Safety summary

What happened

In the early hours of 20 October 2021, NSW Trains’ passenger train service (C012) collided with an abandoned motor vehicle on the rail line south of the West Dapto Road level crossing and Kembla Grange railway station.

The collision with the motor vehicle caused the first carriage of the train to derail and separate from the rest of the train. The front carriage collided with a high voltage stanchion, then tipped on its side, sliding into the adjacent land of the rail corridor.

The driver received serious injuries and two passengers in the lead carriage were also injured. They and the guard were taken to hospital for observation. The other eight passengers were assessed on site and medically cleared.

There was significant damage to the rolling stock, rail infrastructure and overhead wiring as a result of the collision.

What the ATSB found

On 27 October 2021, NSW Police charged an individual with endangering passengers on a railway and obstructing a railway. On 15 November 2022, the individual pleaded guilty to these offences and eight other separate offences. The actions of the individual directly contributed to the collision when the motor vehicle was abandoned after it was driven onto the railway tracks and became stuck.

This individual was captured on Kembla Grange railway station’s closed-circuit television (CCTV). They moved the level crossing cameras away from the level crossing to face directly downwards about 45 minutes before the collision. Sydney Trains Security did not detect camera tampering at this time. A CCTV Upgrade Project was scoped to install and commission tamper alarms on high‑risk CCTV cameras, but the alarms were not operating on these cameras at the time. If the tamper alarm functionality on the CCTV cameras was activated and working as intended, security may have detected the camera tampering.

A member of the public called triple zero, alerting police of the motor vehicle on the rail line about 4 minutes prior to the collision. The call was not treated as an emergency by all parties involved, and the actions taken to alert the train crew of the motor vehicle on the rail line did not allow the train crew time to act and avoid the collision.

After the incident, the guard tried to make an emergency call on the Digital Train Radio System (DTRS) located at the guard’s workstation. The DTRS was not working as it had gone into standby mode as a result of the control circuit breaker tripping – which likely occurred during the separation of carriages.

The guard's training and the other available resources did not provide the guard the knowledge to reboot the DTRS. In this instance, mobile phone coverage was available and the lack of knowledge about the DTRS was not a factor in being able to communicate. The use of a work issued mobile phone allowed the guard to report the incident to Network Control in a timely manner.

The Sydney Trains’ Security Control Centre Standard Operating Procedure contained conflicting instruction for incident response. It referred to the Train Services Delivery Manager (TSDM) in the Incident Response Checklist in addition to the Network Incident Manager (NIM). This potentially added an additional step in communications during incident response before the information reached someone with the ability to warn or stop train services.

The derailment brought down potentially live 1,500 V overhead wires to ground level and whilst the guard and first responders were moving around the wreckage to help passengers, this overhead wiring had not been confirmed as isolated. While this presented a risk to the guard and first responders attending to the driver and injured passengers, the guard had identified the potential sources of electricity and informed the first responders to stay clear.

This investigation also reviewed the status of the remaining open recommendations and actions from the Special Commission of Inquiry into the Waterfall Rail Accident. This was to determine if any outstanding actions had influence and/or importance to the outcomes of this investigation. The review found there were no outstanding actions that influenced or had importance to the outcomes of this incident.

What has been done as a result

Sydney Trains conducted post‑incident technical and systemic investigations and made 14 internal recommendations for their organisation to address key safety issues from this incident. Sydney Trains reported all recommendations of its internal report were completed and closed. 

Key actions taken to address the safety issues raised in this report and the 14 recommendations of Sydney Trains’ internal report are detailed below. 

To address the safety issues raised in this investigation, the Security Control Centre Standard Operating Procedure was aligned with the Sydney Trains Network Incident Management Plan with Security Control Centre Operators required to contact NIMs rather than TSDMs.

Security Control Centre Operators' initial training in responding to emergencies was upgraded to improve communications during emergencies and a recertification module was developed to be provided as refresher training.

CCTV software was upgraded to allow use of a centralised server-based analytics engine to provide alarm functionality. At the time of publication, Sydney Trains was in the process of development, testing and trialling alarm functionality to enable detection of incidents such as the tampering at the West Dapto Level Crossing while reducing the false alarm rate.

The additional actions taken by Sydney Trains to address their internal recommendations included sharing of learnings with other key stakeholders, assessing feasibility of improving emergency lighting circuitry on Tangara Sets, reviewing actions of key personnel to ensure alignment with emergency procedures and reviewing and updating risk registers and procedures to account for learnings from this incident.

Safety message

All obstructions reported on the rail line should be treated as an emergency, and priority given to urgently stopping trains on the network to avoid collision by the most effective means available.  

Rail operators should assess their risk exposure in circumstances where they have been unable to implement planned controls. They should consider implementing alternative or short-term controls to reduce the risk exposure until the agreed controls are in place. 

The processes and procedures that are established by accredited rail operators are the mechanisms by which the accredited operator has provided assurance they are able to manage risks safely. Rail operators should regularly review their controls to ensure they remain effective and continue to achieve their intended purpose. 

When introducing new or changing existing procedures, change control processes should consider the impact on other related procedures to ensure the integrity of risk controls is maintained. Consistency in these procedures throughout the organisation should be confirmed to ensure controls remain effective.

The occurrence

On 20 October 2021, NSW Trains’ passenger service (C012) departed Kiama at 0339 en route to Central Station in Sydney. As the train approached Kembla Grange Station at approximately 0409 it collided with an abandoned motor vehicle on the rail line. This motor vehicle had been left on the rail track approximately 68 m on the south-west side of West Dapto Road level crossing at Kembla Grange.

When the first carriage of the train struck the motor vehicle, it derailed and separated from the other carriages, collided into a high voltage stanchion, tipped onto its side, and slid into the adjacent land of the rail corridor. The driver and two passengers in the first carriage were injured and required hospitalisation. The guard was also taken to hospital for further observation. The remaining eight passengers were assessed on site and medically cleared. There was no-one in the motor vehicle at the time of the collision.

Police were onsite within minutes of the incident, having received an earlier notification of a motor vehicle on track from a member of the public via triple zero. The police assisted with the injured driver and passengers who were taken to hospital.

There was significant damage to the rolling stock, rail infrastructure and high voltage overhead wiring as a result of the collision.

Motor vehicle on the rail line 

At 0313 (EDT)[1] a Sydney Trains’ security camera located on the Kembla Grange Station platform recorded an individual moving the security camera. The camera was moved to focus away from the West Dapto Road level crossing towards the ground. There was no mechanism to alert the Security Control Centre Operators (SCCO)[2] at the Sydney Trains Security Control Centre to this event.

At 0326 a second security camera, also located on the Kembla Grange Station platform, recorded being moved from its focus on the West Dapto Road level crossing towards the ground. This movement was also not alerted to or detected by the SCCO at the Sydney Trains Security Control Centre.

Likely between 0326 and 0405, when police received the first report of a motor vehicle on track, a vehicle was driven onto the railway tracks and abandoned after it became stuck on the rail.

Police forensics marked the location of the motor vehicle at 91.732 km, 68 metres from the West Dapto Road Level Crossing (see Marker A in Figure 3).

Train service C012

At 0339 C012, a 4‑carriage Tangara passenger train service departed Kiama Station en route to Sydney Central Station. As part of the scheduled stops, the train arrived at Dapto Station to pick up passengers and departed shortly after at 0407. The driver gradually accelerated the train to the track speed limit of 100 km/h.

At 0408:40, the driver moved the power notch to the off position and allowed the train to coast (from a speed of 103 km/h) as the train passed the Area 013 transponder (Wollongong South)[3] located at 93.400 km.

At 0409:06, the train passed the track circuit that activated the West Dapto Road Level Crossing warning bells and lights (92.672 km). 26 seconds later, at 0409:32, the driver made an initial brake application (91.944 km). It was estimated the train was approximately 200 m from the motor vehicle at this time. Three seconds later the driver applied full braking (91.860 km) and within the second after, applied emergency braking.

Figure 1: Approach to level crossing

Front of train footage taken from a subsequent train journey at the same time of day. The location of the motor vehicle was 268 m beyond the 92 km posts. At this time the motor vehicle was likely in relative darkness. 

Source: Sydney Trains

Notification to Network Control

At 0405:52 police received a triple zero phone call and were notified of a motor vehicle on the rail line just off the Racecourse and West Dapto Road, near Kembla Grange Station.

At 0407:37, Sydney Trains Security Control Centre received a call from police.

At 0408:47, after confirming the location of the motor vehicle on track from police, the Sydney Trains SCCO called the Train Services Delivery Manager – South West (TSDM)[4].

At 0409:08, the TSDM called the Wollongong Coast Panel Signaller (WCP Signaller)[5] advising them there was a report of a motor vehicle on track and to stop all services immediately.

At 0409:35, 2 minutes from when Sydney Trains received the call from police, the WCP Signaller made a point to point (direct not emergency) call to C012 using the Digital Train Radio System (DTRS), however the call was not answered.

The collision and derailment

At 0409:36, the driver of C012, travelling at approximately 90 km/h, applied emergency braking on the train. Over the next 4 seconds, the train collided with the abandoned motor vehicle on track and derailed to the left of the track in the direction of travel.

The front carriage travelled approximately 125 m upright in a derailed state before the right side of the carriage impacted and flattened a stanchion supporting overhead high voltage wire.

The first carriage tipped onto its right side and jack-knifed so that the rear of the carriage separated from the second carriage, and then slid a further 25 m off to the side of the rail track. The remaining 3 carriages stayed upright with the second carriage derailing and the third and fourth carriages remaining on track and alongside Kembla Grange Station platform (Figure 2).

Figure 2: C012 after the collision and derailment

C012 alongside Kembla Grange Station after collision and subsequent derailment

Source: Sydney Trains, annoted by ATSB

Post occurrence

Thirty seconds after the WCP Signaller had attempted to reach the driver of C012, they attempted to reach the driver with a second point-to-point call which was also unsuccessful. Shortly after, the WCP Signaller received a call from the TSDM. The WCP Signaller initially told the TSDM, C012 had gone through Kembla Grange.

When the TSDM said they could see the track was occupied, they asked if the driver had reported seeing a motor vehicle. The WCP Signaller told the TSDM that they had a few attempts to contact the driver of C012, however each attempted call kept terminating. The WCP Signaller then commented that it appeared now that C012 was not moving.

The TSDM directed the WCP Signaller to make an emergency call to the driver which differed from a point-to-point call as it would be broadcast in the cab on the radio and to all other trains in the area. The WCP Signaller made the Rail Emergency Call (REC) using the emergency function of the DTRS, but there was no response.

At 0411:56, 2 minutes and 16 seconds after the collision, the signaller on the adjacent Wollongong panel (WP Signaller)[6] received a call from the guard of C012, from the guard’s work‑issued mobile phone. The guard told the WP Signaller that the train had been in an accident at the level crossing. The train radio was not working, and they were going to check on the welfare of the driver. The WP Signaller then told the guard to check on the welfare of any passengers. The guard confirmed there were passengers on board, and they would walk through the train to check on the welfare of the passengers and the driver.

As the guard checked the train, they remained on the call to the WP Signaller and confirmed that the second car had derailed and was leaning to the side with lights out and that the lead car had derailed and was lying on its side. The guard also requested an ambulance for the driver.

During this call, the guard told the WP Signaller that the police were onsite. The guard spoke with the police, which could be heard in the background. The police asked the guard about passengers and if the train was live. The guard responded, ‘stay away from the overhead, and that portion of the train is still live’.

The guard then resumed conversation with the WP Signaller. The WP Signaller told the guard that they would advise the Network Incident Manager South (NIM)[7] and the TSDM so that they could arrange for a power outage.

The WP Signaller then informed the TSDM that C012 had derailed, and they had received the call from the guard on C012. The TSDM confirmed with the WP Signaller that protecting signals had been placed at STOP with blocking facilities applied[8].

At 0412:55, 3 minutes and 15 seconds after the collision, the TSDM informed the NIM of the incident. Approximately a minute later, the Electrical Operations Centre (EOC)[9] informed the NIM of a sustained fault on the overhead wire supply from Unanderra to the countryside of Dapto Station, which included the incident site. The NIM then advised the EOC of the incident they had just been informed of by the TSDM.

The NIM then received a call from the WP Signaller who relayed information they had received from the guard on C012.

Next the NIM received a call from the SCCO who said they had received news of the derailment from the NSW Police Radio Operations Group (ROG)[10] and would confirm that all rescue personnel had been contacted regarding the potential for fallen overhead wires to be live. The SCCO also stated the ROG advised that passengers were injured.

At 0415 the NIM called the Incident Rail Commander (IRC) South Coast[11] and requested they attend Kembla Grange.

At 0416:23, in a three-way call between the NIM, EOC and WCP Signaller, the NIM confirmed with the EOC that power would remain off and that the power outage was from Coniston to the countryside of Dapto Station. The NIM then confirmed with the WCP Signaller that signals were at STOP with blocking facilities applied. After speaking with the NIM, the EOC requested the Work Group Leader (WGL) Traction[12] to attend Kembla Grange to verify the power outage. The WGL advised the workgroup would be there in 30 minutes.

At 0419, 9 minutes and 20 seconds after the collision, a Level 2 incident[13] was declared by the NIM. The NIM also updated the Duty Control Manager (DCM)[14] and advised a sustained overhead wire fault from Unanderra to Dapto Station was reported at 0413. The NIM then advised the SCCO of the sustained fault and that a Rescue Power Outage (RPO)[15] was to be issued. Until the RPO was issued, wires were to be treated as live. The SCCO then called the ROG directing to inform emergency personnel onsite to treat the wires as live.

At 0435 the IRC arrived onsite at Kembla Grange and took charge as the Rail Commander under Sydney Trains’ Command and Control structure. At this time a Level 3 Crisis[16] had been declared.

The RPO was issued by the EOC to the NIM at 0444, approximately half an hour after the event, which confirmed the power outage. The EOC then informed the IRC that while the RPO had been issued to the NIM, personnel onsite were still to treat all wiring as live. The EOC also stated that an Emergency Authority[17] was in process and once completed, the Emergency (electrical) Authority would be conveyed to the IRC to enable workers to sign on to it.

The NIM then informed the WCP Signaller, WP Signaller and the TSDM of the RPO details. Both signallers confirmed that blocking facilities had been applied.

At 0524 hours the incident location was declared a crime scene by police.

At 0550 hours Electrical Authority E62/21 was issued for Kembla Grange K171 to ensure power remained isolated in the incident area during incident recovery. The NIM informed the TSDM that the RPO would be overlapped with the Electrical Authority and power would be formally removed.

The NIM was informed by the IRC onsite there was a total of 12 people on board: 2 NSW Trains’ crew, one off-duty guard travelling as a passenger and 9 other passengers. The train crew and 2 passengers with minor injuries were conveyed to hospital. A bus was arranged to transport the remaining passengers to their home.

By 0600 all uninjured passengers were on a bus and departed Kembla Grange Station.

NSW Police maintained control of the site until 11:00 at which time the site was handed to the ATSB.

By 12:00, the site was handed back to Sydney Trains to allow infrastructure repairs and train recovery to commence.

Figure 3: Point of collision and abandoned motor vehicle

The motor vehicle was abandoned on the rail line at yellow marker A and pushed by the train to the location in the picture.

Source: OTSI

Context

Criminal act

On 27 October 2021, NSW Police charged an individual with endangering passengers on a railway and obstructing a railway amongst other charges.

On 15 November 2022, the individual pleaded guilty to 8 separate offences, including endangering passengers on a railway and obstructing a railway.

The actions of this individual were key contributing factors to the collision of C012.

In the individual’s attempts to steal a go-kart from the Wollongong Kart Raceway, located close to the West Dapto Road level crossing, they undertook a series of activities which led to the motor vehicle being stuck on the rail line and abandoned.

At 0313 and again at 0326 on 20 October 2021, a Sydney Trains CCTV recorded the individual moving cameras to face away from the West Dapto Road level crossing (Figure 4).

Figure 4: Level crossing cameras at Kembla Grange Station

CCTV cameras facing the ground and away from the level crossing, moved by the convicted felon as captured on CCTV.

Source: OTSI

Security cameras

CCTV Upgrade Project

Sydney Trains operated a CCTV camera network system with approximately 13,000 cameras to cover the rail network which extends over 800 km of rail track and 170 stations.

Sydney Trains highlighted in their internal investigation that the tamper alarm functionality on Sydney Trains’ network of CCTV cameras was not activated on all cameras as part of the CCTV Upgrade Project contract that commenced in 2015.

The contract required tamper alarms to be installed on all cameras. However, the cameras were prone to vibration caused by passing freight trains and other anomalies resulting in high false alarm rate. Security Control Centre staff could not manage the excessive number of tamper alarms being generated causing installation to be stalled.

The requirement of the contract was subsequently amended so that the tamper alarm functionality was activated only on “high risk” cameras (including cameras that monitored level crossings) but at the time of this incident the functionality had not been activated on the West Dapto Road Level Crossing.

The Sydney Trains Network Maintenance group took charge of the project in December 2020 and a CCTV Operational Working Group was formed to continue progress from February 2021. 

To make changes to the CCTVs on the network, the Sydney Trains Security Group had to submit a request to the CCTV Operational Working Group to get the tamper functionality installed.

Following this incident, Sydney Trains Security group worked with the contractor to find out what was stopping the implementation of the tamper alarm functionality. An issue raised was poor detection on outdoor cameras due to lighting conditions. At the time of authoring this report, other solutions were still under consideration such as electro-mechanical tamper alarms and/or more bespoke high‑end video analytics were being trialled on cameras used to monitor level crossings.

Location

Kembla Grange Station

The station is located 91.586 km from Central Station on the South Coast rail line. It is within the Sydney Trains’ electrified network, which extends as far south as Kiama Station. Kembla Grange is a single platform station situated on the SSE side of the bi-directional rail line.[18]

There were multiple CCTV security cameras at the station, including security cameras mounted on a pole on the western point of the platform intended to face towards the West Dapto Road Level Crossing (Figure 4). These cameras were able to be viewed by staff at Sydney Trains Security Control Centre.

Kembla Grange Station was not staffed but was fitted with a customer access point where the travelling public could reach NSW Trains’ customer service attendants at any time of the day or night. The station is located along the coast between Wollongong and Shellharbour, as seen in Figure 5. The South Coast rail line skirts the west of Lake Illawarra.

Figure 5: Kembla Grange Station

Source: Google Maps

West Dapto Road Level Crossing

The West Dapto Road level crossing was located approximately 150 m west along the West Dapto Road from The Princes Highway. Approximately 20 m from the western most point of Kembla Grange Station platform. 

It was a Type F level crossing with boom gates, audible warning devices and roadside flashing lights. These safety features activate automatically when a train approaches and were designed to be failsafe. The level crossing was functional and operating as required at the time of the incident.

Figure 6 shows the level crossing and how its design affords access into the rail corridor. The individual likely accessed the rail corridor in their motor vehicle from the southwest entry on the downside (left side) of the railway line. 

The individual likely drove the motor vehicle along the side of the track until they reached the high voltage stanchion. They then attempted to drive the motor vehicle over the rail track onto the upside (right side). This is when the motor vehicle got stuck on the rail line.

Figure 6: West Dapto Road Level Crossing

View in both directions, Southwest is down direction away from Sydney, Northeast is up direction towards Sydney

Source: Google Maps

Rolling stock

The passenger train was a Tangara (Set T42) en route to Sydney from Kiama as service C012. There were 4 carriages in the train consist. The lead carriage was 6212, followed by 5213, 5211 and 6211.

The Tangara train set was a double-deck 4-carriage set with 2 motor carriages in the centre and 2 driving control trailer carriages at each terminal end. All carriages were built by A Goninan & Co at Broadmeadow NSW between 1987 and 1997 and were first introduced into service on 12 April 1988.

The control trailer carriage had a compartment for the driver at the front and pantographs[19] on top of the carriage at the rear. The seating capacity of the control trailer carriage was 98 and it weighed 42 tonnes. The motor carriage had a seating capacity of 112 and weighed 50 tonnes.

The Tangara trains were made in two sub classes, the "T sets" for the suburban lines and the "G sets" for the outer-suburban lines. They could run as a set of 4 carriages, or 2 sets could be coupled together to run as an 8‑carriage set. On this morning, train C012 was running as a 4‑carriage Tangara set and was a substitute for the usual Oscar train set (H set) that was regularly servicing the South Coast rail line.

Figure 7: Tangara four-car set

Source: Sydney Trains

Digital Train Radio System

Sydney Trains had a Digital Train Radio System (DTRS) for meeting its train radio communication requirements on its rail network. DTRS was the primary train radio system providing voice and data services to the Sydney Trains electric passenger fleet for day-to-day train operations. It enabled communications between train crews, network controllers, mechanical control and other rail staff.

The DTRS on Set T42 did not work for the guard when they attempted to call the signaller after the incident. The WCP Signaller also attempted to contact the driver on the DTRS after the incident, but was unsuccessful.

Sydney Trains investigated the functionality of the DTRS after the incident. They found the DTRS was working. However, the guard was unable to contact the signaller using the radio as the radio unit had gone into standby mode. Likely as a result of a short circuit tripping the guard’s Control Circuit Breaker unit when the first carriage separated from the train.

The event recorder data revealed unexpected voltage spikes on the unpowered trainline ‘Door Open’ wires at the time that Car 1 (6212) was separating from Car 2 (5213). Sydney Trains concluded that the powered ‘Door Close’ trainline wire suffered a short circuit during the separation which tripped the guard’s Control Circuit Breaker in Car 4 (6211).

For the DTRS to work again, it required the guard to reset it.

DTRS instructions

NSW Trains had a train working procedure NTTWP 182 Digital Train Radio System. This working procedure provided instruction on how to use the system including how to Start Up and conduct a Network Audio Test and how to identify cab radio and Transponder faults during start‑up. The procedure did not cover how to reset the system and in which situations the DTRS would need to be reset. 

The quick guide to the DTRS for guards ‘how to’ video, available on Sydney Trains Intranet provided instructions on how to use the various functions of the DTRS, including how to start up, conduct the various tests, and make emergency calls. There was no instruction on what to do if the DTRS went into standby mode.

Other procedures that provided instruction to train crew on how to respond to an incident, such as, the Operator Specific Procedure NTOSP 12 Responding to an incident and NTTWP 154 Responding to an incapacitated Driver or Guard/Passenger Service Supervisor, focus on what information to provide when reporting an incident, not how to operate the device used to report the incident.

Rail Operations Centre (ROC)

The Rail Operations Centre (ROC) was a purpose-built operations centre for running the Sydney Trains Rail Network. The goal of the ROC was to enable the network to run more efficiently, improve punctuality and achieve faster incident recovery. Teams from Sydney Trains and NSW TrainLink worked together to manage all aspects of the network.

The ROC Control Room Floor (CRF) was established in March 2019, and Security, Operations, Customer Information and NSW TrainLink all began operating from the site. Signal Box Operations later joined the CRF from July 2019. While most signal operations were managed from the ROC, a few signal operations still operated from external signalling control complexes. For instance, Wollongong Signalling Complex controlled the signals on the south coast rail line.

The CRF at the ROC comprised of the following directorates and agencies: Engineering and Maintenance (ICON), Operations Delivery (Service Delivery and Security), Customer Service (Customer Information Unit and Customer Operations), Train Crewing and Support (TCO), and NSW TrainLink. 

Network Operations Reform

Prior to the ROC, Sydney Trains’ rail network operations was primarily managed from the Rail Management Centre (RMC). Commencing in late 2018, Sydney Trains changed its operating model to prepare for the future move into the ROC.

A key objective of the new operating model was to improve the way incidents and service disruptions were managed. The operating model previously used by Sydney Trains had been the same for almost a century, with the role of the Train Controller historically managing both ‘Train Service Delivery’ and ‘Incidents’ across the rail network. 

During this reform, Sydney Trains broke up the key functions of the Train Controller and introduced two new roles:

• Train Service Delivery Manager (TSDM), whose role would be to focus on managing train services across the network.
• Network Incident Manager (NIM), whose focus would be to manage incidents on the rail network and any unplanned possessions and work on track authorities.

During this transition, several communications were released to ensure staff understood the scope of the changes. A summary of the changes was provided in the document ‘Network Operations Changes’ and specific information on the Network Operation Reform was provided to stakeholders, such as Security and Train Crewing, so they could understand how the changes affected them.

A key change included defining where responsibilities lay with the new roles. A table comparing responsibilities from the old Train Controller to the new TSDM and NIM was provided to all\\stakeholders.

The table of responsibilities below was provided to Security:

Table 1 – NOR Stakeholder Information – Security

The stakeholder communication stated all initial calls needed to go to the TSDM which contradicted Sydney Trains’ overarching Command and Control structure.

The stakeholder information also clarified the new network control boundaries and who was responsible for the area.

The previous Train Controller boundaries had broken the rail network into 6 train control areas.

New boundaries for the TSDM were broken into 5 train control areas, with 2 NIM areas to cover the entire rail network, a North and South, which overlaid the TSDM boundaries (Table 2).

Table 2 – NIM and TSDM area boundaries

Involved parties in the ROC

Key roles located in the ROC who were involved in this incident included the Duty Control Manager (DCM), Network Incident Manager (NIM), Train Services Delivery Manager (TSDM), and the Security Control Centre Operator (SCCO).

Duty Control Manager (DCM)

The DCM oversees the daily operations for everyone on the CRF. As the lead for Service Delivery and Customer Operations on the CRF, their role was described in the Sydney Trains document Control Room Floor Roles, as responsible for creating a collaborative work environment to support and empower others to make informed decisions promptly. They drive continuous improvement, encourage technology adoption including systems and procedures, and aimed to achieve improved operational efficiencies while building customer advocacy, amongst other responsibilities.

The DCM was also responsible for managing Level 2 – Critical incidents on the rail network. This is further explained below in Network Incident Management Plan.

Figure 8: ROC Control Room Floor

Source: Sydney Trains

Network Incident Manager (NIM)

The NIM was responsible for end-to-end management of operational rail incidents that happen on the network. They played a key role in communicating with operational employees and updating internal and external stakeholders about incidents. The decisions they made were focused on providing a safe process for people on and about the track and safe transportation of customers.

The NIM was responsible for managing Level 1 – Routine incidents on the rail network. This is further explained below in Network Incident Management Plan.

As their primary role was managing routine rail incidents, the NIM was provided access to the DTRS which enabled them to communicate directly with train services on the rail network.

Train Services Delivery Manager (TSDM)

The TSDM was responsible for the day-to-day management of train service delivery and ensuring smooth running of services on the Sydney Trains network.

They provided thorough communication of real-time information of service status updates and changes to train plans to other business areas.

TSDMs did not have direct access to the DTRS. To pass information to train crew, the TSDM would need to go through the NIM or a Signaller.

The Security Control Centre Operator (SCCO)

The SCCO is part of Rail Network Securityand is discussed later in the report.

Other involved parties

Signallers

Signallers are responsible for the control and supervision of rail traffic movements, the operation of signalling equipment and coordinating train movements within their area of control in accordance with safeworking regulations.

Train operations at Kembla Grange were controlled by a signaller located at the Wollongong Signalling Complex who operated points[20] and signals[21] to permit rail traffic movements. The complex was located approximately 12km from Kembla Grange Station and the location of the incident. 

Signallers used a push button panel which allowed the control and interaction with signalling infrastructure from a remote location. The signallers used the panel to set start and stop points for the intended routes. As the train enters the controlled area, lights illuminate on a large visual display board indicating the location of the train. This allowed the signaller visibility of trains within their designated area.

They could communicate with trains in their area using the DTRS. This communication could occur through either point-to-point calls to specific trains, or emergency broadcasts to all trains on the local network. 

Wollongong Coast Panel Signaller (WCP Signaller)

The WCP Signaller involved in this incident was located at the Wollongong Signalling Complex. They were responsible for operation of the track circuited territory on the South Coast rail line from Berry to Kembla Grange (Figure 9).

In this incident, the TSDM made a call to the WCP Signaller to request all trains be stopped once they learned there was a motor vehicle on track.

Wollongong Panel Signaller (WP Signaller)

The WP Signaller was also located at the Wollongong Signalling Complex and seated alongside the WCP Signaller. As both signallers were in the same room, it was easier for them to communicate about the incident.

The WP Signaller was responsible for operation of the track circuited territory from Port Kembla to Wollongong, including Port Kembla Yards and Inner Harbour (Figure 9).

The WP Signaller received the emergency call from the Guard at 0411:56 from the guard’s work‑issued mobile phone. At this time, the TSDM and the WCP Signaller were also on a call, which was when the TSDM requested the WCP Signaller to make an emergency call to stop all services.

Figure 9: Signalling Panel Boundaries

The boundary of responsibility for the Wollongong Coast Panel Signaller in Orange, Wollongong Panel Signaller in Purple.

Source: Sydney Trains

Incident Rail Commander (IRC)

IRCs provided 24/7 operational response coverage for all major rail incidents on the Sydney Trains network (area bounded by Newcastle, Lithgow, Macarthur, Nowra).

The role of the IRC was to provide onsite incident management for rail incidents within Sydney Trains’ network to ensure effective and timely resolution of operational problems, and safety of all staff, contractors, commuters, and emergency services personnel.

Electrical Operations Centre (EOC)

The EOC was one of 6 maintenance operations centres that combined to form the Infrastructure Control Centre (ICON). The EOC was responsible for high voltage supply control, 1,500 V traction supply control, emergency repair coordination and electrical incidents.

A call from the EOC was made to the NIM when they detected a sustained fault of the high voltage supply between Unanderra and Dapto Stations.

Police Radio Operations Group (ROG) 

The ROG was the radio dispatch and contact centre providing 24/7 assistance and service to the NSW Police Force and members of the community.

The ROG had Communications Officers who were responsible for processing incoming calls from police and the community, including emergency triple zero calls. 

The ROG also had Radio Dispatch Channel (RDC) Operators who were responsible for tasking and coordinating activities of police resources responding to incidents, using both the police radio network and the Computer Aided Dispatch (CAD) system. They provided timely information to operational police to enable appropriate action to be taken.

The Communications Officers and RDC Operators were required to complete training in telephony and police dispatch business systems. They and other general duties police officers did not receive specific training in managing emergencies and other risks on the rail network.

In this incident, communication about the motor vehicle on the rail line between the ROG and Sydney Trains occurred between an Assistant RDC Operator and the SCCO. The sequence of communication from the emergency triple zero call is described in Incident Communication and Timelines.

Driver

The driver commenced working on the New South Wales railways in 2011. They worked in the south and west region, South Coast area as part of the Wollongong crew. Review of the driver’s training records indicated they were appropriately qualified, with the most recent competence assurance assessment conducted in November 2020.

The driver was on their third shift after 4 days off. The 3 shifts were all early starts, with the earliest start of 0200 on the morning of this incident. 

At interview the driver stated they felt alert while driving, the early start was a regular starting time and they had adjusted to the early starts. The investigation did not find fatigue to be a contributing factor to the collision.

Guard

The guard had worked on the rail since 2006. They also worked in the south and west region and South Coast area as part of the Wollongong crew. Review of the guard’s training records indicated they were appropriately qualified with the most recent competence assurance assessment conducted in December 2020. The guard completed Digital Train Radio System Cab User training in July 2016. They had not received any refresher training or additional training in the use of the DTRS.

The guard was on their third shift after 2 days off. The 3 shifts were all early starts, with the earliest start of 0154 on the morning of this incident. The investigation did not find fatigue to be a contributing factor to the collision.

Security

Since the opening of the ROC in 2019, Security merged its two functions of the Security Control Centre and the Security Monitoring Facility and both share a location on the CRF (Figure 8).

Security Control Centre

The Security Control Centre (SCC) provided the security incident command and control function and liaised with the NSW Police and emergency services to manage real-time response to incidents on the rail network. The SCC acted as a communication bridge between external stakeholders and internal stakeholders within the ROC as well as Sydney Trains and NSW Trains employees.

The Security Control Centre was tasked with real‑time monitoring of security cameras on the network. 

Security Monitoring Facility

The Security Monitoring Facility (SMF) was a security support operation. The SMF provided CCTV footage when requested from authorised GIPA staff from NSW Police, Media Unit, Workplace Conduct Unit, and NSW TrainLink. They were the only approved provider of CCTV for Sydney Trains. 

The two functions, the SCC & SMF, were led by one supervisor at the ROC.[22]

SCC Supervisor

The Supervisor of the Security section at the ROC was called the Security Control Centre Supervisor (or SCC Supervisor). This supervisor was responsible for managing and directing the activities of the Security section during the course of a shift whilst managing a team of security operators as the first line of supervision.

In emergency or crisis situations, the SCC Supervisor assisted the Rail Operations Centre and external Security Services in coordinating appropriate emergency responses. This was done in accordance with Sydney Trains’ procedures and response frameworks.

Security Control Centre Operator (SCCO)

The SCCO was responsible for utilising systems deployed within Sydney Trains Security Control Centre, to provide real time responses to security incidents and other emergencies on the rail network. 

They assisted the SCC Supervisor to achieve the functions of the Security Control Centre, such as ensuring passenger safety, preventing equipment damage and theft to assist in improving the customer experience and the overall operations of Sydney Trains.

Amongst the stated responsibilities and operational duties in the Security Control Centre standard operating procedures, the SCCO had a duty to proactively monitor live CCTV cameras across the rail network. This was over 13,000 station-based CCTV cameras and 12,000 train‑based cameras. They were also required to monitor over 800 Help Points, the Alarm Management System and the Injury Hotline.

Emergency response

At the time of this incident, the Sydney Trains emergency response processes had changed from the Incident Management Framework Parts 1, 2 and 3 to the Emergency Preparedness Framework and the Network Incident Management Plan. These documents were developed and implemented in April 2021 to accommodate the Command and Control System that Sydney Trains was adopting for management of emergencies.

Emergency Preparedness Framework

This document described the process for developing and implementing both strategic and local incident management plans to ensure Sydney Trains responded effectively and safely to critical and other emergency situations.

The framework provided the need for the development of an Incident Response Guide and Network Incident Management Plan.

Incident Response Guide

This document contained instructions for first actions to be taken when responding to an incident. It covered a number of scenarios, including train collision/derailment and security threat amongst 15 other scenarios.

On the opening page it clearly defined contact points for rail and non-rail incidents. For rail incidents the 2 key contact points were the local area controller (signaller) and/or Security Control Centre.

Network Incident Management Plan

The Sydney Trains’ Network Incident Management Plan (NIMP) established the appropriate response measures, command and control structure, roles, responsibilities, and functions to be implemented in case of an incident within the Sydney Trains Network.

The NIMP recognised incidents range in severity and must be continually monitored and assessed. They were categorised based on impact and severity before being escalated accordingly through the hierarchy of management/command in the ROC.

As stated in the NIMP, Sydney Trains used a Command and Control System that established strategic, tactical and operational hierarchy to manage rail operations. The ROC Control Room Floor (CRF) created an environment of central coordination, led by the Duty Control Manager (DCM), drawing on the knowledge and experience of key Subject Matter Expert (SME) teams.

The NIMP divided incidents into 2 categories: rail incidents and non-rail incidents.

For managing rail incidents, Sydney Trains has a 3‑tier incident management process, categorised into: 

• Routine Incident – Level 1
• Critical Incident – Level 2
• Crisis Event – Level 3.

As per the NIMP, a Critical Incident (Level 2) was defined as the following;

…any threat, act, event or incident, the acute impact of which severely disrupts business or causes a sustained disruption to Sydney Trains business efforts or reputation. This category includes situations where Sydney Trains may be supporting a State response to a wider disaster or emergency.

The NIMP also stated that incidents that escalate to the Critical level must be raised with the DCM for awareness and monitoring. During a Critical Incident the NIM would maintain their primary functions as indicated in the Routine incidents category, supporting the incident tactically in collaboration with the DCM. The NIM must deploy an IRC to the incident site to assume the role of Rail Commander.

This incident was escalated to a Level 2 incident at 0419, at which point the NIM informed the DCM as required. The NIM had deployed an IRC to the incident at 0415.

Section 4 of the NIMP detailed Incident Response. In the Initial Incident Response, Sydney Trains stated:

Once an incident is imminent or occurs, the alarm should be raised as soon as reasonably practicable so that assistance can be given to protect life, property and the environment. Often this means that first contact needs to be made to workers controlling train movements on the affected track section, the contact points are: 
• Local Area Controller (Signaller); or 
• Security Control Centre (SCC) 

It also states the SCC can contact the police ROG and triple zero directly and is an efficient and timely reporting strategy. In other situations, a member of the public or an emergency service communication centre could raise the alarm.

In this incident, an alarm was raised by a member of the public calling triple zero which started a chain of communications commencing with the police ROG, to the SCCO, the TSDM, then to a Signaller and NIM and eventually through to the DCM.

Security Control Centre Standard Operating Procedures

The Security Control Centre (SCC)’s standard operating procedures (SOP) was a single document of 119 pages. Version 1.3 dated June 2021 consisted of 10 different sections. The tenth section contained 16 separate miscellaneous procedures.

The first 9 sections contained information that was duplicated from other Sydney Trains documentation. 

Duplications included Section 5 Chain of Command and Key Relationships, Section 6 The Rail Operations Centre, Section 7.1 General Control Room procedures, 7.2 Emergency communications, 7.3 Network Rules and Procedures, and Section 8 Command and Control Incident Management System. These sections covered parts of the Sydney Trains documentation that were most relevant to Security.

In Section 8, the SCC SOP recognised the command and control responsibilities with section 8.1 specifically highlighting the NIM managing incident response for Level 1 – Routine Incidents, the DCM responsible for managing Level 2 – Critical Incidents and the Crisis Event Chair (CEC) managing Level 3 – Crisis Events. 

Section 9 of the SOP covered Dispatching and Coordinating Incident Response. It stated that, ‘for ALL incidents managed by the SCC, the ‘Incident Response Checklist should be used…’

In section 9.2 the Incident Response Checklist for incidents that have an effect/impact on the rail network, the procedure prompted the SCCO to inform relevant TSDM/ NIM – MAKE SAFE. There was no reference to the Incident Response Guide developed as part of the overarching emergency management framework.

Communications

NTOSP12 – Responding to an Incident

This NSW Trains document provided the instructions for workers who became aware of or were involved in an incident. The worker was required to report the incident immediately to the relevant Network Control Officer and provide sufficient detail for the NCO to assess the severity of the incident and decide on a response.

The guard reported the incident to the Wollongong Panel Signaller at 0411:56, which they did with a work‑issued mobile phone. The guard said the train had derailed at the level crossing after colliding with a car on the tracks. The guard confirmed that there were passengers on the service and that they would walk through the train to check the welfare of passengers and the driver. The guard confirmed that the second car had derailed and was leaning to the side with lights out and that the lead carriage had derailed and was lying on its side. The guard also requested an ambulance for the driver.

NGE 206 Reporting and responding to a Condition Affecting the Network

This Sydney Trains document prescribed the rules for reporting and responding to unsafe conditions affecting or potentially affecting the network.

The rule stated conditions that can or do affect the safety of operations in the network must be reported promptly to the Signaller responsible for the affected portions of line. The rule further stated the signaller must promptly report the details of the Condition Affecting the Network (CAN) to the Network Controller and tell other affected Signallers.

Network Controllers are defined as qualified workers who on a day-to-day basis manage the safe and efficient operation of the Network. This includes the TSDM and the NIM.

The Signaller in this incident responsible for the affected portion of line was the WCP Signaller.

The report of the motor vehicle on track, which was the CAN, started from a triple zero call, which passed to the Police, the SCCO, the TSDM and then the WCP Signaller. It was highlighted in the Sydney Trains Investigation that all parties involved in the initial report of the motor vehicle on the rail line treated the incident as a routine Condition Affecting the Network (CAN) instead of an emergency.

Incident Communication and Timelines

When the emergency triple zero call was made by a member of the public, the call was initially received by a telecommunications officer who diverted the call to the Police as requested by the triple zero caller. 

This happened at 0405:52, 3 minutes and 43 seconds before the WCP Signaller made the call to the driver of C012.

The call was then received by an ROG Communications Officer who recorded relevant information and started a CAD incident which was then sent onto the relevant Radio Dispatch Channel (RDC) Operator. The RDC Operator reviewed the CAD incident and broadcast over the radio channel for in field police units to respond. The RDC Operator also arranged for an assistant RDC Operator to call the Sydney Trains SCCO. 

This call happened at 0407:37, 1 minute and 58 seconds before the WCP Signaller made the call to the driver of C012.

As per the SCC SOP, the SCCO called the TSDM at 0408:47, 48 seconds before the WCP Signaller made a call to the driver of C012.

The TSDM called the WCP Signaller at 0409:08, 27 seconds before the WCP Signaller made the call to the driver of C012.

By the time the WCP Signaller was told to stop all train services, then acted to call C012 directly to tell them to stop, it was 0409:35. Only 1 second before the driver of C012 applied emergency brakes.

Waterfall recommendations

The train set involved in this incident was the same type and configuration of the train that was involved in the 2003 Waterfall Rail Accident. As some recommendations from the Special Commission of Inquiry (SCOI) had actions against them that had not yet been completed and/or closed, they were reviewed as part of this investigation.

The review was to determine any influence and/or importance to the outcomes of this incident. While each recommendation and the associated actions are discussed below, the investigation concluded that the outcomes from this incident were not directly influenced by the status of the actions to address the Waterfall SCOI recommendations.

The Special Commission of Inquiry (SCOI) into the Waterfall rail accident released its final report on 17 January 2005. The report, titled the Final Report of the Special Commission of Inquiry into the Waterfall Rail Accident, made 177 recommendations (127 recommendations and 50 sub‑elements).

The implementation of these recommendations from this significant SCOI have been monitored by the Rail Regulator since 2005. 

As specified in the Waterfall SCOI Annual Status Reports published on the Office of the National Rail Safety Regulator (ONRSR) website, ONRSR will continue to provide the Minister with annual reports for tabling in the NSW Parliament, in relation to the SCOI Final Report. ONRSR’s public reporting will continue until all recommendations are implemented, with reports being published on ONRSR’s website. At the time of authoring this report, 3 documents on ONRSR’s website provided the status of the recommendations. These were:

1. Waterfall Report No 39 2019
2. Waterfall Annual Status Report – All open and closed recommendations – April 2018 to March 2019
3. Waterfall Rail Accident Recommendations – Closed Subject to Implementation of an Approved Program or Plan – April 2018 to March 2019 

These documents reported that all recommendations from the SCOI report were considered closed except for two. These recommendations had an acceptable response or acceptable alternative response. Six other recommendations were closed subject to implementation of an approved program or plan. That is, the Rail Regulator had agreed that the planned action or alternative action, when completed would meet the recommendation or satisfy the objective of the recommendation. 

Open recommendations

No.32 – RailCorp should progressively implement, within a reasonable time. Level 2 automatic train protection (ATP), and

No.38 – There must be compatibility of communications systems throughout the rail network. It is essential that all train drivers, train controllers, signallers, train guards and supervisors of trackside work gangs in New South Wales be able to communicate using the same technology.

Recommendation No.32 – Automatic Train Protection

At the time of authoring this report, Transport for NSW (TfNSW) had implemented ATP (European Train Control System Level 1 Limited Supervision) on the Sydney Trains Network (excluding Erskineville to Bondi Junction and the Sydenham-Bankstown Line). 

TfNSW was in process of implementing the ‘Digital Systems Program’ (DSP) which upgrades the technology to European Train Control System Level 2 (ETCS L2). 

This program introduces the ETCS L2 and Traffic Management System (TMS) to parts of the T4 Line from Sutherland to Cronulla and from Redfern to Bondi Junction (Tranche 1). It will then be rolled out on North Shore, City Circle, City Area and Sydney Terminal (Tranche 2), as indicated in Figure 10.

System integration testing commenced in December 2023 and would be run in 3 phases and is planned for completion by end 2024.

ETCS L2 and TMS will replace current signalling and train control technology and allows trackside equipment to communicate with trains constantly. This provides better location and train information, to better manage train movements across the network. 

The relationship to Recommendation No.4 – Precise Location is discussed below. 

DSP rollout was planned in stages (tranches) and will cover the entire network including the South Coast rail line. The future tranches will be aligned with asset replacement (conventional signalling) and network needs and is subject to funding approval.

Figure 10: ETCS Level 2 rollout

 Source: Transport for NSW

Recommendation No.38 – Digital Train Radio System

It was noted, the action to address Recommendation 38 became the focus of implementing a Digital Train Radio System (DTRS). A DTRS was installed in the incident train and serving as the main means of communications between the train crew and network control.

When the guard attempted to contact Network Control after the collision and derailment, the DTRS did not work. However, post‑incident testing of the DTRS established the DTRS had become inoperable due to a short-circuit tripping the guard’s Control Circuit Breaker likely because of the collision and derailment. The DTRS returned to “stand‑by mode” which required the system to be reset to be operable again. This could have been done by the guard, however the guard called Network Control using a work‑issued mobile phone.

In Sydney Trains’ investigation, a safety action was taken to communicate to train crew that the DTRS can be made operable by resetting the guard’s Control Circuit Breaker switch. However, in this incident, the decision by the guard to use the secondary mechanism of communication (the mobile phone) was likely a quicker and just as effective method of contacting Network Control due to the time required to restart the system.

Had the incident occurred on a part of the network with poor mobile reception, then the guard would need to rely on the DTRS being operable. So, the safety action to remind train crew the DTRS can be reset was relevant. Additionally, the same reset function applied to the public announcement (PA) system, which had also been tripped and rendered inoperable.

The focus of recommendation 38 was to ensure compatibility of communication systems throughout the rail network. While the DTRS was not used by the guard to contact Network Control, it was not due to incompatibility of communication systems.

To ensure the intent of this recommendation is met, the Regulator will continue to ensure functionality and compatibility requirements are met across the rail networks in New South Wales.

Closed recommendations subject to implementation of an approved program or plan

No. 4    The Rail Management Centre should be equipped by RailCorp with a transcriber system, or mimic board, or such other system as is necessary to enable identification of the precise location at any time of any train on the RailCorp network. 

No.88   The RailCorp passenger containment policy must be abandoned. (RailCorp: Implemented – containment policy abandoned). Note: This recommendation will be finalised once Sydney Trains completes the rollout of its Internal Emergency Door Release (IEDR) retrofit program. 

No.89   There must be a minimum of two independent methods of self-initiated emergency escape for passengers from all trains at all times. 

No. 90  All passenger trains must be fitted with an internal passenger emergency door release. 

No. 92  The internal passenger emergency door release should be fitted with a facility which prevents it from operating unless the train is stationary. 

No. 93  The operation of train doors should have an override facility whereby the driver or the guard can override an internal passenger emergency door release system if the door release is interfered with when there is no emergency. There should be an alarm, together with an intercom, in the guard’s compartment so that, if a passenger attempts to initiate an emergency door release, there is an appropriate delay during which time an alarm sounds in the guard’s compartment and the guard can then, after first attempting to speak via the intercom to the individual concerned, if necessary, override the door release, and make an appropriate announcement over the intercom system in the train.

Recommendation No.4 – Precise Location

At the time of this incident, the South Coast Branch Line, where Kembla Grange Station is located, was in a track circuited territory where the system of safe working relied on track circuits to detect the presence of rail traffic.

As a train traverses a track circuited area, it disrupts the electrical currents flowing through the rails which can then be used to indicate the position of the train. Lights are illuminated on a train location board (see Figure 11) to allow the network controller to get an indication of the location of the train.

The distance between Dapto Train Station and Kembla Grange Train Station is 3.4 km and the network controller has several location indicator lights between these 2 stations to provide an indication of where the train is located.

While this by no means provides a precise location of a train, it could be argued that this is a reasonable indicator for the network controller to know where a train is at a given time.

This was evidenced in this incident when the WCP signaller was aware C012 was in the track section between Dapto and Kembla Grange and was able to respond to the TSDM by saying they would make direct contact with C012, when the TSDM said to stop all services.

Figure 11: Train location board – Wollongong Signalling Complex

Source: Sydney Trains. Kembla Grange located top left, Dapto located top right. C012 was travelling from Dapto towards Kembla Grange at the time of the incident.

The ability for network controllers to identify the precise location of a train on the rail network has been further enhanced as Sydney Trains continues to improve train position reporting.

The implementation of ETCS involves the installation of balises (electronic transponders) that are placed along the rail line and communicate with the train’s onboard system to provide location information.

The ETCS onboard system continuously estimates the current location of the train based on the distance travelled since the last balise was read using onboard odometry information and sends this position information to the ETCS trackside. A Network Controller can review an ETCS fitted trains’ reported location; however, this information is not presented on the Traffic Management System (TMS) screen in real time. The reported location information is limited by odometry accuracy.

The ETCS L2 system will enhance the train location information available to network controllers by

• Enabling smaller sections

• Providing more granular estimated train location information

Note – Track circuits are replaced by axle counters in ETCS L2 areas.

Recommendation No.88 – Containment

The train in this incident had not been retrofitted with the Internal Emergency Door Release (IEDR). At the time of this incident, a project aimed at enhancing the existing Tangara Fleet of trains in Sydney had commenced. The Tangara Technology Upgrade (TTU) Project was a collaborative endeavour, with TfNSW, Sydney Trains, contractors, and industry experts working together to enhance the Tangara trains. It was scheduled to be completed by 2025.

At the time of authoring, the current TTU project scope did not include internal emergency release mechanisms. However, internal emergency door release mechanisms would be installed as part of another project being managed and delivered by Sydney Trains, the Tangara Fleet Life Extension (TFLE) project. In the upgraded Tangara trains, passengers would have the ability to manually release doors from the inside, allowing for swift evacuation if needed. This enhancement aligned with modern safety standards and provided an additional layer of security for commuters.

It was however, noted that extraction of the passengers from the first carriage, that had tipped over, was completed by entry and exit through the rear of the carriage where there remained an opening from the first and second carriages separating. This opening provided a more accessible means of entering and exiting the carriage, compared to opening a side door and having to climb up and out.

The driver was also able to be rescued from the front cab of the carriage as the front emergency door could be opened (Figure 12).

Recommendation No.89 – Emergency escape

On the Tangara the 2 independent methods were the external sliding doors and the intercar doors into the next carriage. In the Kembla Grange incident as there was a separation between the first and second carriages as a result of the derailment, the intercar doors served as the means of entry and exit for the passengers from these carriages.

As the IEDR had not been installed on these carriages at the time of the incident, the second independent method of self-initiated emergency escape for passengers was not available.

The driver was extricated from the emergency door at the front of the train.

Figure 12: Emergency door at front of train

 Source: OTSI

The other 3 closed recommendations (90, 92, and 93) all relate to the installation and functionality of an internal emergency door release. As mentioned above, this train set had not yet had the IEDR retro fitted. 

Similar related incident

Collision of NSW Trains Intercity train N169 with abandoned motor vehicle Woy Woy, NSW 19 April 2024

At approximately 1756 hours on Friday 19 April 2024 at Rawson Road level crossing Woy Woy, New South Wales, an eastbound motorist turned left at the level crossing and accidentally drove their motor vehicle into the railway corridor. The driver exited the motor vehicle after it became stuck on the railway tracks.

Two witnesses arrived at the scene at approximately 1757 and reported they observed the motorist exiting the vehicle and a bystander getting into the vehicle to assist the driver to move it.

At around this time Witness 1 called a tow truck driver.

Witness 2 tried to confirm with bystanders onsite whether triple zero had been called. When they did not receive a response, they called triple zero, confirmed from phone records to have been at 1759. 

Witness 2 reported experiencing delays through the triple zero triage process as the operator appeared to have difficulty comprehending the situation and the location. When eventually dispatched through to the police the witness reported the car stranded on the tracks. 

After the phone call to the tow truck driver was completed, Witness 1 contacted the Network Incident Manager (NIM) by dialling the phone number displayed on the lineside signage and level crossing identification number for fault reporting. This call was received by the NIM at 1802:04. 

An approaching train activated the Rawson Road level crossing at 1802:30, which was heard in the background of the phone call between the NIM and the witness. This call was terminated and the NIM placed a priority call to both the Central Coast and Hornsby North Signalling panel operators, to initiate an emergency “All Stop” message through the Digital Train Radio System (DTRS). 

Central Coast issued an emergency all stop at 1802:55. The train driver reported hearing the broadcast just prior to the vehicle being struck.

At 1803:22 approximately 4 minutes after the triple zero call was made, and after the vehicle had been struck, the Police Radio Operations Group (ROG) Operator contacted Sydney Trains SCCO with the first notification of the motor vehicle on the tracks at Rawson Road level crossing. The ROG Operator conveyed police patrols had reached the site and the train had just collided with the car and that the car was unoccupied.

In social media footage of the collision police sirens can be heard in the background indicating police had been despatched to the incident prior to the ROG Operator reporting the obstruction to the SCCO. It is possible that had Sydney Trains received a call advising of the track obstruction from:

• Witness 1 before they rang the tow truck driver
• the ROG Operator immediately after the triple zero call from Witness 2, 

the train driver of N169 may have received advice of the vehicle on the rail line in time to slow or stop short and prevent the collision.

Sydney Trains investigated this incident. During their investigation they found the NIM was unable to make Rail Emergency Calls (RECs) using their DTRS as the function was not switched on. This decision was made at the time the ROC commenced operations. It was noted that the NIM DTRS could still make point to point calls to trains. 

Sydney Trains commented, given the NIM’s span of management over the network, point to point calls may not be practical in an emergency situation, hence the decision made by the NIM, in the Woy Woy incident, to bring in the Area Controllers was the best method of stopping trains at that time.

Rail Operations Management in Sydney Trains were not aware of the REC facility not being available to NIM terminals and this was not detected in their investigation of the Kembla Grange incident. 

Safety analysis

Trespassing in the rail corridor and abandoning a motor vehicle on the rail line led to the collision and derailment of train C012 just south of the West Dapto Road Level Crossing at Kembla Grange.

The incident presented some opportunities which may have led to mitigation of the incident, and these have been discussed below.

Opportunities to mitigate risk

There were 2 opportunities which may have led to train C012 being stopped before it collided with the abandoned motor vehicle.

The first was when the individual who abandoned the motor vehicle tampered with the security CCTV cameras. The cameras were located on the Kembla Grange Station platform and positioned at the West Dapto Road Level Crossing. The individual tampered with the CCTV cameras approximately 45 minutes before the collision occurred.

The second opportunity to mitigate the event arose when a member of the public called triple zero to notify the police of the abandoned motor vehicle on the rail line approximately 4 minutes before the collision occurred.

Both opportunities are discussed further below.

After the collision and derailment occurred, there was a risk of further escalation of the incident. The Digital Train Radio System was not available for the guard to report the incident and there was potentially live 1,500 V overhead wires at ground level post‑incident on the accident site.

These issues are also discussed further below.

Security Control Centre operators unaware of camera tampering

On the morning of the incident at 0313 a Sydney Trains’ security camera located on the Kembla Grange Station platform recorded an individual moving the security camera. CCTV then captured images of the same individual moving the level crossing cameras away from the level crossing to face directly downwards at 0326, approximately 45 minutes before the collision.

Sydney Trains Security Control Centre was not aware the camera had been moved until 0412:57, 3 minutes 17 seconds after the collision. The SCCO identified the camera movement during the phone conversation with the ROG, which occurred after the collision and derailment.

There was an opportunity for Sydney Trains to detect a security risk at 0313 and 0326, and perhaps stop the sequence of events which led to the vehicle on the track.

Had the camera movements been detected there may have been an opportunity for the Security Control Centre to deploy rail security or police to the scene. These responders may have stopped the individual from attempting to cross the track or detected the presence of a vehicle on the tracks.

While it cannot be said with certainty that events after the detection of a camera being tampered with would have prevented the motor vehicle being stuck, early detection of, and proactive response to camera tampering may provide the opportunity to intervene when security risks such as this occur.

CCTV monitoring

The Security Control Centre’s Standard Operating Procedures (SCC SOP) suggested the Security Control Centre provides proactive monitoring of the entire Sydney Trains rail network. Page 10 states that operators proactively monitor over 13,000 station‑based CCTV cameras and 12,000 train‑based cameras, over 25,000 cameras in total. 

The SCC SOP detailed the floor plan and desk set‑up for the Security Control Centre operators and provided the minimum staffing levels for given shifts. While much of the time 4 Security Control Centre operators were rostered to live monitor the rail network, there could be up to 5 Security Control Centre operators on some shifts or during night shifts as few as 3 operators.

The task of monitoring some 25,000 station and train‑based cameras was, therefore, as detailed in the SCC SOP, expected to be effectively managed by 3 to 5 individual operators depending on the numbers on shift.

The Security Control Centre operators were each assigned a particular area to monitor e.g. Console 4 live monitors the Illawarra and Bankstown Lines. This operator was responsible for live monitoring over 3,000 cameras.

This monitoring involves an individual overseeing many cameras on monitors at a desk. As a result, it is not possible to effectively monitor all assigned cameras at the same time, or reliably monitor camera changes, as in this incident where camera tampering was not detected.

Tamper alarms 

Installation of tamper alarms on cameras was identified and agreed to by Sydney Trains as a reasonable measure to improve the security of the rail network. Tamper alarms provide an opportunity to improve proactive live monitoring as Security Control Centre operators in principle should be immediately alerted to a tampering event. This would then enable the Security Control Centre operator to act expeditiously. 

A CCTV Upgrade Project to install tamper alarms on all cameras across the rail network was started in 2015. The scope of the CCTV Upgrade Project was amended during implementation, when excessive false alarms were encountered. The scope was amended to place tamper alarms on all cameras that were under 2.4m in height or were covering specific assets, such as level crossings, or any camera with a history of vandalism. Sydney Trains identified in their investigation of this incident that the revised tamper alarm functionality had not yet been fully implemented. Including activation of the tamper alarms on the West Dapto Road Level Crossing, even though it was identified for activation.

The Sydney Trains Network Maintenance group took charge of the project in December 2020 and a CCTV Operational Working Group was formed to continue progress from February 2021. Progress on installing these tamper alarms was continuing at the time of publishing this report.

The opportunity for detecting these types of events remains significantly lower while the installation of tamper alarms or alternative solutions remained outstanding. 

No alert to train crew

In this incident, the train crew was not alerted to the abandoned motor vehicle on the track in time for them to slow or stop the train to avoid a collision or mitigate the outcomes. The recorded radio call from the WCP Controller to C012, highlighted the WCP Controller attempting to call C012 at 0409:35 and there was no response. 

There was an opportunity for the collision and derailment to be avoided when a report of a motor vehicle on track came from a triple zero call from a member of the public at 0405:52. Sydney Trains was not alerted to this until 0407:37, which meant there remained approximately 2 minutes for a message to be provided to C012 to stop prior to the collision at approximately 0409:35.

This time was taken up with the passing of information from the SCCO to the TSDM and then to the WCP Signaller, who then made the call to C012 via the DTRS at about the same time the driver of C012 applied emergency brakes on the train.

The audio recording of these calls highlighted emergency awareness as an area for improvement. If the message had reached the driver of C012 in time, they could have slowed or stopped the train which could have prevented the collision from occurring or lessened the outcome.

Rail emergencies

The definition of an emergency in the railways is essentially any incident requiring urgent action which might involve death or serious injury, health and safety effects and/or significant damage to property or infrastructure[23].

A vehicle obstructing the rail line presents an immediate threat to the safety of train crew and the travelling public and therefore requires immediate action to stop all train services in the vicinity to prevent collision and escalation.

There is a level of understanding about rail operations that the ROG would glean over time through the interactions they have with the Sydney Trains Security Control Centre, however a firm understanding of what constituted an emergency on the rail line would not be expected to be known by the ROG without clear instruction or rail emergency training. As the ROG is the first contact point from a triple zero call about a rail emergency, it would be reasonable to review whether rail emergency awareness training should be provided to ROG Communications Officers and RDC Operators.

The SCCO is the first point of call into Sydney Trains from the ROG for these types of emergencies.

As a rail employee, the SCCO receives relevant training to identify rail emergencies. However, Sydney Trains stated in its internal investigation that the SCCO had not received any training in responding to emergencies since 2017.

Emergency situations are times when people are required to make fast and deliberate decisions and take actions to mitigate further escalation of consequences. As the SCCO had not received regular emergency refresher training in the preceding 4 years, their appreciation and understanding of how to react in an emergency was likely not at a competency level required for an effective response.

The SCCO’s response reflects this as they took considerable time to verify and confirm with the Assistant RDC Operator that there was a motor vehicle stuck on the rail line before they made the call to the TSDM. The Assistant RDC Operator stated there was a report of a car stuck on the rail line 19 seconds into the conversation with the SCCO. Valuable time was used up and at 47 seconds into the conversation the SCCO asked if it is confirmed a motor vehicle is on the train tracks? Then at 58 seconds asks, are “they” inside the corridor? To which the Assistant RDC Operator needs to confirm if the SCCO means the deployed NSW Police. All taking up critical time to potentially stop a collision and further escalation.

It took 1 minute and 10 seconds before the SCCO made a call to the TSDM.

Without suitable training and practice exercises in emergency situations, the SCCO was possibly slower to respond to the information given to them by the Assistant RDC Operator. In a role that is required to understand and act expeditiously when emergencies arise, the level of training and exercising of the appropriate response for SCCOs is important.

Performing well in a situation that arises on rare occasions is not guaranteed when that individual has not been provided training in emergency response for many years.

A report of a motor vehicle stuck or any significant object on the rail line poses an immediate threat to life and the safety of train services and should be treated as an emergency. With appropriate training and/or instruction the reaction to this information should be to take immediate action to stop train services to avoid collision and prevent escalation.

Management of rail emergencies

As discussed previously, there was inconsistency between the SCC SOP and NIMP.

The NIMP required all incidents to be reported to the NIM or the DCM to be managed, however the report from the SCCO of the incident was directed to the TSDM.

An explanation for this was presented in Sydney Trains’ internal investigation, that being, the SCCO perceived the situation as a routine Condition Affecting the Network (CAN), rather than as an Emergency (which is a type of CAN requiring a more urgent response).

This incident was an emergency as defined by the NIMP and therefore needed to be treated in accordance with the NIMP. The NIMP required that once the incident is imminent or occurs, first contact needs to be made with workers controlling train movements on the affected track section.

This is the accepted and accredited process for Sydney Trains Network Incident Management.

When the SCCO called the TSDM after they were informed of a motor vehicle on the track, the incident was not managed in accordance with the requirements of the NIMP. This incident required a call to the NIM or the DCM to manage. That said, the TSDM in this instance acted quickly to advise the signaller to stop all trains. 

Procedure with conflicting instructions

The Sydney Trains Security Control Centre Standard Operating Procedure (SCC SOP) contained conflicting instructions for incident response. While referencing the Command and Control System as the new Incident Management System that is detailed in the Network Incident Management Plan (NIMP), the SCC SOP also introduced the TSDM to the incident response process.

Page 59 of the SCC SOP contained the 'Incident response checklist'. This checklist is to be used for all incidents managed by the Security Control Centre.

Its purpose, to provide prompts for the SCCO in the event of an incident that may have an effect or impact on the rail network. The SCCO is instructed to "Inform relevant TSDM/NIM - MAKE SAFE."

The SCC SOP introduced the TSDM as a point of contact in an incident, however, the Sydney Trains NIMP only states the NIM and DCM, as the points of contact, for Level 1 and 2 incidents.

The NIMP provides a clear statement of roles and their responsibilities for managing network incidents. There is no mention in the NIMP of a role for the TSDM in the command and control system.

Sydney Trains also identified in their internal investigation an issue with inclusion of the TSDM in the Security Control Centre procedures.

Page 30 of the Sydney Trains Investigation report stated:

The current SCC Standard Operating Procedure v1.3 and informal procedure allowed for the TSDM to be informed of the motor vehicle on the running line to determine the response, instead of specifying only the NIM, introducing an additional line of communication with no access to the DTRS.'

This highlighted that inclusion of the TSDM in the lines of communication slows response to an individual that has access to the DTRS (and hence an ability to STOP train services). Sydney Trains also highlighted in their investigation that an alternative solution to getting the SCC SOP and Sydney Trains NIMP processes consistent, would be to consider the processes that are occurring already as embedded and instead provide the TSDM with the ability to stop all train services when an incident such as this one occurs.

Given the competence displayed by the TSDM in this incident, the alternative solution proposed by Sydney Trains, to give the TSDM access to the DTRS and the ability to stop all train services when required is worthy of assessing for feasibility of implementation.

In the related Woy Woy incident, the NIM still opted to call the signaller to place an emergency broadcast, rather than placing a point to point call themselves, as they determined that this was the most effective means to stop the train. This was required as the REC functionality on the NIM’s DTRS had been turned off. NIMs could still make point to point calls to trains but not emergency broadcasts. This was the status of the NIM DTRS functionality at the time of the Kembla Grange incident, and this status was unknown to Sydney Trains Rail Operations Management. 

However, awareness of the issue has led to further technical advice being sought regarding the practicality of switching on the REC facility on NIM DTRS terminals, with a view to determining the best method/ shortest practical communication chain to stop trains in emergency situations.

Digital Train Radio System

The DTRS on Set T42 did not work when the guard attempted to call the Signaller after the train had collided with the motor vehicle, derailed, and separated. After the derailment and separation, the Signaller made attempts to contact the driver on the DTRS but was unsuccessful.

Sydney Trains investigated the functionality of the DTRS after the incident. They found the DTRS was working as required. The radio unit on the train had gone into stand‑by mode likely because of a short circuit in the guard’s control circuit breaker unit, which occurred when the train collided, and the first carriage separated.

For the guard to be able to use the DTRS again, it required the guard to reset it.

In post‑incident testing of the DTRS, a reset of the unit was conducted, and it took approximately 30 seconds for the radio to restart after the guard key in and another 50 seconds to get through the service menu to make an emergency call.

In this emergency where the guard was in a heightened state of arousal, 80 seconds is a considerable time to wait for the radio to be usable again. Had there been no other option, then the DTRS would have been available for the guard to use after a reset, provided they had appropriate instruction on how to reset it.

In this instance the guard had a second option available which was to use a mobile phone to contact the network controller. This option was a quick and effective way of reporting the situation.

High voltage risk

As a consequence of the collision and derailment, the front carriage collided with a high voltage stanchion, bringing it to the ground along with 1,500 V overhead wires.

The Electrical Operations Centre (EOC) was alerted to a sustained fault between Unanderra and Dapto and notified the NIM approximately 4 minutes after the collision. It is highly probable the sustained fault was caused by the front carriage bringing down the high voltage stanchion. This sustained fault meant the power through the overhead wires in this section had been cut off however, verification of power being cut from the overhead had not been conducted.

Instruction from the NIM was for everyone to treat the overhead wires as live until the Rescue Power Outage (RPO) was issued.

At 0411:56, 2 minutes 16 seconds after the collision, the guard was reporting the incident to the WP Signaller. During this call the guard tells the WP Signaller that the police are onsite. 

At this point, the Incident Rail Commander (IRC) had not made it to site to take control and there had been no verification of high voltage power being cut out. With no other qualified person onsite, the guard had assumed the role of Site Controller.

It is important to highlight the competence of the guard, and their training, as it enabled them to inform the police and other first responders to watch out for the high voltage danger of the overhead wires and live portion of the train.

Additionally, a secondary avenue of mitigating risk exposure to the police was in action through the communication chain between the SCCO and Assistant RDC Operator informing emergency personnel on site to treat the wires as live.

Findings

From the evidence available, the following findings are made with respect to the collision between passenger train C012 and a motor vehicle on track near West Dapto Road level crossing, Kembla Grange, New South Wales, on 20 October 2021.

Contributing factors

• An individual abandoned a motor vehicle on the rail line south of West Dapto Road Level Crossing, Kembla Grange.
• Train C012 collided with the abandoned motor vehicle south of West Dapto Road Level Crossing and derailed.
• The driver of C012 was not alerted to the abandoned motor vehicle on the rail line in time to stop the train prior to colliding with the vehicle and derailing.

Other factors that increased risk

• An Individual tampered with CCTV cameras monitoring the West Dapto Road level crossing at Kembla Grange Station without being detected.
• Sydney Trains Security Control Centre Operator was not alerted to tampering of the cameras at Kembla Grange Station that monitored the West Dapto Road level crossing.
• Sydney Trains Security Control Centre Standard Operating Procedure contained conflicting instructions on incident response, which were not aligned with the Sydney Trains Network Incident Management Plan (NIMP).
• Report of a motor vehicle stuck on the rail line was not treated as an emergency.
• There was a risk to the guard and first responders who attended to the driver and injured passengers, when the potentially live 1,500 V overhead wires came down to ground level.
• When the guard tried to make an emergency call on the Digital Train Radio System, they could not use it to contact Network Control in a timely manner.

Safety issues and actions

Sydney Trains Security Control Centre Operator unaware CCTV cameras tampered with at Kembla Grange Station

Safety issue number: RO-2021-012-SI-01

Safety issue description: Sydney Trains Security Control Centre Operator was not alerted to tampering of the cameras at Kembla Grange Station that monitored the West Dapto Road Level crossing.

Response by Sydney Trains: CCTV software has been recently upgraded to allow use of a centralised server-based analytics engine to provide alarm functionality. Additionally, Sydney Trains has purchased software licenses to allow development / testing / trialling of this software. It is believed that the more sophisticated analytics available will allow detection of incidents such as the tampering at the West Dapto Level Crossing while reducing the false alarm rate.

ATSB comment: This action is appropriate to ensure a risk control for trespassers on the rail line being detected is in place. In the interim period, while the control is being developed, tested and trialled, without any other control for tamper detection, the trespasser risk remains untreated.

Sydney Trains Security Control Centre Operator procedure contains conflicting instructions on incident response

Safety issue number: RO-2021-012-SI-03

Safety issue description: Sydney Trains Security Control Centre Standard Operating Procedure contained conflicting instructions on incident response, which were not aligned with the Sydney Trains Network Incident Management Plan (NIMP).

Response by Sydney Trains: The Security Control Centre Standard Operating Procedure has now been aligned with the Sydney Trains Network Incident Management Plan with Security Control Centre Operators required to contact NIMs rather than TSDMs, and, Security Control Centre Operators' initial training in responding to emergencies has been upgraded (initial training module - STSCC02C - Knowledge & Skills) so that initial training around communicating during emergencies is improved and a recertification module (STSCC07A - SCC - Competency Assurance Assessment) is currently under development and will be provided as refresher training. 

It is expected that the refresher training will be provided to operators every 12 months.

ATSB comment: The actions taken by Sydney Trains as described above addresses the inconsistencies previously in the safety management system. The safety issue is considered closed adequately addressed.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the Driver of C012
• the Guard of C012
• Train data logger from D6212 and D6211
• Sydney Trains CCTV cameras
• Sydney Trains audio communication systems
• Sydney Trains documented management systems
• NSW Trains documented management systems
• Transport for NSW
• NSW Police Investigation

References

ONRSR annual implementation reports on the NSW Government response.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any individual whom the ATSB considers appropriate. That section allows an individual receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• Driver of C012
• Guard of C012
• NSW Trains
• Sydney Trains
• Transport for NSW
• ONRSR
• NSW Police

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Rail safety investigations in New South Wales Most transport safety investigations into rail accidents and incidents in New South Wales (NSW) and Victoria are conducted in accordance with the Collaboration Agreement for Rail Safety Investigations and Other Matters between the Commonwealth Government of Australia, the State Government of NSW and the State Government of Victoria. Under the Collaboration Agreement, rail safety investigations are conducted and resourced in NSW by the Office of Transport Safety Investigations (OTSI) and in Victoria by the Chief Investigator, Transport Safety (OCI), on behalf of the ATSB, under the provisions of the Transport Safety Investigation Act 2003. The Office of Transport Safety Investigations (OTSI) is an independent statutory body which contributes to improvements in the safety of bus, ferry and rail passenger and rail freight services in NSW by investigating safety incidents and accidents, identifying system-wide safety issues and sharing lessons with transport operators, regulators and other key stakeholders. Visit www.otsi.nsw.gov.au for more information. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 30 October 2021, empty coal train 9QJ5 travelling west to Moura mine, derailed at the 99.270 km point between Mount Rainbow and Dumgree, Queensland. A total of 20 wagons and 2 remote locomotives (mid-train) derailed.

The derailment occurred following ballast undercutting work that had been completed 2 days prior. Two empty coal trains heading west had travelled over the section, without incident, prior to train 9QJ5.

What the ATSB found

The ATSB found that train 9QJ5 derailed likely due to a track irregularity following track disturbance works between Mount Rainbow and Dumgree. The track irregularity likely developed under the passage of the train.

The rail stress-free temperature, near the point of derailment, was not adjusted following the track work as planned. Consequently, the track was likely left in a stressed condition when the track was handed back fit for service.

It was also established that temporary track monuments had not been regularly placed throughout the worksite, being only used for about the final 200 m of work. While this was not considered contributory to the derailment, this increased the risk of the track not being returned to the correct position following track disturbance work.

Further, after the track disturbance works had been completed, a temporary speed restriction of 40 km/h was not applied to assure safe passage over that section of track. This was particularly important given that the rail stress-free temperature was unknown at that time.

What has been done as a result

Aurizon has implemented various safety actions, including developing and implementing a rail stress worker course, conducting roadshows to discuss the Track Stability Manual, reviewing and updating the manual, and creating a rail stress appreciation course. In addition, they have updated the site assessment walkout templates with rail stress information and issued a toolbox talk to infrastructure workers, reinforcing procedural requirements during track-disturbing work to maintain track stability.

Safety message

This accident highlights the importance of assuring track stability following disturbance work through having a correct rail stress‑free temperature, which is critical to rail safety. Likewise, track stability assurance also relies on the use of accurate track offsets, during, and temporary speed restrictions, following, track disturbance work.

The investigation

The occurrence

Scheduled maintenance

On 27 October 2021, at about 1230 local time, Aurizon’s RM902 ballast cleaning machine began ballast undercutting work along a section of track between Dumgree and Mount Rainbow, Queensland, from 99.800 km to 98.300 km. The work was part of planned track maintenance on Aurizon Network’s Moura system, integrated possession number 75, between Graham and Dumgree (Figure 1).

Due to operational considerations, ballast undercutting work concluded early at about 2020, completing 554 m between 99.840 km and 99.286 km. The RM902 ballast cleaning machine departed the site at 2255.

On 28 October 2021, ballast resurfacing was conducted over the same section and was completed at 1140. Following this, local level crossings were re-established and, at 2245, the SW05 form (the authority for the work between Mount Rainbow and Dumgree) was provided to the integrated possession protection officer.

On 30 October 2021, at about 0847, the work between Graham and Dumgree was completed, and the track section was re-opened without speed restrictions.

Figure 1: Location of the track works Mount Rainbow – Dumgree, Queensland

Source: Aurizon, annotated by the ATSB

The occurrence

At about 1130 and 1215, 2 empty coal trains passed over the re-opened line, heading west, between Mount Rainbow and Dumgree without incident.

At about 1545, empty coal train 9QJ5 passed through Mount Rainbow heading west towards Moura Mine, travelling at about 64 km/h. The train gradually increased speed to a maximum of 77 km/h, before the driver applied dynamic brake to decrease speed for an approaching 60 km/h track speed limit.

When approaching the 99 km, the rail traffic crew noticed a transition in ballast colour from dark to light (Figure 4). A short time later, at 1556:50, the recorded brake pipe pressure began to decrease in the remote distributed power locomotives. At 1556:57, travelling at 54 km/h, the emergency brake was activated (due to a loss of brake pipe air) in the leading locomotive, stopping the train about 160 m later at about 100.220 km. The in-cab telemetry between the leading locomotive and remote locomotives was broken.

After securing the train, one of the drivers walked back, discovered that the wagons had derailed (Figure 2), and reported the derailment to Aurizon network control.

Figure 2: Main wreckage site

Source: Aurizon, modified by the ATSB

Context

Train information

General

Train 9QJ5 consisted of 2 leading diesel electric locomotives, 50 empty coal wagons, 2 distributed power diesel electric locomotives, and another 50 empty coal wagons. The total length of the train was 1,714 m with a gross mass of 2,501 t. The train was operated by 2 appropriately qualified Aurizon drivers. Both drivers recalled during interview that the track was smooth as the leading locomotive passed over the recently ballasted track.

Recorded information

The locomotives were fitted with event data recorders. Data from the leading locomotive (4012) showed the train was operated consistent with the advertised track speeds. In addition, the emergency brake automatically activated as a direct result of the brake pipe loss of air due to the train separation.

At the time of derailment, the leading remote distributed power locomotive (4044) recorded a 4 kN tractive effort. The ATSB considered if this force contributed to the derailment through buff (compressive) forces in the couplings between the wagons. It was determined that the 4 kN was erroneous and did not contribute.

Track infrastructure

The narrow-gauge track[1] between Mount Rainbow and Dumgree consisted of 60 kg/m continuously welded rail fastened with resilient fasteners on concrete sleepers nominally spaced at 667 mm on ballast 250 mm deep. There was no overhead wiring electrical traction system or stanchions installed. The track consisted of undulating terrain with multiple tight radius[2] reverse curves (Figure 3 left). The point of derailment was located between 301 m radius reverse curves on a 1 in 153 downhill grade (Figure 3 right).

Figure 3: Track details at the point of derailment

Source: Aurizon, annotated by the ATSB

Site and wreckage information

Following the derailment, Aurizon inspected the derailment site and commenced an investigation. Based on the site evidence, Aurizon determined that the leading left wheel of the trailing rear axle of the 31st wagon (behind the 2 leading locomotives, VSAS 50930) climbed over the left rail (in the direction of travel) at 99.277 km (Figure 3). The wheel flange ran along the rail head for about 3.6 m then dropped off the field side.[3]

The following 20 wagons derailed (not including the 35th position wagon) and 2 remote distributed power locomotives derailed (located at position 51 and 52 in the consist). The train travelled about 400 m in a derailed condition. Aurizon specialists inspected the rolling stock in-field and found no pre-existing defects.

Aurizon found evidence of a track misalignment commencing at about 99.270 km, just prior to the point of derailment, where the concrete sleepers had begun to move both vertically and laterally (left and right). The track misalignment progressively worsened beyond the point of derailment (Figure 4). The ballast in the work location was also analysed. Although the ballast failed under 53 mm and 37.5 mm sieve tests,[4] Aurizon determined that the specification failure identified was not considered to have been contributory to the accident.[5]

Aurizon concluded that the recent track maintenance activity had a substantial impact on the compressive stress condition of the track leading up to the point of derailment in the heat of the day. This resulted in the track infrastructure becoming unstable and a flange climb derailment due to track misalignment.  

Figure 4: Point of derailment and track misalignment

Note: The rear portion of wagons was removed from the site before the above photograph was taken. New ballast is lighter in colour.

Source: Aurizon, annotated by the ATSB

Stress-free temperature

Railway tracks are constructed of steel rails that expand and contract with changes in temperature. When the temperature increases, the rail expands and when the temperature decreases, the rail contracts. These changes in length can cause stresses and strains in the rail, which can lead to breaks, buckling, and other types of lateral instability. To prevent such instability, the rail is designed to have a stress-free temperature.

The design stress-free temperature refers to the temperature at which the rail is neither in compression nor in tension, and is established during track construction. However, this may change due to factors such as rail creep,[6] dynamic train forces (such as train acceleration and braking), and maintenance activities (such as tamping, destressing or ballast cleaning). Therefore, the actual stress-free temperature of the rail may not necessarily be the design temperature. Consequently, the actual temperature should be routinely measured to ensure it remains within the designed tolerances.

Aurizon specified a rail design stress-free temperature of 38°C for the line between Mount Rainbow and Dumgree. Although the line had been regularly inspected and maintained, the actual stress-free temperature of the rail before the track disturbance work commenced was unknown.

Track standards

The track was to be maintained in accordance with Aurizon’s standards including the Civil Engineering Track Standards[7] and Track Stability Manual.[8]

Track consolidation

The Civil Engineering Track Standards stated:

All track that has been recently disturbed must have a speed restriction applied following the work as specified in Table 10.1 Acceptance Criteria for Track Consolidation.

An excerpt of Table 10 is shown in Figure 5 indicating that a temporary speed restriction of 40 km/h or less was required after undercutting works until consolidation of the ballast[9] had occurred through either dynamic stabilisation or having 10 loaded coal trains pass over the track, establishing valid stress-free temperature results and making any rail adjustments.

Figure 5: Excerpt from the Civil Engineering Track Standards detailing the requirements for temporary speed restrictions for track disturbance works

Source: Aurizon, modified by the ATSB

Management of track stability

The Track Stability Manual described approved processes and procedures for the management of track stability on continuously welded rail by correct rail adjustment, and improving the track’s resistance to track buckles (compressive force) and breaks (tensile force). The management of track stability involved 2 separate processes:

• control of rail stress to reduce longitudinal forces in the rail that can lead to buckling
• maintenance of the ballast profile and condition to improve ability of track to resist these forces.

Figure 6 is an excerpt from the Track Stability Manual showing the track stability requirements for various disturbance works, including ballast undercutting. Ballast control through track consolidation, and rail stress control through stress testing or rail adjustment, were both mandatory requirements. The manual also noted that, as there were different mandatory requirements listed, there may be a situation where 2 or more speed restrictions may apply, and that the more ‘severe restriction’ should always apply. Following ballast undercutting works, in addition to the speed restriction required until ballast consolidation was completed (discussed above), a 40 km/h limit was to be put in place until a stress test with an adequate result or rail adjustment was performed.

Figure 6: Excerpt from the Track Stability Manual detailing the track stability requirements

Source: Aurizon, modified by the ATSB

Figure 7 is an excerpt from the Track Stability Manual and shows the level of applied speed restriction based on the ambient air temperature and unknown status of the rail stress‑free temperature. In this instance, based on the unknown status of the rail stress-free temperature and ambient air temperature, a temporary speed restriction of 40 km/h was required until a rail adjustment was performed within the intervention threshold of 3 days (Figure 8).

Figure 7: Excerpt from the Track Stability Manual detailing speed restrictions based on ambient air temperature

Source: Aurizon, modified by the ATSB

Figure 8: Excerpt from the Track Stability Manual detailing the risk controls for an unknown rail stress-free temperature

Source: Aurizon, modified by the ATSB

Planned trackwork

Without dismantling the track, the ballast cleaning machine undercut the ballast bed with a moving chain beneath the rails and sleepers, removing contaminated and degraded ballast. The ballast was replaced with new ballast under the track, shown as the lighter colour in Figure 4.

Ballast undercutting track work, between Mount Rainbow and Dumgree, disrupted track stability between 99.840 and 99.286 km (554 m). This disruption potentially extended to include an influence zone up to 100 m either side of the work.[10] To mitigate the risks associated with track instability, the following key tasks were usually performed during and following disturbance work to assure track stability. They were, but not limited to:

• using track monuments[11] to measure offsets
• repositioning the track back to the original position based on the recorded offsets
• tamping[12] the track to the design curvature and superelevation[13]
• dynamic stabilisation[14]
• rail stress testing (if applicable) and subsequent adjustments to the rail
• using temporary speed restrictions until track stability was assured.

On 27 October 2021, following an initial delay, work commenced at about 1230 and about 350 m was completed before a shift handover.  Following the handover to the afternoon shift, it was noted by the work supervisor that no temporary monuments had been installed. In preparation for continuation of the work, steel star pickets were hammered into the field-side of the track to create a temporary datum or monument points. The pickets were used at intervals of about 50 m to record track offsets, to ensure the track was returned to its original position following undercutting work. The afternoon shift completed about 200 m of undercutting work with monuments installed and track offsets recorded.

Following ballast replacement, the track was realigned using the previously recorded track offsets before design curvature and elevation corrections were made. The track was also dynamically stabilised to consolidate the ballast.

Generally, when ballast undercutting works was conducted, a stress test was completed following that works using a VERSE®[15] stress testing machine. The results of that test determined whether adjustments to the rail were required if found to be outside tolerances. In this case, as the curvature of the track was too tight to use this machine and receive accurate results, a re‑stress was planned to be completed. A re-stress (rail adjustment) involved cutting the rail, measuring the rail gap and temperature, calculating the rail stress-free temperature and required gap, then welding the rail together.

Prior to the work commencing, a rail stress plan was approved to begin following the work on 28 October 2021. Due to staff availability, the planned rail adjustment was not conducted on that date nor was there evidence provided to the ATSB that it had been rescheduled to occur within 72 hours, as specified in the Track Stability Manual (Figure 8). Following the work, a temporary speed restriction (TSR) board was not erected to cover the worksite. The site supervisor believed that other TSRs for the broader work covered that specific worksite.

Environmental information

The closest Bureau of Meteorology weather monitoring station was at Thangool Airport, about 35 km south-south-west from the derailment site. The maximum outside air temperature recorded on 30 October 2021 was 34.2 °C.

Aurizon monitors air and rail temperatures at numerous locations on their network, including Mount Rainbow (7.7 km east) and Dumgree (10.4 km west). Table 1 shows the maximum air and rail temperatures, including near the time of derailment (at 1600).

Table 1: Aurizon recorded temperatures

Location		Maximum temperature °C	Time of derailment temperature °C	Train at 1130 (°C)	Train at 1215 (°C)
Mount Rainbow	Air Rail	33.1 at 1330 hrs 48.1 at 1400 hrs	31.1 40.1	30.9 47.6	32 48
Dumgree	Air Rail	35.7 at 1445 hrs 51.6 at 1315 hrs	35.3 49	32.3 48.1	33.8 50.8

Figure 9 and Figure 10 show Aurizon recorded air and rail temperatures at Mount Rainbow and Dumgree between 28 October 2021 and 30 October 2021. The maximum air temperatures on each day were below the design stress-free temperature of 38°Cfor the rails. However, at the time of the derailment, the rail temperature was decreasing and was about 40.1 °C at Mount Rainbow and 49 °C at Dumgree.

Figure 9: Mount Rainbow air and rail temperatures

Source: Aurizon, annotated by the ATSB

Figure 10: Dumgree air and rail temperatures

Source: Aurizon, annotated by the ATSB

Similar occurrence

ATSB investigation (RO-2018-005)

On 24 January 2018, at about 1347 local time, loaded Aurizon coal train EF01 encountered a track buckle at Duaringa, on Aurizon Network’s Blackwater System between Emerald and Rockhampton, Queensland. The buckle resulted in 17 wagons in the train consist derailing (Figure 11), damaging 502 m of track on the down line and 54 m of track on the adjacent up line, with rails, sleepers and overhead line equipment requiring replacement.

Figure 11: Duaringa derailment site

Source: ATSB

The ATSB found that the track buckle had formed on a falling 1 in 50 grade at the point of the track where ballast cleaning and track stabilisation work had been completed less than 12 hours earlier. The ballast cleaning operational plan did not consider compressive stress in the continuous welded rail as a risk at this location.

The compressive stress, steep grade, proximity to a turnout and high ambient temperature meant the track structure had a limited capacity to constrain lateral forces. While the ballast cleaning, track resurfacing and dynamic track stabilisation work met Aurizon Network’s civil engineering track standards, negative operational outcomes were not anticipated when a risk assessment was done for the site.

Following this occurrence, Aurizon changed its procedures to ensure a temporary speed restriction was applied to all work sites on which ballast undercutting had been performed. The restriction was to remain in place until rail adjustment or stress testing had been completed and it had been determined that the rail stresses were within accepted limits. In addition, sites with a high risk of compressive rail stress would be identified and added to the site hazard map before conducting ballast cleaning.

Safety actions implemented by Aurizon following the Duaringa derailment had not been applied as part of the planned track work between Mount Rainbow and Dungree and are discussed in the Safety analysis below.
 

Safety analysis

Findings

Safety actions

Safety action by Aurizon

Aurizon advised the ATSB of the following safety actions:

• A rail stress worker course was developed and rolled out to relevant roles.
• Roadshows were conducted in all districts, where network asset leaders discussed the intent and application of the Track Stability Manual.
• The Track Stability Manual was reviewed and updated.
• A rail stress appreciation course was created and attended by civil supervisors and civil superintendents across the Aurizon network.
• Site assessment walkout templates were updated to include relevant rail stress related information.
• A toolbox talk was created and issued to all infrastructure workers, reinforcing procedural requirements when performing track disturbing work to maintain track stability.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the train crew
• Aurizon

References

Office of the National Rail Safety Regulator. (2019). Guideline - Road Rail Vehicle Management and Operations, Version 1.0. Adelaide, SA: Office of the National Rail Safety Regulator.

Rail Industry Safety and Standards Board. (n.d.). Glossary of Terms. Retrieved from https://www.rissb.com.au/glossary/

Rail Industry Safety and Standards Board. (2018). Track stability (AS7643: 2018). Retrieved from https://www.rissb.com.au/products/as-7643-track-stability/

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• train crew
• Aurizon
• Office of the National Rail Safety Regulator.

Submissions were received from:

• Aurizon
• Office of the National Rail Safety Regulator.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1] Narrow gauge is nominally 1,067 mm.

[2] Aurizon defined a tight radius curve as a 300 m radius.

[3] The side of the rail opposite the gauge face (the inner side of the running rail head).

[4] New ballast contains approximately 40-45% voids and has the size, shape, density, and grading requirements specified to suit the operational requirements and environment. However, although all Australian railway systems have differing grading requirements, all have a maximum size of 53 or 63 mm and are limited to approximately 0.7% of dust passing a 75 μm sieve.

[5] Aurizon Category A investigation report of derailment of 9QJ5.

[6] The permanent or progressive longitudinal movement of rails in track caused by expansion or contraction of the rail or the action of rail traffic.

[7] SAF-STD-0077-CIV-NET Module 10 Civil Engineering Track Standards – Track Stability and Hot Weather Precautions, Ver 1.0, 11/01/2021.

[8] AZN.NA.MAN.12.6170.005 HWD Track Stability Manual – Network, Ver 2.0, 04/01/2021.

[9] The process of recompacting the ballast after track disturbance works, achieved through either the action of loaded trains or mechanical means.

[10] Any rail adjustment or speed restriction resulting from track disturbance works must cover the extent of the site, and an additional length of track beyond the immediately affected area. This is known as the influence zone as defined by Aurizon (Track Stability Manual). For rail adjustments, the influence zone extended 100 m at each end of the affected work area.

[11] A permanent monument located at the side of the track to facilitate the accurate measurement of rail creep. Measurements were taken between a marker on the monument and punch marks made on the side of the rail head. Where no permanent monuments were installed, it was best practice to install and use temporary monuments, such as steel star pickets.

[12] The process by which ballast is packed around the sleepers of a track to ensure the correct alignment for the location, speed and curvature of the line.

[13] Generally, the term superelevation (or cant) is used for intended height difference in the rails (that is, where the track is inclined in a curve), and the term 'cross-level' is used for unintended height difference (that is, due to track irregularity).

[14] Dynamic track stabilisation is a track maintenance technique that uses controlled vibrations to improve the stability of the ballast bed. This is done by applying horizontal vibrations to the track while simultaneously applying a vertical load. The vibrations cause the ballast stones to re-arrange themselves in a denser and more homogeneous structure, which improves the track's resistance to lateral displacement and settlement.

[15] The vertical rail stress equipment (VERSE®) machine is a scientific instrument used to non-destructively measure the stress-free temperature of continuously welded rail.

Findings

From the evidence available, the following findings are made with respect to the separation issue involving a Saab 340B, registered VH-ZLV, and a Beech Aircraft B200, registered VH-WXB that occurred at Brisbane West Wellcamp, Queensland on 21 October 2021.

Contributing factors

• The flight crew of VH-ZLV broadcast an incorrect position of their aircraft when approaching the circuit. This probably resulted in the pilot of VH-WXB misidentifying it for another aircraft in the circuit and influenced their decision to conduct a non‑standard circuit entry contrary to the traffic flow.
• The flight crew of VH-ZLV did not effectively monitor the radio, resulting in them having an incorrect mental model of VH-WXB’s position and thus not perceiving VH-WXB as a threat.
• The pilot of VH-WXB manoeuvred their aircraft opposite to circuit traffic direction while descending into the active side of the circuit in the vicinity of the airport resulting in a conflict with VH-ZLV.
• Neither flight crew identified the other aircraft visually or on their TCAS, leading to VH-WXB turning in front of VH-ZLV and resulting in the crew of VH-ZLV receiving a TCAS RA.

Safety actions

Safety action by Air Charter Coordinators

As a result of this incident the operator of VH-WXB advised the ATSB that they:

• will ensure there is a 4-minute buffer between a regular public transport (RPT) flight’s time in the circuit and theirs by holding[1] at LUKEY, to ensure that the RPT flight is on final approach when they join the circuit
• have briefed their pilots of the event and communicated the need to adhere to the procedures written in CAAP 166 - Operations at Non-Towered Aerodromes. This included advice that when traffic congestion is anticipated, actions such as conducting orbits to allow greater spacing in traffic sequencing should be considered  
• have discussed the traffic congestion issue with the training school based at Wellcamp and have agreed that during the scheduled arrival times of RPT aircraft, the training school will limit the number of their aircraft flying within the area.

Safety action by Regional Express Pty Ltd

The operator of VH-ZLV advised the ATSB of the following actions:

• operations at, and in the vicinity of, non-towered aerodromes have been included as a focus item in the periodic aircrew check cycle
• this occurrence will be used internally as a human factors case study for operations around common traffic advisory frequency airports.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilot in command of VH-ZLV
• the pilot of VH-WXB
• Regional Express Pty Ltd
• Air Charter Coordinators
• Airservices Australia
• Civil Aviation Safety Authority
• Avdata
• OzRunways

References

Civil Aviation Safety Authority. (2019, August). Brisbane West Wellcamp Airspace Review (D19/265775). https://www.casa.gov.au/airspace-review-toowoomba-wellcamp-airport

Civil Aviation Safety Authority. (2019). CAAP 166-01 v4.2 Operations in the vicinity of non-controlled aerodromes. Civil Aviation Safety Authority. https://www.casa.gov.au/sites/default/files/caap-166-01-operations-vici…

Civil Aviation Safety Authority. (2021). Advisory Circular AC 91-10 v1.0 Operations in the vicinity of non-controlled aerodromes. Civil Aviation Safety Authority. https://www.casa.gov.au/sites/default/files/2021-10/advisory-circular-91-10-operations-vicinity-noncontrolled-aerodromes.pdf 

Civil Aviation Safety Authority. (2020). Part 91 (General Operating and Flight Rules) Manual of Standards. Australian Government. https://www.legislation.gov.au/Details/F2021C01308/Html/Text#_Toc90102790

Civil Aviation Safety Authority. (2023). Visual Flight Rules Guide. Civil Aviation Safety Authority. Visual Flight Rules Guide | Civil Aviation Safety Authority (casa.gov.au)

Hobbs, A. (1991). Limitations of the See-and-Avoid Principle. Australian Transport Safety Bureau. /publications/1991/limit_see_avoid/  

Reynolds, R., & Blickensderfer, E. (2009). Crew Resource Management and Shared Mental Models: A Proposal. Journal of Aviation/Aerospace Education & Research, 19(1), 15-24. https://doi.org/10.15394/jaaer.2009.1380

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew of VH-ZLV
• the pilot of VH-WXB
• the aircraft operators
• the Civil Aviation Safety Authority

Submissions were received from:

• the pilot in command of VH-ZLV
• the Civil Aviation Safety Authority
• Regional Express Pty Ltd

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Separation and TCAS events within the circuit area at Wellcamp and Toowoomba

Source: ATSB

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1]     Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances, such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.

[2]     Instrument flight rules (IFR): a set of regulations that permit the pilot to operate an aircraft in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR).

[3]     Brisbane Centre is one of 2 major centres – the other being in Melbourne. From Brisbane Centre, Airservices manages the airspace over the northern half of Australia, representing around 5% of the world’s total airspace. Brisbane Centre’s flight information region (FIR) neighbours include Indonesia, East Timor, Papua New Guinea, Fiji, New Zealand, and the USA.

[4]     A common traffic advisory frequency (CTAF): a designated frequency on which pilots make positional broadcasts when operating in the vicinity of a non-controlled airport or within a broadcast area.

[5]     A waypoint is a specified geographical location used to define an area navigation route or the flight path of an aircraft employing area navigation.

[6]     Touch-and-go landing: a procedure whereby an aircraft lands and takes off without coming to a stop.

[7]     Sequence numbers specify the landing sequence position of an aircraft with respect to any preceding traffic.

[8]     Traffic alert and collision avoidance system (TCAS): a type of airborne collision avoidance system (ACAS).

[9]     Traffic advisory (TA): an alert issued by an airborne collision avoidance system (ACAS) when the detected traffic may result in a conflict. Pilots are expected to initiate a visual search for the traffic causing the TA.

[10]    Resolution advisory (RA): a manoeuvre, or a manoeuvre restriction, calculated by an airborne collision avoidance system (ACAS) to avoid a collision. Pilots are expected to respond immediately to an RA unless doing so would jeopardize the safe operation of the flight.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• aircraft operator
• aircraft manufacturer
• engine manufacturer.

References

Cessna Aircraft Company, Model 441 Maintenance Manual, chapter 71-00-03, 3 September 1984.

Garrett Airesearch, Maintenance Manual TPE331-8/-9, chapter 79-10-01, 31 July 1984.

Submissions

Submissions were received from:

• the aircraft operator
• the engine manufacturer.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On the afternoon of 25 October 2021, a Boeing 737 aircraft, registered VH‑VZT and operated by Qantas, was being prepared for a passenger air transport flight from Perth, Western Australia to Adelaide, South Australia. During a routine external aircraft check (‘walk-around’), the captain identified the presence of frost on the wings, resulting from cold fuel from the previous flight in the main tanks located in the wings and presenting a safety risk. To remove the frost, the cold fuel was transferred from the main (wing) tanks to the centre tank, and the main tanks were filled with warmer fuel via refuelling.

Just after reaching the assigned cruise altitude, the flight crew completed a routine procedure to switch the centre tank fuel pumps off and the aircraft began to use main tank fuel. At about 1749 a fuel imbalance alert was displayed, indicating unequal fuel quantities in each main tank. While actioning relevant checklists the flight crew diagnosed the reason for the unequal fuel quantities was a fuel leak and shut down the left engine. The flight diverted to Kalgoorlie, Western Australia where the aircraft landed without incident. Post-flight inspections determined that there was no fuel leak and that the fuel system was serviceable.

What the ATSB found

The licensed aircraft maintenance engineer (LAME) directed the flight crew on the fuel transfer from memory. The procedures required the crossfeed valve to be closed when the operation was completed, however, the valve was not closed. This was likely associated with the crew following the LAME’s instructions rather than referring to the relevant procedure. While this is permissible, referring to procedures is a more reliable method to ensure all steps are carried out.

During pre-flight checks, and later during the climb and level-off, the flight crew did not notice the crossfeed selector in the open position or the associated dimmed blue indicator light on the fuel panel. In flight, after the centre tank fuel pumps were switched off, fuel had been continually pumped from the left main tank to the right engine via the open crossfeed valve as the result of uneven fuel pump pressures. Although the aircraft’s manuals stated that this could occur when the crossfeed valve was open in flight and lead to a fuel imbalance, the flight crew did not recall this at the time. In addition, the Boeing 737 IMBAL (imbalance) checklist did not provide sufficient guidance for a flight crew to identify an open crossfeed valve as being a potential reason for a fuel imbalance. Consequently, the flight crew decided that there could be a fuel leak.

Partly as a result of confirmation bias, stress and perceived time pressure with the aircraft approaching an overwater segment of the flight, the flight crew abbreviated the relevant checklists. Flight crew actions when completing the Fuel leak engine checklist resulted in them mistakenly confirming the presence of a fuel leak, but unknown to the flight crew at the time, the method used to determine the presence of a fuel leak was invalid due to a step being inadvertently performed out of sequence.

As a result, the crew unnecessarily shut down an engine during flight.

What has been done as a result

Following the occurrence, Qantas communicated the factors involved to 737 flight crews.

Safety message

Checklists are designed to minimise performance variability under workload and stress, and thereby increase the likelihood that all required actions are successfully carried out. The importance of precision when following checklists, especially when under stress and time pressure, is highlighted by this occurrence.

The investigation

The occurrence

Pre-flight activities

On the afternoon of 25 October 2021, a Boeing 737-838 aircraft, registered VH‑VZT and operated by Qantas, was being prepared for a passenger air transport flight from Perth, Western Australia to Adelaide, South Australia.

The first officer (FO), who was undergoing line training,[1] was assigned the pilot flying role and the captain (a check and training captain) was the pilot monitoring.[2] The captain was responsible for the external aircraft check (‘walk-around’), and the FO had responsibility for conducting the flight deck pre-flight procedure.[3]

The captain made their way to the apron for the walk-around at about 1627, and at the same time the refueller positioned their vehicle at the aircraft to commence refuelling.[4] During the walk‑around, the captain saw extensive cold soaked fuel frost[5] (CSFF) on the lower surfaces of both wings, which had formed after the previous flight (see Cold soaked fuel frost).

At the completion of the walk-around, the captain located the licenced aircraft maintenance engineer (LAME) responsible for the aircraft’s line certification and maintenance. They discussed the presence of CSFF, and noted that the temperature of the fuel onboard was -4° C (there was 4.2 tonnes of fuel remaining after the previous flight, with 2.1 tonnes in each of the 2 main, or wing, tanks). The LAME suggested conducting a ground transfer of fuel to attempt to remove the CSFF, to which the captain agreed. This process transfers cooler fuel from the 2 main tanks to the centre tank, making room in the main tanks to receive warmer fuel when the aircraft is refuelled to melt the CSFF. At about 1631, the captain returned on board the aircraft. The captain recalled that after boarding the aircraft they went to the washroom, and then returned to the flight deck.

Ground transfer of fuel

The following sequence of events was reconstructed mainly from CCTV recordings and interviews with the flight crew and LAME. The cockpit voice recorder (CVR) data was later overwritten, and the other on-board recorders did not contain data relevant to this period.

The FO recalled that the fuel transfer began with the captain on the flight deck, after the captain returned from the walk-around, and that the captain mentioned the presence of CSFF. However, the captain recalled that a fuel transfer (to remove the CSFF) was underway when they returned to the flight deck.

At about 1631, the LAME placed an access stand (moveable ladder/platform) under the fuelling station located near the leading edge of the right wing. About this time, the LAME asked the refueller to delay the fuelling to allow for the fuel transfer to be conducted. The LAME then opened the defuel panel (located next to the fuelling station) and opened the manual defueling valve.

Based on the CCTV recording, the LAME got the flight crew’s attention at about 1633. The LAME recalled instructing the FO to switch on all the main tank fuel pumps and to open the crossfeed valve. The FO recalled that both flight crew heard this over the flight deck speakers. The FO recalled complying with the LAME’s verbal instructions (without referring to the written procedures) by reconfiguring the forward overhead fuel panel, under the captain’s supervision. As stated previously, the captain recalled returning to the flight deck after the fuel transfer was begun.

The CCTV showed the LAME returning to the right wing and accessing the defuel panel at about 1634. The LAME recalled that they opened the centre tank fuelling valve switch, and monitored the fuel transfer via the tank quantity gauges on the fuelling panel.

Between 1637:02 and 1637:22, the LAME inspected the right and left lower wing surfaces, then returned to monitor the fuel transfer. Because of fuel pump operating limitations, this allowed for 1 tonne of fuel to be safely transferred to the centre tank from the main tanks. The LAME recalled assessing that, based on the planned uplift of fuel, moving 500 kg of fuel out of each main tank into the centre tank would not be sufficient to allow enough warmer fuel to be uplifted to melt the CSFF.

The planned total amount of fuel for the next flight was 8.6 tonnes (requiring 4.4 tonnes to be uplifted by the refueler). The LAME recalled they contacted the flight crew 3 times to request an increase to the fuel order and that their requests were not accepted until the third time.[6] According to the LAME, shortly after this they saw that the fuel was pumping out of the right tank faster than the left tank and instructed the FO to turn off the right main tank fuel pumps.

The FO recalled only one discussion about an increase to fuel and that the captain was present at the time. The captain recalled one discussion during which the LAME advised that a patch of CSFF remained on one of the wings and recommended adding extra fuel to melt it.

Ultimately the captain requested an additional 1 tonne of fuel be uplifted. The LAME recalled that not long after this, they instructed a flight crew member to switch off the left main fuel pumps and to close the crossfeed valve. The LAME could not recall with certainty who they spoke to but believed it was the FO. The FO did not recall hearing back from the LAME regarding the completion of the fuel transfer.

The Before start checklist required the crew to ensure the fuel pumps were on, the switches for which were on the same overhead panel as the crossfeed selector. As the FO was undergoing line training, the captain scanned the overhead panel. They recalled looking at the fuel pump switches but not the crossfeed selector. Additionally, they did not notice the dimmed[7] blue light located on the overhead fuel panel which indicated the crossfeed valve was open. The captain stated glare from the sun may have hindered their ability to notice the dimmed light.

Preparation for pushback and taxi

At 1638:39, upon completion of the fuel transfer, the LAME closed the defuel valve and the defuel panel. The LAME recalled advising the refueller of the revised fuel order and that fuelling could commence, and removed the access stand clear of the aircraft.

Fuelling was completed at 1648. Both flight crew recalled the flight deck fuel indications showing 9.6 tonnes, and the captain observed the fuel distribution between the centre and main fuel tanks was as expected. The FO did not recall any communication with the LAME about the crossfeed valve at this time. The FO recalled the captain requesting all fuel pumps be turned on and interpreted this to be the end of the fuel transfer procedure but could not recall the fuel crossfeed valve position. Furthermore, the FO did not recall a discussion that the frost had been removed from the aircraft wings.

After the passengers were on board, the flight crew conducted the before start procedure and at 1702 the aircraft was pushed back from the bay and commenced taxi to the runway for take-off. At this time, the fuel quantity in each main tank was approximately equal.

Commencement of imbalance

The aircraft took off from Perth at 1711, and by 1731 had reached the cruising altitude of 39,000 ft. At 1733, the annunciator light FUEL illuminated. Both flight crew recalled looking at the overhead fuel control panel and as they expected at this point in the flight,[8] observing both centre tank fuel pump LOW PRESSURE amber lights illuminated (which can indicate low fuel in that tank). After confirmation by the FO, the captain selected both centre tank fuel pumps off. Neither flight crew recalled observing any other light illuminated on the fuel panel.

At about this time, the captain made a mental calculation adding the quantity of fuel used to the current fuel quantity remaining in each main tank and confirmed the total was equal to the departure fuel quantity.

Recorded data indicated that the fuel quantities in the left and right fuel tanks began to differ at this time, as the fuel used by the engines was mostly drawn from the left fuel tank (see Operation with the fuel pumps on and crossfeed valve open). The rate of fuel imbalance change over the next 35 minutes averaged about 1,700 kg/h, with significantly more fuel being used from the left fuel tank than the right throughout this period. Fuel flow to each engine was approximately equal throughout the flight until the left engine was later shut down.

At about 1748, an amber fuel IMBAL (imbalance) alert appeared on the upper display unit in the centre of the instrument panel. This alert is triggered when the difference in fuel quantity between the main tanks is more than 453 kg for at least 60 seconds and is not associated with an audible indication or master caution.

Identification of imbalance and conduct of relevant checklists

The following events are mainly based on the flight crew recollections, and it was not possible to determine their actual sequence.

When the flight crew noticed the IMBAL alert, they looked at the fuel control panel and confirmed that the main fuel tank pumps were all on.

At 1753, the FO wrote down the left and right fuel tank quantities and the current time. The captain recalled that this was done when they saw the IMBAL alert. The quantities were consistent with the recorded data at this time, and the fuel imbalance (difference between the quantities) was 630 kg.

More than half of the aircraft’s planned flight path to Adelaide was over water, and the latter half would be at night. The captain reported feeling time pressure to determine the most appropriate actions as the aircraft approached the coastline; at this time the aircraft was less than 15 minutes from crossing it. The FO reported experiencing elevated stress with the increasing workload and recalled becoming focused more on flying the aircraft.

The flight crew initiated the quick reference handbook (QRH) IMBAL (fuel imbalance) non-normal checklist (NNC) with the captain (as pilot monitoring) referring to the physical book on the flight deck (see Fuel imbalance and engine fuel leak checklists for the content of the relevant checklists). Step 3 of the IMBAL checklist stated that a fuel leak should be suspected if the total fuel remaining is less than planned, or if an engine has excessive fuel flow. If a fuel leak was suspected, the checklist directed flight crews to the Fuel leak engine checklist.

The captain saw the fuel quantity indication for the left tank reduce at a high rate and thought that there must be a fuel leak. The captain also confirmed around this time that other engine and fuel indications appeared normal.

While neither criterion had been met, the flight crew agreed that a fuel leak was suspected and commenced the Fuel leak engine checklist. Step 3 of this checklist required the flight crew to confirm that the crossfeed selector was closed (or close it). According to the captain’s recollection, while actioning the checklist, the captain identified that the crossfeed valve switch was in the open position and moved it to the closed position. At the time, neither pilot recalled that flight with the crossfeed valve open would lead to a progressive fuel imbalance (see Aircraft fuel system). With the crossfeed valve closed, each engine would draw fuel only from the same-side tank.

Step 5 of the Fuel leak engine checklist required the flight crew to record the main tank fuel quantities and the current time. Step 6 of the checklist stated that a fuel leak is ‘confirmed’ if:

• fuel spray is observed from an engine or strut, or
• if there is a change in fuel imbalance of 230 kg within 30 minutes or less (equivalent to 460 kg/h).

The captain contacted the cabin service manager (CSM) and requested they look out a rear cabin window for signs of a fuel leak. The CSM advised the captain they could not see any indication of a fuel leak.

The FO recalled checking the fuel imbalance again about 2 minutes after writing the quantities down, showing an increase in imbalance greater than 230 kg per 30 minutes, although the exact time at which this assessment was done could not be established. The actual imbalance increased by 230 kg within 10 minutes. Within the limitations of the recorded data,[9] the average imbalance rate appeared lowest from about 1753–1755, at about 225 kg/h.

Aware of the risk of commencing the overwater section of the flight with an apparent fuel leak and likely imminent engine shutdown, the flight crew considered diversion options, which included Perth and Kalgoorlie-Boulder, Western Australia. Accordingly, the flight crew prepared for a diversion to Perth.

Diversion, engine shutdown and landing

At 1800, the flight crew advised air traffic control of their intention to return to Perth and commenced a turn at 1801. The flight crew then discussed Kalgoorlie-Boulder Airport was closer and had fire services available. At 1805 the flight crew declared a PAN[10] and prepared for a landing at Kalgoorlie-Boulder Airport, commencing descent at 1806.

Continuing the Fuel leak engine checklist, and having considered the rapid reduction of fuel in the left tank being indicative of a fuel leak, the flight crew shut down the left engine at 1806:58. At this time there was about 6,423 kg of fuel on board, including about 3,701 kg in the right tank. The checklist did not require the crossfeed valve to be reopened unless there was a Fuel LOW alert. At 1807:41 the flight crew started the auxiliary power unit (APU) in accordance with the Fuel leak engine checklist. The APU, which draws fuel from the left main tank, consumed about 34 kg over the remainder of the flight.

From about 1808 to 1812, the fuel quantity in the left main tank was steady. From 1812 to the end of the flight, the fuel quantity in each main tank decreased at an almost equal rate (indicating that the crossfeed valve was open during this period).

The aircraft landed at Kalgoorlie-Boulder Airport on runway 29, coming to a stop on the runway at 1852 with about 5,357 kg of fuel remaining on board, including 3,225 kg in the right tank. The flight crew then made an alert announcement to the cabin. The left engine was inspected and declared safe by the Aviation Rescue Fire Fighting Service (ARFFS), and the cabin alert was cancelled. The aircraft was then taxied to the bay and the passengers were disembarked.

The aircraft was inspected and tested at Kalgoorlie by aircraft maintenance engineers. They determined that:

• there were no fuel leaks or other relevant unserviceabilities
• when tested, the fuel used by both engines was within normal limits
• the fuel quantities in each tank after landing (2.05 tonnes in the left main tank and 3.18 tonnes in the right main tank) met the criteria for a fuel imbalance.[11]

After receiving information from the flight crew, the operator concluded that the crossfeed valve had likely been open during the occurrence flight, and this led to the fuel imbalance (see Operation with the fuel pumps on and crossfeed valve open). The aircraft was then returned to service.

Context

Personnel information

Captain

The captain held an Air Transport Pilot (Aeroplane) Licence (ATPL) and was appropriately qualified and authorised to conduct the flight. The captain had almost 12,000 hours total flying experience with over 5,000 hours on 737 variants. The captain was a check and training pilot for the operator and had flown about 110 hours in the previous 90 days.

As a result of the Qantas response measures to COVID-19[12], the captain was stood down from mid-April 2020 until 23 September 2020. Upon completion of simulator training, they returned to flying duties at the end of September 2020. Although the captain remained stood up after that time, their monthly rostered flying hours were lower than was usual prior to the pandemic. In the 12 months prior to the event, they flew 40% of the hours they had flown in the 12 months prior to stand down. In the 3 months immediately prior to the event flight, their monthly average flying hours were roughly half their pre-pandemic average. The captain reported that while being comfortable to fly, because of the stand down and reduced flying hours, they noted a degradation in their skills.

First officer

The FO held a Commercial Pilot (Aeroplane) Licence and was appropriately qualified and authorised to conduct the flight. The FO had about 1800 hours total flying experience and about 110 hours on the 737. The FO had flown about 24 hours in the previous 90 days. The FO was undergoing line training and was qualified to act as a first officer on revenue flights alongside a check and training captain.

The FO joined Qantas as a second officer on the Boeing 787 fleet. In 2019 they commenced FO promotion and 737 type rating training, however soon after this was delayed. The FO’s training recommenced in May 2021. As a result of Qantas’ COVID-19 response measures, the FO was stood down between September and October 2021, re-commencing flying duties mid-October 2021.

Licenced aircraft maintenance engineer

The LAME was employed by Qantas, and the holder of an Australian Aircraft Maintenance Engineers Licence. The LAME’s licence was appropriately endorsed, and they were authorised to conduct maintenance on Boeing 737-838 aircraft in the Qantas fleet.

Recorded data

Flight data (Figure 1) showed that after the fuel in the centre tank had been consumed, an imbalance between the left and right main fuel tanks began to develop and was maintained for the remainder of the flight.

Figure 1: Fuel quantities on the occurrence flight

Image source: ATSB.

Aircraft manuals

The Boeing aircraft maintenance manual (AMM) contained procedures to carry out maintenance and testing on the aircraft. It was primarily used by maintenance personnel and generally not available to flight crews. The Qantas fuelling manual contained procedures for maintenance personnel, fuel company staff, and flight crew.

The aircraft’s flight crew operation manual (FCOM) was prepared by Boeing and reproduced by Qantas. It comprised of 2 volumes plus a quick reference handbook (QRH). Volume 1 included guidance for ground transfer of fuel. Volume 2 contained systems information.

Cold soaked fuel frost

Background

Aircraft such as the 737 typically cruise at altitudes around 40,000 ft where the outside air temperature can be as low as -57° C. On longer flights such as Australian transcontinental flights, the temperature of the fuel in the main tanks decreases considerably, a phenomenon known as cold-soaking. After a flight, the temperature of the fuel in the main tanks may be at a sufficiently low temperature such that it lowers the wing skin temperature to below the freezing point.

Between flights, if there is rain or high humidity and regardless of the ambient temperature, ice can form on the upper and lower surfaces of the cold-soaked wings and accumulate over time. This ice can be invisible to the eye (referred to as clear ice) or visible frost.

The presence of any ice or frost on the wings of an aircraft prior to flight can significantly reduce lift, and therefore compromise take-off and flight performance. The US Federal Aviation Administration (FAA) approved de-icing program update[13] stated:

For the 737, take-off is permitted with cold soaked fuel frost (CSFF) on the wings provided strict conditions are met. Outside these conditions, ice or frost formations on upper or lower wing surfaces must be removed. General guidance in the Qantas de-icing/anti-icing procedure manual stated:

Removal of cold soaked fuel frost by fuel transfer

In colder climates, frost, snow, and ice is removed with fluids applied to the aircraft with dedicated equipment. For ports where this equipment is unavailable, the cold soaked fuel can be transferred into the aircraft’s centre tank making room for the wings to be refuelled. The introduced fuel is warmer, and therefore frost and ice can be prevented or removed.

Qantas advised that fuel transfers were usually carried out by LAMEs, however during the COVID‑19 pandemic flight crew were sometimes required to carry out the flight deck actions because of quarantine requirements (keeping flight and ground crews more separate).

There were 3 documents available to Qantas staff that contained the procedural requirements to carry out a fuel transfer – the Boeing AMM used by maintenance personnel, the Qantas fuelling manual used by maintenance personnel and flight crews, and the flight crew operation manual (FCOM) used by flight crews. The procedures to transfer fuel differed, with several steps presented in a different order across the 3 documents.

Aircraft fuel system

Description and operation

The 737 fuel system (Figure 2) comprised the following major components:

• 3 fuel tanks – left and right main tanks in the wings, and a centre tank
• 2 fuel pumps for each tank
• an engine and APU fuel feed system (including a crossfeed allowing engines to be fed from any tank)
• a fuel quantity and temperature indicating system
• a refuel / defuel system.

Figure 2: Fuel system schematic

Image source: Boeing, annotated by the ATSB.

Operation with the fuel pumps on and crossfeed valve open

The description of the fuel system in Volume 1 of the FCOM stated that the fuel pumps supplied both engines from the centre tank until the centre tank quantity decreased to near zero. The fuel pumps normally then supplied the engines from their respective main tanks. The centre tank fuel pumps produced higher pressure than the main pumps to ensure that centre tank fuel was used before the main tank fuel, even with all fuel pumps in operation.

The FCOM also stated that continued flight with the crossfeed valve open would result in a progressive fuel imbalance. The 737 flight crew training manual (FCTM) stated:

…the fuel pumps in the airplane have allowable variations in output pressure. If there is a sufficient difference in pump output pressures and the crossfeed valve is opened, fuel feeds to the operating engine from the fuel tank with the highest pump output pressure. This may result in the fuel unexpectedly coming from the tank with the highest output pressure.

Fuel imbalance condition

The FCTM stated that aircraft controllability was not significantly affected by a fuel imbalance but that its structural life could be reduced by frequently operating with an out-of-limit fuel balance condition. It stated that the primary purpose of fuel balance alerts is to prevent higher fuel consumption that results from increased trim drag.

Diagnosis of a fuel imbalance condition

The FCTM stated:

The FCTM additionally stated:

On the position of the crossfeed valve after an in-flight engine shutdown, the FCTM stated:

Fuel imbalance and engine fuel leak checklists

The QRH provided instructions for abnormal situations and to where possible return the aircraft to a normal operating state. Flight crews accessed the section relevant to the abnormal situation and followed the QRH procedural steps sequentially. Decision points in the QRH procedural steps in some cases led to another QRH section depending on the nature of the abnormal situation that was being diagnosed.

The QRH IMBAL checklist is shown in Figure 3. From step 5, the checklist contained steps to verify the functionality of the crossfeed valve, rectify the imbalance if the valve is serviceable, and then close the valve.

Relevant sections of the Fuel leak engine checklist are shown in Figure 4 and Figure 5. From step 11, the checklist contained steps to shut down the affected engine, including starting the APU when available and (only when a fuel low alert is shown) opening the crossfeed selector.

Figure 3: QRH IMBAL checklist

Image source: Boeing.

Figure 4: QRH Fuel leak engine checklist (first 2 pages)

Image source: Qantas.

Figure 5: QRH Fuel leak engine checklist (remaining pages)

Image source: Qantas.

Safety analysis

Introduction

When carrying out an exterior inspection of the aircraft prior to departure, the captain observed extensive cold soaked fuel frost on the lower surface of both wings. The presence of frost is a risk to flight safety, and the captain and the attending licenced aircraft maintenance engineer agreed on removing the frost by a ground transfer of fuel. This was carried out by the engineer and the first officer (FO). Transferring fuel from the main tanks to the centre tank required the crossfeed selector (in the flight deck) to be opened to commence the transfer and closed once completed.

The procedural step to close the crossfeed valve was not carried out, and the aircraft was dispatched. This resulted in a progressive fuel imbalance, which was misdiagnosed by the flight crew as a fuel leak. As a result, the left engine was shut down in flight unnecessarily and the aircraft was diverted to Kalgoorlie-Boulder.

The analysis will examine the coordination of pre-departure fuel transfer procedures, and the flight crew’s management of the fuel imbalance.

Fuel transfer coordination

The licensed aircraft maintenance engineer (LAME), who was licenced on the aircraft type, drew on their technical knowledge of the aircraft’s systems to facilitate the fuel transfer, and the FO recalled being directed to carry out the required actions in the flight deck. It could not be established when the captain arrived on the flight deck but the captain was present later to approve the additional fuel.

The recollections of the LAME, captain and FO differed in regard to the completion of the fuel transfer. As the captain needed to authorise the change in fuel uplifted, it is likely that both flight crew were on the flight deck at the conclusion of the fuel transfer when the crossfeed valve was to be closed.

However, the procedural step to close the crossfeed valve was not carried out. This was likely associated with the FO and/or captain following the LAME’s instructions rather than referring to the relevant procedure. While this is permissible, referring to procedures is a more reliable method to ensure all steps are carried out. In any case, there was insufficient evidence to determine the reasons for the crossfeed valve not being closed.

There are numerous tasks that may be carried out without referring to a procedure. However, for tasks that are infrequently performed or that may be unfamiliar, the use of a procedure increases the likelihood they will be accomplished successfully.

Flight with open crossfeed valve

During subsequent preparations for the flight, the captain and FO did not identify that the crossfeed selector had remained in the open position, and at the time its accompanying ‘valve open’ light would be dimmed. As the fuel panel was out of the normal field of view, the selector position and indicator light would not be readily detectable.

Neither flight crew member noticed the crossfeed selector was positioned to open or the dimmed blue ‘valve open’ light immediately above it on the overhead fuel panel during the first part of the flight. There was no requirement for the selector or indicator to be checked in normal flight.

The IMBAL (imbalance) alert does not usually require immediate attention as an imbalance condition is itself a relatively minor concern, and not a strong indicator of a serious problem. It is presented as an amber warning on the fuel tank quantity indication and is not associated with an aural alert. Associated with this manner of indication, the flight crew probably did not notice the alert immediately.

Use of checklists in response to the in-flight fuel imbalance

Introduction

The correct response to an IMBAL alert is to commence the IMBAL (imbalance) checklist. The objective of this checklist was to decide if a fuel leak is suspected and, if not, balance the fuel. With a suspected fuel leak, the IMBAL checklist led to the Fuel leak engine checklist. The objective of this checklist was to confirm the existence of an engine fuel leak and either shut down the affected engine or continue with normal operations if there was no fuel leak.

The following sections discuss the flight crew’s application of these checklists and the reasons for the diversion and erroneous shutting down of the aircraft’s left engine.

Not recognising crossfeed issue when using the IMBAL (imbalance) checklist

When the imbalance alert was triggered, the flight crew commenced actioning the QRH IMBAL non-normal checklist. The IMBAL checklist stated that the alert may be caused by a fuel leak, an inoperative crossfeed valve or a fuel imbalance; it did not state that it could be the result of the crossfeed valve being open. This meant that a critical piece of information was absent from the flight crew’s awareness at the time; had they recalled this knowledge or if it had been included in the checklist as a note or step, they may have re-evaluated the possibility of a leak and continued the IMBAL checklist. This would have directed the flight crew to perform steps to verify the functionality of the crossfeed valve and then rectify the imbalance if the valve was serviceable.

Although the presence of crossfeed information probably would have led to a different outcome in this case, a fuel imbalance condition is itself usually minor and a flight crew erroneously progressing to the Fuel leak engine checklist should still usually be able to detect or rule out a more serious condition such as a fuel leak.

Misdiagnosing fuel leak

The IMBAL checklist stated that a fuel leak should be suspected if the total fuel remaining is less than planned, or if an engine has excessive fuel flow. Neither of these conditions existed, but the crew reported they felt time pressure to take action prior to the aircraft crossing the coastline.

Consequently, although there was no evidence that the remaining fuel was less than expected and no leak was visible, the flight crew formed a mental model that there was a fuel leak, originating with and/or reinforced by the rapid reduction of fuel in the left main tank. Consequently, the flight crew progressed to the Fuel leak engine checklist.

The Fuel leak engine checklist had a step to check that the crossfeed valve was closed. It was not possible to conclusively determine whether, or at what time, the flight crew did this due to the limitations of the recorded data and the flight crew’s recollections. However, until around the time the left engine was shut down, more fuel was being used from the left tank than the right. From 1753-1755, the average imbalance rate reduced to about 225 kg/h, which may indicate that the crossfeed valve may have been closed during all or part of this period. However, the imbalance continued to increase through this period, with each engine having a comparable fuel flow, and the imbalance increased again after this period. This indicates that if the crossfeed valve had been closed at about 1753 it was likely also opened again, but the evidence suggests that it was more likely than not open throughout this period. Also, fuel flow rates after this indicate that the crossfeed valve was closed at about the same time the left engine was shut down (1807), and then reopened about 4 minutes later, staying open for the rest of the flight. In either case, the step of the Fuel leak engine checklist to close the crossfeed valve (and keep it closed) was not carried out correctly. If there had been an actual leak from the left engine fuel system, having the crossfeed valve open would have resulted in a greater loss of fuel than would otherwise have occurred.

After this step, the checklist required crews to record the fuel quantities and ‘the current time’ and monitor for a change in imbalance of more than 230 kg ‘within 30 minutes or less', and to check for visual indications of fuel spray. If either or both of these conditions are met, a fuel leak was to be considered ‘confirmed’.

The relevant step in the checklist, to ‘record the main tank fuel quantities and the current time’, required that the fuel record was to be contemporaneous. However, the flight crew calculated the rate of imbalance change using the fuel quantity that was recorded prior to commencing this checklist, so it included a period of time during which the crossfeed valve was open. Therefore, the imbalance was continuing to increase because the fuel for both engines was mostly being drawn from the left fuel tank.

While it is prudent to record fuel quantities as soon as practicable after a fuel leak is suspected, the effect of changing the order of the two checklist steps was probably not apparent to the crew. The decision to use the quantity that they previously recorded was probably influenced by perceived time pressure of approaching the coastline, at night, with a suspected fuel leak. Had the flight crew recorded the fuel quantities again they would have had to wait several more minutes to assess the rate of imbalance change. Furthermore, the monitoring condition could be misread or misunderstood by a flight crew experiencing stress and time pressure.

During this period, the imbalance changed by more than 230 kg within 10 minutes. As a result, one of the conditions to confirm a fuel leak appeared to be met, but unknown to the crew at the time, was based on incorrect information as the relevant checklist was not followed precisely.

This is likely an example of confirmation bias, which is the tendency for people to seek information that confirms their hypotheses, interpret ambiguous evidence as supporting their hypotheses, and either discount or not seek information that contradicts their hypotheses (Wickens and others 2013).

Although the flight crew may have realised that the crossfeed valve had been open when they later closed the crossfeed valve, by this time they had erroneously ‘confirmed’ the presence of a fuel leak based on what information they considered at the time, and likely did not recall the systems knowledge about the effect of an open crossfeed valve and did not have enough contradictory information to question their now well-established mental model of a fuel leak, nor to question the validity of the imbalance calculation. Accordingly, the flight crew decided to follow the checklist steps that ultimately led to an engine shutdown.

With ample fuel on board for the 46-minute descent and landing, even accounting for the hypothetical potential to lose all fuel from the left main tank, in principle the flight crew now had time to reconsider the situation. However, they did not have enough information at hand to give them a compelling reason to perform a new calculation of the imbalance rate, or of the fuel remaining compared with the expected amount. Further, while it is likely that these actions would have provided correct information, it would also have contradicted the information previously used and potentially confused the flight crew further.

Stress and time pressure

Both flight crew members reported stress and time pressure with diagnosing the reason for the fuel imbalance. Research has shown that stress may result in ‘attentional narrowing’, resulting in people drawing upon fewer information sources (Staal 2004), and narrowing their perception of the most relevant or threatening cues (Burian and others 2005, Wickens and Hollands 2000).

The ability to carry out complex tasks and access working memory is impaired (Burian and others 2005). People can also act more impulsively (Dismukes and others 2007), and the capacity to retrieve information from long term memory is affected (Dismukes and others 2015). When under time pressure, trained and experienced individuals often make decisions based on their recognition of a situation rather than methodically reviewing all available options (Klein 1998).

This occurrence is an example of how stress and time pressure can affect decision-making by reducing the effective search for information and the ability to evaluate a solution. This impacted the flight crew’s ability to recall and gather information, such as checking the crossfeed selector or recalling the effect of it being open, carefully evaluating the fuel used against the expected amount.

This led to a cautious and conservative but somewhat hasty decision to suspect a fuel leak. In turn, and further associated with stress and time pressure, a step in the Fuel leak engine checklist—to record the fuel quantities at the current time—was skipped or overlooked in favour of using the fuel quantities recorded earlier. This inadvertently led to an incorrect fuel imbalance calculation and, ultimately, an unnecessary engine shutdown.

Findings

From the evidence available, the following findings are made with respect to the fuel imbalance and engine shutdown involving Boeing 737, VH-VZT, near Esperance, Western Australia, on 25 October 2021.

Contributing factors

• Under instruction from the engineer, the flight crew conducted steps to perform a ground transfer of fuel (to remove cold soaked fuel frost from the wings) without referring to the relevant procedures. Consequently, an error was made in not closing the fuel crossfeed valve before flight.
• During pre-flight checks, and later during the climb and level-off, the flight crew did not notice the crossfeed selector in the open position or the associated dimmed blue indicator light on the fuel panel.
• The Boeing 737 IMBAL (imbalance) checklist did not provide sufficient guidance for a flight crew to identify an open crossfeed valve as being a potential reason for a fuel imbalance.
• Partly as a result of confirmation bias, stress and perceived time pressure, the flight crew abbreviated the relevant checklists. As a result, the flight crew’s calculation of the rate of fuel imbalance change was invalid, and they misdiagnosed the fuel imbalance as being the result of a fuel leak, resulting in an unnecessary inflight engine shutdown.

Safety actions

Safety action by Qantas Airways

After the occurrence, Qantas communicated the factors involved to 737 flight crews.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Airservices Australia
• the flight crew and cabin crew on board VH-VZT
• the licenced aircraft maintenance engineer
• Qantas Airways Limited.

References

Burian BK, Barshi I & Dismukes K 2005, The challenge of aviation emergency and abnormal situations, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2005-213462.

Dismukes RK, Berman BA & Loukopoulos LD 2007, The limits of expertise: Rethinking pilot error and the causes of airline accidents, Ashgate Aldershot UK.

Dismukes RK, Goldsmith TE & Kochan JA 2015, Effects of acute stress on aircrew performance: Literature review and analysis of operational aspects, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2015-218930.

Klein G 1998, Sources of power: How people make decisions, Massachusetts Institute of Technology.

U.S. Department of Transportation Federal Aviation Administration 2022, Notice 8900.636 – Revised FAA-Approved Deicing Program Updates, Winter 2022–2023.

Staal MA 2004, Stress, cognition, and human performance: A literature review and conceptual framework, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2004-212824.

Wickens CD & Hollands JG 2000, Engineering psychology and human performance, 3rd edition, Prentice-Hall International Upper Saddle River, NJ.

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• flight crew of VH-VZT
• licenced aircraft maintenance engineer
• Boeing
• Qantas Airways
• Civil Aviation Safety Authority (CASA).

Submissions were received from:

• captain of VH-VZT
• licenced aircraft maintenance engineer
• Qantas Airways.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On the afternoon of 16 September 2021, a Virgin Australia Airlines Boeing 737-8FE (B737) aircraft, registered VH-YIO, was conducting a scheduled passenger service from Sydney Airport, New South Wales (NSW), to Ballina Byron Gateway Airport (Ballina Airport), NSW. At the same time, a Cessna Caravan 208 (Caravan) aircraft, registered VH-YMV, taxied for a private instrument flight rules flight from Ballina Airport to Sunshine Coast Airport, Queensland.

While the B737 was on final approach to land on runway 24, the Caravan was taxied onto the runway and a take-off was commenced towards the approaching B737. The flight crew of the B737 conducted a missed approach to avoid the Caravan, during which they received a traffic collision avoidance system traffic advisory. At the closest point of approach, the lateral separation between the 2 aircraft decreased to approximately 0.9 NM with vertical separation reducing to about

700 feet. At the time of the incident, the aircraft were operating within the airport’s broadcast area and were both receiving a surveillance flight information service (SFIS).

What the ATSB found

The ATSB’s investigation identified that the Caravan pilot had an incorrect mental model of the traffic scenario, believing the B737 would land behind them on runway 06, rather than runway 24. The Caravan pilot had been provided with traffic information by the Ballina Airport SFIS controller, but the controller had not specified the landing direction of the B737 and the pilot had not sought this information.

The scenario was further compounded by the flight crew of the B737 not hearing the initial communications from the Caravan pilot, or the SFIS controller's response, and the flight crew remained unaware of the Caravan until just prior to it entering the runway. The Caravan pilot did not see the B737 approaching from the opposite direction and took-off directly towards it, resulting in the flight crew of the B737 to conducting a missed approach. No safety alert was issued by the SFIS controller as they were concerned that doing so would result in over transmitting communications from the aircraft in conflict.  

The ATSB also found that the SFIS had been implemented in an area with known surveillance coverage limitations, resulting in the SFIS controller having no displayed positional information for the Caravan until it reached an altitude of about 1,500 feet. Consequently, the controller was solely reliant on radio communications for situation awareness during the period of conflict between the Caravan and B737, significantly reducing their ability to provide appropriate traffic and avoidance advice.

What has been done as a result

Although reportedly an outcome of a post‑implementation review, rather than a response to this occurrence, Airservices Australia (Airservices) advised that there was an intention to install additional technology to improve surveillance coverage in the vicinity of Ballina Byron Gateway Airport by March 2023, but that timeline was dependent on a number of factors.

Noting the indefinite timeframe, in order to support Airservices’ intended action, including complying with a related recommendation issued by the Civil Aviation Safety Authority in its Ballina airspace review, the ATSB issued a safety recommendation to Airservices to address this surveillance limitation in a timely manner.

Safety message

Safety around non-controlled airports is an area of focus for the ATSB and a SafetyWatch priority. Pilots can reduce the likelihood of similar incidents occurring by communicating directly with aircraft on the common traffic advisory frequency when services such as a surveillance flight information service are provided. Additionally, pilots and controllers alike should ensure critical information is communicated and understood in order to maintain the accuracy of shared mental models.

The ATSB also strongly encourages the fitment of ADS‑B transmitting, receiving and display devices as they significantly assist the identification and avoidance of conflicting traffic. The continuous positional information that ADS‑B provides can highlight a developing situation many minutes before it becomes hazardous – a significant improvement on both point‑in‑time radio traffic advice and ‘see‑and‑avoid’. The ATSB also notes that ADS‑B receivers, suitable for use on aircraft operating under both the instrument or visual flight rules, are currently available within Australia at low cost and can be used in aircraft without any additional regulatory approval or expense.

The occurrence

On the afternoon of 16 September 2021, a Virgin Australia Airlines Boeing 737-8FE (B737) aircraft, registered VH‑YIO (Figure 1), was conducting a scheduled passenger service from Sydney Airport, New South Wales (NSW), to Ballina Byron Gateway Airport (Ballina Airport), NSW. There were 2 flight crew, 4 cabin crew and 47 passengers on board. The captain was pilot flying (PF) and the first officer (FO) was pilot monitoring (PM).[1]

Figure 1: VH-YIO

Source: Supplied

At 1332:33 Eastern Standard Time,[2] when the B737 was approximately 44 NM to the south of Ballina Airport, the FO made an initial positional broadcast on the Ballina Airport common traffic advisory frequency (CTAF) [3] (see the sections titled Broadcast area and Common traffic advisory frequency). This broadcast was acknowledged by the Ballina surveillance flight information service (SFIS) controller (see the section titled Surveillance flight information service).

At 1335:15, the B737 FO made another broadcast on the Ballina CTAF advising that the aircraft was now 27 NM south of Ballina Airport and would land on runway 24 at an estimated time of 1345.

Meanwhile, the pilot of a Cessna Caravan 208 (Caravan) aircraft, registered VH-YMV prepared for a private instrument flight rules (IFR) flight from Ballina Airport to Sunshine Coast Airport, Queensland. The pilot was the only person on board and the purpose of the flight was to reposition the Caravan to the Sunshine Coast for parachute operations.

The Caravan pilot had flown a different aircraft from Sunshine Coast Airport to Ballina Airport earlier that day. On arrival at Ballina Airport, the pilot undertook a prefight inspection of VH-YMV and readied the aircraft for the flight.     

At 1338:00, the B737 FO made a further broadcast on the Ballina CTAF advising that the aircraft was now 15 NM south‑east of Ballina Airport and would be positioned for a 10 NM final to land on runway 24 at a time of 1345.

At 1341:17, the Caravan pilot made a taxi broadcast on the Ballina CTAF advising that the aircraft would depart from runway 06 for an IFR flight to the Sunshine Coast. At the time, the weather recorded by the aerodrome weather information service (AWIS) indicated a few clouds at 2,600 feet above ground level, visibility greater than 10 km and a 12-17 knot wind from a 160-170° direction. The pilot recalled listening to AWIS and noting a crosswind. Although this wind direction favoured a departure from runway 24, the pilot recalled observing the windsock, assessing it favoured a departure from runway 06, and hence electing to do so. The aircraft was parked on the general aviation apron and the pilot chose to take-off from the intersection of taxiway A and runway 06, which involved a short taxi to the hold point with no backtracking along the runway.

At 1341:27, the SFIS controller responded to the Caravan pilot’s broadcast and provided the pilot with traffic information on the B737 and a Jetstar Airbus A320 (A320), registered VH-VQK, that was also inbound to Ballina Airport (Figure 2). The SFIS controller stated:

Yankee Mike Victor squawk 4547. Traffic [is] Velocity 1141, 737, shortly turning onto a 10 NM final, followed by Jetstar 464 an Airbus 320 currently 20 NM to the south-west and they're tracking for a right downwind runway 24. They'll be crossing centreline at about time four five.

Figure 2: At 1341:51, the pilot of the Caravan advised the SFIS controller that they had copied the traffic and correctly read back the transponder squawk code. Figure 2: A320 and B737 locations at 1341:27

Source: Google Earth, annotated by the ATSB

The flight crew of the B737 did not recall hearing the Caravan pilot’s taxi broadcasts or the SFIS controller’s responses to the taxi broadcast on the CTAF and were unaware of the presence of the Caravan. The SFIS controller noted that the B737 flight crew had not responded to the Caravan pilot’s taxi broadcast but did not confirm if they were aware of the Caravan (see the section titled SFIS procedures).

The B737 continued the approach for Ballina Airport and, at 1341:57, made a left turn onto a 10 NM final for runway 24.

Meanwhile, the Caravan pilot had formed the belief that the B737 would land on runway 06 based on their earlier observation of the runway windsock. The pilot had also misunderstood the traffic information provided by the SFIS controller as meaning that the B737 was on approach for runway 06, not runway 24, and hence believed that the Caravan could depart ahead of the arriving B737 without causing a conflict. The pilot recalled conducting a visual check for traffic before entering the runway but did not see the B737 that was on final approach to land on runway 24 (see the section titled Human factors).

At 1343:28, the pilot of the Caravan made a broadcast on the CTAF stating that the aircraft was entering and rolling runway 06 (Figure 3).

Figure 3: Caravan and B737 locations at 1343:28

Source: Google Earth, annotated by the ATSB

The SFIS controller heard the Caravan pilot’s ‘entering and rolling’ broadcast and was aware of the developing conflict between the Caravan and the B737. However, the SFIS controller elected not to issue a safety alert (see section titled Safety alert).

The ‘entering and rolling’ broadcast was the first transmission the flight crew of the B737 recalled hearing from the Caravan pilot and when they first became aware of the Caravan. At 1343:36, the B737’s FO made a broadcast on the CTAF stating that the B737 was on a 5 NM final approach for runway 24. Neither the Caravan pilot nor the SFIS controller responded to this broadcast.

At about 1344:00, the Caravan pilot commenced the take-off directly towards the approaching B737.

At 1344:15, the B737’s FO made a further broadcast on the CTAF querying the Caravan’s location. At 1344:19, the Caravan’s pilot responded stating that the aircraft had just become airborne from runway 06 (Figure 4). The B737’s FO immediately replied asking if the Caravan pilot could see the B737, which was now on a 3 NM final for runway 24. At 1344:36, the Caravan pilot confirmed sighting the B737, and its FO then requested the Caravan pilot to commence a turn. The Caravan pilot did not respond to the FO’s broadcast, but the pilot did initiate a turn to the right shortly after becoming airborne.

Figure 4: Caravan and B737 locations at 1344:19

Source: Google Earth, annotated by the ATSB

At 1345:06, the captain of the B737 initiated a missed approach and, a short time later, the flight crew sighted the Caravan ahead of their aircraft, travelling in a northerly direction. During the missed approach, the flight crew received a traffic collision avoidance system[4] traffic advisory[5] generated by the Caravan’s proximity. The flight crew maintained visual contact with the Caravan and repositioned the B737 for a left circuit to land on runway 24.

A review of recorded flight data indicated that the closest point of approach occurred at 1346:12 as the lateral separation between the 2 aircraft decreased to approximately 0.9 NM with vertical separation reducing to about 700 feet (Figure 5).

Figure 5: Caravan and B737 tracks and relative distances

Source: Google Earth, annotated by the ATSB

The Caravan pilot set course north for Sunshine Coast Airport and communications with the aircraft were transferred to the Brisbane Airport approach controller at 1349:26. The B737 landed at Ballina Airport at about 1359:00.

Context

Personnel information

B737 flight crew

The captain held an air transport pilot licence (ATPL) (aeroplane) and had a total flying time of 15,719 hours, having flown 25 hours in the previous 90 days. The captain was familiar with Ballina Airport and had operated there in both turboprop and jet aircraft over a 20-year period.

The FO held an ATPL (aeroplane) and a total flying time of 8,607 hours, having flown 72.3 hours in the previous 90 days. The FO was also familiar with Ballina Airport having operated there in both turboprop and jet aircraft throughout their career. The FO’s last flight to Ballina Airport took place on 11 May 2021.

Caravan pilot

The pilot held a commercial pilot licence (aeroplane) and a total flying time of 1,008 hours, having flown 50 hours in the previous 90 days. The pilot was familiar with Ballina Airport and had last flown into the airport approximately 3 months prior to the incident flight.

Controller

The surveillance flight information service (SFIS) controller had experience in both tower and en route air traffic environments prior to commencing in the SFIS controller role. The controller was based in the Airservices Australia Brisbane Centre and had undertaken SFIS endorsement training in August 2021, before the SFIS service commenced on 12 August.  

Ballina Byron Gateway Airport

Ballina Byron Gateway Airport is situated approximately 3 NM from the city of Ballina, NSW. The airport has an elevation of 7 feet above mean sea level (AMSL) and a single sealed runway, orientated in a 062°-242° magnetic direction (Figure 6). The airport had global positioning system (GPS)‑based instrument approaches and a non-directional beacon ground-based navigation aid.

Figure 6: Ballina Byron Gateway Airport

Source: Airservices Australia

Airspace and traffic services

Ballina Airport was located within non‑controlled Class G airspace, which extended from the ground surface to 8,500 feet AMSL. The airport did not have a control tower and was not supported by an air traffic control separation or sequencing service (that is, a non-controlled airport).

Overlying the non‑controlled airspace was Class C controlled airspace which extended up to flight level (FL) 180,[6] and controlled Class A airspace above that. An air traffic information and separation service was provided within the Class C airspace and a separation service was provided within the Class A airspace. A restricted area existed approximately 5 NM south of the airport (the aircraft involved in this incident were clear of this area).[7]

The non‑controlled airspace surrounding Ballina Airport was available for use by aircraft operating under visual flight rules and instrument flight rules. The primary method of traffic separation at Ballina Airport was visual and relied on pilots using ‘alerted see-and-avoid’[8] practices.

A broadcast area (BA) was in place within an approximate radius of 15 NM from the airport and a surveillance flight information service (SFIS) was provided to aircraft operating within the BA during defined periods (see the section titled Surveillance flight information service).

Broadcast area

Surrounding Ballina Airport was a BA that mandated the carriage and use of radio equipment for aircraft operating within a radius of 15 NM of the airport, from surface level to 8,500 feet, excluding penetrating arcs of circles for Lismore Airport and Gold Coast control area steps (Figure 7).

Figure 7: Ballina Airport broadcast area

Source: Google Earth, annotated by the ATSB

The broadcast area was expanded from 10 NM to 15 NM on 28 January 2021 to ‘reduce residual airspace risk’. The expansion of the BA occurred following a separation incident involving a Jetstar A320 and a Jabiru aircraft that occurred about 13 NM from Ballina Airport on 28 November 2020 (see ATSB investigation AO-2020-062).

The broadcast area required all pilots to make mandatory positional broadcasts when entering or operating within the defined lateral and vertical limits of the BA on the Ballina Airport CTAF. Pilots were also required to acknowledge calls from aircraft departing or landing whose operations were in conflict with their own, and should announce when in receipt of a call indicating that their aircraft may be in conflict when operating outside of the circuit area.

Common traffic advisory frequency

The Ballina Airport CTAF was a designated radio frequency on which pilots made positional broadcasts when operating in the vicinity of the airport. The Ballina Airport CTAF was shared with neighbouring airports and aeroplane landing areas at Casino, Lismore and Evans Head.

A surveillance flight information service, detailed in the following section, was provided on the CTAF to aircraft operating within the Ballina Airport BA.

Surveillance flight information service

A surveillance flight information service (SFIS) was provided to aircraft operating within the Ballina Airport BA between 2200-0800 Coordinated Universal Time [9] (1 hour earlier during Eastern Daylight-saving Time[10]) or as notified by notice to airmen.

The SFIS utilised available surveillance data, and broadcasts on the airport’s CTAF, to provide all visual flight rules (VFR) and instrument flight rules (IFR) aircraft with a full traffic information and alerting service. The information provided by the SFIS controller contained advice on conflicting traffic. However, the SFIS was not a separation or sequencing service and pilots remained responsible for seeing and avoiding other aircraft.

The service was provided by a dedicated Airservices Australia air traffic controller located at the Brisbane Centre. Pilots made broadcasts and reported to the SFIS controller (callsign ‘Ballina Information’) on the Ballina Airport CTAF.

The SFIS commenced on 12 August 2021 and replaced the previously established certified air/ground radio service (CA/GRS). The CA/GRS was provided at Ballina Airport from March 2017 to the commencement of the SFIS service in August 2021 and was delivered by a certified air/ground radio operator (CA/GRO) located at the airport.

SFIS procedures

Airservices Australia procedures required the SFIS controller to communicate specific details when passing traffic information to aircraft. This information was to include the traffic’s intentions, the traffic’s reported position and estimate. The SFIS controller was also procedurally required to provide traffic information to aircraft in class G airspace when an aircraft was expected to arrive with less than 10 minutes separation time from aircraft departing from the same airport.

During this occurrence, the SFIS controller provided traffic information to the Caravan pilot that did not include the B737’s estimated landing time and runway number. The controller stated that as the pilot’s communications appeared to be ‘competent’ and ‘confident’, it had not been considered necessary to emphasise the B737’s landing direction. Similarly, when the B737’s flight crew did not respond to the Caravan pilot’s taxi broadcast, the controller did not consider it necessary to confirm they were aware of the Caravan because, according to their SFIS training, they were not required to follow-up communications for aircraft already on the CTAF (as was the case for the B737).

Safety alert

A safety alert comprises advice provided to a pilot when the SFIS controller becomes aware that an aircraft is in a position that places it in unsafe proximity to terrain, obstructions, active restricted or prohibited areas, or another aircraft. In cases where an aircraft is in close proximity to another, a safety alert should be issued by the controller unless the pilot had advised that action to resolve the situation was being taken, or the other aircraft was in sight. A safety alert could be issued in all classes of airspace both within and outside surveillance coverage.

However, on the day of the occurrence, the SFIS controller did not issue a safety alert to either the B737 or the Caravan after its pilot reported entering and rolling runway 06 although it was apparent to the controller that a conflict would result. The controller advised that their reason for not doing so was due to a concern that the alert could result in the over transmission of radio communications from either aircraft.

Technical systems

Secondary surveillance radar

Secondary surveillance radar utilises ground stations (interrogators) and transponders on board aircraft.

A transponder is a receiver/transmitter which transmits an automatic reply upon receiving an interrogation request. A manual ‘ident’ transmission can also be initiated by the pilot. The information that may be transmitted by a transponder is dependent on the ‘mode’ of equipment fitted to an aircraft:

• Mode A transponders transmit an identifying code only
• Mode C transponders transmit an identifying code and altitude (based on standard pressure)
• Mode S transponders transmit an identifying code, altitude (based on standard pressure) and permit data exchange

The signal from the transponder is received by the ground station and combined with the aircraft’s position established via radar (range and bearing). This information is then relayed to air traffic control where it is displayed on the controller’s console screen.

Automatic dependant surveillance broadcast

Automatic dependent surveillance broadcast (ADS-B) utilises electronic equipment on board an aircraft to automatically broadcast the aircraft’s precise location, and other parameters, via digital data link (ADS-B OUT). The data is then used by air traffic control and other aircraft to depict the aircraft’s position, and other information, on a display without the need for radar.

The system uses GPS data to determine the aircraft’s position then transmits the position, and other parameters (such as identity, altitude and speed), at rapid intervals. These transmissions are received by dedicated ADS-B ground stations and the information is then relayed to air traffic control and displayed on the controller’s console screen.

The transmissions can also be received by other aircraft with the capability to receive and displayed this information (ADS-B IN). Both the B737 and Caravan were fitted with ADS-B OUT equipment. Neither aircraft was fitted with ADS-B IN equipment, nor were they required to be.

Surveillance coverage

The SFIS was a surveillance-based service that utilised secondary surveillance radar (SSR) and ADS-B information, in combination with pilot broadcasts made on the CTAF, to provide pilots with traffic information and alerts.

Documents developed by Airservices Australia before implementing the Ballina Airport SFIS contained a list of ‘critical components’ necessary for the service. Although ‘adequate surveillance coverage’ was one of these critical components, Ballina Airport had no ADS-B ground station and the surrounding area had significant limitations in SSR and ADS-B coverage. Surveillance coverage charts produced by Airservices Australia indicated that, near the airport, the SSR and ADS-B coverage did not commence until about 1,500 feet above ground level (Figure 8).

Figure 8: SSR and ADS-B coverage within the vicinity of Ballina Airport

Source: Airservices Australia, annotated by the ATSB

The hazards and risks associated with the surveillance coverage limitations were identified by Airservices Australia prior to the implementation of the SFIS and documented as:

Limited surveillance coverage may lead to unintended aircraft proximity (Airprox), inadequate separation assurance (ISA), or loss of separation (LOS) occurrence.

Airservices Australia conducted a risk assessment and rated the initial risk as moderate. However, its pre-implementation risk treatment did not reduce the risk any further. Residual risks associated with the surveillance coverage limitations were formally accepted and the SFIS was implemented with the risks unaddressed. These limitations meant the Caravan’s positional information was not displayed on the SFIS controller’s console screen until it reached an altitude of about 1,500 feet, which occurred about 100 seconds after take-off was commenced.

Previous events

A search of the ATSB occurrence database found that during the period from the implementation of the SFIS (12 August 2021) to the date of the incident (16 September 2021), there was one reported occurrence and no reported separation issues within 20 NM of Ballina Airport.

Regulatory oversight

The Airspace Act 2007 assigned the administration and regulation of Australian administered airspace to the Civil Aviation Safety Authority (CASA). As part of this function, CASA was required to undertake regular reviews of airspace to determine if existing classifications were appropriate, air navigation services and facilities were suitable, there was safe, efficient, and equitable use of airspace, and identify any associated risk factors.

On 15 December 2022, CASA publicly released a final Ballina airspace review. The review identified 3 areas of concern:

• Frequency congestion
• Heightened risk of separation incidents
• Situational awareness

As a result, the review made 9 recommendations (Table 1).

Table 1: Ballina airspace review recommendations

Source: Airspace Review of Ballina – 2022 with minor amendments by the ATSB

On 16 June 2022, recommendation 1 and 2 were implemented resulting in Lismore, Casino and Evans Head being separated from the Ballina Airport CTAF. Recommendation 3 was due for implementation by April 2023 and proposed the installation of an ADS-B ground station in the vicinity of Ballina Airport to provide surveillance coverage to the runway surface.

The ATSB undertook a detailed assessment of CASA’s role in the oversight of the airspace surrounding Ballina Airport following a separation occurrence involving an Airbus A320-232 and a Jabiru that took place on 28 November 2020 (see investigation AO-2020-062).

Human factors

The ATSB investigation considered a range of human factors that could have influenced the decisions and actions of the pilots and controller involved. No indicators that increased the risk of any of the individuals experiencing a level of fatigue known to influence performance were found. The following factors, however, were found to have possibly had an influence:

• shared mental models
• situation awareness
• confirmation bias

Mental models

According to Methieu et al (2000), mental models are internally organised knowledge structures that allow individuals to understand and interact with their environment. Mental models are said to be ‘shared’ when the models of individuals overlap – the greater the overlap the greater the similarity of understanding.

In scenarios involving the movement of aircraft within the airspace system, it is anticipated that pilots and air traffic controllers will have a high degree of shared mental model overlap. However, when communication is ineffective, and critical information and assumptions are not shared, the degree of shared mental model overlap is decreased, coordinated decision making is degraded, and safety defences are eroded (Bearman et al 2010).

The mismatch of mental models was evident in the lead up to this incident. Critical traffic information and assumptions were not shared between the SFIS controller, the Caravan pilot, and the B737 flight crew. This resulted in each party holding a different mental model of the traffic scenario.

Situation awareness

Situation awareness (SA) is best conceptualised as a 3-stage process:

1. task related features or cues are acquired and interpreted by the individual
2. information is integrated and comprehended within the context of the task to derive meaning for the individual
3. the individual anticipates the future state of the system (Wiggins 2022)

The accuracy of an individual’s SA directly influences their decisions.

The SFIS controller, the Caravan pilot and the B737 flight crew all held incomplete information on the traffic scenario and the intended actions of the others involved. As a result, their capacity to accurately predict the future traffic state was compromised and their decision-making impacted accordingly.

Confirmation bias

Confirmation bias involves an individual seeking out information that confirms an assumption and rejecting, ignoring, or explaining away information that conflicts with the held assumption (Wiggins 2022). Based primarily on their assessment of the windsock, the Caravan’s pilot incorrectly believed that the B737 was on final approach for runway 06 and not runway 24. It is therefore possible that the pilot’s confirmation bias influenced the visual check before entering the runway with the B737 on final approach from the opposite direction going undetected.

Safety analysis

The incident

On 16 September 2021, a Boeing 737, VH-YIO (B737), was approaching runway 24 to land at Ballina Byron Gateway Airport when a Cessna Caravan 208, VH-YMV (Caravan), commenced a take-off on the reciprocal runway. The B737’s flight crew conducted a missed approach during which the lateral separation between the 2 aircraft decreased to approximately 0.9 NM with vertical separation reducing to about 700 feet. At the time of the incident, the aircraft were operating within the airport’s broadcast area, and both were receiving the associated surveillance flight information service (SFIS).

Communications

The SFIS controller had not included the B737’s estimated time of landing and runway direction when providing traffic information to the Caravan pilot. In addition, the Caravan pilot had formed the belief that the B737 would land on runway 06 (based on observing the runway windsock), and then interpreted the traffic information provided by the controller incorrectly as it confirmed their incorrect mental model. The pilot did not seek to validate this assumption by communicating directly with the B737’s flight crew or by querying the information provided by the controller.

The scenario was further compounded by the B737’s flight crew not hearing the Caravan’s taxi broadcasts or the SFIS controller’s responses. Those taxi transmissions commenced 40 seconds before the B737 turned onto final approach for runway 24. The ATSB was not able to determine why the flight crew did not hear the exchange. In any case, they were not aware of the Caravan until the ‘entering and rolling’ broadcast made by its pilot.

The SFIS controller knew the B737’s flight crew had not acknowledged the Caravan pilot’s taxi broadcast but recalled from SFIS training that follow-up communications were not necessary for aircraft already on the common traffic advisory frequency (CTAF). Consequently, the controller decided not to confirm that the flight crew were aware of the Caravan, and an opportunity to address the evolving situation was missed. This resulted in the B737’s flight crew remaining unaware of the Caravan and the latter’s pilot continued to incorrectly believe the B737 would land in the opposite direction.

The Caravan pilot’s incorrect mental model also led them to believe the Caravan could take-off ahead of the landing B737, using runway 06, without any conflict. The pilot recalled conducting a visual check prior to entering the runway; however, their likely confirmation bias and reduced situation awareness possibly resulted in not sighting the approaching B737. Consequently, the Caravan was taxied onto the runway and a take-off commenced directly towards the B737.

Safety alert

The SFIS controller recognised the impending conflict between the two aircraft after hearing the Caravan pilot’s ‘entering and rolling’ broadcast but decided not to issue a safety alert because of concerns of over transmitting communications from the Caravan or the B737. However, between the ‘entering and rolling’ broadcast and confirmation that the Caravan pilot had sighted the B737, there was a total of 53 seconds during which time no transmissions were made on the CTAF. A safety alert issued during this time would probably have ensured the pilots on both aircraft were fully aware of the conflict.

Surveillance coverage limitations

Prior to the implementation of the Ballina Airport SFIS, Airservices Australia had identified a hazard associated with a critical component of the service that could lead to unintended aircraft proximity events. As the secondary surveillance radar and automatic dependent surveillance broadcast (ADS-B) coverage near the airport did not commence until about 1,500 feet above ground level, ADS-B equipped aircraft operating below this height may not be displayed on the SFIS controller’s console screen. Airservices Australia formally accepted the risk associated with the surveillance coverage limitations and the SFIS was implemented with this critical component compromised. 

The limitation in coverage resulted in the SFIS controller having no positional information on the Caravan during the period of conflict until the aircraft reached an altitude of about 1,500 feet about 100 seconds after taking off. During this period, the controller was solely reliant on radio communications for situation awareness and had reduced options for providing any avoidance advice necessitated by the situation.

The heightened risk of separation incidents in the vicinity of Ballina Airport was identified in the Civil Aviation Safety Authority’s (CASA’s) Ballina airspace review, which was published in December 2022. Recommendations contained in that review document included the installation of an automatic dependent surveillance broadcast (ADS-B) ground station in the vicinity of Ballina Airport to enable ADS-B surveillance capability to the runway surface. The review document contained 8 other recommendations designed to incrementally transition Ballina Airport to a controlled aerodrome service with an associated control zone and control area steps by 13 June 2024. Such an aerodrome control service would have prevented the traffic conflict between the B737 and the Caravan.

Both this separation occurrence and that detailed in AO-2020-062 involved high-capacity transport aircraft using the primary defence of alerted see‑and‑avoid. Noting the known limitations of this principle, and the increasing and complex mix of traffic, the ATSB considers that timely implementation of the recommendations detailed in CASA’s airspace review document would significantly improve safety at Ballina Airport.

Findings

From the evidence available, the following findings are made with respect to the separation occurrence involving Boeing 737-8FE, VH-YIO (B737) and Cessna Caravan 208, VH-YMV (Caravan) at Ballina Byron Gateway Airport, New South Wales on 16 September 2021.

Contributing factors

• Based on an assessment of the windsock only, the Caravan pilot wrongly assumed that the B737 would land behind them on runway 06 and not present a conflict for their departure. This incorrect mental model of the traffic was not corrected prior to the conflict as the surveillance flight information service controller did not specify that the B737 would land on runway 24 and the pilot did not confirm the runway direction with the controller or with the B737’s flight crew.
• The B737’s flight crew did not hear the Caravan pilot’s taxi broadcast or the surveillance flight information service controller's response, who also did not confirm if the flight crew were aware of the Caravan. Consequently, the flight crew was unaware of the Caravan until its pilot made a broadcast before entering the runway.
• The visual check by the Caravan’s pilot before entering the runway did not identify the B737 on final approach to land on runway 24, possibly due to confirmation bias and degraded situation awareness resulting from the pilot’s incorrect mental model of the traffic.
• The Caravan’s pilot commenced a take-off directly towards the approaching B737 resulting in its flight crew conducting a missed approach to avoid the Caravan.

Other factors that increased risk

• The surveillance flight information service controller did not issue a safety alert after the Caravan entered the runway and commenced taking off towards the approaching B737 due to concerns that issuing an alert would result in over transmitting communications from either aircraft.
• The surveillance flight information service (SFIS) had been implemented in an area with known surveillance coverage limitations, resulting in the SFIS controller having no displayed positional information for the Caravan until it reached an altitude of about 1,500 feet. Therefore, during the period of conflict between the Caravan and B737, the controller was solely reliant on radio communications for situation awareness, reducing their ability to provide appropriate traffic and avoidance advice. (Safety issue)

Safety issues and actions

SFIS surveillance coverage

Safety issue number: AO-2021-038-SI-01

Safety issue description: The surveillance flight information service (SFIS) had been implemented in an area with known surveillance coverage limitations, resulting in the SFIS controller having no displayed positional information for the Caravan until it reached an altitude of about 1,500 feet. Therefore, during the period of conflict between the Caravan and B737, the controller was solely reliant on radio communications for situation awareness, reducing their ability to provide appropriate traffic and avoidance advice.

Glossary

ADS-B              Automatic dependant surveillance broadcast

AMSL               Above mean sea level

ATPL                Air transport pilot licence

BA                    Broadcast area

CA/GRO           Certified air/ground radio operator

CA/GRS            Certified air/ground radio service

CTAF                Common traffic advisory frequency

FO                    First officer

GPS                 Global positioning systems

IFR                   Instrument flight rules

KM                   Kilometres

NM                   Nautical miles

NSW                 New South Wales

PF                    Pilot flying

PM                   Pilot monitoring

SA                    Situation awareness

SFIS                 Surveillance flight information service

SSR                 Secondary surveillance radar

VFR                  Visual flight rules

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew of VH-YIO and pilot of VH-YMV
• the SFIS controller
• Virgin Airlines Australia
• Avdata
• OzRunways
• Civil Aviation Safety Authority
• Airservices Australia
• Bureau of Meteorology
• Experience Co Limited

References

Wiggins M 2022, Introduction to human factors for organisational psychologists, Taylor & Francis Group, Milton

Bearman C, Paletz S, Orasanu J & Thomas M 2010, The breakdown of coordinated decision making in distributed systems, Human factors, Vol. 52, pp. 173-188

Mathieu J, Heffner T, Goodwin G, Salas E & Cannon-Bowers J 2000, The influence of shared mental models on team process and performance, Journal of applied psychology, vol 85, pp. 273

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew of VH-YIO and pilot of VH-YMV
• the SFIS controller
• Virgin Airlines Australia
• Airservices Australia
• Experience Co Limited
• Civil Aviation Safety Authority.

Submissions were received from:

• Airservices Australia
• Experience Co Limited
• Civil Aviation Safety Authority.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

On 3 September 2021, a Boeing Company 737-8FE (B737), registered VH-YIS and operated by Virgin Australia, was conducting a flight from Melbourne, Victoria, to Darwin, Northern Territory. During the pre-flight briefing, the flight crew planned the incorrect displaced threshold instrument approach into Darwin Airport. During the approach, air traffic control cleared the flight crew for a non-displaced threshold approach but the flight crew continued and conducted the pre‑planned displaced threshold approach and landing. The aircraft landed 1,153 m into the runway.

Separately, on 19 September 2021 a Boeing Company 737-81D (B737), registered VH-YFC and also operated by Virgin Australia, conducted a flight from Brisbane, Queensland to Darwin, Northern Territory. During the pre-flight briefing the flight crew similarly planned a displaced threshold approach into Darwin runway 11 instead of the non‑displaced threshold approach. The aircraft landed 932 m into the runway.

What the ATSB found

The ATSB found that the flight crew of VH-YIS misinterpreted the notice to airmen (NOTAM) information during the pre-flight briefing which led them to believe that runway 11 was displaced. As a result, they planned for the displaced threshold approach on runway 11. The flight crew continued the planned runway 11 VOR-T despite being cleared for the non‑displaced threshold runway 11 VOR-Z approach by air traffic control.

This resulted in reduced runway length being available for the landing roll. Air traffic control did not request the flight crew to correctly readback the VOR approach clearance resulting in a missed opportunity to identify the error and for the flight crew to reconsider their decision to continue the displaced threshold approach.

The flight crew of VH-YFC similarly misinterpreted the NOTAM during pre-flight briefing which led them to believe that both ends of 11/29 in Darwin were displaced. This resulted in the flight crew planning for and conducting the RWY 11 VOR-T displaced threshold approach instead of the RWY 11 VOR-Z non-displaced threshold approach.

Both flight crews misinterpreted the Darwin Airport recorded information prior to arrival, this also resulted in a missed opportunity to capture the misidentification of the displaced threshold information from the NOTAM.

What has been done as a result

After the first incident, Virgin Australia updated their Flight Crew Operational Notice to reflect that the Darwin Airport runway 11 works had been completed, and then subsequently modified it further after the second occurrence to specifically highlight the displaced thresholds.

Safety message

Operational information in a NOTAM, can have critical importance for the planning and conduct of a flight. As such, misinterpretation of this information can significantly affect flight safety.

Correct and complete readback of air traffic control clearances, are important to confirm that information has been received and understood and provide a valuable defence to detect and correct errors such as occurred during these incidents.

Finally, when there is uncertainty or ambiguity about the condition of a destination, such as a displaced threshold, flight crew are encouraged to seek clarification from air traffic control.

The investigation

The occurrence

On 3 September 2021 at about 0945 Eastern Standard Time (EST)[1] the flight crew of a Boeing Company 737-8FE (B737), registered VH-YIS (YIS) and operated by Virgin Australia, were conducting their pre-flight briefing on the flight deck in preparation for flight VA1457 from Melbourne, Victoria, to Darwin, Northern Territory. The flight crew consisted of a captain and a first officer.

The flight crew reported that they both reviewed a NOTAM[2] for Darwin (Figure 1) during the pre‑flight briefing and acknowledged to each other that there were runway works in progress that reduced the available runway length. The flight crew also reviewed the Flight Crew Operational Notice (FCON)[3] for Darwin (Figure 4). The captain commented that they were aware of the reduced runway length for Darwin and the first officer commented that they were both under the impression that runway 11 had a displaced threshold and not runway 29 as the NOTAM stated.

The flight crew received the ATIS[4] (Figure 2) during cruise and then commenced an arrival brief 30 minutes before the planned top of descent. The flight crew planned to conduct the Darwin runway 11 VOR-T instrument approach associated with a displaced runway 11 threshold (Figure 7) and they calculated the landing distance based on that displacement.

At 1436 Central Standard Time (CST)[5] air traffic control instructed VA1457 to descend to 9,000 ft and they were subsequently cleared for the runway 11 VOR-Z instrument approach (Figure 6).The flight crew, cognisant that they had planned for the VOR-T in expectation of a runway 11 displaced threshold, discussed with each other that air traffic control had cleared them for the VOR-Z approach. The flight crew, believing that the VOR-T was safe and appropriate, elected to continue and not conduct the VOR-Z approach in accordance with their clearance.

The aircraft touched down 1,153 m into the runway and the aircraft decelerated to a stop before the displaced threshold cones that were present at the 29 displaced threshold. The aircraft backtracked on the runway and taxied to the terminal. Having recognised the error, the flight crew reported their misinterpretation of the displaced threshold to Virgin Australia.

On 19 September 2021, the flight crew of a Boeing Company 737-81D (B737), registered VH-YFC (YFC) and also operated by Virgin Australia, were conducting their pre-flight briefing for flight VA449 from Brisbane, Queensland to Darwin, Northern Territory. The flight crew consisted of a captain and a first officer.

During the pre-flight briefing, the flight crew reviewed the NOTAM (Figure 1) and the company supplied briefing pack. The captain commented that they believed the NOTAM and FCON were ambiguous regarding the displaced runway threshold and expected to acquire more information in flight when they received the ATIS (Figure 3). The flight departed at 0944 EST.

Prior to the top of descent into Darwin, the flight crew received the ATIS and commenced their arrival brief. They discussed that there was no information on the ATIS broadcast regarding displaced thresholds, and decided to conduct the displaced threshold VOR-T approach just in case the threshold was displaced. The flight crew also commented that if the PAPI[6] was operating that it would read high while on approach to runway 11.

The flight crew conducted the Darwin runway 11 VOR-T approach and touched down 932 m down the runway, decelerated, and proceeded to the terminal. During the taxi to the terminal, the captain noted the displaced threshold cones at the 29 end of the runway and realised that a misinterpretation of the NOTAM had occurred. The flight crew reported the occurrence to Virgin Australia.

Context

Information available to flight crew

Both flight crews conducted a briefing prior to dispatch from their departure airports. The information included in these briefings was provided to them by Virgin Australia in the FCON and in a pilot briefing pack that was prepared for each flight. The briefing packs contained information such as the flight plan, weather, and fuel requirements. They also contained the NOTAMs of the departure and destination airports, as well as information on en-route airports, in case a diversion was required. The briefing pack provided to the crew of YFC included a note from the Virgin Australia dispatcher indicating that Darwin runway 29 has a displaced threshold.

Notice to airmen

For both occurrences, information related to displaced thresholds in the Darwin NOTAM (Figure 1) was the same. The NOTAM stated that runway 29 had a displaced threshold of 765 m due to works in progress and that the eastern end of runway 11/29 was not available due to the works. The NOTAM also stated that the landing distance available on runway 11, with the runway 29 threshold displaced, was 2,670 m.

Figure 1: Darwin NOTAM, current at the time of both occurrences

Source: Virgin Australia, annotated by ATSB

The captain of YIS stated that when they reviewed the NOTAM during the pre-flight briefing the reduced length of the runway was all that they comprehended. The captain did not review the NOTAM again until after the occurrence. The first officer reviewed the NOTAM twice before departure, once at home and once during the pre-flight briefing with the captain. The first officer stated that, after the pre-flight briefing, they were both under the impression that the threshold of runway 11 was displaced.

The captain of YFC recalled that, after reviewing all the available information during the pre-flight briefing, their interpretation was that both thresholds of runway 11/29 were displaced. The captain stated that the 11 VOR-T was planned with an expectation to gather further information regarding the displaced thresholds when the ATIS was received in flight.

The flight crew of YIS, and the captain of YFC, recalled reviewing the NOTAM after their flights and realising that a misinterpretation of the displaced threshold had taken place.

Automatic terminal information service

In both occurrences the ATIS was received in flight via the ACARS[7] prior to the conduct of the arrival briefings. The ATIS received on 3 September (Figure 2) by the flight crew of YIS, stated that runway 11 and 36 was to be used for arrivals and departures. It also noted that runway 11 had a reduced runway length. The first officer commented that after reviewing the ATIS they conducted the arrival briefing with the impression that runway 11 had a displaced threshold rather than a section of the upwind end of the runway being unavailable.  

Figure 2: ATIS utilised by flight crew of YIS on 3 September 2022

Source: Virgin Australia, annotated by ATSB

The ATIS received on the 19 September (Figure 3) by the flight crew of YFC, stated that runway 11 was in use and that runway 11 had a reduced runway length. The captain commented that the ATIS only mentioned a reduced runway length on runway 11 and not a displaced threshold, therefore they continued with the planned runway 11 VOR-T approach. No clarification was sought from air traffic control on either occasion.

Figure 3: ATIS utilised by flight crew of YFC on the 19 September 2022

Source: Virgin Australia, annotated by ATSB

Flight Crew Operational Notice

The FCONs were provided to both flight crews as part of the flight briefing pack. On the 3 September 2021 the FCON (Figure 4) provided the following information:

• From 25 February 2021 until 30 September 2021, RWY 11/29 is undergoing works associated with upgrading the Aircraft Arrestor System.
• During works, RWY 11 threshold and RWY 29 threshold will be displaced at separate times.
• Actual date and time of works and threshold displacements will be advised by NOTAM.

The FCON also stated the specific VOR instrument approach chart to use

Figure 4: Flight Crew Operational Notice used by VH-YIS on the 3 September 2022

Source: Virgin Australia, annotated by Virgin Australia

Following the occurrence on the 3 September, the FCON (Figure 5) was updated by Virgin Australia on the 16 September with the following amendment:

• During the works RWY 29 threshold will be displaced, and runway operational length of both RWY 11 and 29 will be reduced.

Figure 5: Flight Crew Operational Notice used by VH-YFC on the 19 September 2022

Source: Virgin Australia

VOR Approaches

Darwin runway 11 had 2 published VOR procedures current at the time of the occurrences. The VOR-Z (Figure 6) and the VOR-T (Figure 7).

The VOR-Z RWY 11 approach was used when the runway did not have a displaced threshold. The aircraft was to be flown down a 3° approach path from an 8 nm final approach fix, indicated by the Maltese cross, from an altitude of 1,880 ft to a touch down point 300 m past the runway threshold.

Figure 6: VOR-Z non-displaced threshold approach

Source: Airservices Australia, annotated by ATSB

The VOR-T RWY 11 approach was to be used when the threshold was displaced 723 m due to runway works. The VOR-T placed the aircraft 130 ft higher at the final approach fix, indicated by the Maltese cross, The aircraft was to be flown down a 3° approach path from an 8 nm final approach fix altitude of 2,010 ft to a touch down past the displaced runway threshold.

Figure 7: VOR-T displaced threshold approach

Source: Airservices Australia, annotated by ATSB

Air traffic control readback requirements

Aeronautical Information Package Australia ENR 1.1-15, 2.11.2.5 stated:

The full chart title of the instrument approach procedure, as described at the top of the relevant chart, must be used in all clearances, coordination and readbacks relating to the procedure, including entry procedures. However, with the exception of circling approaches, the suffix may be omitted if there is no possibility of confusion. Where multiple approach procedures are on the same chart, only the approach procedure being conducted shall be referred to.

On the 3 September occurrence, air traffic control (ATC) cleared the crew of YIS to conduct the VOR-Z approach. The captain responded ‘cleared the 11 VOR but did not use the suffix of Zulu or Tango. ATC did not request the captain to readback the suffix.

For the 19 September occurrence, the captain reported that air traffic control only cleared YFC for the 11 VOR with no suffix. This could not be verified as the ATC recording was not available.

Recorded information

Flight parameters for the approach were recorded by both aircraft and were provided to the ATSB. This data included the:

• aircraft height above the airfield
• ground speed
• rate of descent in feet per minute
• angle of descent in degrees
• touchdown point of aircraft
• brake pressure
• engine settings.

On the 3 September 2021, the flight data indicated that:

• YIS touched down 1,153 m into the runway at a groundspeed of 139 kt
• 1.25 seconds later the auto brakes activated (1,256 m into the runway)
• 7 seconds after the touchdown, reverse thrust was selected (1,606 m into the runway)
• reverse thrust was active until a groundspeed of 43 kt
• peak manual braking occurred from a groundspeed of 37 kt to 19 kt.
• YIS turn around on the runway prior to the unusable area and taxied to the terminal

On the 19 September 2021, the flight data indicated that:

• YFC touched down 932 m into the runway at a groundspeed of 137 kt
• auto braking was active until a groundspeed of 98 kt
• reverse thrust was active until a groundspeed of 58 kt
• YFC exited via a taxiway and taxied to the terminal.

Safety analysis

Introduction

In September 2021, on 2 separate occasions, Virgin Australia flight crews planned and conducted a displaced threshold approach and landing on runway 11 at Darwin Airport. At the time of the occurrences runway 11 was not subject to a displaced threshold, although, at the opposite end on runway 29, a displaced threshold was in place due to works being undertaken.

Flight information

NOTAM information indicated that the eastern end of runway 11/29 was not available due to the works and, as a result, the threshold of runway 29 was displaced. The flight crew of YIS misinterpreted this section of the NOTAM and concluded that runway 11 had a displaced threshold and planned the VOR-T displaced threshold approach for runway 11.

The flight crew of YFC similarly misinterpreted the NOTAM, concluding that both ends of the runway were simultaneously displaced. As a result, they planned for a displaced threshold on runway 11, with an intention to await further information contained in the ATIS.  

The FCON used by the flight crew of YIS stated that the runway 11 threshold and runway 29 threshold were displaced at separate times. The FCON also directed the flight crew to refer to NOTAM information to identify which runway threshold was displaced during flight planning. The FCON detailed the correct VOR chart to use when the thresholds were displaced. The flight crew, with this information from the FCON, in conjunction with a misinterpretation of the NOTAM that runway 11 threshold was displaced, planned the runway 11 VOR-T displaced threshold approach.

An updated version of the FCON, which contained information that the threshold of runway 29 was displaced, was provided to the flight crew of YFC. As the threshold of runway 11 was not displaced at the time, the FCON did not provide any information on runway 11 other than stating that the operational length of both runway 11 and 29 was reduced. The flight crew did not identify that the reduced length of runway 11 was due to the works underway at the upwind end of the runway. As a result, the flight crew planned the displaced threshold approach to runway 11 with an intention to await the reception of the ATIS for further information.

Due to the succinct nature and purpose of an ATIS, the Darwin ATIS only referenced the runway in use at the time, which was runway 11. As runway 11 was not subject to a displaced threshold, the ATIS only informed of its reduced length.

The flight crews of YIS and YFC continued with their plan to conduct the VOR-T displaced threshold approach in both instances. The captain of YFC commented that the ATIS was expected to provide further information in flight on the status of the runway, but no further information was obtained from the ATIS. There was no attempt by the flight crews to contact ATC for clarification on either occasion.

ATC cleared the flight crew of YIS to conduct runway 11 VOR-Z, non-displaced threshold approach. This approach clearance was unexpected by the flight crew as they had planned the VOR-T displaced threshold approach. The flight crew decided to continue with their planned displaced threshold approach without advising ATC. The captain responded to ATC with ‘cleared runway 11 VOR’ but omitted the suffix ‘Zulu’.  ATC did not request the flight crew to read back the suffix as required. A readback request by ATC may have presented an opportunity for the flight crew to identify the error.

It is likely that, due to both flight crew’s initial misinterpretation of a displaced threshold from the NOTAM information, any further information that was provided by the FCON and the ATIS was viewed with a perception that the threshold of runway 11 was displaced. As a result, the flight crew of YIS did not realise the misinterpretation until ATC cleared them for the VOR-Z approach. The flight crew of YFC did not realise their misinterpretation until after landing.

Findings

From the evidence available, the following findings are made with respect to the NOTAM misinterpretations at Darwin Airport on the 3 and 19 September 2021.

Contributing factors

• The flight crew of VH-YIS misinterpreted Darwin airport information during pre-flight briefing, which resulted in them believing that the threshold of runway 11 in Darwin was displaced. This subsequently resulted in the flight crew planning for and conducting the RWY 11 VOR-T displaced threshold approach instead of the RWY 11 VOR-Z standard approach.
• The flight crew of VH-YIS continued the planned runway 11 VOR-T approach despite being cleared for the runway 11 VOR-Z approach by air traffic control. This resulted in reduced runway available for the landing roll.
• The flight crews of VH-YIS and VH-YFC misinterpreted, or did not comprehend, the information on the ATIS prior to arrival. This resulted in a missed opportunity to capture the misidentification of a displaced threshold and the continuation of the VOR-T approach.
• The flight crew of VH-YFC misinterpreted Darwin Airport information during pre-flight briefing which led them to believe that both ends of 11/29 in Darwin were displaced. This resulted in the flight crew planning for and conducting the RWY 11 VOR-T displaced threshold approach instead of the RWY 11 VOR-Z standard approach.

Other factors that increased risk

• Air traffic control did not request the flight crew of VH-YIS to fully readback their VOR approach clearance. This was a missed opportunity for the error to be identified and the flight crew to reconsider their decision to continue with the planned VOR-T approach.

Safety actions

Safety action by Virgin Australia

Following the occurrence on the 3 September 2022, Virgin Australia modified their Flight Crew Operational Notice (FCON) for Darwin Airport to remove the runway 11 displaced threshold information, and then subsequently modified the FCON further after the second occurrence to specifically highlight the displaced thresholds.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Virgin Australia
• the flight crews of VH-YFC and VH‑YIS
• RAAF air traffic control
• Airservices Australia
• Civil Aviation Safety Authority

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Virgin Australia
• the flight crews of VH-YFC and VH-YIS
• RAAF air traffic control
• Civil Aviation Safety Authority

No draft report submissions were received.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.