referred to as ‘SFAIRP,’ the Rail Safety National Law (NSW), s. 47, defined this as ‘…that which is (or was at a particular time) reasonably able to be done in relation to ensuring safety.’

[43]    Rail Safety National Law (NSW), s. 99.

[44]    While this referred to an earlier version of the standard (ISO 31000:2009), at the time of the accident it remained current.

[45]    Rail Safety National Law National Regulations 2012, Sch. 1, item 13.

[46]    See Ardglen banking operations – History.

[47]    See OTSI/ATSB investigation: RO-2020-008, Uncontrolled runaway and derailment of banking locomotives Kankool, NSW, on 3 June 2020 for further information.

On 4 December 2021, the pilot of an Air Tractor AT-400 aircraft, registered VH-ACQ and operated by Aircair Aviation Operations (Aircair), was conducting aerial application (spraying) operations on a property 75 km west-south-west of Moree, New South Wales.

At 0604 Eastern Daylight-saving Time,[1] the aircraft departed Moree Airport and tracked to the property’s airstrip, 43 km south-west of Moree Airport. A loader was stationed at the property’s airstrip, whose role was to mix and load chemical into the aircraft’s hopper, and to refuel the aircraft.

A GPS tracker onboard the aircraft recorded data at 15-second intervals. The data showed that commencing at 0632, the aircraft took off from the property airstrip and sprayed 11 loads over the course of the morning.

For the first 8 loads, the aircraft remained within sight of the loader. Those loads were sprayed using a racetrack pattern (Figure 1). Each of the 8 loads took about 20 minutes, except the third load, which took 32 minutes as it included clean-up spray runs (across the direction of the pattern) and tracking to the next target area. Each time the aircraft landed at the airstrip, the loader mixed chemical and water totalling 1,250 L into the hopper. On 2 of those occasions, the loader refilled the aircraft fuel tanks.

Figure 1: Racetrack spray pattern

Source: ATSB

At 0914, while the pilot conducted the seventh load, the operations manager sent the pilot a text message advising that 4 of the target fields marked on the map were no longer to be sprayed (marked in orange in Figure 2). On the next (eighth) load, the pilot overflew an area marked on their map to be sprayed that day, which was adjacent to a river and under water due to flooding. As a result, the pilot radioed the operations manager to ask whether to spray the flood-affected area. The operations manager reported that they contacted the property owner but were subsequently unable to communicate with the pilot via radio to provide a response. 

Figure 2: Operating area including target spray blocks, location of airstrip, property boundary and neighbouring house 

Source: Aircraft operator information overlaid on Google Earth, annotated by the ATSB

At 1053, the aircraft took off with the tenth load and continued to fly north-south racetrack patterns from the western side of blocks 127 and 128, followed by an inspection of the northern end of the target area, before returning to land at the airstrip again at 1120. The loader then filled the aircraft with fuel and loaded 1,250 L of chemical into the hopper. While the loader did those tasks, the pilot had a snack and a drink, and conducted a walk-around of the aircraft, which they had done consistently during refuelling breaks throughout the day.

At 1126:15, the aircraft departed on the eleventh load and tracked again towards blocks 127 and 128 to recommence spraying the next run from where they had left off (as can be seen in Figure 3), in the racetrack pattern. The pilot commenced a run to the south, but before reaching the target crop, the aircraft climbed and turned left. The aircraft then overflew the northern boundary of block 127, which was also the property boundary. The operations manager heard the pilot on the radio expressing concern about the potential for chemical spray to drift towards a house on the neighbouring property due to the wind. The aircraft then tracked north and again overflew the flood-affected area (top of Figure 2 and Figure 3), before returning to the north‑eastern end of block 127 (Figure 3).

Figure 3: GPS data showing the aircraft’s track on the accident load

Source: Aircraft operator TracPlus data overlaid on Google Earth, annotated by the ATSB

A witness reported that on the first and second runs along the eastern boundary, which were towards the south and north respectively, the pilot used smoke to assess the drift from the wind, before commencing spraying on the next (third) run. Instead of a racetrack pattern, the pilot conducted back-to-back spray runs with a procedure turn at each end. In a procedure turn, the aircraft is initially turned away from the direction of the turn, usually about 45°, before reversing the direction and completing the turn to position the aircraft on the reciprocal heading for the next spray run (Figure 4).

Figure 4: Back-to-back patterns with procedure turns

Source: Aerial Application Pilots Manual (Aerial Application Association of Australia, 2011), annotated by the ATSB

After the two ‘smoker’ runs, the aircraft sprayed 4 runs. At 1145, the aircraft commenced a spray run towards the south, at the end of which the aircraft climbed. The aircraft’s last recorded position was at 1145:30 about 170 m beyond the southern end of the field and 180 ft above the ground.

A witness (‘Witness 1’, Figure 5) located in the neighbouring paddock to the east, observed the aircraft turn slightly left then enter a right turn, consistent with a procedure turn. During the turn, the witness observed the aircraft’s nose pitch down and it descended rapidly, right‑wing low, then disappeared behind trees. The witness reported seeing a black plume of smoke rise almost immediately afterwards.

Figure 5: Aerial photo of target spray area taken 10 December 2021, showing accident site and witness location  

Note: The yellow lines represent the block boundaries.

Source: Aircraft operator, annotated by the ATSB

Another witness positioned about 1 km south of the accident site, observed the aircraft’s distinct yellow colouring as it descended among trees and impacted the ground. The witness estimated this was followed within about 2 seconds by flames and smoke. The pilot was fatally injured, and the aircraft was destroyed.

Context

Pilot information

Medical, licence and qualifications

The pilot held a valid Class 1 Aviation Medical Certificate issued on 15 October 2021 with no recorded medical issues and was reported to have been fit and healthy. The pilot’s Commercial Pilot Licence (Aeroplane) was issued on 30 March 2021.

The pilot also held ratings for:

• single-engine aeroplane
• low-level
• aerial application[2]

and endorsements for:

• tailwheel
• manual propeller pitch control
• gas turbine engine.

The pilot attained Spraysafe accreditation[3] through the Aerial Application Association of Australia (AAAA) on 2 July 2021 and had been issued a Pesticide Licence by the New South Wales Environment Protection Authority on 24 August 2021.

At the start of the accident day, the pilot had accumulated 372.5 flying hours, 203.3 of which were conducting aerial application operations (including training), 31.7 of which were in VH-ACQ. 

Recent history

The pilot’s recent sleep-wake and work history was determined from a combination of interviews, text messages, logged flight times and recorded flight data.

The pilot lived about 30 km from their assigned base and about 70 km from the operator’s Moree base. In late November, the pilot’s commute was increased by about 1 hour as a road was inaccessible due to flooding.

On 2 December 2021 (2 days prior to the accident), the pilot left home at about 0600, returned at 2000 for dinner and was in bed by 2100. That day, the pilot recorded 13 hours of duty time and 8 hours of flight time. The pilot had described this as a huge day – the most spraying so far in one day – and was very tired at the end of the day.

The day prior to the accident, the pilot was awake by 0412 and left for work at 0530. That day, the pilot recorded 13 hours of duty time and 7.9 hours of flight time. At 1816, the pilot sent a text message to a friend stating that they were about to fall asleep in the aeroplane (but did not advise the operator), before ferrying the aircraft to Moree Airport for maintenance, arriving at about 1900. Rather than drive home, the night before the accident, the pilot stayed with another company pilot in Moree. The company pilot reported that the accident pilot was happy and was proud of having sprayed 1,100 hectares that day and 1,000 hectares the previous day. They went out for dinner at about 2100 and went to bed between 2200 and 2215. Others described the pilot that evening as a bit tired but nothing out of the ordinary.

The accident day was the pilot’s ninth consecutive day of duty. That morning, the pilot was awake by 0510 and picked up another company pilot at 0530. They purchased breakfast, snacks and lunch from a petrol station before heading to Moree Airport. The company pilot recalled that the pilot reported having had a good sleep, appeared fresh and not tired, and was very happy that morning. Other company pilots who had seen the pilot in the 24 hours prior to the accident reported that the pilot did not seem overwhelmed or stressed.

For the 3 days prior to the accident, the recorded flight times were the longest consecutive logged by the pilot (7.7, 8.0 and 7.9 hours) and the longest duty times (12, 13 and 13 hours).

Flight training

The pilot completed their commercial pilot licence flight test on 24 March 2021 with 166 hours total flying time. The pilot had completed an integrated training course, combining ground theory training with practical flight training for their private and commercial pilot licences. During this training, the pilot was described as a good student who was well-prepared, focused and dedicated. The pilot’s non-technical skills were assessed as being very good, and their aircraft handling skills were described as exceptional – including maintaining the aircraft well within the required tolerances in steep turns, practice forced landings and circuits. 

Aerial application training

The pilot commenced training for aerial application and low-level ratings on 15 June 2021, and achieved those, along with a tailwheel endorsement, on 30 June 2021. At that time, the pilot had accrued 204.3 hours total flying time. This included the aerial application rating training, which consisted of 31.1 hours dual (including test) and 5.5 hours solo aerial application flight time, conducted in a Piper PA-25 two-seat dual-control aircraft.

The instructor who conducted the pilot’s aerial application rating and endorsement, noted in the second lesson (16 June) that the pilot had carried out stalls in all configurations at 1,000 ft above ground level. The pilot was reported to have handled these well for their total flying experience and achieved a good standard in recovery from stalls during climbing turns with left- and right-wing drops.

The lesson conducted on 20 June was conducted on a field similar to the accident field – with a diagonal boundary and trees – and included conducting back-to-back runs with procedure turns (Figure 6). On the training day, the wind was about 5 kt in the downwind direction at the diagonal boundary. The lesson notes indicated the pilot initially had difficulty lining the aircraft up on the spray run after the turn. The notes from the following day’s lesson (21 June) included ‘needs to back off on turns, pulling too tight…at times near stall’. A similar comment was made on 28 June. The instructor reported providing feedback to the operator of VH-ACQ (Aircair), to keep an eye on this aspect, but overall assessed that the pilot flew very well when taking into account the limited hours of experience at that time. 

Figure 6: Diagonal boundary paddock example  

Source: ATSB

Employment at Aircair

The pilot was inducted into Aircair Aviation Operations (Aircair) in July 2021, and initially commenced working as ground crew – mixing and loading chemical. On 9 September, the pilot satisfactorily conducted an operational proficiency check flight with the chief pilot in a Cessna 185 aircraft. The pilot’s first aerial application job at Aircair was on 15 September 2021 in a Cessna 188B (C188B) aircraft – a conventional single-seat, piston-engine, strut-braced low-wing agricultural aircraft – having completed 2.4 hours of familiarisation in the aircraft in the previous 2 days. The pilot’s emergency dump training[4] in the C188B aircraft was assessed satisfactory on 21 October 2021, although recorded in the pilot’s logbook as 13 October.

The pilot then conducted aerial application in the C188B aircraft and on 22 November 2021, the chief pilot signed off that the pilot had completed the required 110 hours of aerial application under supervision. At that time, the pilot had accrued 321 hours of flying time.

The pilot was described as having a natural ability to pick things up quickly, flew very nicely and did everything they were asked to. The chief pilot and general manager of Aircair assessed that the pilot was then ready to progress to turbine-engine aircraft.

Gas turbine design feature endorsement

On 26 November 2021, the pilot commenced gas turbine engine endorsement training. The Civil Aviation Safety Regulations Part 61 Manual of Standards Schedule 2 detailed the skills and knowledge required to operate a gas turbine powered aircraft on the ground and in the air during normal and abnormal operations. The elements specified in the Schedule were starting, stopping and managing a gas turbine engine, and managing abnormal and emergency actions applicable to a gas turbine engine.

The endorsement required the pilot to complete ground (theory) components including studying the applicable flight manual, and then submit a written exam on the engine and aircraft to the examiner, which the pilot completed on 26 November 2021.

The pilot also received ground familiarisation of the engine and aircraft, followed by 7.5 hours of flight time in a two-seat dual-control turbine Air Tractor AT-504 aircraft. This included normal and abnormal situations, stalls and steep turns, and aerial application operations. The pilot’s stall training in the AT-504 aircraft consisted of climbing to a safe height, at which the supervising pilot demonstrated a straight and level stall, with the accident pilot following on the controls. The supervising pilot pointed out the stall buffet and the stall stick position, then demonstrated recovery from the impending stall, by reducing back pressure on the control stick. The supervising pilot commented that the AT-504 always tended to drop the right wing about 5° in the stall. The accident pilot then conducted two stalls. On the second of those, during the recovery, the aircraft nose lowered, and, assuming the aircraft had recovered from the stall, the pilot reapplied back pressure. However, as the wing was still stalled at the time, this action resulted in a secondary stall, from which the pilot performed a successful recovery.

Having demonstrated the ability to identify and recover from stalls, the pilot then conducted their first aerial spraying activity under supervision in the AT-504. The supervising pilot reported that the pilot had initially applied too much back pressure on the control stick (‘pulled too hard’) during the turn. This was due to trying to keep the aircraft too close to the paddock and led to a stall buffet during the turn. The supervising pilot reported that they reiterated the importance of the stall stick position, and the need to reduce back pressure on the control stick. The amount of force required on the control stick depended on the trim setting. If the aircraft was trimmed such that forward pressure was required during a spray run, the back pressure required to stall the aircraft was small.

The supervising pilot also reported advising the pilot to increase the amount of initial turn (‘fade’) away from the direction of the turn in the procedure turn, so the resulting turn was not as tight. They commented that the pilot subsequently flew the spray pattern ‘beautifully’.

The pilot received their gas turbine endorsement on 27 November 2021. The pilot had completed the requirements of the endorsement; however, it was noted that the theory examiner had signed off the endorsement although the flying component was conducted by a different pilot. At the time the theory component was conducted, a dual-seat aircraft was not available to conduct the in-flight competencies, and as a result, the examiner would have had to observe the pilot solo in a single seat aircraft from the ground. The operator assessed it would be more effective and safer to wait until the dual-seat aircraft was available. The theory examiner was not available when the dual-seat aircraft became available and the flying component was supervised by a pilot whose instructor rating was not current as it had not been renewed, primarily due to COVID restraints. They had however, previously conducted 5 gas turbine endorsements before their rating lapsed, and subsequently renewed their instructor rating in 2022.

Transition to the AT-400

On the morning of 28 November, the pilot conducted circuits in the AT-504 in preparation for transitioning to the single-seat AT-400 aircraft.

The operator reported that they had put many less-experienced pilots in VH‑ACQ over the last 40 years, primarily because it never lacked take-off performance, even when fully loaded. They assessed that the biggest differences the pilot would have found in transitioning from the C188B to the AT-400, were that the operating speed of VH-ACQ was about 20 kt faster, it was heavier and had more inertia. Due to its inertia, it would take longer to recover from an impending stall than the C188B. The operator noted that the cockpit layout of VH-ACQ was very similar to the C188B but more ergonomic. The main difference was the Satloc GPS display, which had a touchscreen in the C188B, but a keypad in the AT-400. The pilot had reportedly noted during their endorsement that this was something they would have to get used to.

Before the accident pilot’s first flight in the AT-400 (VH-ACQ), the Aircair general manager reported briefing the pilot about the aircraft. This included cautioning the pilot to keep the airspeed up in the turns because of the shorter wings, without Hoerner wing tips (Appendix A – Hoerner wingtips), and higher wing loading[5] than the AT-504. As a result, VH-ACQ tended to give less pre-stall buffet indication before stalling. However, the general manager advised the pilot that the stall characteristics were similar to the AT-504, in that the AT‑400 would likely drop a wing in a stall and stall recovery required the pilot to reduce back pressure on the control stick. This was consistent with descriptions by other pilots who had flown VH-ACQ. They described it as providing a stall buffet later in an impending stall than an AT-502. Additionally, that it tended to drop a wing when close to the stall, and that all Air Tractors can produce a significant wing drop when close to the stall in an unbalanced turn.

On 29 November, the pilot conducted familiarisation and circuits in VH-ACQ, before commencing revenue operations with a reduced hopper load (1,000 L), mentored from the ground by the chief pilot. The next day, the chief pilot approved an increase to 1,200 L hopper loads for 3 days, before assigning a maximum hopper load of 1,300 L on 3 December. That was still the pilot’s assigned limit on 4 December.  

The chief pilot reported that the pilot appeared to be coping well with the transition to VH-ACQ. The pilot had described the transition to the AT-400 as ‘like learning to fly again’ and had remarked that they loved flying VH-ACQ. The pilot had reportedly commented that because of the air conditioner in VH-ACQ, they did not get as tired as when flying the C188B. The pilot and chief pilot had spoken each day that the pilot flew VH-ACQ, up to the accident day. The chief pilot reported that this included discussion of general management of the turbine engine, and that the pilot had not indicated any deficiency in operating the aircraft.

Ongoing supervision and mentoring

During the pilot's flights at Aircair, they were typically supervised either by the chief pilot or the general manager flying in the same area or observing from the ground. Regardless of having completed the mandatory supervised hours, the chief pilot advised that inexperienced pilots were typically ‘spoon fed’ up until 800–900 hours of agricultural flying.

The pilot had been conducting aerial spraying on the same property on the 2 days before the accident. The chief pilot had briefed the pilot at the end of the day prior to the accident, and discussed what blocks had been done, which to do next and the expected weather noting the wind direction and forecast high temperature. The chief pilot was absent on the accident morning and did not speak to the pilot.

The chief pilot reported that they would have been on the radio with the pilot if they had not been called away on leave that day. As a result of that leave, on the day of the accident, the pilot was unsupervised for the first time. However, the Aircair general manager radioed the pilot at 0645 to check how they were going, and the pilot responded that they were good and had a plan for the day’s operation.

Aircraft information

VH-ACQ

VH-ACQ was an Air Tractor Incorporated AT-400 single-seat low-wing tailwheel agricultural aircraft manufactured in the United States (US) in 1980. It was first registered in Australia – to Aircair – in November 1980 to operate in the Agricultural category, and was later operated in the Restricted category.[6] The Certification basis was US Federal Aviation Regulation (FAR) 21.25(a)(1) and the aircraft met the structural requirements of FAR 23, basis February 1, 1965, through Amendment 23-9. The flight criteria, propulsion, system and equipment items met the requirements of Appendix B, Civil Aeronautics Manual (CAM) 8, November 15, 1951, as amended through January 10, 1956.

The aircraft was powered by a Pratt & Whitney PT6A-15AG turboprop engine, which drove a Hartzell HC-B3TN-3D three-blade constant speed reversible pitch propeller.

The aircraft was fitted with two fuel tanks, located in the inboard section of each wing and an integral part of the wing structure. Both tanks gravity fed into a small header tank, located behind the hopper. Their combined total fuel capacity was 476 L, of which 454 L was usable. This equated to a maximum usable fuel weight of 363 kg (using a specific gravity of 0.8 for Jet A1 fuel). The aircraft was also fitted with dispersal equipment for spraying and spreading, and a system that allowed the hopper contents to be dumped if required. The hopper had a capacity of 1,514 L.

Maintenance history

The aircraft was maintained by a Civil Aviation Safety Authority (CASA)-authorised maintenance organisation in accordance with a CASA-authorised system-of-maintenance. A periodic inspection, including annual, 150 and 300-hourly, was completed on 28 September 2021, with the current maintenance release issued at that time. Scheduled and preventative maintenance conducted during this time included:

•  engine overhaul and fitment of an overhauled propeller assembly
•  replacement of lower spar caps (due life limit), with wing disassembly allowing for wing repairs and hopper refurbishment
•  testing of the airspeed indicator, altimeter, compass and pitot/static system
•  corrosion treatment and repainting.

At the time of the accident, the aircraft had accrued 18,869.2 hours total time in service. The aircraft had flown 4 hours 42 minutes since maintenance, having undergone a scheduled 75-hour inspection the evening prior, which included checking air and fuel filters, tyres, brakes and governor. The maintenance release had likely been destroyed in the post-impact fire and was not recovered from the accident site. However, there was no report of any aircraft defects prior to the accident. Furthermore, a general review of the maintenance records did not identify any anomalies.

Aircraft operating weight

The AT-400 type certificate data sheet[7] specified a maximum weight of 2,722 kg (6,000 lb). For VH-ACQ to operate above that weight, Air Tractor Service Letter 304 – Establishing and operating with a special purpose operating weight for Air Tractor aircraft, applied. The Service Letter referenced methods described in CAM 8 to enable operations up to a maximum recommended weight of 3,565 kg (31% overload). A placard affixed to the aircraft stated the maximum take-off weight as 3,565 kg. The Service Letter stated:

When operating at weights above the certificated maximum weight, please note that the stall speeds will increase from the published stall speed numbers in the Airplane Flight Manual. For example, when operating at a 31% overload weight, the stall speed will be approximately 15% higher than at the certificated maximum weight. During the required flight check, the new stall speeds should be determined.

On 23 October 2018 at 18,098.2 hours total time in service, the airframe logbook included an entry stating that the aircraft was flight checked on that day in accordance with CAM 8.10-3(e). It was found to be safely controllable and to operate satisfactorily with the hopper load of 1,356 kg and aircraft total weight of 3,565 kg.

Accident load weight and balance

The Airplane Flight Manual (AFM)[8] for VH-ACQ included a load data sheet to calculate the aircraft’s weight and balance. The sheet contained a table with entries for the weight, arm and moment of the aircraft with sprayer and spreader configurations, pilot, baggage, hopper and fuel. The table also provided forward and aft centre of gravity (CG) limits for weights up to 2,269 kg and for 2,722 kg, with a straight-line variation between those points.

For the accident load, VH-ACQ had been refuelled to full and the hopper loaded to about 1,250 L. Using a fuel consumption rate of 225 L/hr for spraying based on the company’s operations manual, the probable fuel remaining was approximately 387 L (310 kg). The pilot had completed 4 spray runs about 1,700 m long at an 18 m wide swath, using a chemical application rate of 18 L/ha, which left about 1,030 L in the hopper. The accident weight was therefore approximately 3,066 kg, below the demonstrated maximum gross weight of 3,565 kg, and the CG was about 534 mm aft of the datum. This was within extrapolated CG limits.

The hopper load calculation table for VH-ACQ stated that with full fuel, the maximum permissible hopper load was 1,348 kg.

Fuel tank certification and testing

For the aircraft’s certification, CAM 8.3052 Tank Tests required that all fuel tanks should be pressured tested to 3.5 PSI to provide an indication of the ability of the tank to resist distortion and leakage under vibratory, accelerating, and surging loads, which may be encountered in flight and landing conditions.

FAR 23.967 (e)(1) stated that the fuel tank must withstand 9 G ultimate fore and aft load from emergency landing conditions. Air Tractor simulated this in testing by converting the acceleration to an internal pressure. Air Tractor provided an extract of the engineering report covering the fuel tank testing. Their testing found that using 20 PSI, the fuel tanks were capable of withstanding 27 G before leaking.

These two requirements were for flight, landing and emergency landing conditions, but did not assess the tank for tolerance to direct impingement. There was no requirement in the design standards for normal category aeroplanes to be tested for fuel tank crashworthiness.

Installed GPS systems

Systems

The aircraft was fitted with a TracPlus surveillance system, which provided real-time tracking through a satellite or mobile phone network. It reported position, altitude, and speed at set time periods, in this case every 15 seconds. The ATSB obtained TracPlus data for the accident day and several previous flights.

A Satloc aerial guidance system provided the pilot with guidance commands to fly accurate spray patterns. It was set to record at 2-second intervals. The Satloc data from the accident flight was unrecoverable due to extensive fire damage to the Satloc unit. However, the ATSB obtained Satloc data for several of the pilot’s previous flights. 

Satloc increase/decrease

The Aircair Air Tractor fleet all had the same control stick switch configuration. The Satloc stick switch (button) provided a ‘remote’ function to increase or decrease the run number, which could also be done on the Satloc keypad (Figure 7).

Figure 7: Satloc stick switch and keypad

Source: ATSB

The Satloc keypad could be set to either increase or decrease the run numbers. When set to increase, pressing the stick switch (button) once, increased the run number by one, and when set to decrease, pressing the stick switch once decreased the run number by one. When a pilot had set up the Satloc GPS to spray a racetrack pattern, then changed to fly a back-to-back pattern, they would then be spraying every second run number (with the alternate numbers on the other side of the programmed racetrack pattern). Therefore, the next parallel spray run required the switch to be double-clicked at the end of each run to spray the adjacent, parallel run.

The stick switch could only make the run numbers go one way: up if increase was set or down if decrease was set. Therefore, if a pilot inadvertently clicked the button too many times and needed to go back, that would have to be done using the keypad.

When the Satloc was set to decrease, this swapped the direction function of the keypad buttons: the up arrow on the keypad (labelled ABC) would then decrease the run number and the down arrow on the keypad (labelled DECR) would increase the run number. Reportedly, this frequently resulted in pilots pressing the incorrect (for example, up arrow) button first, then having to press the correct one (for example, down arrow) multiple times. This would require ‘head in cockpit’ time and the potential for distraction from controlling the aircraft. The US Federal Aviation Administration (FAA) Advisory Circular 137-1A stated that pilots should ‘use extreme caution when using GPS swath-marking equipment to prevent diverting attention away from the task of flying the aircraft safely’. 

Meteorological information

Bureau of Meteorology

Between 0600 and 1145 on the accident day, the pilot was operating within the NSW - West subdivision of the Bureau of Meteorology Graphical Area Forecast.[9]. The forecast for NSW - West issued at 0323 on 4 December and valid 0400–1000 was for visibility greater than 10 km and no cloud. The graphical area forecast issued at 0325 and valid 1000–1600 included scattered high cloud above 10,000 ft and, from 1100, isolated cumulonimbus clouds with visibility reducing to 2,000 m in isolated thunderstorms and rain. Moderate turbulence below 10,000 ft was forecast in thermals and dust devils[10] from 1200.

The nearest Bureau of Meteorology weather station was at Moree Airport, 80 km east-north-east of the property airstrip. The aerodrome forecast[11] for Moree Airport issued at 0424 and valid from 0600–1900 included wind from 360° at 8 kt, changing from 1100 to 240° at 14 kt and CAVOK.[12] Between 1100 and 1500, there was a 30% probability of variable winds at 20 kt gusting to 40 kt with visibility reducing to 2,000 m in thunderstorms with rain and associated scattered cloud at 800 ft above aerodrome elevation. The maximum temperature was forecast to reach 34 °C.

Oz Forecast

For more accurate local weather information (temperature and wind speed/direction), company pilots usually referenced the closest Oz Forecast weather station. The wind was measured 2 m above ground level and recorded in km/h and degrees true (°T). The nearest Oz Forecast weather station was located 11 km west of the property airstrip. Data from that weather station recorded at 15-minute intervals and converted to kt, is shown in Table 1.

Table 1: Weather recorded at 15-minute intervals from 0600–1200 EDT

Source: Oz Forecast

At the time of the accident (1145), the wind was from the south-west at 10 kt gusting to 18 kt and the temperature was 32.6 °C. On the last spray run, as the aircraft had been tracking south, the wind was primarily a headwind. As the aircraft started to turn, it initially encountered more of a crosswind. The accident occurred as the wind became a quartering tailwind, but before completion of the turn to the north.

Other observations

A witness described the wind at about the time of the accident as ‘chopping and changing directions, was more stop and start again…gusts on and off’. The loader also described the weather as ‘windy’ and reported that the wind had become stronger throughout the morning.

At the time of the accident, the Aircair general manager was flying near Moree Airport, where the temperature was about 32 °C. They described the flying conditions as starting to get ‘bumpy and uncomfortable’ and about 30 minutes after the accident, as ‘quite windy and rough’. They reported that on the accident day, the wind had started from the north-east and went around to the north-west during the morning, in the usual summer pattern, but that it was stronger than normal, and increased around the time of the accident.

Another company pilot operating in the area that day recalled that it was the first hot, rough day of the season.

The chief pilot reported that on the evening before the accident flight, during their briefing with the pilot, they discussed the forecast 35 °C temperature. This included discussion of the associated increased thermal activity, which may lead the pilots to cease spraying operations.

At the time of the accident, the sun was not in a position to affect the pilot’s visibility.

Operational information

Work orders

The pilot had operated at the same property on 2–4 December. The blocks allocated to the pilot to be sprayed were depicted on multiple work orders for the property, one of which is depicted in Figure 8. Of the blocks depicted in Figure 8, on 4 December the pilot sprayed blocks M10, M11, M24, M25, M118, before commencing blocks 127 and 128. Block 117 was the wet area along the river and 123, 124 and 125 were not to be sprayed (although as they had powerlines in them, the pilot had been told not to spray them anyway).

Figure 8: Work order map depicting areas to be sprayed and location of the accident site

Source: Aircraft operator, annotated by the ATSB

Field selection

The operator reported that they selected blocks for spraying appropriate to a pilot’s experience and ability – including the block shape and whether there were powerlines in or near the target area. The accident pilot had not yet sprayed a block with a powerline in it, but had sprayed blocks with a powerline along one edge in the previous two weeks. Although not documented, it was reported that when any new aspects of the spraying task were introduced, the chief pilot or general manager would be there to mentor the pilots – either on the ground or flying next to them. The gradual progression to more complex blocks continued with the pilot’s transition to a more powerful, faster, heavier aircraft.

The field the pilot was spraying at the time of the accident (127 and 128 – Figure 8) was selected by the chief pilot because it was considered suitable for the pilot’s level of experience, with no powerlines or difficult obstacles. The blocks sprayed by the pilot the previous day were irrigated blocks – squarer and more defined. The accident field was a dry-land block with a few small trees. The field was near rectangular, but it had a diagonal border at the southern end, and the eastern and western fence lines were not quite parallel. The diagonal border angled down toward the western side, which would have made the back-to-back spray runs with a procedure turn at each end slightly more difficult for the pilot when incrementing runs from east to west. This is because with a diagonal end, each subsequent time the pilot pulled the aircraft up to make the procedure turn, the aircraft had to be further beyond the boundary to allow enough distance to line up for the next run (Figure 6).

Back-to-back pattern

According to the AAAA Aerial Application Pilot’s Manual (2011), the back-to-back pattern was the most common pattern flown prior to the availability of on-board GPS systems. It was usually the first pattern pilots learnt in their initial aerial application rating training. Flying back-to-back patterns was the preferred pattern when working around a hazard, such as a powerline, tree, susceptible crop, or house. This was because in a back-to-back pattern, the aircraft would be gradually moving towards a hazard. In contrast, when flying a racetrack pattern, the aircraft moves away from the hazard, which could be more easily forgotten on the next run. In a back-to-back pattern, during the procedure turn at the end of each run, the aircraft is turned through 180°. During the turn, ‘most of the speed is squandered and you arrive back on the same [reverse] heading at which you started the turn, with time and speed both going in the wrong direction’ (AAAA, 2011).

The operator reported that during a procedure turn, pilots judge how far to turn away (fade) by using the GPS light bar for guidance, counting (for example, for 3 seconds) in their head, or by feel, before banking the opposite way around the turn. If they do not get it right, it can be difficult to line up on the next run. In that case a pilot would normally skip that run and write the missed run number on their hand. They would then either return to spray it later or leave it and advise the operations manager at the end of the day, so that it would get done another day. The chief pilot reported having previously seen the pilot with missed run numbers written on their hand.

In a procedure turn, after the fade, as a pilot banked to turn the aircraft in the opposite direction, they would extend some flap during the turn, usually up to about 15° in the Air Tractor aircraft. They would then retract the flap as the aircraft lined up for the next spray run. The chief pilot reported that the key instrument referenced by a pilot during the turn was the airspeed indicator, while also cross-referencing the GPS light bar, and using the turn and balance indicator (ball) to ensure a balanced turn. The target airspeed they were referencing on the airspeed indicator depended on the aircraft weight.

Flight and duty review

Aircair flight and duty time limitations were in accordance with Civil Aviation Safety Regulations Part 137.Q. The key limitations were:

• maximum flight time of 170 hours in 28 days and 1,200 hours in 365 days
• daily tour of duty limit of 14 hours including a rest period of at least 8 hours after a duty of 10 hours or less, or 10 hours after a duty of more than 10 hours
• following a tour of duty of more than 10 hours, a pilot was permitted to recommence after 9 hours off duty, if they believed they were mentally and physically fit to do so and would not breach any other regulation in the subpart
• at least 36 hours continuous off duty in any 14 days
• 44 hours cumulative duty time limit in 3 days (72 hours) and 98 hours in 7 days (168 hours). 

The Aircair Administration and Policy Manual stated that for aerial application operations, duty time was calculated from 30 minutes prior to the flight to 15 minutes after the flight. The regulations defined flight time as commencing when ‘the aircraft first moves under its own power for the purpose of taking off’.

On the accident morning, the aircraft engine started at 0553, take-off roll commenced at 0559 and it took off at 0600. According to Aircair’s procedures, recorded duty time would commence no later than 0529, although the pilot arrived at the airport at about 0550. According to the operator’s flight and duty records, the pilot had been on duty for 13 hours the previous day, having commenced duty at 0700 and ended at 2000. Recorded data showed the aircraft was shut down at 1919 that evening and duty time should therefore finish no earlier than 1934.

As the previous day’s duty time exceeded 10 hours, the pilot was required to have a rest period of 10 hours, but could recommence duty after 9 provided the pilot assessed themselves ‘mentally and physically fit to do so’. The pilot’s start time was close to the 10-hour rest period, accounting for imprecision of the recorded duty times. It could not be determined whether the pilot made this assessment, however, regulations required pilots to ensure they were fit for duty prior every flight. Civil Aviation Safety Regulation 137.300 described that a pilot was not fit for duty if they had not had adequate rest, food or drink; or was adversely affected by a medical condition or a psychoactive substance.

The pilot commenced flying for Aircair on 9 September 2021 and flew 15.5 hours total for the month. In October, the pilot flew 54.8 hours in the C188B aircraft, over 18 days, with the longest flight time 7.3 hours on 6 October followed by 6.3 hours on 7 October. From 1 to 24 November, the pilot conducted 50.4 hours in the C188B. In that period, the longest flight time was 6.6 hours on 16 November which was also the longest duty day of 10.5 hours. The previous longest flight time recorded was on 6 October (7.3 hours). Both those days had been preceded by significantly shorter flight times.

The pilot’s most recent day off work prior to the accident was 25 November. After their day off, on 26 November the pilot commenced the transition to turbine-engine aircraft. Figure 9 and Table 2 show the pilot’s flight and duty records from 26 November to 3 December. The first time (ever) that the pilot flew VH-ACQ, was 5 days before the accident on 29 November. On that day, the pilot was awake at 0454 and home at 2126, having logged 5.6 hours of flight time in VH-ACQ.

Figure 9: Recorded flight and duty times from 26 November to 3 December 2021

Source: Aircraft operator data analysed by the ATSB

Table 2: Flight and duty records from 26 November to 3 December 2021

In the 8-day period since the pilot’s last rest day, there were some discrepancies between the logged flight and duty times and the recorded GPS data for the aircraft. On 3 December, the aircraft was rolling at 0647, 13 minutes prior to the recorded duty commencement. On 29 November, the aircraft landed at 1841 and on 26 November, the aircraft landed at 1932, both times after the recorded end of duty period. It was the pilot’s responsibility to enter the flight and duty times and it could not be determined how the inconsistencies occurred. The chief pilot reported that they checked the entered data occasionally.

Operational tempo

A review of text messages the pilot sent to a friend (but not to the operator) showed that since October and throughout November, the pilot had often mentioned that they felt tired, and had frequently been awake at or before 0500, and getting to bed after 2100. 

The accident pilot had flown more than 30 hours in VH-ACQ in the 4 days prior to the accident. The chief pilot commented that the company pilots had been doing a lot of flying and were approaching the flight and duty limits every day. Other company pilots reported that they had been working long, but not excessive, days. Further, that although they had early starts, they were not finishing very late.  

On the day before the accident, the chief pilot had reported being worried about the company pilots with the workload ahead. The chief pilot sent a text message to check they were all managing the workload and reminding them to work together with each other and the ground crew, stick to the routine and keep it simple. Later that day, a company aircraft struck a powerline, which resulted in minor damage and no injuries to the pilot.

In response, on the morning of the accident flight, the chief pilot sent a message to all company pilots, reminding them, among other things, to be aware of the effects of successive early starts and late finishes. The message advised pilots to manage their time and rest when they could, consider load sizes particularly following refuelling, maintain wire awareness, and to be safe, have fun and keep it simple.

Communications

The UHF radio in VH-ACQ had malfunctioned on the day prior to the accident and been fixed that evening. The UHF radio was used to communicate with the operations manager, other company pilots in the area and normally, with the loader. However, the loader did not have a radio that day as they were not driving a (company) vehicle fitted with one. Normal procedure involved the pilot communicating with the loader via radio so the loader could prepare the next chemical load prior to landing. The operator also had a procedure for loaders to operate with an unserviceable UHF, which required the loader to either mix load by load only, or to continue mixing until further notice, and to have a mobile phone. The loader had a mobile phone.

During refuelling prior to the accident load, the pilot sent a text message to the operations manager and received an immediate response. After departing with the accident load at about 1130, a company pilot operating in the area heard the accident pilot on the radio to the operations manager advising of their concern about drift onto neighbouring property and that the wind was picking up. That company pilot later reported that they thought the pilot sounded nervous. The operations manager reportedly responded suggesting they could spray a different area or cease operating.

Analysis of recorded data

The TracPlus data for 4 December 2021 indicated that the pilot had not flown a hazard check of any block before commencing spraying or conducting clean-up runs. This meant the pilot had not overflown the south-eastern area of the block (127 and 128) where the accident occurred.

For the accident load, several data points were recorded at the northern and southern ends during the turns. Analysis of these points indicated the maximum height reached during the turn at each end of the field was about 250 ft above the ground.

Analysis of Satloc data from the pilot’s flight the day prior to the accident, showed that in more than 75% of procedure turns, the peak angle of bank was 50–70° and peak acceleration was between 1.5 and 1.9 G. The angle of bank exceeded 80° three times and the peak G on average occurred at about the same time as the peak angle of bank. In the turn technique described in the AAAA’s Aerial Application Pilot’s Manual (AAAA, 2011), the peak G would be reached before the peak angle of bank:

A key pilot technique in aerial application is to unload the aircraft from excessive G before applying aileron to initiate a turn. This is most likely to be relevant during a pull out of a paddock at the end of a run. Pull back to get out of the paddock and establish the aircraft in a climb, unload the G, and then initiate the turn. 

The Satloc data from the day prior to the accident also showed that during back-to-back spray runs with procedure turns, the aircraft was usually lined up (within half a swath width) on the next spray run about 200 m prior to the crop boundary.

Aerodynamic stall

A wing generates lift when the airflow around the upper and lower surfaces results in a pressure difference between those surfaces. At a certain angle of attack (the relative angle between the chord line of the wing and the approaching airflow), which is a characteristic of the wing design, the flow over the upper surface of the wing separates from the surface. This condition is known as an aerodynamic stall (or simply a stall) and results in a rapid reduction in the lift generated and an increase in drag. Due to the sudden reduction in lift from the wing and rearward movement of the centre of lift, an uncommanded nose-down pitch ensues.

A wing drop occurs when one wing stalls before the other, which can be exacerbated by uncoordinated (or ‘unbalanced’) flight. A cross-control stall occurs when the critical angle of attack is exceeded while aileron is applied in one direction and rudder in the opposite direction.

As a loss of altitude also occurs during recovery from a stall, it is possible to stall with insufficient height above the ground to recover. The AFM for VH-ACQ stated the altitude loss from a wings-level stall was 220 ft at 2,722 kg gross weight. The main indications of an impending stall in the AT-400 are airframe buffeting (vibration) and an aural stall warning (horn).  

Aerofoils of the type used on aircraft such as the AT-400, typically stall at angles of attack of around 16°. This critical angle of attack can be exceeded at any airspeed, any (pitch) attitude and any power setting. As most small aircraft do not have an instrument that indicates the aircraft’s angle of attack, the angle of attack at which the stall occurs may be referenced to an airspeed. The AFM for VH-ACQ provided stall speeds at 2,722 kg gross weight, power off, wings level (0° angle of bank), in a balanced level turn at selected angles of bank, and with the flaps up (retracted) and flaps down (fully extended) (Table 3).

Table 3: Angle of bank and stall speed at 2,722 kg, power off (adapted from AFM)

However, the airspeed at which a stall will occur is not fixed to a single value, and varies with weight, centre of gravity, load factor,[13] and power setting. Tight turns and rapid pull-ups increase the load factor and therefore increase the stall speed. A stall that occurs at a stall speed greater than the +1 G stall speed, such as when turning or pulling up, is termed an accelerated stall. Increasing an aircraft’s weight by 25% will result in the stall speed being about 12% faster.

At the probable aircraft weight at the time of the accident (3,066 kg), the stall reference speeds in the AFM (Table 3) would increase by a factor of 1.06. For the referenced angle of bank stall speeds, if the pilot did not move the control stick aft to maintain level flight, and the aircraft descended while turning, (at the same radius), the G would be less, therefore the stall speed would be lower than when maintaining a level turn.

The primary control for angle of attack is the aircraft’s elevator. Pulling back on the control stick will increase the angle of attack and pushing forward will decrease the angle of attack. If a pilot pulls the stick too far back and deflects the elevator too far, it will increase the angle of attack of the wing to the critical angle and stall it. The elevator control stick (or column) position at which the critical angle of attack is reached is independent of factors including airspeed, angle of bank, power, and pitch attitude. Recovery from a stall requires reducing the angle of attack by moving the control stick forward, which normally means lowering the aircraft nose (pitching down). A secondary stall can result following a stall if, during the recovery, the pilot again pulls the stick past the position at which the critical angle of attack is reached in an effort to regain horizontal or climbing flight too quickly.

As VH-ACQ was the ‘first of type’ AT-400 registered in Australia, flight tests were conducted at Ballarat airfield, Victoria, on 31 October and 2 November 1980. At the flight-tested weight of 3,042 kg, the report concluded that the handling characteristics were acceptable. It found the airframe (pre-stall) buffet was felt at 76 kt indicated airspeed (IAS) with the flaps up (fully retracted) and was ‘not violent’. There was a ‘clear and distinctive’ stall warning onset at 80 kt IAS with flaps up (fully retracted) and at 68 kt with flaps down (fully extended). The stall characteristics were described as ‘satisfactory’.

Human performance considerations

Workload

Workload is defined as the sum of task demands placed on an individual’s cognitive resources that are used for attention, perception, decision making and action (Skybrary, 2010). Humans are limited in the amount of new information the brain can process at once. Once the limit of cognitive resources has been reached, performance starts to decline with increased error rates and/or delayed responses. Factors that can increase workload include excessive task demands, time pressures, a lack of operator skills and knowledge, or environmental conditions (NASA, 2010).

Task complexity and an individual’s level of experience and knowledge can have a significant impact on their workload (Li and others, 2021). Less experienced pilots typically have a higher cognitive workload compared to those that are more experienced due to their continual learning and development of skills. A more experienced and knowledgeable individual can rapidly interpret a situation based on past experiences and knowledge, and subconsciously pattern-match. This frees up cognitive capacity for a pilot to maintain vigilance and monitor performance, and, if they choose, reflect on their actions, whereas a less experienced individual may not (Byrne and others, 2013).

Green and others (1996) described the effect of practice on motor skills such as flying an aeroplane. With experience, skill acquisition progresses from the cognitive phase, in which the learner has to think consciously about the action, through the associative phase and on to become automatic, and the skill can then be executed without conscious control. Until this occurs, central processing capacity is needed to perform the task. Thus, a pilot with fewer hours in an aeroplane type would be expected to experience a higher workload than a more experienced one for the same task.

The instructor who conducted the pilot’s aerial application rating described the increase in workload for a pilot progressing from the C188B to the AT-400 as: ‘The workload is just so high for [the AT-400 aircraft] – they’re fast, nippy in the turn. If you are going to fly it on the edge, things are going to happen. It has more than double the weight and inertia’ of the C188B. They further reported that aerial application work is ‘not mundane’, that the pilot would be concentrating all the time, and has to consider other factors such as drift and temperature, in addition to flying. To conduct effective aerial application, while manoeuvring the aircraft at low altitude, a pilot must visually scan external cues and monitor internal resources (NTSB, 2014).

High workload is associated with increased error rates and reduced safety margins (Harris, 2011). It also leads to a degradation in performance and at extremely high levels of workload, important information may be missed due to the narrowing or focussing of attention onto only one aspect of the task (Green and others, 1996).

Fatigue

Overview

The Civil Aviation Safety Regulations define fatigue for a flight crew member (FCM) as:

a physiological state of reduced alertness or capability to perform mental or physical tasks, which:

• may impair the ability of the FCM to safely operate an aircraft
• is caused by 1 or more of the following: 
  • the FCM’s lack of sleep;
  • the FCM’s extended wakefulness;
  • the FCM’s circadian phase at any relevant time;
  • the FCM’s workload of mental activities, or physical activities, or mental and physical activities at any relevant time.’

The International Civil Aviation Organization (ICAO) (2020) defines fatigue as:

… a physiological state of reduced mental or physical performance capability resulting from sleep loss or extended wakefulness, circadian phase, or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety-related operational duties.

Factors that can cause fatigue include (CASA, 2012):

• emotional strain
• mental workload
• strenuous or sustained physical exertion
• inadequate food and fluid intake
• adverse environmental conditions, such as extremes of temperature, low light levels, vibration and confined spaces
• disrupted and lost sleep.

Mental fatigue results from long periods of cognitive activity. Its effects can include reduced concentration and manual dexterity, increased reaction time, performance monitoring, error management and decision making (Boksem and others, 2005; Bafna & Hansen, 2021, CASA, 2012; Heywood 1999).  

Self-assessment of fatigue

Although there are some known limitations of self-rated fatigue, research on airline flight crew has shown correlation between self-rated fatigue and performance in vigilance tasks, for example using the Samn-Perelli 7-point fatigue scale[14] (Garwon, 2016, Petrilli, 2007 and Roach, 2012). There was no regulatory or operator requirement for pilots to determine (or provide) a standardised fatigue estimation prior to, or during, operations.

Sleep and time of day

Inadequate quantity and quality of sleep is a contributor to fatigue. Most people generally require 7–8 hours of sleep to achieve a maximum amount of alertness and performance. Sleep debt can be cumulative and can result in degraded performance and uncontrolled sleep episodes (Orlady & Orlady, 1999; Hawkins, 1993). The pilot’s 72-hour history indicated they had adequate sleep opportunities in the preceding nights and the pilot was reported to have no sleeping issues.

Circadian rhythms are the body’s internal clock that regulates the sleep-wake cycle and repeats roughly every 24 hours. According to the International Civil Aviation Organization (2016) there are two times of peak sleepiness within a 24-hour cycle. The main peak is in the early morning between 0300–0500 known as the window of circadian low, another smaller peak around 1500–1700 is known as the afternoon nap window. For each individual these times can vary. The period between when the pilot arrived at Moree Airport and the accident was outside these peak sleepiness times.

Effect of multiple long days

The instructor who conducted the pilot’s aerial application rating, when asked what the effect of the previous long days would be, reported that it was not just the last couple of days; the season had effectively continued since July without a break. Research has found self-ratings of fatigue (Rithemeister and others 2021) and risks of successive incidents both increase for each consecutive day worked (Folkard and Akerstedt 2004).

As documented by ICAO (2020) biomathematical modelling is ‘a computer programme designed to predict aspects of a schedule that might generate an increased fatigue risk for the average person, based on scientific understanding of the factors contributing to fatigue…All bio-mathematical models have limitations that need to be understood for their appropriate use.’ Biomathematical models can only forecast the effects of sleep and circadian rhythms[15] on performance and cannot account for other factors known to impact performance such as training, experience, stress and illness. Additionally, the models were not designed for aerial agricultural operations and did not consider the pilot’s cognitive workload.

The ATSB used two software programs, Sleep Activity Fatigue Task Effectiveness-Fatigue Avoidance Scheduling Tool (SAFTE-FAST) and Fatigue Assessment Tool by InterDynamics (FAID) Quantum, which are biomathematical models to assess fatigue based on the pilot’s duty hours and sleep opportunity in the days leading up to the accident. Each model has specific applications and limitations.

SAFTE-FAST predicts future performance based on the recent sleep history of the projected population or individuals. The output is a performance score indicating a percentage of cognitive effectiveness at a point in time. The lower the performance score, the higher the effect of fatigue. The model is based on biological determinants of fatigue such as: hours of sleep, hours of wakefulness, current sleep debt, the circadian process and sleep fragmentation (awakenings during a period of sleep) that reduce quality (Hursh and others 2004). SAFTE-FAST indicated that the pilot’s performance was not affected by sleep history and circadian processes.

FAID uses work hours as its input to predict the effect on fatigue and performance of different duty periods or work schedules. The FAID output is a score indicating different levels of fatigue exposure for different work hours. The higher the FAID score, the higher the fatigue exposure. The FAID score is based on the following biological determinants of fatigue: time of day of work and breaks, duration of work and breaks, work history in the preceding 7 days, and biological limits on recovery sleep (InterDynamics n.d). FAID indicated a high fatigue exposure risk for the pilot on the accident day, but lower (although still high) at the time of the accident than the start of the day.

The outputs of the two models were inconsistent. The differences in results can be explained by the underlying parameters in each model.

Time on task

Agricultural operations are known to place high demands on the pilot’s attention for sustained work periods, which can result in a degradation of performance, even if the pilot has obtained adequate sleep. This is due to the continuous, repetitive, low altitude flying associated with this type of operation, while also managing the spray application (NTSB, 2014).

Rosa and others (2020) found that during a simulated 11-hour flight mission, participants' self-ratings of fatigue increased over time and their response time was slower after 7 hours. This demonstrates that sustained attention and vigilance were adversely affected by time on task.

Having started the aircraft’s engine at 0553, the pilot had been operating for nearly 6 hours when the accident occurred at 1145. Consistent with previous days and normal operations, the pilot took short breaks while the loader was refuelling, to get out of the aircraft, eat and drink. These breaks occurred approximately every hour and would last about 10 minutes. One fatigue countermeasure is activity breaks. These can reduce the impact of accumulating workload and alertness and performance will improve briefly due to providing a mental break from a continuous task (Caldwell 2008; Mallis and others 2022). Therefore, breaks can be temporarily beneficial in reducing the effects of fatigue.

Combined effects of workload and fatigue

Fatigue and workload can have similar effects on vigilance, perception and reaction/response times. A study of workload and fatigue in rail workers (Fan & Smith, 2017) found that both high workload and fatigue were associated with performance impairments. High workload was also found to increase fatigue, which then leads to a reduction in performance. The United Kingdom Civil Aviation Authority Flight-crew human factors handbook – CAP 737 (2016) described symptoms of increasing workload, including attentional and task focusing, task shedding, increased fatigue, and chance of error. It stated that:

Sustained workload contributes to fatigue. Very high workload (particularly fast onset) and feelings of not coping with the workload can cause high arousal or stress. All these things make error more likely.

The handbook lists effects of fatigue, similar to those associated with mental fatigue described earlier, including reduced awareness, easy distraction and increased slips and mistakes.

Accident site and aircraft damage  

Accident site and impact

The wreckage was located at the southern end of a stand of trees and had been subject to a significant post-impact fuel-fed fire. There were no powerlines in the area and there was no evidence the aircraft struck a tree or bird prior to the collision with terrain.

On-site examination of the wreckage and surrounding ground marks indicated that the aircraft impacted terrain upright, in a nose-down attitude of about 40°, with the right wing down about 10°. The propeller, main wheels and wing leading edge impacted the ground first (Figure 10), during which the fuselage right bottom longeron[16] fractured and punctured the right wing main spar (Figure 11). Two propeller blades were located at the engine point of impact.

Figure 10: Initial impact points – right wing, main landing gear and propeller

Source: ATSB

Figure 11: Fuselage frame longeron fracture and associated impact damage with main spar damage to right wing

Source: ATSB

Forward momentum then collapsed the forward section of the fuselage and resulted in the main spar rotating about 120° and separating from the fuselage. The aircraft then continued a short distance rotating to the right, consistent with a right turn/spin, and came to rest facing approximately east.

The engine fractured in half around the flange ‘C’ area (ring of bolts joining the exhaust casing to the gas generator casing), with the gas generator module remaining near the fuselage. The propeller hub, with propeller blade, the engine power section module, including power turbine wheel, was recovered about 27 m from the impact point, in the direction of the target crop (north). The liberated compressor turbine disc was found a further 30 m beyond the hub in a similar direction (north-east), and at the edge of the fire zone (Figure 12).

The flame front and debris trail were in the direction of the wind (towards the north-east) and towards the target crop (north). The propeller hub displacement and fire zone were consistent with the aircraft’s trajectory prior to the loss of control, and with ignition at the final resting place. There was no evidence of fire at the initial impact point.

Figure 12: Overview of accident site and fire zone

Source: ATSB

Wreckage examination

Although the throttle position could not be determined from the wreckage, examination of the damage to the engine and propeller blades was consistent with the engine producing power at impact. Seat frame distortion was consistent with a nose-down attitude at impact. Although impact and fire/heat damage precluded inspection of some control tubes and cables, flight control continuity was established via examination of connections, for example steel rod ends securely attached to bellcranks.

Aircraft configuration

Flap actuator measurement and corresponding flap setting indicated the flaps were extended about 18°. Due to impact damage, the position of the dump lever and of the hopper door could not be determined.

Fuel testing

A fuel sample was collected from the operator’s fuel tank at the property. The fuel was tested for the presence of water with none identified. A visual inspection did not identify any particulate matter in the fuel. There were also no reports of fuel quality concerns with the operator’s other aircraft using the same fuel source.

Survivability

Post-mortem and toxicology results

An autopsy report was prepared for the NSW Coroner. The report provided to the ATSB included the results of a post-mortem examination conducted by a forensic pathologist and toxicology testing.

The post-mortem examination found one minor fracture and multiple heat-related injuries, with no (life-threatening) traumatic injuries identified. No natural disease pathology was identified and no substances likely to have contributed to the accident were found in the toxicology results. The cause of death was found to be the effects of fire.

Restraint and helmet

The pilot’s seat was fitted with a 4-point harness, the webbing of which was destroyed by the fire. Despite this level of damage, the left and right lap belt attach points were found secured and the lap belt and shoulder harness steel buckle was secured. Additionally, the lap belt and shoulder harness webbing had been replaced in January 2020, and therefore would be very unlikely to have failed due to deterioration.

The pilot was always known to wear a helmet and was almost certainly wearing it at the time of the accident.

Impact force analysis

The ATSB analysed deformation of the pilot’s seat frame to determine peak impact deceleration. The pilot’s seat frame was bent at the two seat attachment locations, but the seat pan was undeformed. This indicated that the angle of deceleration was mostly forward rather than vertical. It was assessed that the seat rail was at the lowest height adjustment. The 4-point restraint was being worn at impact.

In conducting a dynamic loads analysis, a conservative evaluation of the peak deceleration for the pilot seat was 75 G. Based on a stall speed with flaps retracted of 60 kt, this equates to a square wave deceleration pulse[17] duration of 42 milliseconds.

The Aircraft crash survival design guide Volume 2 – Impact conditions and human tolerance (Coltman and others, 1989) placed this forward deceleration in the ‘area of severe injury’. Severe injury included life-threatening injuries such as major haemorrhages, spinal, abdominal and thoracic injuries, multiple fractures, concussion and long-time unconsciousness (Eiband, 1959). This was based on experiments of whole-body impact tolerance conducted on human volunteers to (mostly) subcritical levels, and test animals. Whole-body tolerance criteria were assessed with subjects seated in the upright posture and wearing full-torso restraints (and in some cases head restraint). The tolerable magnitude of accelerative force is a function of the duration; higher G were tolerated for a shorter pulse duration.

Post-impact fire safety

Post-impact fire and survivability

A potentially survivable accident is one in which the impact forces are within the limits of occupant tolerance, the aircraft structure preserves the required survival space, and the occupant restraint is adequate. As detailed below, for aircraft (including fixed and rotary wing) with a maximum certified take-off weight of 5,700 kg or less, post-impact fire (PIF) has been shown to contribute significantly to injuries and fatalities in accidents that are otherwise potentially survivable (TSB, 2006).

Aircraft certification requirements

Aircraft certification is found primarily in three regulatory structures: the US Federal Aviation Regulations (FARs), the Canadian Aviation Regulations, and the European Aviation Safety Agency requirements. These requirements are harmonised such that light aircraft manufactured in the US, Canada and Europe all meet basically the same standards.

Part 23 of the FARs prescribes the airworthiness standards for aeroplanes in the normal, utility, aerobatic, and commuter categories. There are only three FAR 23 fuel system certification requirements designed to reduce the risk of PIF. These specifically apply to aircraft with retractable landing gear in the event of a wheels-up landing.

The AT-400 aircraft was certificated under FAR 21 in the restricted category. It met the structural requirements of FAR 23, and the flight criteria, propulsion, systems and equipment items of CAM 8, Appendix B (FAA TCDS A9SW).

Fuel tanks in accident impacts

In an accident impact, metal fuel tanks are prone to rupturing, allowing fuel to spill. The rupture of the tank causes the fuel to escape at high pressure and velocity which in turn causes the fuel to form a fine mist, which can be ignited by a source such as a hot engine or electrical arcing, and produces a very intense fire.[18]  

The rupturing of the tanks results from high fluid pressures caused by inertial accelerations during the impact. The pressure distorts the tank walls and rupture will occur when the strain[19] of the distortion reaches the rupture strain (also known as the ‘ultimate’ or ‘fracture’ strain) of the tank wall material.

To improve crashworthiness, fuel bladders and cells have been constructed of materials that are less prone to rupturing, that is, they have a higher rupture strain. These are able to withstand more deformation and a puncture is less likely to expand or tear and form a larger opening from which fuel can escape.   

The rupture strain for airframe aluminium (2024-T3 alclad sheet) is about 18%. Elastomers[20] tolerate severe deformation without rupturing – for a typical elastomer, the rupture strain is about 300% – significantly higher than metals. Additionally, even if elastomeric walls are punctured, the probability of fuel misting is very low because the flow rate for the puncture is much less than through a split tank wall. As an example, Robinson R44 helicopter bladder tanks are elastomer.

The resistance of elastomers to rupture and puncture can be substantially increased by incorporating high-strength fibres, such as Kevlar, into the material. For ultimate post-crash fire resistance (as in motor racing), fuel tanks (or cells) use double elastomeric walls with material such as Kevlar in the outer layer. This substantially reduces the probability of tank wall rupture, puncture and of fuel misting.

Prevention of post-impact fires

The US National Transportation Safety Board (NTSB) special study report General Aviation Accidents: Postcrash Fires and How to Prevent or Control Them (NTSB, 1980), found that PIF occurred in about 8% of the 22,002 general aviation accidents in the US during 1974–1978. Fatalities resulted from about 59% of the accidents involving PIF and 13.3% of the accidents without fire. The study tested the hypothesis that PIF occur more often in severe accidents. Severe accidents included collisions with the ground or objects such as trees/poles, stall/spin accidents, and some following engine failure/malfunction. These made up almost 80% of fatal accidents. In severe accidents, fatalities occurred in 18% of the accidents without PIF, but in more than 60% with PIF. For non-severe accidents, less than 1% involved fatalities without PIF and 19% involved fatalities with PIF. The report summarised that fire, rather than impact, was the major contributor to fatalities in general aviation accidents involving PIF.

The study found that PIF was occurring in survivable accidents. It noted that in contrast to civil aviation, the US Army had used fuel containment technology to dramatically reduce fire injuries and deaths. A crash resistant fuel system is designed to absorb energy in controlled failures of sacrificial structures to minimise impact loads on the fuel tank and eliminate the escape of flammable fluid in a crash. The intent was that the aircraft occupants would then have sufficient time to escape or be rescued without the threat of fire.

The report identified that technology for crash-resistant fuel systems existed (in 1980) suitable for general aviation aircraft. The 1980 NTSB special study report stated that ‘the concept of fuel containment is both feasible and achievable now’. The report Tests of Crash-Resistant Fuel System for General Aviation Aircraft (Perrella, 1978) concluded that lightweight, flexible, crash-resistant fuel cells used in combination with self-sealing break-away fuel-line couplings can effectively reduce PIF in general aviation aircraft equipped with wing tanks. Safety fuel cells were developed in the 1960s to prevent post-crash fuel-fed fires in race cars to improve survivability.

However, aircraft design and certification regulations did not reflect the technologies available. In response, the US NTSB issued 6 recommendations to the US Federal Aviation Administration (FAA) to implement regulations aimed at addressing the issue of post-crash fires – A-80-90 to A-80-95.

On 17 September 1985, the FAA issued an advance notice of proposed rulemaking that informed the public of the FAA’s intent to formulate rules to improve the crash-resistance of small airplanes' fuel systems and requested economic and technical information to assist in economic analysis and technical decisions for future rulemaking.

After several years of studies and discussions, on 20 May 1988, the FAA advised the NTSB that they had drafted a notice of proposed rulemaking (NPRM). On 14 February 1990, the FAA issued an NPRM proposing changes to the airworthiness standards to improve the crash resistance of fuel system on normal, utility acrobatic, and commuter category airplanes. These proposed design changes were to limit fuel spillage near ignition sources and would provide additional time for survivors of an accident to evacuate the aeroplane.

After some changes and review of the NPRM, in 1995, the FAA concluded that the recommendations could not be justified on a benefit-to-cost basis and therefore planned to take no action on these recommendations.

In 1996, the NTSB assessed that no tangible action had occurred in the 16 years since the issuance of these recommendations, and classified recommendations A-80-90 to -92 as closed with unacceptable safety action.

Since that time, crash-resistant fuel bladders/tanks have been introduced in rotorcraft. Crash-resistant fuel system technologies have also advanced significantly, particularly in motor sports.

Regulation of helicopter fuel systems

In 1994, US helicopter standards FAR 27.952 and FAR 29.952 introduced fuel system crash resistance tests and features for new design certification. These were introduced because it was estimated at the time that 5% of occupants in survivable rotorcraft accidents were killed or injured by PIF. There were no equivalent test requirements for fixed wing aircraft.

Research for ATSB investigation AO-2013-055, found that in Australia from 1993 to 2013, PIF occurred in 7 of 47 impact-related accidents (with usable fuel remaining) involving Robinson R44 helicopters not fitted with bladder tanks. Six of those accidents resulted in fatalities. The investigation found that PIF occurred in a significantly higher proportion of accidents involving R44 helicopters without bladder-type tanks than in other similar helicopter types. In response to ATSB safety recommendation AO-2013-055-SI-01, in April 2013, CASA issued an airworthiness directive requiring Australian operators of R44 helicopters to comply with the manufacturer’s service bulletin to replace all-aluminium fuel tanks with bladder-type tanks on R44 helicopters. Since then, there have been 68 R44 and R44 II accidents in Australia, 4 of which had PIF. There were no recorded fatalities as a result of PIF in R44 helicopters in that period.

Transportation Safety Board of Canada safety issues investigation

The Transportation Safety Board of Canada (TSB) conducted a safety issues investigation – Post‑impact fires resulting from small-aircraft accidents. The investigation examined TSB data for the 13,806 accidents involving aircraft weighing 5,700 kg or less, that occurred between 1976 and 2002. The TSB determined that PIF had occurred in 521 (3.8%) of those accidents, resulting in 728 (22%) of the 3,311 total fatalities. Of the 728 fatalities, 205 were assessed as due to fire as were 80 of the 231 total serious injuries. The aircraft included 382 production aeroplanes, 94 production helicopters, 27 amateur-built aeroplanes, 2 amateur-built helicopters, 1 gyroplane and 17 ultralights. Two of the accidents were mid-air collisions between 2 aeroplanes.

The investigation found that PIF presented a significant risk of fire-related injuries and fatalities to the aircraft occupants following a collision because of:

• the proximity of fuel to the occupants
• limited escape time
• limited energy-absorption characteristics of the airframes in crash conditions
• high propensity for immobilising injuries
• inability of firefighters to suppress PIFs in time to prevent fire-related injuries and fatalities.

The investigation concluded that there should be improvements to prevent PIF and reduce fire-related injuries in otherwise survivable accidents. It found that ‘the most effective defence against post-impact fire is to prevent the fire from occurring at impact, either by containing fuel or preventing ignition, or both’.

The investigation also reviewed the history of post-impact fire safety action and identified that previous attempts to amend certification requirements for small aircraft had been unsuccessful. The report stated that post-impact fire-resistant fuel system technology had been demonstrated to be effective in race car and automotive applications, and in certified civilian helicopters. However, there was no requirement to incorporate these engineering countermeasures into new or existing small aeroplanes (or helicopters certified before November 1994).

While acknowledging the difficulty of implementing design improvements in new and existing (FAR 23 and equivalent) aircraft, the investigation found that doing so would reduce the incidence of fire-related injuries and significantly increase the rate of occupant survival.

ATSB post-impact fire occurrences

Post-impact fire data

As not all accidents were likely to have a post-impact fire risk, ATSB identified a subset of accidents, which were impact-related and therefore expected to be more likely to result in fire. The ATSB occurrence database held records of 316 collision with terrain or controlled flight into terrain (CFIT) accidents involving VH-registered (fixed-wing) aeroplanes between 2012 and 2021.

PIFs occurred in 34 (11%) of these accidents. Of the 316 accidents, 81 resulted in fatal injuries, 24 of which had PIF, in 36 the highest injury level was serious, 5 of which had PIF, and 199 resulted in only minor or nil injuries, 5 of which had PIF. As a proportion of PIF accidents, 71% were fatal, 15% were serious injury accidents and 15% resulted in minor or nil injuries. By comparison, 20% on non-PIF accidents were fatal, 11% resulted in serious injuries and 69% in minor or nil injuries.

Figure 13: Proportion of accidents with and without PIF

The 316 accidents resulted in a total of 137 fatalities and 61 serious injuries. The 34 PIF accidents accounted for 35 of the fatalities (26%) (similar to the TSB issues investigation which found 22%), and 10 (16%) of the serious injuries (Table 4).

Table 4: Number of fatal and serious injuries in PIF vs all aeroplane accidents 2012-2021

Survivability analysis

The ATSB analysed available information from the 34 PIF accidents to determine which fatalities and serious injuries were due to fire or impact. Information sources included post-mortem reports, coroners’ reports and published ATSB investigation reports. Post-mortem reports were not available for all the fatal accidents and were generally only of flight crew (not passengers). Further, for non-fatal injuries, recorded details of the injuries were limited. For this analysis, the severity was assessed as having been increased due to fire only where burns or smoke inhalation were specifically mentioned. Where information was unavailable, these were not counted as fire-related injuries/fatalities. As the NTSB found, fire rather than impact was the major contributor to fatalities in general aviation accidents involving PIF.

There were 2 accidents in which the cause of death was a combination of multiple injuries and fire, and where the injuries included head/skull injuries. These were assessed as probably not survivable because head injuries and skull fractures were significantly associated with mortality in studies of falls from heights and motor vehicle accidents (Liu and others, 2009, Papadimitriou-Olivgeris and others, 2020).

In 5 of the 34 PIF accidents (15%), a total of 5 fatalities were assessed as a result of fire following survivable injuries received in the impact. This was about 4% of all the VH-registered aeroplane impact-related accident fatalities. Two additional accidents resulted in a total of 4 serious injuries due to fire. Detail of the analysis is in Appendix B. In summary, analysis of the 34 PIF accidents found:

• 5 were considered survivable without the post-impact fire, where occupants were fatally injured
• 18 in which the accident impact was not considered survivable or were probably not survivable
• 2 resulted in serious fire-related injuries
• 9 in which occupants egressed and survived without further injury.

Five of those 34 accidents with a post-impact fire occurred during aerial application operations:

• 2 were probably not survivable as the occupants sustained multiple injuries including skull fractures
• 1 in which the occupant survived and exited the aircraft before it was destroyed by post-impact fire
• 1 in which the pilot died from the effects of fire
• 1 in which the pilot died from the effects of fire and sustained injuries that would probably have prevented the pilot extricating themselves from the wreckage.

Fuel tank type

Three types of fuel tanks were used in the accident aircraft – integral, rigid and bladder tanks:

• Integral fuel tanks are part of the aircraft structure. They are manufactured by assembling parts of the aircraft structure with sealant to form a fuel-tight compartment, most commonly in the wings.
• A rigid tank can be made of various materials including aluminium alloy, steel or composites. They are usually removable and mounted into the airframe structure.
• A bladder type fuel tank is a rubber/elastomer cell dependent on the structure of the cavity it sits in to support the weight of the fuel within it. Bladder (or ‘bag’) tanks have historically been installed in the wing in lieu of sealing the structural components but not made of crash-resistant materials. Crash-resistant materials are capable of providing impact and puncture resistant fuel bladders and cells such as those used in helicopters and racing cars.

For the aircraft involved in the 34 PIF accidents:

• Non-crash-resistant bladder tanks were fitted in 2 aircraft involving 6 fatalities. No serious injuries were recorded for those aircraft and neither accident was survivable.
• Rigid tanks were fitted in 9 of the aircraft involving 7 fatalities, none of which were survivable. Two resulted in serious injuries that were not fire related.
• Integral tanks were fitted in 23 of the aircraft involving 22 fatalities, 5 occupants of which would have survived without for the fire. In those aircraft, 8 serious injuries occurred, 4 of which were attributable to fire.

Organisational information

Aircair overview

Aircair was founded in 1980 and was one of the largest aerial application operators in Australia. The CASA-issued Air Operator’s Certificate current at the time of the accident was re-issued to Aircair on 11 June 2021, valid until 30 June 2024. Under the certificate, Aircair was authorised to conduct aerial application and aerial work operations. At the time of the accident, Aircair had a fleet of 13 aircraft conducting application operations and engaged 12 pilots. As well as VH-ACQ, the aircraft fleet included a radial-engine Air Tractor AT-301, turbine-engine AT-502, AT-504 and AT-802 type aircraft, and a piston-engine Cessna 188B, which the company had purchased specifically for the accident pilot to operate during their initial supervised hours of aerial application operations.

Safety management

At the time of the accident, although Aircair was not required to have a safety management system, they had implemented the AAAA’s Aerial Improvement Management System (AIMS). AIMS was designed to meet the safety management and quality assurance requirements of the multiple regulators that an aerial application employer is bound by, including CASA. AIMS incorporated safety management of all facets of the business, including aviation, and was designed to integrate with the company’s Operations Manual.

The AIMS section associated with planning and conducting an application detailed that the operations manager or general manager could select a particular pilot for a given application based on their experience. The section also included a detailed drift risk assessment, which was to be followed by a plan to manage the application risks, including identifying if a forecast temperature would result in a decision to cease spraying. There was no requirement for the risk assessment to be documented or retained. The chief pilot reported having discussed the application plan and forecast with the pilot the evening prior to the accident, and the pilot had confirmed the temperature spray limit with the operations manager while the aircraft was being refuelled shortly before the accident. 

The AIMS section also required the pilot to complete a hazard check on arrival to the treatment area.

Similar occurrences

Loss of control in flight

The CASA Advisory Circular 61-16 – Spin avoidance and stall recovery training (CASA, 2020), stated that stall-spin accidents accounted for about a quarter of all general aviation accidents worldwide. Further, that other than those which occurred during dual flight instruction, most of those losses of control occurred at a height too low for recovery.  

The ATSB occurrence database recorded 269 accidents that occurred due to a loss of control between 2010 and 2020 involving (fixed-wing) aeroplanes. Of those accidents, 32 occurred while manoeuvring or conducting airwork, 17 of which resulted in fatal injuries. Of the 32 accidents that occurred during manoeuvring/airwork, 14 were conducting aerial application or mustering operations.

The following is a sample of ATSB investigations into fatal accidents that resulted from an aerodynamic stall at a height too low to recover before the aircraft impacted terrain.

AO-2008-069

The pilot of a Piper Aircraft PA36-375 Pawnee Brave was conducting aerial baiting operations in the Pilton Valley, Queensland when the aircraft collided with terrain. The aircraft was seriously damaged by impact forces and a post–impact, fuel- and magnesium-fed fire. The pilot was fatally injured.

The investigation found that the topography of the area and the strong gusty wind conditions at the time, probably resulted in turbulence that increased the hazardous nature of the low-level application task. It is likely that the pilot lost control of the aircraft as a result of that turbulence, at a height from which recovery was not possible before the aircraft struck the ground.

AO-2009-070

The pilot of a Cessna A188B aircraft was fatally injured when the aircraft impacted terrain during spraying operations. The investigation determined that the aircraft stalled at an altitude from which the pilot was unable to recover before the aircraft impacted terrain.

AO-2011-082

A PZL-Mielec M18A Turbine Dromader aircraft impacted terrain on a cotton station near Dirranbandi, Queensland while conducting aerial spraying. The pilot was fatally injured, and the aircraft was destroyed by impact forces.

The ATSB found that, for reasons that could not be determined with certainty, the aircraft departed from controlled flight during a turn at low height and the pilot was unable to recover before impacting the ground.

AO-2012-059

The owner-pilot of a Cessna 150 aircraft was aerial stock mustering on a cattle station about 55 km north-east of Bourke, New South Wales. The aircraft was observed circling over an area (where cattle were not moving,) then entered a steep descent followed by the sound of an impact. The aircraft was seriously damaged, and the pilot sustained fatal injuries.

The ATSB found that, while manoeuvring at low level, the pilot inadvertently allowed the aircraft to aerodynamically stall, resulting in a high rate of descent and collision with terrain. There was insufficient information about pilot control inputs to establish the factors that precipitated the stall.

AO-2014-192

On 29 December 2014, a Cessna 172S aircraft departed Cambridge Airport, Tasmania to photograph yachts participating in the 2014 Sydney Hobart race. On board the aircraft were the pilot and a photographer.

At about 1815, the aircraft commenced low-level photographic runs on yachts. Shortly after completing a run on one yacht at a height of about 50 ft, the aircraft entered a steep climbing turn. The aircraft had almost completed a 180° turn when the upper (right) wing dropped sharply while the aircraft’s nose pitched down to almost vertical. The aircraft impacted the water’s surface in an almost vertical nose down attitude with wings about level. Both aircraft occupants were fatally injured, and the aircraft was substantially damaged.

As a result of the steep climbing turn, the aircraft’s upper wing aerodynamically stalled, resulting in a rapid rotation out of the turn. The steep pitch attitude indicated that, because of the stalled upper wing, the aircraft entered a spin. There was insufficient height for the pilot to recover the aircraft.

Addressing loss of control in flight occurrences

The US FAA Airplane Flying Handbook (2021) chapter 5 Maintaining aircraft control: upset prevention and recovery training, stated that a loss of control in flight (LOC-I) is the leading cause of fatal general aviation accidents in the US and commercial aviation worldwide. The text listed situations that increase the risk of loss of control, including uncoordinated flight, distraction, turbulence and poor risk management. It further stated that in situations where a LOC-I can occur, pilots must recognise when the aircraft is approaching a stall or has stalled and execute the correct procedure to recover the aircraft. This requires training that includes slow flight, stalls, spins, and unusual attitudes.

US FAA Advisory Circular 120-109 – Stall prevention and recovery training was aimed at reducing LOC-I accidents and incidents. The circular stated that a ‘recurring causal factor in LOC-I accidents and incidents is the pilot’s inappropriate reaction to impending stalls and full stalls’. Further, the circular advised that reducing the angle of attack was the most important pilot action to recover from an impending or full stall and therefore this should be emphasised in stall training. 

Safety analysis

Introduction

On the morning of 4 December 2021, after completing the fifth spray run of the eleventh chemical load on a property near Moree, New South Wales, VH-ACQ was observed to climb, enter a right procedure turn, then descend rapidly and impact terrain, followed almost immediately by an intense fuel-fed fire.

The investigation found no evidence of a bird or tree strike, or anything likely to have jammed the flight controls affecting controllability. Continuity of the flight controls was established, the main wing spar was intact, and the engine was making power and driving the propeller when the aircraft impacted the ground. At the time of the accident, the aircraft was below the maximum take-off weight approved for aerial application operations and the centre of gravity was within the extrapolated limits.

This analysis will discuss development of the accident sequence and the effect of the environmental conditions. The pilot’s experience and how this contributed to workload and fatigue will also be examined. Further, it will consider the management of flight risk and factors affecting survivability.

Loss of control

Witness observations of the aircraft turning and descending rapidly were consistent with an aerodynamic stall and loss of control in flight. These observations were consistent with the accident site, in which the aircraft wreckage was confined in a small area, with evidence of a high vertical impact and low forward speed.

The last recorded GPS position left of the last spray run and about 180 ft above the ground, was consistent with the pilot conducting a right procedure turn – a shallower turn about 45° to the left, followed by a steeper right turn – at the end of the spray run. That last recorded height was very likely not the maximum reached, as the data from previous turns showed the aircraft generally climbed to about 250 ft above the ground.  

The loss of control in flight was consistent with a rapid entry to the stall. That stall was a result of the angle of attack being too high from moving the elevator control stick position too far aft while increasing the bank angle during the turn. The stick force experienced by the pilot on the elevator control depended on the trim position, which could not be determined. Regardless of the stick force, the stick position that a pilot needs to set to recover from a stall will be the same. Stall prevention requires monitoring the position of the elevator control stick, awareness of its position at which the aircraft will stall, and to maintain the control stick forward of that position. Stall warning or buffet should alert the pilot to move the stick forward, but the pilot may have had very little warning. The pilot reportedly had the stall stick position demonstrated, and although they had on occasion pulled the stick back too far in a turn during training, this was a common training error, which the pilot had been observed to have rectified. Analysis of recorded GPS data from the pilot’s flights prior to the accident, showed the pilot generally employed sound technique in the turns.  

The Airplane Flight Manual stated that the aircraft would lose 220 ft in recovering from a straight and level stall at the published maximum weight, based on flight testing. Recovery height would be increased by an accelerated stall and uncoordinated turn. Accident site analysis showed the aircraft impacted the ground nose-down and wings almost level, which suggested the pilot had acted to recover from the stall but had insufficient height to complete the recovery.

Effect of field shape

As evidenced by the recorded GPS data, the pilot had not flown hazard checks on the accident day. The operator assessed that as the pilot had overflown the accident block several times in the previous days, they were probably familiar with it. However, it could not be determined whether the pilot had identified the uneven southern boundary and shape of crop to be sprayed before commencing the accident turn.

Due to the shape of the target block, the pilot needed to turn the aircraft further beyond the southern boundary or wider than the previous turns, to line up on the next spray run at a suitable height to commence spraying. Consideration of additional turn radius was also required due to the 10–18 kt gusty south-westerly wind becoming a tailwind during the turn, thereby pushing the aircraft closer to the crop.

The recorded GPS data from the pilot’s flights on the day prior to the accident showed that the aircraft was usually lined up on the next spray run about 200 m prior to the crop boundary. The location of the accident and the position where the loss of control occurred was about 110 m south of the target crop. At that point, the aircraft was too high and too close to the southern boundary to manoeuvre safely to commence spraying the crop at the start of the next spray run. From this position, the pilot likely attempted to tighten the turn rather than miss the additional crop (and skip that spray run).

Experience, workload, and fatigue

Experience

The pilot had commenced aerial application training immediately after attaining a commercial pilot licence in the minimum timeframe. On achieving their aerial application and low-level ratings, the pilot commenced aerial application operations as an employee of the aircraft operator, in September 2021. The pilot then conducted the required supervised aerial application flight time in a piston-engine aircraft. One week before the accident, the operator assessed that the pilot was ready to transition to turbine-engine Air Tractor aircraft.

Although the pilot had demonstrated competence in the aircraft and aerial application to a high level of skill for their experience, at the time of the accident, they were still relatively inexperienced in overall flight time, aerial application, and particularly in the AT-400 aircraft. This inexperience likely affected many facets of the operation, including aircraft handling, workload and fatigue.

Workload 

Agricultural pilots operating at low altitudes must visually scan external cues to control the aircraft and avoid obstacles, while also monitoring inside the cockpit including instruments, spray systems and property maps. Due to the close proximity to obstacles, terrain and the airspeeds at which the aircraft are flown, agricultural pilots have less time to respond to abnormal situations. As a result, any lapse in concentration or imprecision in control input could lead to catastrophic consequences (NTSB, 2014).

During the morning, the increased temperature, change in wind direction and increase in wind strength and gust speed, made the flying conditions increasingly turbulent. The conditions half an hour after the accident were described as quite windy and rough. Turbulence has been found to increase physical and mental workload, which can lead to degradation in the pilot’s ability to safely and effectively operate the aircraft. This is due to human perceptual systems breaking down, as a result performance can diminish, leading to fatigue, motion sickness and reduced mental performance. (Dodd and others, 2014). These conditions increased the pilot’s workload through additional physical aircraft handling and discomfort.

The pilot’s text message regarding the temperature, radio call regarding drift, and the aircraft’s track on the accident load, were indicative of the pilot making decisions in response to the changing conditions. While such decision-making is a usual part of spraying operations, it requires cognitive resources, thereby increasing workload. The pilot’s radio call about 20 minutes before the accident, suggested the pilot was experiencing stress and high workload. During the morning, the pilot had been in radio contact with the operations manager and other company pilots including the Aircair general manager. However, resources usually available to assist in managing the pilot’s workload and aid in decision‑making, were diminished on the accident day as the loader had no radio and it was the first day that the chief pilot was not supervising the pilot.

Without these resources to assist, the pilot was possibly assessing whether to cease flying due to the conditions, further adding to their cognitive load. Making such a decision may also have been more difficult while other company pilots were continuing to operate.

The pilot’s concern about drift precipitated a change of plan, whereby the pilot elected to move from the western to the eastern boundary, abandon the incomplete racetrack pattern and resume spraying in a back-to-back pattern. The change in spray pattern briefly required the pilot’s focus inside the cockpit to change GPS settings, introducing the potential for distraction and increasing workload. However, there was no evidence to demonstrate this distraction occurred at the time of the accident.

Due to a combination of inexperience, the environmental conditions, decision-making, and absence of supervision, the pilot’s workload was likely at a level known to increase error rates, reduce performance and lead to important information being missed (Green and others, 1996).

Fatigue

The pilot had several early starts and long days in the month prior to the accident, consistently reporting to a friend (but not to the operator) being very tired at the end of each day. As the accident day was the pilot’s ninth day of duty, there was an increased risk of cumulative fatigue. In the 3 days prior to the accident, the pilot had recorded their longest consecutive flight and duty times since commencing aerial application operations. Additionally, the pilot’s commute by car to and from the base was extended due to recent flooding, which reduced the opportunity for recovery between flight duties.  

All the pilot’s recent flight time was cognitively demanding low-level aerial application with short breaks during refuelling. Additionally, the cognitive demands would have been higher than for a more experienced pilot, particularly the pilot’s very limited flight time in the turbine-engine aircraft. At the time of the accident, the pilot had been operating for approaching 6 hours, with several short (10-minute) breaks during refuelling, including one about 15 minutes prior to the accident. Research on sustained attention during a task has shown that decreases in performance and self-rating experiences of fatigue increase over time (Rosa and others, 2020). However, work breaks can be temporarily beneficial in reducing the effects of fatigue (Caldwell 2008; Mallis and others 2022).  

The pilot’s sleep history and the accident time of day were unlikely to have affected the pilot’s performance. However, the consecutive long flight and duty times in the days leading up to the accident, in what would have been a high cognitive workload environment for the pilot, likely resulted in the pilot experiencing fatigue at a level known to affect performance.

Effects of workload and fatigue

Several factors increased the pilot’s workload at the time of the accident, including the conditions and inexperience. Those same factors and the high workload itself, combined with long flight and duty times in the preceding days, also likely contributed to the pilot experiencing fatigue.

The pilot had probably encountered similar environmental conditions while flying a piston-engine Cessna 188B aircraft in the previous weeks, but had more experience in that aircraft. That aircraft also had more docile stall characteristics and gave more warning of an impending stall. After commencing flying VH-ACQ 5 days before the accident, the pilot had demonstrated competence in that aircraft and operated it effectively, including spraying over 1,000 hectares in the previous 2 days. However, on the accident day, the pilot mishandled the aircraft during the turn. This handling error was likely a result of fixating on making the crop, and not monitoring the aircraft state or allowing adequate margin for the conditions. These errors and impaired awareness were consistent with the effects of both overload and fatigue.

Flight risk management

Management of fatigue is a shared responsibility between the aircraft operator and the pilot. Although the pilot had self-assessed as being tired on many occasions in the previous weeks, including the evening prior to the accident, there was no evidence this had been reported to the operator. Additionally, this tiredness had been noted in the evenings, following which there was a sleep opportunity for the pilot to recover (to some extent) before commencing the next morning.

Based on the regulatory duty time limitations, had the pilot been off duty for between 9 and 10 hours when they commenced on the morning of the accident, they were within a discretionary period that required a self-assessment of being mentally and physically fit to fly. The pilot commenced on the accident day close to the 10-hour rest period and it was unknown whether the pilot conducted this self-assessment. However, pilots were required to ensure they were fit to fly prior to every flight. There was also no evidence that the operator was aware the pilot had commenced duty on the accident day within or approaching the discretionary duty time window.

The aircraft operator’s operations manual stipulated that fatigue be managed in accordance with Civil Aviation Safety Regulations, which provided maximum flight and duty times (and minimum rest periods) for aerial application operations. However, there was no consideration of environmental conditions or experience – total aeronautical experience, aerial application flight hours, or hours in an aircraft model – nor how this may affect fatigue. Given inexperience and environmental conditions can increase fatigue, these factors in combination should be considered as part of fatigue risk.

Furthermore, fatigue risk is just one component of overall flight risk. A flight risk assessment provides a comprehensive assessment of factors that increase risk and the effect of combination of these factors. Although it was not required by regulations at the time, the aircraft operator had a safety management system. However, it did not include a flight risk assessment tool, which is a key component of a safety management system (FAA, 2016).

The 2014 US National Transportation Safety Board Special investigation report on the safety of agricultural aircraft operations outlined that risk management guidelines and best practices specific to agricultural aircraft operations were necessary to help operators and pilots mitigate their unique risks. These practices should include information and checklists for performing pre-flight risk assessments and identifying mitigation strategies.

A flight risk assessment tool specific for aerial application operations should include consideration of pilot (experience, recency, supervision, fitness to fly), aircraft (including role equipment), environment (weather, task, chemical, hazards) and operational pressures. Use of a flight risk assessment tool before commencing a flight also acts as a prompt for a pilot to reassess the risk when the considered factors change. Although the operator was attempting to manage the risk associated with inexperience, having a formal process may have integrated all the hazards present on the accident day. Had a flight risk assessment tool been available to the pilot on the accident morning, the combination of the weather conditions, inexperience, complexity of the task, absence of supervision, and probable fatigue, would have been expected to generate an elevated risk rating that would have required mitigation and/or approval for the pilot to conduct or continue the flight.

Survivability

The post-mortem examination identified that the pilot succumbed to the effects of fire. The fire was likely a hot, flash-over fire resulting from the rupture of the fuel tanks and misting of the fuel. Local workers who witnessed the accident were on site within minutes of the accident, however, the fire erupted within seconds of impact.

The tolerance of the human body to accident impact is a function of many variables, including individual characteristics, such as age, sex and general health. The restraint system significantly contributes to the overall probability of survival in an accident (Coltman and others, 1989). Contact injuries are reduced by 4-point (and 5-point) restraints and aviation-standard helmets. Restraints, energy-absorbing structure and seats reduce acceleration injuries. If these injuries do occur, they can contribute to fire-related fatalities and more serious injuries, by preventing self-extrication from an aircraft in the event of a post-impact fire.

An estimate of the impact forces, based on the bending of the pilot seat frame, indicated the accident would have likely resulted in severe injury. However, the pilot did not sustain impact-related injuries likely to have contributed to mortality. The pilot was almost certainly wearing a helmet and a 4-point restraint, and the cockpit maintained survivable space around the pilot’s torso. The crushing of the hopper and forward section of the aircraft likely absorbed a significant amount of the of the forward impact, aiding in reducing acceleration injuries.

Crash-resistant fuel systems

Air Tractor aircraft, like many others, use the aircraft wing structure as an integral fuel tank. The AT-400 fuel tank met or exceeded the certification requirements. In an impact with the ground, traditional aircraft wing structures are comparatively rigid and will rupture, allowing their fuel contents to escape. Due to the high fluid pressures generated inside the fuel tank in ground impacts, fuel forced through these ruptures tends to mist into a large cloud, which increases the risk of ignition and conflagrates quickly into a large encompassing fire.

An aircraft fuel tank lined with a crash-resistant bladder can be more resistant to spilling or leaking due to its ability to retain its contents if distorted. Being flexible, the bladder can withstand changes to its shape without rupturing or splitting. The bladder is also more tolerant of penetrating objects being able to deform around the intruding body to some extent. There have been no fatal or serious injuries to occupants as a result of post-impact fire in Robinson R44 helicopters in Australia since fitment of bladder tanks was mandated after a fatal accident in 2013. Prior to that time, accidents involving Robinson R44 helicopters without bladder tanks resulted in a significant proportion of post-impact fires. Of the (fixed-wing) aeroplanes involved in fatal accidents with post-impact fire in Australia between 2010 and 2022, 2 were fitted with fuel bladders. However, these were not made of crash-resistant materials.

Bladder tanks are one technology designed to improve crashworthiness of fuel systems. Crash‑resistant fuel systems reduce the risk of post-impact fire and provide occupants with more time to escape or be rescued. VH-ACQ was not fitted with crash-resistant fuel tanks or systems. The certification standards at the time the aircraft was manufactured did not require it, nor did the fixed-wing aircraft standards at the time of the accident. This differed from the requirements for rotary-wing aircraft.

The US National Transportation Safety Board and the Transportation Safety Board of Canada found a significant risk associated with post-impact fires in general aviation aircraft. As a result, they made recommendations to the US Federal Aviation Administration aimed at addressing the crashworthiness of fuel systems in these aircraft. A review of VH-registered aeroplane accidents in the ATSB occurrence database from 2010–2022 found a significant risk for post-impact fire fatalities, consistent with that previously identified in the US and Canada. Nearly 4% of the fatalities (5 fatalities in 10 years) in general aviation accidents in Australia were solely the result of the post impact fire. A fatality percentage of 5% was used by the Federal Aviation Administration to justify fuel system crash resistance tests and features for new helicopter designs.

The design principles and technologies for crash-resistant fuel systems exist and have been proven effective in helicopters and the automotive industry. Incorporating these in aeroplane design would reduce the risk of impact-induced fire in otherwise survivable accidents.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving Air Tractor AT-400, VH-ACQ, 75 km west-south-west of Moree, New South Wales, on 4 December 2021.  

Contributing factors

• The aircraft was too close to the start of the spray run during the turn, which probably resulted in the pilot tightening the turn. This almost certainly resulted in an aerodynamic stall at a height too low to recover before colliding with the ground.
• The pilot was likely experiencing high workload and fatigue due to long flight and duty times, inexperience, the complexity of the task and the weather conditions. The combined effects of these factors probably resulted in the pilot mishandling the turn.
• The aircraft’s integral fuel tanks ruptured during the accident sequence. This resulted in a fire which led to the pilot’s fatal injuries.

Other factors that increased risk

• The aircraft was not fitted nor required to be fitted with a crash-resistant fuel system under the current standards or those in place at the time of manufacture. As a result, post-impact fire presents a significant risk of fire-related injuries and fatalities to aircraft occupants. (Safety issue)

Other findings

• A flight risk assessment tool is used in some aerial work operations, however for aerial application operations it is not a requirement and generally not used. A flight risk assessment tool tailored to aerial application would likely have identified an elevated risk on the day of the accident, due to the combination of the pilot’s inexperience, weather conditions, complexity of the task, absence of supervision and probable fatigue.
• The pilot was almost certainly wearing a helmet and 4-point restraint increasing their chances of survival in an accident.

Safety issues and actions

Crash-resistant fuel system

Safety issue number: AO-2021-052-SI-01

Safety issue description: The aircraft was not fitted nor required to be fitted with a crash-resistant fuel system under the current standards or those in place at the time of manufacture. As a result, post-impact fire presents a significant risk of fire-related injuries and fatalities to aircraft occupants.

Safety recommendation description: The ATSB recommends that the United States Federal Aviation Administration take action to address certification requirements for crash-resistant fuel systems for fixed wing aircraft to reduce the risk of post-impact fire.

Safety action not associated with an identified safety issue

Additional safety action by Aircair Aviation Operations Pty Ltd (Aircair)

Aircair has considered whether there could be a risk associated with fatigue that does not necessarily correlate to flight and duty hours worked. As such, they are investigating if other means of measuring fatigue risk can be developed, such as a point score system that includes any other contributory factors such as conditions, experience, overall wellbeing and difficulty of the task. Further, they intend to explore technology available in modern cars and machinery that measures operator fatigue.

In August 2022, Aircair’s pilot group underwent advanced stall and spin prevention, recognition and recovery training with an experienced aerobatic instructor. Due to its success, Aircair is investigating ways of incorporating such training into its new pilot induction program.

Aircair recommended that the risks associated with mobile phone use in the cockpit (as referenced in the Aircair Operations Manual) are reiterated to pilots on a regular basis by way of pilot meetings and safety notices.

Aircair intends to ensure that pilots are regularly reminded of the possibility of becoming distracted by guidance systems and the impact this may have on safe operations. As part of this process, pilots should be reminded to only attend to GPS related issues when at a safe height above the ground.

Pre-application field inspections form a critical component for a safe application operation (particularly for unfamiliar fields). The requirement to conduct such inspections is set out in the Aircair Operations Manual and is tested during Aircair Operator Proficiency Checks (OPC). The importance of pre‑application field inspections will be reinforced to pilots on a regular basis by way of pilot meetings and safety notices.

Glossary

AAAA               Aerial Application Association of Australia

AFM                 Airplane Flight Manual

AIMS                Aerial Improvement Management System

CAM                 Civil Aeronautics Manual

CAR                 Canadian Aviation Regulation

CAS                 Calibrated airspeed

CASA               Civil Aviation Safety Authority

CASR               Civil Aviation Safety Regulations

CG                   Centre of gravity

EDT                  Eastern Daylight-saving Time

FAA                  Federal Aviation Administration

FAR                  Federal Aviation Regulation

FCM                 Flight crew member

IAS                   Indicated airspeed

ICAO                International Civil Aviation Organization

LOC-I                Loss of control in-flight

NASA               National Aeronautics and Space Administration

NPRM               Notice of proposed rule making

NTSB                National Transportation Safety Board

PSI                   Pounds per square inch

SMS                 Safety management system. A systematic approach to organisational safety encompassing safety policy and objectives, risk management, safety assurance, safety promotion, third party interfaces, internal investigation and SMS implementation.

TSB                  Transportation Safety Board (of Canada)

UTC                  Coordinated Universal Time

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aircraft operator and chief pilot
• other company pilots
• Civil Aviation Safety Authority
• New South Wales Police Force
• aircraft manufacturer
• aircraft maintainer
• accident witnesses
• recorded data from the aircraft’s GPS units
• Bureau of Meteorology and Oz Forecast.

References

Air Tractor (2012). Service letter 304: Establishing and operating with a special purpose operating weight for Air Tractor aircraft.

Australian Transport Safety Bureau (2017). ATSB Safety Investigation. Canberra, Australia: ATSB.

Bafna, T. & Hansen, J. P. (2021). Mental fatigue measurement using eye metrics: A systematic literature review. Psychophysiology, 58(6), 13828-n/a. doi: 10.1111/psyp.13828

Beilock, S. L., Carr, T. H., MacMahon, C., & Starkes, J. L. (2002). When paying attention becomes counterproductive: Impact of divided versus skill-focused attention on novice and experienced performance of sensorimotor skills. Journal of Experimental Psychology: Applied, 8, 6-16.

Boksem, M. A. S., Meijman, T. F., & Lorist, M. M. (2005). Effects of mental fatigue on attention: An ERP study. Brain research. Cognitive brain research, 25(1), 107-116. doi: 10.1016/j.cogbrainres.2005.04.011

Byrne, A. J., Murphy, A., McIntyre, O., & Tweed, N. (2013). The relationship between experience and mental workload in anaesthetic practice: an observational study. Anaesthesia, 68(12), 1266-1272. doi: 10.1111/anae.12455

Caldwell, J. A., Caldwell, J. L., & Schmidt, R. M. (2008). Alertness management strategies for operational contexts. Sleep medicine reviews, 12(4), 257-273. doi: doi:10.1016/j.smrv.2008.01.002

Civil Aviation Safety Authority (2012). Fatigue Management Strategies for Aviation Workers: A Training & Development Workbook.

Civil Aviation Safety Authority (2020). Advisory Circular AC 61-16 v1.0: Spin avoidance and stall recovery training.

Coltman, J. W., Van Ingen, C., Johnson, N. B. & Zimmerman, R. E. (1989). Aircraft crash survival design guide: Volume II – Aircraft design crash impact conditions and human tolerance. US: United States Army Aviation Applied Technology Directorate.

Dawson, D., & Reid, K. (1997). Fatigue, alcohol and performance impairment. Nature, July 1997, 388:235.

Dodd, S., Lancaster, J., Miranda, A., Grothe, S., DeMers, B., & Rogers, B. (2014). Touch Screens on the Flight Deck: The Impact of Touch Target Size, Spacing, Touch Technology and Turbulence on Pilot Performance. Proceedings of the Human Factors and Ergonomics Society 58th Annual Meeting, 58(1), 6-10. https://doi.org/10.1177/1541931214581002

Eiband, A. M., Human tolerance to rapidly applied accelerations: A summary of the literature, NASA Memorandum 5-19-59E, National Aeronautics and Space Administration, Washington, D.C., June 1959.

Faber, L. G., Maurits, N. M., Lorist, M. M., & de Lange, F. P. (2012). Mental Fatigue Affects Visual Selective Attention. PloS one, 7(10), e48073-e48073. doi: 10.1371/journal.pone.0048073

Fan, J., & Smith, A.P. (2017). The impact of workload and fatigue on performance. Conference Paper in Communications in Computer and Information Science, June 2017. doi: 10.1007/978-3-319-61061-0_6

Federal Aviation Administration (2021). Airplane Flying Handbook, FAA-H-8083-3C. US: FAA. Retrieved from: Airplane Flying Handbook | Federal Aviation Administration (faa.gov)

Fletcher, A., Lamond, N., van den Heuvel, C., & Dawson, D. (2003). Prediction of performance during sleep deprivation and alcohol intoxication by a quantitative model of work-related fatigue. Sleep Research Online, 5(2), 67-75.

Fletcher, A. (1999). Measurement and management of work-related fatigue: Development and preliminary validations of a predictive model. Ph.D. Thesis, 1999, The University of South Australia.

Folkard, S., & Åkerstedt, T. (2004). Trends in the risk of accidents and injuries and their implications for models of fatigue and performance. Aviation, space, and environmental medicine, 75(3), A161-A167.

Gawron, V. J. (2016). Overview of self-reported measures of fatigue. The International Journal of Aviation Psychology, 26:3-4, 120-131. doi: 10.1080/10508414.2017.1329627  

Goode, J. H. (2003). Are pilots at risk of accidents due to fatigue?. Journal of safety research, 34(3), 309-313. doi: 10.1016/s0022-4375(03)00033-1

Green, R. G., Muir, H., James, M., Gradwell, D., & Green, R. L. (1996). Human Factors For Pilots (2nd ed.), Ashgate, England.

Harris, D. (2011). Human Performance on the Flight Deck. Ashgate, England.

Hawkins, F.H. (1993). Fatigue, Body Rhythms and Sleep. In H.W. Orlady (Eds.), Human Factors in Flight (2nd ed., pp. 56-83). Ashgate.

Heywood, B. (1999). Pilot Fatigue and the Limits of Endurance, Flight Safety Australia (1999, April). Retrieved from: https://skybrary.aero/sites/default/files/bookshelf/1080.pdf.

Hursh, S. R., Balkin, T. J., Miller, J. C., & Eddy, D. R. (2004). The fatigue avoidance scheduling tool: Modeling to minimize the effects of fatigue on cognitive performance. SAE transactions, 111-119.

InterDynamics (n.d.). FAID® Quantum Version 1.1 User Guide.

International Civil Aviation Organization (2020). Manual for the Oversight of Fatigue Management Approaches (Doc 9966).

Li, P. C., Wang, Y. X., Chen, J. H., Luo, Z. H., Dai, L. C. (2021). An experimental study on the effects of task complexity and knowledge and experience level on SA, TSA and workload. Nuclear engineering and design, 376, 111112. doi: 10.1016/j.nucengdes.2021.111112

Liu, C-C., Wang, C-Y., Shih, H-C., Wu, J. J-K., Huang, C-I., Hsu, H-S., Huang, M-H., Huang, M-H., Huang, M-S. (2009).  Prognostic factors for mortality following falls from height. Injury, International Journal of the Care of the Injured, 40 (2009) 595–597.

Mallis, M., Banks, S., Dorrian, J., & Dinges, D. F. (2022). Aircrew fatigue, sleep need, and circadian rhythmicity. In Keebler, J.R., Wilson, K.A., Lazzara, K.H., & Blickensderfer, E.L. (eds) Human Factors in Aviation and Aerospace (pp. 309-339). Academic Press.

National Aeronautics and Space Administration (2010). Human Integration Design Handbook (HIDH). Retrieved from: https://www.nasa.gov/sites/default/files/atoms/files/human_integration_design_handbook_revision_1.pdf

National Transportation Safety Board (1980). General Aviation Accidents: Postcrash Fires and How to Prevent or Control Them (NTSB-AAS-80-02).

National Transportation Safety Board (2014). Special Investigation Report on the Safety of Agricultural Aircraft Operations (NTSB/SIR-14/01). Retrieved from: https://www.ntsb.gov/safety/safety-studies/Documents/SIR1401.pdf

Orlady, H.W., & Orlady, L.M. (1999). Human Factors in Multi-Crew Flight Operations. Ashgate, England.

Papadimitriou-Olivgeris, M., Panteli, E., Koutsileou, K., Boulovana, M., Zotou, A., Marangos, M., Fligou, F. (2021). Predictors of mortality of trauma patients admitted to the ICU: a retrospective observational study. Brazilian Journal of Anesthesiology, 71 (2021) 23-30.

Perrella, W.M. Jr. (1978), Tests of Crash-Resistant Fuel System for General Aviation Aircraft, (FAA-RD-78-28), interim report prepared for the US Department of Transportation, Federal Aviation Administration.

Petrilli, R.M.A., Roach, G.D., Dawson, D., & Lamond, N. (2007). The sleep, subjective fatigue, and sustained attention of commercial airline pilots during an international pattern. Chronobiology International, 23(6): 1347–1362. doi: 10.1080/07420520601085925

Riethmeister, V., Matthews, R. W., Dawson, D., de Boer, M. R., Brouwer, S., & Bültmann, U. (2019). Time-of-day and days-on-shift predict increased fatigue over two-week offshore day-shifts. Applied ergonomics, 78, 157-163. doi: 10.1016/j.apergo.2019.02.010

Roach, G.D., Petrilli, R.M.A., Dawson, D., & Lamond, N. (2012). Impact of layover length on sleep, subjective fatigue levels, and sustained attention of long-haul airline pilots. Chronobiology International, 29(5): 580–586. doi: 10.3109/07420528.2012.675022

Rosa, E., Eiken, O., Grönkvist, M., Kölegård, R., Dahlström, N., Knez, I., ... & Willander, J. (2020). Effects of fatigue on cognitive performance in long-duration simulated flight missions. Aviation Psychology and Applied Human Factors, 10(2), 82. doi: 10.1027/2192-0923/a000191

Skybrary (2010). Workload (OGHFA BN). Skybrary. Retrieved  from: https://www.skybrary.aero/index.php/Workload_(OGHFA_BN)

Tran, Y., Craig, A., Craig, R., Chai, R., & Nguyen, H. (2020). Psychophysiology 57(5), e13554-n/a. doi: 10.1111/psyp.13554

Transportation Safety Board of Canada (2006). Post-impact fires resulting from small-aircraft accidents, (SII A05-01).

Tucker, A. (2015). JHC Commanders’ Guide to Fatigue Management. Retrieved from: https://www.aviation.govt.nz/assets/licensing-and-certification/medical/jhc-commanders-guide-to-fatigue-management.pdf

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the aircraft operator
• the aircraft maintainer
• Civil Aviation Safety Authority
• US National Transportation Safety Board
• Transportation Safety Board of Canada
• Pratt & Whitney Canada
• US Federal Aviation Administration
• Air Tractor Incorporated
• Satloc.

Submissions were received from;

• the aircraft operator
• the aircraft maintainer
• Civil Aviation Safety Authority
• US National Transportation Safety Board
• US Federal Aviation Administration
• Pratt & Whitney Canada
• Transportation Safety Board of Canada
• Air Tractor Incorporated
• Satloc.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A – Hoerner wingtips

Executive summary

What happened

At 0528 on 20 November 2021, a De Havilland Canada DHC-8, registered VH‑QQD, departed on a charter flight from Perth to Port Hedland, Western Australia.

As the aircraft approached 10,000 ft, the flight crew carried out transition altitude checklist items and observed that the cabin had not pressurised. The flight crew decided to return to Perth and the aircraft landed uneventfully.

What the ATSB found

The aircraft had been undergoing maintenance on the day prior to the occurrence, and for operational reasons the recirculation fan had been removed for fitment to another aircraft. VH‑QQD had not been removed from the schedule as the assigned aircraft for the flight, and its unserviceability was not detected prior to flight. The absence of the recirculation fan on the occurrence flight prevented the aircraft from pressurising.

The operator’s operations department incorrectly interpreted a message from its engineering department regarding the serviceability status of VH‑QQD, and it remained assigned to the charter flight. This allocation remained on the flight crew’s roster and the flight manifest, which contributed to the flight crew’s confidence that the aircraft was serviceable.

As there were no allowable defects against the aircraft, the captain did not check the maintenance log prior to flight and, as a result, did not detect that the recirculation fan had been removed. However, during pre-flight activities the captain observed the circuit breaker that had been opened to facilitate the recirculation fan removal. The captain reset the circuit breaker without reviewing the maintenance log for recent or open defects as per the operator’s flight crew operating manual.

What has been done as a result

After the occurrence, the operator took the following actions:

• refined the terminology used by engineering to communicate aircraft serviceability, and reviewed internal communication methods
• distributed an internal memo to all staff advising that if the aircraft technical logs were not located in the crew room when receiving the aircraft, it was to be considered unserviceable
• distributed an internal memo to flight crews to reiterate existing paperwork and circuit breaker resetting requirements
• incorporated a dedicated compartment for each aircraft’s documents in the crew room with a placard instructing flight crews to contact maintenance watch if the scheduled aircraft’s documents were not in their compartment.

Safety message

Any task, including those that may seem innocuous, should be performed as though it is the last defence to ensure safe operation. The aircraft documents contain the only reliable records of airworthiness that a pilot should trust, and this occurrence shows that thoroughly checking them remains an important control to determine if the aircraft can be operated.

The investigation

The occurrence

Aircraft assignment to the flight

On 15 November 2021, Maroomba Airlines received a request to carry out a charter flight from Perth Airport to Port Hedland Airport, Western Australia, scheduled to depart at 0600 on 20 November 2021. The flight was entered into the operator’s operations management system (AvSys[1]), with an assigned aircraft (VH‑QQD, a De Havilland Canada DHC-8) along with an assigned flight crew. The flight and assigned aircraft information was then added to the crew’s roster.

VH‑QQD was operated on a scheduled flight on Friday 19 November 2021. After the flight, at about 1500, that flight crew made an entry in the maintenance log regarding a propeller de-ice defect, which made the aircraft unserviceable.

Another of the operator’s 4 DHC-8s, VH‑QQK, was reaching the end of the period it could operate with a permissible unserviceability[2] for its recirculation fan. As the operator did not have engineering personnel rostered on evenings or weekends, it was decided to use the fan from VH‑QQD and leave VH‑QQD unserviceable. The removal of the recirculation fan from VH‑QQD was entered into its maintenance log at 1700 (Figure 1).

Figure 1: Aircraft maintenance log entry for recirculation fan removal

Source: Maroomba Airlines, modified by the ATSB

Meanwhile, at 1625, the departure time for the Port Hedland charter flight on 20 November was changed in AvSys to 0500, and the assigned flight crew were made aware.

At 1812 on 19 November, the operator’s duty engineering supervisor used an instant messaging program to communicate the following message about fleet status in accordance with normal protocols:

QQD and QQP in maintenance. AEP, QQK, CWO, NYA Serviceable. QQK MEL [minimum equipment list] 21-10 cleared. Recirc fan serviceable

This message was promulgated to a group that included the operations department. A member of the operations department acknowledged receipt of the status message and updated AvSys. For reasons that could not be determined, the status of VH‑QQD was not updated, and VH‑QQD remained the assigned aircraft for the charter flight on the following morning.

Pre-flight preparation

The operator’s facilities at Perth Airport consisted of a maintenance hangar, an administration and operations building, and an apron area. On 20 November 2021, the captain arrived at 0330 and logged onto AvSys. After confirming the aircraft assigned to the charter was VH‑QQD, the captain saw that the aircraft was positioned on the operator’s apron area, close to the terminal.

The operator's flight crew operating manual required the flight crew to check aircraft documentation when accepting the aircraft. The operator stated that this meant that each document needed to be checked. The manual did not assign this responsibility to either flight crew member in particular.

The captain found that the aircraft documents (see Aircraft documentation suite) for VH‑QQD were not in the crew room as they normally would be for flight crews to review prior to accepting an aircraft. The captain checked the aircraft’s registration on the flight manifest, reconfirming the flight had been assigned to VH‑QQD.

The captain recalled that on a previous occasion prior to flight, the operator’s engineers had not placed the aircraft documents in the crew room after completing maintenance, unintentionally leaving them in the adjacent hangar. As a result, on the present occasion, the captain entered the hangar and located VH‑QQD’s documents on a workbench.

The captain stated that the presence of a pink duplicate maintenance log page, indicating permissible unserviceabilities, would normally prompt them to examine the maintenance log. On this occasion, there were no permissible unserviceabilities, and the captain left the maintenance log in its sleeve. At that time, the maintenance log contained the open entries that made the aircraft unserviceable (that is, the propeller de-ice defect and the absence of the recirculation fan).

The operator required flight and cabin crew members to arrive 1 hour prior to their flight’s scheduled departure time (which was now 0500). The first officer arrived shortly before 0400, while the captain was in the hangar. However, although the assigned cabin crew member had acknowledged the departure time change, they mistakenly thought the flight was scheduled to depart at 0600, in part because the automated rostering system had not updated correctly. At 0415, in an attempt to maintain schedule since the cabin crew member had not yet arrived, the captain and first officer carried out some of the cabin crew’s pre-flight tasks, such as security checks and stowage of catering.

From about 0430, the captain and first officer continued the flight crew pre-flight tasks. To facilitate the removal of the recirculation fan the previous day, engineers had opened its relevant circuit breaker (see Aircraft circuit breakers). The captain re-set it, believing that (based on their knowledge of the system) the circuit breaker had tripped.

At 0440, the flight crew called the fuel provider to find out when they would arrive to refuel the aircraft (the flight crew expected an earlier refuelling, having advised the fuel provider of the flight’s requirements at 0410). Refuelling commenced at 0445 and was completed just before 0500. The cabin crew member arrived at 0500. The 7 passengers boarded the aircraft and taxi commenced at 0519.

Occurrence flight

The aircraft took-off at 0528, just after sunrise, and both pilots later reported that there was significant glare at this time. Additionally, the captain reported the flight crew workload during the departure was high due to the aircraft’s high rate of climb, radio calls, and radar vectoring[3] from air traffic control (ATC). The absence of the recirculation fan prevented the aircraft from pressurising; however, this would not have been known to the crew at the time.

At 0534, as the aircraft approached 10,000 ft and continued to climb, the flight crew carried out transition altitude checklist items. They observed the cabin differential pressure (the difference in pressure between inside the aircraft cabin and the local external atmosphere) to be 0 pounds per square inch (psi), indicating that the cabin had not pressurised. They observed the cabin altitude to be approaching 10,000 ft.

There were no cabin altitude warnings, and the flight crew did not consider it necessary to use supplementary oxygen. Generally, aircraft can operate up to 10,000 ft without the occupants requiring the use of supplementary oxygen or the aircraft being pressurised.

The captain selected the autopilot to altitude hold and requested descent to 10,000 ft from ATC. Once clearance was received, the flight crew commenced descent. The crew carried out the cabin pressurisation failure checklist, but the cabin pressure and altitude indications showed that the aircraft remained unpressurised.

After confirming the relevant circuit breaker was correctly set, the flight crew decided to return to Perth. The cabin crew member was briefed on the nature of the defect and instructed to prepare the cabin for a normal landing. The aircraft returned to Perth and landed uneventfully. The crew and passengers were assigned another aircraft for the flight to Port Hedland.

Context

Aircraft documentation suite

The Maroomba Airlines aircraft documentation suite consisted of a:

• flight log – a history of the aircraft’s flights
• maintenance release – the controlling document that released the aircraft for service, valid for a set period
• maintenance due list – maintenance requirements that were due to be carried out during the maintenance release period
• maintenance log – a history of the aircraft’s maintenance activity and certification (engineers made entries in the maintenance log to record the maintenance requirement, as well as a second entry to detail the work carried out and to certify it had been complete)
• summary of deferred defects card – a list of permissible unserviceabilities.

The maintenance release, maintenance due list, and deferred defects card were individual sheets. The flight and maintenance logs were books. All were typically stored in a folder with an internal sleeve for the maintenance log. Engineers would normally record maintenance activities in the maintenance log only. For the aircraft to be airworthy, all of the documents needed to be actioned appropriately; that is, the maintenance release could be current (as it was in this case) but the aircraft could not be operated on the basis of entries in the maintenance log.

For flights departing from Perth Airport, all the aircraft document folders were normally placed in the crew room prior to flight crew arrival, and then carried on board the aircraft. Prior to accepting an aircraft, the flight crew operating manual required the flight crew to review them to ensure that:

• the aircraft was airworthy
• the flight could be conducted without any scheduled maintenance falling due
• the flight crew were aware of any operational limitations arising from permissible unserviceabilities.

The captain previously flew for a high-capacity airline that kept most aircraft documentation in a single book, and maintenance history or open defects were visible concurrently with the flight log. They had recently been trained and checked to line as a direct entry captain on the operator’s DHC‑8 fleet. The captain recalled that during this training it ‘wasn’t normal procedure’ to review the recent maintenance history.

Aircraft circuit breakers

An aircraft circuit breaker connects or isolates electrical power to a system. They can be opened (‘pulled’) intentionally, such as to facilitate maintenance, or they can trip to protect a system in an overload situation.

Circuit breakers incorporate a white band as a visual indicator to show that the relevant electrical system has been intentionally or unintentionally isolated (Figure 2).

Figure 2: Exemplar aircraft circuit breakers

Source: Maroomba Airlines, annotated by the ATSB

A transient overload in an aircraft system may trip a circuit breaker, but not necessarily be a defect. As a result, operators establish guidelines, based on those from the aircraft manufacturer, for flight crews to re-set circuit breakers and continue operations.

The operator’s guidelines for re-setting after a cooling period were:

• only reset if the aircraft is on the ground
• only reset if there is no recent history of reported defects with the effected or a related system and there is no evidence of anomalies with these systems
• should the breaker trip again, the cause of the trip must be rectified before another attempt to reset.

Recirculation fan

The aircraft’s air-conditioning and pressurisation systems were designed to maintain a safe and comfortable environment within the flight deck, cabin, and cargo bay (collectively known as the flight compartment) during all phases of flight. The recirculation fan is located outside the flight compartment in the rear fuselage and is not visible externally (Figure 3).

The flight compartment is pressurised by maintaining a balance between airflow entering and airflow leaving the flight compartment. On the occurrence flight, the absence of the recirculation fan allowed airflow to leave the flight compartment at a rate greater than what could be supplied, so the aircraft could not be pressurised.

Figure 3: Flight compartment recirculation fan installation

Source: De Havilland Aircraft of Canada Limited, modified by the ATSB

Safety analysis

On the day of the occurrence, the aircraft was not serviceable because it had no recirculation fan fitted, which prevented it from pressurising. The removal of the fan the day before was entered into the maintenance log. However, the unserviceable status of VH‑QQD was not entered into the operations management system (AvSys) by the operations department, so the aircraft remained assigned to the flight and on the flight manifest visible by the flight crew.

The flight manifest was among the items for the flight crew to check during their pre-flight preparations. At this point, there was no reason for the flight crew to believe the aircraft was not serviceable. Although operations planning is not a means to control airworthiness, the omission on this occasion contributed to the flight crew’s confidence that VH‑QQD had been assigned to the flight and was serviceable.

Airworthiness is controlled through the use of the document suite kept on board the aircraft. This is of particular importance when a discrepancy is not obvious, such as the absence of the recirculation fan in this instance (as it was not visible during an external inspection). On the morning of the occurrence, the document suite’s unusual location provided an indication that something was wrong but would not normally be interpreted as indicating that the aircraft was unserviceable. Also, the captain likely experienced expectation bias resulting from the initial information that showed VH-QQD assigned to the flight, which would not normally occur unless the aircraft was serviceable.

The first real opportunity for the flight crew to discover the problem was the presence of unserviceabilities in the maintenance log. The operator’s flight crew operating manual required the flight crew to check the document suite when accepting the aircraft. The captain would not normally check the maintenance log unless there was a pink page present that showed permissible unserviceabilities. As there were none, the captain did not check the maintenance log. As a result, the entries for the propeller de-ice defect and the circulation fan removal were not detected.

Other documents would not have showed that the aircraft was not serviceable. For example, the maintenance release being current was not the only requirement for airworthiness. This is because the documentation suite as a whole is used to manage airworthiness rather than through individual documents.

In addition, the first officer did not check the aircraft documentation, as there was no requirement to do so. Finally, the circuit breaker that had been opened to facilitate the recirculation fan removal was another prompt for the captain to review the maintenance log for recent or open defects. However, probably due to expectation bias, the prompt was not successful on this occasion.

Ultimately, the flight crew detected the problem when they conducted the transition altitude checklist, demonstrating the importance of checklist items. Had that not occurred, the crew would have subsequently been alerted to the situation by a cabin altitude warning. Nevertheless, even though this particular occurrence was unlikely to result in an adverse outcome, it demonstrated the importance of having rigorous processes for ensuring an aircraft was serviceable prior to being used for a flight.

Findings

From the evidence available, the following findings are made with respect to the cabin pressurisation issue involving a De Havilland Canada DHC-8, registered VH‑QQD, 30 km north of Perth Airport, Western Australia, on 20 November 2021.

Contributing factors

• The flight was commenced without a recirculation fan fitted to the aircraft, preventing the aircraft from pressurising.
• When reviewing the aircraft documents prior to accepting the aircraft, and after resetting a circuit breaker, the captain did not check the maintenance log for open entries. As a result, the open entry showing the recirculation fan removal was not detected.
• The operations department did not remove the aircraft from its assigned flight after receiving a message from the engineering department about the status of multiple aircraft, including that the assigned aircraft was unserviceable.

Safety actions

Safety action by Maroomba Airlines

After the occurrence, the operator took the following actions:

• refined the terminology used by engineering to communicate aircraft serviceability, and reviewed internal communication methods
• distributed an internal memo to all staff advising that if the aircraft technical logs were not located in the crew room when receiving the aircraft, it was to be considered unserviceable
• distributed an internal memo to flight crews to reiterate existing paperwork and circuit breaker resetting requirements
• incorporated a dedicated compartment for each aircraft’s documents in the crew room with a placard instructing flight crews to contact maintenance watch if the scheduled aircraft’s documents were not in their compartment.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On the morning of 22 November 2021, a Network Aviation Fokker Aircraft F100, registered VH‑NHV, operating from Perth Airport to Paraburdoo Airport, Western Australia, encountered unforecast weather on arrival at Paraburdoo. Low cloud had developed below the landing minima, which resulted in 3 missed approaches. On the fourth approach, the aircraft fuel state was near the minimum fixed reserve, so the flight crew continued the approach below landing minima without visual reference and landed without further incident.

What the ATSB found

The ATSB found that, after having completed 2 missed approaches at Paraburdoo, the flight crew had lost confidence in their flight plan weather forecasts and were reluctant to attempt a diversion to an alternate airport without current weather information. After the third missed approach, the aircraft did not have sufficient fuel to reach a suitable alternate and the flight crew were committed to landing at Paraburdoo.

The flight crew’s flight plan for Paraburdoo indicated the lowest cloud would be above their landing minima, with deteriorations in the weather lasting for up to 60 minutes. However, the actual conditions encountered were below their landing minima and continued to deteriorate. This was difficult to forecast by the Bureau of Meteorology as detection of low cloud was obscured by higher level cloud. The development of low cloud at Paraburdoo contrasted with the expectation that surface heating would lift the existing cloud base.

After the second missed approach at Paraburdoo, the flight crew attempted to obtain an updated forecast for Newman Airport from air traffic control, but they did not express any urgency with this request. This, in combination with air traffic control workload at the time, resulted in a delay of 15 minutes before an update was offered. By that time, it was no longer required as they had insufficient fuel remaining to divert to Newman. Further, the aircraft was not fitted with an operational aircraft communications addressing and reporting system (ACARS), and they were beyond the range of the nearest automatic en route information service (AERIS). Therefore, the flight crew had no other means for obtaining updated weather forecasts for potential alternate aerodromes.

Paraburdoo Airport had an automatic weather station, which could measure the relative humidity at the surface. However, there were no means for measuring atmospheric data above the surface, which is one of the elements used to forecast cloud bases. In addition, the nearest weather balloon stations were more than 160 NM (300 km) from Paraburdoo, and therefore, the Bureau of Meteorology relied on cloud observations at nearby aerodromes to verify the expected conditions for Paraburdoo. Also, as the Newman automatic weather station was not recording the cloud or weather data groups, it was unknown if a SPECI report should have been issued for Newman for low cloud conditions, as it was for Paraburdoo.

Other than a procedure that limited the number of missed approaches to 2, Network Aviation did not provide flight crew with diversion decision-making procedural guidance when encountering unforecast weather at a destination.

In addition, Network Aviation had not included the threat of weather below the landing minima in their risk assessments for controlled flight into terrain. Consequently, these risk assessments did not include risk controls to address this threat. Without the identification of this threat and associated controls, their safety assurance team would not have had oversight of how effectively this was managed.

What has been done as a result

Following this incident, Network Aviation have implemented several proactive safety actions, which included:

• An amendment to their flight plans to include diversion calculations for 2 alternate aerodromes. This was provided pre-incident for flights that required an alternate and amended post-incident to provide it for all flights.
• Their arrival briefing procedure was amended to require flight crew to brief the minimum fuel required to divert to an alternate for all flights.
• Introduced a Fokker Aircraft F100 company procedures manual with pre-populated diversion information for each of their F100 destinations.
• Re-issued an updated internal safety advisory notice for their flight crew about the limitations of automatic weather information services.
• Updated their Paraburdoo Airport risk assessment to capture this incident as a risk and their safety action as controls.
• Updated their risk assessments for controlled flight into terrain to include adverse weather as an environmental threat.
• Amended their company fuel policy to mandate additional alternate fuel requirements for nominated airports (operator approved variations). Airport classification is assessed based on alternate availability, instrument approach availability, aerodrome forecast reporting and historical accuracy, local mesoscale weather phenomena, and topography/terrain.
• Established access for flight crew to obtain expanded briefings on ports (with operator fuel policy approved variations) from internal company meteorologists.
• Updated the company’s Aerodrome and Route Data Manual to provide a new section on weather planning tools and resources, and a new section explaining the limitations of ceilometers and visibility meters installed in automatic weather information stations throughout the company network.
• Enhanced the company’s training reference library for flight crew to support pilot knowledge and decision making. Additional content in the library is focused on company learnings from QF1616, which includes: 
  • fuel management
  • threat management and contingency planning
  • time management in areas of vulnerability
  • pilot in command responsibilities.
• Updated their take-off and landing data cards to provide a dedicated section for recording the alternate aerodrome, estimated time interval, fuel burn and fuel on arrival.

Safety message

Adverse weather conditions may not be experienced in the Australian environment to the same extent as they are in other countries. However, these events have been identified as contributing factors to incidents and accidents throughout aviation history and have been a driver for numerous safety initiatives. Therefore, it is important for all operators to consider how unforecast weather will be managed and ensure it is reflected in their risk management so that safety assurance activities can review how effectively it is managed and provide feedback for management review.

The occurrence

Overview

On 22 November 2021, at about 0746 Western Standard Time,[1] a Network Aviation Fokker Aircraft F100, registered VH‑NHV, operating flight QF1616 from Perth Airport to Paraburdoo Airport (YPBO), Western Australia, encountered unforecast low cloud on arrival at Paraburdoo. Three missed approaches were conducted during which time the flight crew considered diversion options to Karratha Airport (YPKA), Newman Airport (YNWN), and Solomon Airport (YSOL) (Figure 1). On the fourth approach, the aircraft fuel state was near the minimum fixed reserve, so the flight crew continued the approach below the minimum descent altitude (MDA)[2] without visual reference to the runway. The aircraft landed without further incident.

Figure 1: Incident flight path from Perth to Paraburdoo

Source: Google Earth, annotated by the ATSB

Pre-flight and departure

On the morning of 22 November 2021, the captain and first officer (FO) for flight QF1616 arrived at the airport and proceeded directly to their aircraft for a planned 0600 departure. Their flight was the first of 3 Network Aviation F100 flights from Perth to Paraburdoo, with the second and third flights scheduled to depart at 0630 (QF1618) and 0700 (QF1840). The flight time to Paraburdoo was scheduled to be 1 hour 29 minutes.

Once on board the aircraft, the flight crew downloaded and reviewed their flight plan on their electronic flight bags. The flight plan indicated a direct flight to Paraburdoo with the minimum required fuel, which included a 10% flight fuel variable reserve, 60 minutes of holding fuel for arrival at Paraburdoo, and 30 minutes of fixed fuel reserve. The additional 10-minute company fuel reserve was recorded on the flight plan as removed due to the forecast payload.

The mean weather conditions for arrival at Paraburdoo from the aerodrome forecast^[3] included scattered[4] cloud at 1,000 ft and broken cloud at 3,000 ft with visibility greater than 10 km.[5] There was also a TEMPO[6] period for broken cloud at 1,000 ft and visibility reduced to 4,000 m, valid for their arrival time, which required 60 minutes holding fuel. The TEMPO conditions were forecast to be above their landing minima,[7] so while they departed with minimum fuel, the flight crew expected visual conditions at Paraburdoo before reaching the MDA. The captain recalled that the other inland airports in the Pilbara region had similar forecasts with TEMPO or INTER[8] periods, and that Karratha ‘was bad, but forecast to improve’.

At about 0553, the flight crew received a last-minute change on their flight plan, which reduced the planned take-off and landing weights by 847 kg. At this time, the fuel truck had departed, and the captain elected not to delay the flight by recalling the refueller to load additional fuel.

The flight data recorder indicated the aircraft departed at 0619:32 and reached its cruise altitude of flight level (FL)[9] 350 at 0646:05. The FO was designated as the pilot flying (PF) and the captain was the pilot monitoring (PM) at the start of the flight.[10] The PF had loaded Paraburdoo into the flight management computer (FMC) as route 1 and YPKA as route 2. Therefore, the FMC was calculating the fuel required for both destinations.

Arrival at Paraburdoo

The cockpit voice recorder indicated that at about 1 hour after take-off, at 0719 and FL 350, the flight crew listened to the Paraburdoo automated weather information service (AWIS).[11] The AWIS indicated the wind was from 050° at 6 kt, the cloud was scattered at 2,100 ft, broken at 4,800 ft, overcast at 6,700 ft, QNH[12] 1012, temperature and dewpoint[13] were 20 °C and 19 °C respectively, and relative humidity 94%. The flight crew discussed the weather and noted there was no rainfall reported and that the wind favoured runway 06. As the operator had a requirement for an instrument approach to be flown for arrivals at Paraburdoo, they commenced preparations for the area navigation (RNAV) approach to runway 06, which included their arrival briefing.

At about 0724, the PM contacted their ground station at Paraburdoo to advise them of their 0745 estimated time of arrival and their ground handling requirements. At 0725:41, the descent was commenced, and the PM advised Melbourne Centre air traffic control (ATC) of their estimated time of arrival at Paraburdoo. At about 0730, while on descent through FL 240, the flight crew listened to the Paraburdoo AWIS a second time.[14] The PM then verbalised ‘1013’[15] to the PF, who acknowledged the change in QNH, and they noted that the reported rainfall was less than moderate.

At interview, the captain (PM) recalled only noting the change in QNH and expected the visual conditions for landing to remain the same after listening to the AWIS.[16] The FO (PF) did not recall this second instance of listening to the AWIS.

First approach (runway 06)

At about 0731, the flight crew selected the Paraburdoo common traffic advisory frequency (CTAF) and turned on the pilot activated lighting (PAL),[17] which provided precision approach path indicators (PAPI)[18] for each runway and low intensity runway edge lighting. At about 0736, the flight crew completed their approach checklist for the runway 06 RNAV approach and noted their estimated time of arrival was 0744. As the aircraft descended through 5,500 ft, the flight crew observed extensive cloud. At 0741:43, just after passing the initial approach fix, the PF decided to configure the aircraft early due to a tailwind on the approach. At 0743:28, the flight crew changed the autopilot vertical mode from altitude hold to vertical speed and commenced their final descent to runway 06.[19]

At about 0744, the PF called for the before landing checklist, which the PM reported as completed as the aircraft descended through 3,000 ft towards the MDA of 1,960 ft. During the approach, the PM verbalised the aircraft’s vertical position relative to a 3° descent path and each subsequent distance-altitude step in the procedure as required. At 0746:01, the PM reported they were 100 ft above the minima, which was acknowledged by the PF. Shortly after, the PM announced ‘minima’, followed by ‘no contact’. The PF then announced that they were going around, and the PM commented that they were too high. The flight crew reported at interview that they sighted the runway with the PAPI indicating 4 white lights and were therefore too high to safely land from the first approach.

The aircraft was climbed to 5,200 ft in the missed approach, and while on climb, the flight crew briefly discussed the first missed approach. They concluded that they were too high on the approach due to a tailwind and decided to conduct an approach to runway 24. At 0747, the PM notified ATC of the missed approach and that they would make an approach to runway 24 and requested an operations normal[20] time of 0815.

Second approach (runway 24)

At 0752:46, while setting up for an approach to runway 24, the PM commented that the weather at all the surrounding airports was unsuitable, and then listened to the AWIS. The AWIS broadcast indicated the cloud was broken at 800 ft, overcast at 1,500 ft, and visibility had reduced to 5,000 m. Between 0753:20 and 0756, the flight crew had several conversations about the weather. This included that they could see ‘holes’ in the cloud where they were holding, that they were too steep when they became visual on the first approach, and that they expected to have a headwind on the approach to runway 24.

At about 0757, the flight crew activated the PAL, and the PM made a CTAF call to announce their intention to conduct an approach to runway 24. At about the same time, the flight crew of QF1618 contacted ATC for their clearance to leave controlled airspace on descent to Paraburdoo. At about 0758, the PM of QF1616 reported to QF1618 that they had commenced the runway 24 RNAV approach. This was followed 1 minute later by a broadcast from the flight crew of another aircraft (QF1802) to ATC that they had landed at Newman.

At 0802:43, the PM announced that they were 100 ft above the minima (of 2,040 ft) on the runway 24 RNAV approach, followed by ‘minima’. At 0802:53, the PF announced they were going around. At interview, the flight crew explained that they became visual with the ground on the approach to runway 24, but low cloud in front of them obscured the runway, which required a missed approach.

At 0805, while holding at 4,100 ft, the flight crew again discussed the weather and the PF commented that an aircraft had landed at Newman. They were uncertain of the actual weather conditions at that location and the PM noted they only had about 40 minutes of holding fuel remaining. At interview, the flight crew reported that, following the second missed approach, they noted that the FMC indicated they were at minimum fuel to divert direct to Karratha from their present position. However, the PM was cognisant of the fact that the FMC calculation did not account for the actual wind conditions they might experience en route or allow for an instrument approach on arrival. As Newman was closer than YPKA, they considered potentially diverting there with a fuel reserve on arrival for an approach.

At 0806, the PM contacted ATC to notify them of their second missed approach due to low cloud and requested the latest weather for Newman. Melbourne Centre acknowledged the request. However, there was no urgency conveyed by the PM nor was the aircraft’s fuel status relayed with this request. The flight crew and ATC then diverted their attention to their other tasks, which included traffic inbound to Paraburdoo.

Third approach (runway 06)

Between 0807 and 0809, the flight crew discussed their options, which included a preference to remain at Paraburdoo and that they had enough fuel for 2 more approaches. The PM then broadcast their intentions to QF1618. The flight crew of QF1618 reported that they had sufficient fuel for 35-40 minutes holding and then a diversion to Karratha.[21] At 0810:32, the PM contacted the Paraburdoo safety car officer and asked if the cloud overhead the airport was ‘sitting still or moving through’. The officer reported that it was coming from the north-west and was ‘moving through’. The flight crew briefly discussed this observation and then elected to make another approach to runway 06. The PF commented that the weather felt like it was persistent and that they did not have any options.

At about 0813, the PM provided ATC with a new operations normal time of 0830 and they commenced their third approach. At 0816:33, the PM announced ‘minima’ and 5 seconds later the PF announced that they were going around. During the missed approach, the PF reported that the runway 24 approach was better, and the PM noted that the wind was getting worse.

Fourth approach and landing (runway 24)

The aircraft climbed to 5,200 ft after the third missed approach and entered a holding pattern for the runway 24 RNAV approach. At about 0819, the flight crew noted they had 1.8 tonne of fuel on board and decided to hold while QF1618 conducted an approach to runway 24. The PM then advised QF1618 of their intention to hold until minimum fuel and offered them an approach while they were holding.

At about 0821, ATC contacted QF1616, and the PM notified them that they were manoeuvring to allow QF1618 to make an approach and provided a new operations normal time of 0840. This was acknowledged by ATC with the additional query as to whether the flight crew still required the weather forecast for Newman. The PM responded that it was no longer required (due to their fuel state).

At about 0822, the PF commented that Solomon was directly ahead (55 NM to the north), and the flight crew then discussed Solomon as a divert option and the need to obtain updated weather while they were holding. However, the PF then noted the lowest MDA at Solomon was about 800 ft above the aerodrome elevation (2,800 ft MDA), which was about 200 ft higher than at Paraburdoo. There were no further discussions of Solomon given the lower probability of establishing visual reference from an approach with a higher MDA.

At about 0825, the flight crew listened to the Paraburdoo AWIS, which reported the cloud was broken at 400 ft and 800 ft, visibility was 4,200 m, wind from 270° at 6 kt, QNH 1013 and relative humidity was 93%. At about 0826, QF1618 notified QF1616 they were going to start their approach and queried how long QF1616 would hold before diverting. The PM replied that they could not divert and would hold until they were ready to make a final approach. At about 0827, QF1840 broadcast that they were inbound to Paraburdoo and ATC notified them that QF1616 and QF1618 were traffic for them. At about 0828, the PM remarked that they had 12 minutes fuel remaining before landing with a 1.1 tonne fuel reserve.

At 0828:49, the captain and FO exchanged roles, the captain became the PF, and the FO became the PM for the final approach. The flight crew then discussed their options, which were to either comply with the missed approach criteria and declare a MAYDAY[22] fuel situation if not visual at the missed approach point or continue below MDA for a landing if they were not visual at the minima. They agreed to continue below the MDA for a landing.

At about 0834, ATC broadcast a SPECI alert for Paraburdoo, which was followed by a CTAF call from QF1618 to report their missed approach from runway 24, and then another ATC broadcast for a SPECI alert for Solomon. At 0834:48, the PM of QF1616 made a CTAF call that they were commencing the runway 24 RNAV approach. The PF then emphasised to the PM that they both needed to be prepared to call a go-around if either of them sensed the approach was becoming unsafe. At about 0837, ATC contacted QF1616 for an update and the PM reported that they had commenced the approach.

At 0841:51, the ground proximity warning system[23] announced ‘1,000 ft’, which was followed shortly after by the PM stating they were at 3 NM and ‘on profile’. Ten seconds later, at 844 ft above ground level and 273 ft above the MDA, the PM remarked the cloud was starting to break up. The PM called ‘minima’ at 0842:25. The ground proximity warning system then announced ‘500 ft’, ‘400 ft’, and ‘300 ft’. At 0842:50, the autopilot was disconnected, and the PM announced that they had sighted the runway and were on profile, at which stage they were 293 ft above ground level and 291 ft below the MDA. The flight crew reported they were slightly left of centreline, but on glideslope with the PAPI when they became visual with the runway. This was consistent with the flight data recorder information, which indicated a steady descent profile on the approach and a maximum of 5° heading change between the autopilot disconnect and landing.

At 0843:23, the aircraft landed without further incident. During the landing roll, the captain recalled noting that their fuel on board indicated 0.96 tonne.[24] Following the landing, the PM made a CTAF broadcast that there were some very low patches of cloud at 250-300 ft above ground level. Figure 2 depicts the weather during the landing roll.

Figure 2: Weather at Paraburdoo during the landing roll of flight QF1616

Source: Aerodrome Management Services, annotated by the ATSB

Context

Personnel information

Captain

The captain held a valid Air Transport Pilot Licence (Aeroplane) with a multi‑engine aeroplane instrument rating, type ratings for the Fokker FK70/100 (F100) and De Havilland Canada DHC-8 aircraft, and a Class 1 Aviation Medical Certificate. They had accrued 6,698 hours total flying experience with 2,641 hours on the F100. The captain reported being awake for about 5 hours at the time of the incident, having slept 7 hours the previous night, and recorded a mental fatigue score of 3 (‘Okay, somewhat fresh’) for the time of the occurrence.

First officer

The first officer (FO) held a valid Air Transport Pilot Licence (Aeroplane) with a multi-engine aeroplane instrument rating, type ratings for the Airbus A320, Fokker FK70/100, Embraer EMB 120 and Dornier DO328-100 aircraft, and a Class 1 Aviation Medical Certificate. They had accrued 6,735 hours total flying experience with 1,556 hours on the F100. The FO reported being awake for 5 hours at the time of the incident, having slept 8 hours the previous night and recorded a mental fatigue score of 2 (‘Very lively. Responsive, but not at peak’) for the time of the occurrence.

Aircraft information

Fuel requirements and weight limits

In accordance with the forecast conditions, the QF1616 flight plan fuel for take-off from Perth comprised of 89 minutes flight fuel (3,614 kg), 11 minutes variable reserve (361 kg), 60 minutes holding fuel (1,733 kg) and 30 minutes fixed reserve (962 kg). This resulted in a minimum take-off fuel load of 6,670 kg. In addition, the aircraft was loaded with 36 kg of tanker fuel^[25] and 100 kg of taxi fuel, resulting in a flight plan fuel load at engine start of 6,806 kg.

The operator’s fuel requirements included the option for an additional 10 minutes holding fuel (equating to about 290 kg), payload permitting. The flight plan indicated that this was removed due to the forecast payload. To allow for last minute, minor payload variations without exceeding maximum landing weight, flight dispatch was required to plan a tanker fuel limit that ensured a 300 kg buffer on maximum landing weight. Consistent with these requirements, the flight plan landing weight at Paraburdoo was 39,615 kg and the maximum landing weight was 39,915 kg.

At about 0553 (7 minutes prior to the scheduled departure), there was a last-minute change to the passenger and freight loads. This resulted in a reduced planned landing weight of 38,768 kg, which would have permitted the captain to take an additional 1,147 kg of tanker fuel. However, the aircraft had already been refuelled and the refueller had departed when the flight crew received their last-minute change.

Navigation system information

The aircraft was equipped with a flight management system (FMS), with an associated flight management computer (FMC). The FMS navigation source was the global navigation satellite system (GNSS). In GNSS mode, the FMS was certified for RNP[26] 2, RNP 1 and RNP 0.3 operations but the vertical navigation (VNAV) function was not certified. Therefore, Network Aviation could conduct RNAV approaches to the LNAV landing minima but did not have approval to conduct them to the LNAV/VNAV minima.  

Aircraft communications addressing and reporting system

The incident aircraft was fitted with a non-operational aircraft communications addressing and reporting system (ACARS). The ACARS is a digital datalink system used for transmitting messages between the aircraft and ground stations via very high frequency (VHF) radio or satellite. This system provides another mechanism for flight crews to obtain weather information.

The Network Aviation Group-A F100 aircraft, which included the incident aircraft, were not fitted with satellite communications. Without satellite communications, the ACARS was limited to VHF line of sight with the ground stations.

According to the operator, the F100 fleet had a mixture of ACARS hardware units, and they were originally acquired without ground station connectivity and had no service provider. In 2016, 2 aircraft were selected for a feasibility study to test the technical viability and likely cost for activating the ACARS, which was then projected out to the remainder of the fleet. A business case, which included the activation of ACARS across the F100 fleet, was submitted in 2016 and the decision was made not to proceed with implementation at that point in time. This decision was based on a consideration of the range of projects underway across Network Aviation and a benefits analysis of implementing the solution. They had not considered including satellite communications in their ACARS business case and believed that most of their operational requirements could be met with VHF ground station connectivity. Network Aviation continues to operate the F100 aircraft and are not currently planning to implement ACARs on the fleet, however, they have not ruled out implementation of ACARs in the future.

Airport information

Paraburdoo Airport was an uncontrolled aerodrome with an elevation of 1,406 ft. The town of Paraburdoo is located about 5 NM west of the airport and lower terrain is located to the west of the town along a north-west to south-east divide (Figure 3). The airport had one runway, runway 06/24 (2,132 m long and 45 m wide), which had low intensity runway lighting installed and precision approach path indicator lighting set at a 3.0° slope for a threshold height of 50 ft, which were serviceable. The instrument approaches available included RNAV using GNSS for runways 06 and 24.

Figure 3: Paraburdoo (YPBO) terrain map

Source: Topographic-map.com, annotated by the ATSB

The LNAV landing minima for the RNAV approach was the minimum descent altitude (MDA) of 2,010 ft for runway 06 (604 ft above aerodrome level (AAL)) and 2,090 ft (684 ft AAL) for runway 24. The MDA could be reduced by 100 ft if an accurate QNH was obtained within 15 minutes of arrival, which reduced it to 504 ft AAL for runway 06 and 584 ft for runway 24. For the flight crew of QF1616, when flying a constant descent profile, they were required to add 50 ft to the MDA for the missed approach commencement altitude. Therefore, the flight crew operated to a minima of 1,960 ft (554 ft AAL) for runway 06 and 2,040 ft (634 ft AAL) for runway 24.

The aerodrome was equipped with an automatic weather station (AWS), which provided an automatic weather information service (AWIS) to flight crew, and meteorological METAR and SPECI reports to the Bureau of Meteorology (BoM) and Airservices Australia (air traffic services provider). Local radio traffic was conducted on a common traffic advisory frequency and air traffic services were provided by a Melbourne Centre flight information area (FIA) frequency.

Automatic weather station

A basic AWS has sensors for the temperature, dewpoint,[27] wind, QNH and rainfall data groups. At aerodromes, these basic AWS sensors are supplemented with a ceilometer and visibility meter. The ceilometer estimates cloud height by sending a laser light pulse near vertically through the atmosphere and using the back scatter[28] to measure cloud height. The AWS algorithm processes the raw sensor data every minute. While the current ceilometer data is used by the AWIS, the METAR and SPECI reports use the 30-minute average of data, but with the last 10 minutes given a double weighting to improve the response time to changing conditions. The BoM provided the following explanation for the difference between a ceilometer and human observer:

The ceilometer is an estimate based on the continuous sampling of a single point over a period of time (30 minutes for the ceilometer); whereas a human observer produces an estimate based on a view of the whole airfield and the whole sky over a short time prior to the observation.

According to the BoM, the AWS will trigger a SPECI report if the 10-minute average for the cloud base is below the highest alternate minimum[29] (1,664 ft at Paraburdoo) or 1,500 ft. A SPECI is also triggered if the 10-minute average for the visibility is below the highest alternate minimum (7,000 m at Paraburdoo) or 5,000 m.

If a data group is not available when a METAR or SPECI report is produced by the AWS, then this is indicated by solidi; ‘////’ for visibility, ‘//’ for weather and ‘//////’ for cloud. This is broadcast by the AWIS as ‘[data group] not available’.

Meteorological information

The flight plan for QF1616 provided the flight crew with the aerodrome forecasts (TAFs) for their departure, destination, and company approved alternate aerodromes. The FO programmed Karratha Airport as route 2 in the FMS and the flight crew discussed Karratha, Newman Airport and Solomon Airport as divert options after the second and third missed approaches at Paraburdoo. Therefore, the investigation of meteorological information focussed on the forecast and actual conditions for these aerodromes.

Flight plan forecast conditions

Paraburdoo

At the scheduled departure time from Perth of 0600, the forecast mean conditions for Paraburdoo were light rain with scattered cloud at 1,000 ft AAL, broken cloud at 3,000 ft, and visibility greater than 10 km with a TEMPO period until 1100 for broken cloud at 1,000 ft and visibility reduced to 4,000 m with moderate rain showers. The Paraburdoo METAR conditions, issued at 0430, reported rain, scattered cloud at 4,500 ft, 5,700 ft and 6,700 ft, wind from 060° at 8 kt, and the temperature and dewpoint were 20 °C and 19 °C respectively.

Newman

The forecast cloud and visibility conditions for Newman were the same as Paraburdoo with the exception that the TEMPO period extended until 1400. The Newman METAR conditions, also issued at 0430, reported cloud overcast at 11,000 ft and the weather data group was not available.

Karratha

The forecast mean conditions for Karratha were light showers of rain with scattered cloud at 2,000 ft, broken cloud at 5,000 ft, and visibility greater than 10 km. The conditions were forecast to improve at 0900 to no significant weather with scattered cloud at 5,000 ft. There was an intermittent period of variation from the prevailing conditions on the forecast that ended at 0400 for broken cloud at 1,500 ft and visibility reduced to 3,000 m in showers of rain. The METAR conditions, also issued at 0430, reported scattered cloud at 7,900 ft, overcast cloud at 11,000 ft, greater than 10 km visibility and the weather data group was not available. The flight plan did not include a forecast for Solomon.

Aerodrome weather reports

Paraburdoo

The Paraburdoo AWS issued the following observation reports on the morning of the incident (Table 1). For each of the times provided below, the QNH was 1013 and there were light rain showers, except for 0930 when the weather data group was not available.

Table 1: Aerodrome weather reports for Paraburdoo

The period in which the cloud base was broken below 1,000 ft extended from 0751 until 0930. Scattered cloud at 500–600 ft buffered this period. The actual conditions recorded by the AWS indicated a cloud base lower than the forecast conditions, which extended beyond the 30‑60‑minute duration for TEMPO conditions. According to the BoM’s analysis of the meteorological conditions at the time of the incident, the TAF for Paraburdoo was amended to alternate conditions in low cloud at 0834, which was 4 minutes after the TEMPO holding period of 60 minutes was no longer satisfying the observed conditions. Overall, the observed weather reports included a cloud base below the highest alternate minima of 1,664 ft for 3 hours 26 minutes, from 0730 to 1056.

Newman

The reports for Newman indicated the AWS weather and cloud data groups were not available for the period 0600-1000. In this period, 11 reports were issued, 9 METAR and 2 SPECI reports. The SPECI reports were for a reduction and subsequent improvement in the visibility at 0934 and 0944 respectively. As the cloud data group was not available, it could not be determined if Newman was suitable at the time the captain requested the latest weather from air traffic control for this location.

Karratha

The reports for Karratha indicated the cloud base was above 10,000 ft from 0730–1000, and the visibility was greater than 10 km for the period 0600-1000. Therefore, the weather reports for Karratha indicated it was a suitable diversion option during the period of the incident.

Solomon

From 0600-1000, 16 reports were issued for Solomon, which consisted of 12 SPECI and 4 METAR reports. At 0804, the lowest cloud was broken at 600 ft, which was below the lowest landing minima, and therefore it was unsuitable at the time the flight crew were considering it. At 0841, the cloud was scattered at 500 ft and 1,400 ft, and broken at 2,100 ft with 5,000 m visibility. The weather data group was not available for this period.

Development of low cloud base at Paraburdoo

The BoM noted that Paraburdoo was outside the optimal range[30] for the nearest weather radar stations, located at Learmonth (210 NM) and Dampier (162 NM). At these distances, any echoes appearing on the weather radar displays would be from clouds higher up in the atmosphere and thus not representative of conditions closer to the surface. So, while Paraburdoo appeared clear of rain on the weather radars at the time of the incident, light showers of rain reported on the METARs indicated that this was not the case. Nearby weather stations all recorded rainfall and it was likely that the light rain or drizzle was widespread due to a rainband over the area. The BoM further stated that the period of low visibility leading up to the incident further supported the presence of precipitation.[31] It was likely that the rainfall provided extra moisture through evaporative processes as it fell into unsaturated air, which is known as the wet bulb effect.

The BoM also reported that the wind direction was likely a contributing factor for the low cloud base, which backed from the north-east at 0730 to the north-west at 0751 and around to the west at 0830. When the wind blows from the west, the local terrain surrounding Paraburdoo forces the air to rise. Rising air cools, while the amount of moisture remains constant, thus reducing the dewpoint depression[32] and promoting the development of low cloud as the air becomes saturated. This process is known as orographic uplift and results in upslope stratus[33] cloud. Therefore, the BoM concluded that the mechanisms that produced the low cloud at Paraburdoo were a combination of the wet bulb effect due to moistening of the airmass from rainfall and the orographic uplift provided by the terrain.

On their first approach at Paraburdoo, the flight crew noted they had a tailwind component to runway 06, despite the AWIS indicating the surface wind was north-easterly. The BoM reported that the winds described by the flight crew indicated the layer of wind above the surface layer would have been ascending as it flowed over the terrain. If this layer was close to saturation, then this could have promoted the formation of low cloud. The BoM indicated that ‘meteorological theory supports this conclusion if all factors were to line up, but it can’t be stated for certain.’

Forecasting for Paraburdoo

The Paraburdoo TAF used by the flight crew during pre-flight planning was issued at 0208 with a validity period from 0200 to 2000. The BoM reported that, at 0200, there had been observations of scattered cloud at 1,000 ft at nearby airports, which supported the TEMPO forecast for broken cloud at 1,000 ft at Paraburdoo. Early in the morning, broken cloud at about 1,000 ft was observed at various locations, mostly for periods of less than 1 hour at a time. Meteorological model guidance was forecasting the low cloud would lift at around 0800. However, from the duty forecaster’s experience, low cloud would persist in the Paraburdoo area longer than what the modelling generally indicated. As a result, a conservative approach was taken regarding the timing of the TEMPO and the Paraburdoo TAF issued at 0208 retained the TEMPO for broken cloud at 1,000 ft until 1100.

The BoM’s model traces had indicated saturated levels through to near to the surface. However, modelling in northern Australia was subject to false alarms for widespread low cloud. Therefore, some form of surface verification and/or satellite observations were required for them to have confidence in the modelling. They noted that the lifting trend in the modelling did not occur, and cloud bases dropped further below the highest alternate minima after 0700 and persisted for longer than the 1-hour TEMPO periods. They reported that, this event was difficult to forecast accurately, given modelling false alarms and the lack of observed lower cloud and satellite imagery available prior to the onset of very low cloud at Paraburdoo. The cloud that lowered significantly after 0700 contrasted with what they would normally expect, where the surface heating would lift the cloud base rather than for it to lower further.

The 0208 TAF forecast the temperature to rise throughout the morning. However, the AWS recordings indicated a slower temperature rise than what was forecast and a small dewpoint depression. The following table presents the TAF forecast temperatures and the recorded AWS temperatures and dewpoints on the morning of the incident.

Table 2: Aerodrome forecast (TAF) and automatic weather station (AWS) temperatures and dewpoints

Sources of atmospheric moisture

The BoM reported that the depth of moisture through the atmosphere is important in determining the potential for low cloud development. There are not many observation sources that indicate the depth of moisture in an airmass, except for balloon soundings and aircraft meteorological data relay (AMDAR). There were no weather balloons or AMDAR profiles available at Paraburdoo to provide atmospheric data, including the depth of moisture in an airmass and there is currently no plan to install a weather balloon station, or a weather radar, at Paraburdoo.

Weather balloons and radar

Balloon-based weather observations provide precise measurements of temperature, pressure, humidity, wind speed and direction. The BoM released about 56 balloons each day from 38 locations.The main items attached to the balloon are a foil-coated cardboard target used to slow the descent of the balloon and track it with radar, and a small white plastic box known as a radiosonde, which has the sensors used to measure meteorological variables.

During the radiosonde’s flight it is constantly transmitting the meteorological data to ground equipment, which processes and converts the data into weather messages and is displayed as an aerological diagram for use by forecasters. The aerological diagram allows forecasters to obtain a snapshot of the atmosphere above a specific location to determine the atmosphere’s stability and forecast the lower and upper levels of clouds and their types.

The nearest weather balloon stations were Port Hedland, Learmonth, and Meekatharra. These locations were 175-210 NM from Paraburdoo and not guaranteed to be representative of the conditions at Paraburdoo. Figure 4 depicts the nearest weather balloon stations to Paraburdoo (blue) and the nearby airports (West Angelas (YANG), Barimunya (YBRY), Eliwana (YEWA) and Christmas Creek (YCHK), in green) where the 0200 observation of scattered cloud at 1,000 ft was used to support the incident TAF conditions.

Figure 4: Weather balloon stations relative to Paraburdoo

Source: Google Earth, annotated by the ATSB

According to the BoM, the spatial distribution of the upper air network is designed to meet the requirements of national and regional numerical weather prediction models. The spatial density was reviewed in 2022 and found to meet the requirements set by the World Meteorological Organization for numerical weather prediction. The weather radars are targeted to areas where significant or hazardous weather intersect with areas of highest community need. While this covers 98% of the population, much of inland Australia, such as Paraburdoo, are not covered. Consequently, no precipitation was detected at Paraburdoo by the nearest weather radar stations at Learmonth and Dampier at the time of the incident.

Aircraft meteorological data relay

The World Meteorological Organization, in cooperation with some international airlines, has established the aircraft meteorological data relay program (AMDAR). The AMDAR system predominantly utilises existing aircraft onboard sensors, computers, AMDAR software and communications systems to collect and transmit meteorological data to ground stations via satellite or radio links using ACARS. This data is then relayed to national meteorological and hydrological services. These observations supplement the data gathered by other meteorological instruments and help to improve the accuracy of forecasts.

Vertical profiles of the atmosphere are taken when the aircraft climbs or descends during the departure or arrival phase of flight. According to the World Meteorological Organization guide to aircraft-based observations (ABO):

Vertical profiles derived from ABO should be considered as being very similar in character and application to those derived from meteorological radiosondes. AMDAR and other ABO generally provide an improvement in forecasting ability through a reduction in NWP [numerical weather prediction] forecast error of 10%–20% over the first 24 hours of the forecast period.

The AMDAR profiles coverage for Western Australia throughout the month of November 2021 is shown in Table 3 (fractional profiles are the result of averaging over multiple weeks). Paraburdoo was not part of the AMDAR network.

Table 3: AMDAR profiles Western Australia in November 2021

Sources of in-flight weather updates

Air traffic control