Overview

On the morning of 19 January 2021, the general cargo ship Trinity Bay (cover photo) grounded on Harrington Shoal in the Great Barrier Reef Marine Park mandatory pilotage area while on passage from Thursday Island in the Torres Strait to Cairns, Queensland. The ship sustained minor hull damage with no reported injuries or oil pollution. The ship was subsequently refloated on the rising tide and following an underwater inspection and change of key bridge personnel, resumed its passage to Cairns, arriving on 22 January.

Crew handover

On 1 January 2021, Trinity Bay was alongside in Cairns, Queensland, (Figure 1) undergoing a routine crew change prior to commencing a 4-week roster transporting cargo between Cairns, Horn Island, Weipa, and Thursday Island. During the 4-week roster the crew generally undertook 4 return voyages[1] and later that afternoon, the ship departed Cairns for Horn Island on the first voyage.

Figure 1: Section of chart Aus 4620 showing Trinity Bay’s ports of call

Source: Australian Hydrographic Office, annotated by the ATSB

On 12 January, Trinity Bay departed Thursday Island for Cairns to complete the second return voyage using a route plan that had been regularly used over the previous 10 years. This original route was marked on the ship’s paper charts[2] in permanent red ink (Figure 2) and was also saved and displayed on the ship’s TRANSAS electronic chart system (ECS) program.[3] On this occasion, the master also directed the ship’s watchkeeping officers to evaluate a newly created route plan for the passage by comparing the proposed new route’s waypoints and courses (printed on paper) with those of the ship’s original route being executed.

By 1800 local time on 13 January, Trinity Bay was alongside in Cairns following an uneventful passage. The ship’s officers did not identify any significant concerns with the newly created route.

Figure 2: Section of Trinity Bay's chart Aus 839 showing original routes

Source: Sea Swift, annotated by the ATSB

New passage plans

While in Cairns, the ship’s crew were occupied with cargo operations, bunkering, and planned maintenance. In preparation for the next voyage, the master loaded the newly created‑ northbound routes into the ship’s ECS but did not plot them onto the paper charts, which retained the original routes in red ink (Figure 2). At 1340 on 15 January, Trinity Bay departed Cairns for Horn Island on the third return voyage. The master’s night orders[4] stated that the new routes displayed on the ECS would not align with the original routes marked on the paper chart and that watchkeepers were to follow the new routes displayed on the ECS. The northbound passages proceeded without incident and the ship arrived in Weipa at 0020 on 18 January.

While alongside in Weipa, the master loaded the new southbound routes into the ECS in preparation for the return to Cairns. Once again, the new waypoints and routes were not plotted onto the ship’s paper charts. The ship then departed Weipa for Thursday Island, arriving at 0200 on 19 January.

Passage and grounding

Departure from Thursday Island

At 0500 on 19 January, Trinity Bay departed Thursday Island bound for Cairns using one of the newly created‑ southbound routes. By about 0530, Trinity Bay had exited port limits and entered the Great Barrier Reef and Torres Strait vessel traffic service (REEFVTS)[5] monitoring area. The ship’s entry was verbally reported by the ship’s crew to REEFVTS over very high frequency (VHF) radio in accordance with REEFVTS reporting requirements.

The master was on watch at the time of departure while the remaining crew secured the ship for sea. At about 0545, the chief mate took over as officer of the watch (OOW). The ship was on autopilot, on a heading[6] of 116° at about 11.7 knots,[7] with draughts of 3.2 m forward and 3.8 m aft. The morning was partly cloudy with visibility recorded as 6 nautical miles (miles),[8] with light winds and calm seas.

At 0545, the duty REEFVTS operator sent Trinity Bay ship encounter information (SEI)[9] via Inmarsat-C.[10] Between 0600 and 0800, the OOW made hourly entries into the bridge logbook recording the ships heading, speed, gyrocompass error, weather observations, and sea state details. They also plotted radar position fixes on the paper chart at 15 minute intervals while also monitoring the ship’s progress against the new route on the ECS. As the new route was not marked on the paper chart, the OOW’s radar fixes did not align with the original route marked in red pen (Figure 3). However, the OOW expected this (as noted in the master’s night orders) and they assessed that the passage was progressing safely with the ship on the planned track as displayed on the ECS.

At about 0715, the OOW fixed the ship’s position on the paper chart. A few minutes later, the ship passed Mid Rock, a charted rock with a depth of 4.9 m, at a distance of about 0.18 miles. This did not elicit any concern from the OOW, and the ship continued on its planned track.

At 0736, the OOW altered course in accordance with the new passage plan and route displayed on the ECS. Following the course alteration, they noted that the parallel index[11] listed in the passage plan document for the new leg (148° and 0.46 miles off Albany Rock) was incorrect and did not correspond to the planned route. Despite that, the OOW kept the ship on the route displayed on the ECS and continued with the passage.

At 0745, the OOW plotted a radar fix on the paper chart. At about the same time, they sighted Harrington Reef west cardinal mark[12] off the ship’s port bow noting that it appeared closer than they were accustomed to when using the original southbound route. They went back to the radar to verify their fix and checked the ship’s track on the ECS. The OOW noted that the planned route on the ECS was laid west of Harrington Reef cardinal mark and assessed that the passage was proceeding as planned (Figure 3).

Figure 3: Section of Aus chart 839 used on board Trinity Bay

Image of a section of paper chart Aus 839 used on board at the time of the grounding showing original passage plans marked in red ink and radar fixes made by the OOW leading up to the grounding.

Source: Sea Swift, annotated by the ATSB

At 0800, the OOW plotted another radar fix on the paper chart and visually confirmed that the Harrington Reef west cardinal mark remained on the ship’s port side (Figure 3). They verified the radar fix again and then checked the depth sounder, which indicated a depth of 17.5 m. They noted that the paper chart indicated a similar depth, and once again assessed that there was no cause for concern.

The grounding

At about 0810, the OOW noticed the ship’s bow swing sharply to port. In response, they immediately switched to manual steering and placed the wheel hard-to-starboard. As the bow continued to swing to port, the OOW checked the radar and saw that the ship’s speed had reduced from about 12.1 knots to 7.3 knots and that the depth sounder indicated a depth of about 0.63 m. As the ship’s speed continued to decrease rapidly, the OOW realised that the ship was aground (Figure 4). In response, they brought the main engine telegraph to stop and called the master on the ship’s telephone.

Figure 4: Section of chart Aus 839 showing Trinity Bay’s track

 Trinity Bay’s automatic identification system (AIS) data overlaid onto chart Aus 839.

Source: Australian Hydrographic Office, modified and annotated by the ATSB using electronically recorded data

Shipboard response

The master, who had awoken on hearing the ship’s engine pitch change, immediately went to the bridge. The master checked the ECS which showed that the ship was aground on Harrington Shoal, a charted feature with a depth of 0.9 m situated north-west of Harrington Reef (Figure 4). The master also noted that the ECS showed the route leg passing directly across Harrington Shoal. The master then checked the paper chart which confirmed that the ship’s track, projected forward from the OOW’s last two position fixes, passed directly over Harrington Shoal.

The master established that there was no immediate danger to the ship and that there were no visible signs of damage or pollution.[13]  The ship’s bow appeared to be clear of the shoal which was composed mostly of sand.

The master asked the chief engineer to commence deballasting[14] and called the ship’s designated person ashore (DPA)[15] to advise them of the grounding. At the request of the DPA, the master sounded the ship’s tanks to confirm the integrity of the hull and sounded the surrounding waters to establish depths around the ship. The DPA also instructed the master to notify REEFVTS of the situation while they notified the Australian Maritime Safety Authority (AMSA).

At 0822, the master called the duty REEFVTS operator using a mobile phone and informed them that Trinity Bay was aground on Harrington Shoal. The REEFVTS operator, who was unaware of the grounding, notified their supervisor and the regional harbour master for Cairns.

At about 0950, the second mate, positioned at the bow, advised the master that the ship appeared to be moving with the rising tide. The master used the bow thruster to confirm that the bow was moving freely and then engaged astern propulsion (about 25% of available RPM), which resulted in the ship moving astern.

The ship continued to make sternway off the shoal while the master used the bow thruster to control the ship’s head and, by 1010, Trinity Bay was clear of Harrington Shoal. At about 1035 the master anchored the ship about 2 miles to the south-south-west of the shoal, just inside the western boundary of the designated shipping area (DSA).[16]

AMSA subsequently instructed the ship manager to ensure the ship remained at anchor until a hull inspection had been completed. Trinity Bay remained at anchor overnight while the crew undertook regular soundings of the ship’s accessible double bottom and wing tanks to confirm there was no water ingress.

Hull assessment and return to Cairns

At 0710 on 20 January, a commercial dive crew arrived at the ship. An underwater inspection of the ship’s hull identified minor paint damage amidships leading aft and a fresh dent amidships on the port side. Paint was stripped on the bottom of the hull through to the end of the skeg, but the propeller and rudder were undamaged. Some dents were noted on the port bilge keel, but no cracks were detected.

At about 1230, the ship’s marine manager and marine superintendent arrived at the ship by water taxi from Horn Island after flying up from Cairns earlier that morning. The master and chief mate were stood down and the marine superintendent took over duties as master.

The marine manager quarantined the charts onboard and replaced them with a fresh set of charts with a pre-prepared passage plan for a voyage to Cairns. The replacement master completed a new passage plan document incorporating the pre-prepared passage plan and sought AMSA approval for its use.

AMSA issued a prohibition notice[17] prohibiting the use of the TRANSAS ECS for navigation. As a result, the marine manager shut down the ECS and posted a notice on the bridge advising crew of its removal from service. AMSA subsequently permitted Trinity Bay to continue the voyage subject to conditions, including the provision of status updates and damage assessments every 12 hours.

At 1829, the replacement master advised REEFVTS they had clearance to resume the voyage. At 1835, the ship weighed anchor and resumed passage for Cairns, arriving at 0645 on 22 January.
 

Trinity Bay

Trinity Bay is an 81 m,[18] general cargo vessel, built in Koje, South Korea in 1996. At the time of the grounding, the ship was owned and operated by Sea Swift as a coastal freighter operating a weekly service supplying communities around the Cape York Peninsula and Torres Strait. Trinity Bay was a domestic commercial vessel (DCV) certified by the Australian Maritime Safety Authority (AMSA) for operations in service categories 1C[19] and 2B.[20] Although certified to carry passengers,[21] the ship was primarily used to transport general cargo.

Equipment and machinery

The ship was equipped with the necessary navigational and safety equipment for a vessel of its service categories under the relevant DCV regulations and marine orders.[22]

The ship’s navigation equipment included:

• official paper nautical charts
• a radar
• an automatic identification system (AIS)
• gyrocompass
• differential global positioning systems (DGPS)[23]
• a bridge navigational watch alarm system (BNWAS)
• a TRANSAS Navigator electronic chart system (ECS) program installed on a computer[24]

The ship’s propulsion was provided by a Caterpillar 3606 engine delivering 1492 kw at 900 rpm with a service speed of 13.5 knots. The ship was not equipped with a voyage data recorder (VDR),[25] nor was it required to be.

Charts

The regulations required that Trinity Bay carry adequate and up-to-date official nautical charts for the intended voyage. At the time of the grounding, the ship’s primary means of navigation (being used to meet the chart carriage requirements of the regulations) was official paper nautical charts issued by the Australian Hydrographic Office (AHO).

Electronic chart system (ECS)

In addition to the paper charts, Trinity Bay was equipped with a TRANSAS Navigator electronic chart system (ECS) program installed on a computer on the bridge. An ECS is a navigation information system that electronically displays vessel position and relevant nautical chart data from a database, but does not meet the International Maritime Organization (IMO) requirements for an electronic chart display and information system (ECDIS).

Trinity Bay’s ECS program (called a ‘chart plotter’ by the crew) did not use official electronic navigation charts (ENCs) and could not be used to meet the chart carriage requirements of the regulations.[26] The software and hardware were not type approved to meet the functional requirements for ECDIS and the ECS was also not capable of performing automated route safety function checks or look‑ahead safety function checks. The ECS was listed as a navigational aid in the ship’s passage plan documents, in the operator’s fleet memos and in the safety management system (SMS), which stated:

Advantage is to be taken of all the navigational equipment with which the vessel is fitted however, electronic navigational equipment is to be utilised as navigational aids only and must not be solely relied upon.

Furthermore, in September 2020, Sea Swift issued a fleet memo reminding crews that the ECS was not an approved ECDIS, and that navigation was to be conducted on up-to-date paper charts.

Crew

Trinity Bay was crewed by 9 crew as required by the vessel’s SMS and the ship’s certificate of operation. The ship’s complement comprised 4 deck crew, 3 deck watchkeeping officers (a master and 2 mates) and 2 engineers (a chief engineer and second engineer). The ship’s crew operated on a 4-week roster, and most had sailed together on the ship for several years.

The master had about 42 years of seagoing experience and held a valid Australian master’s certificate of competency (Master <80m NC). [27] The master had 30 years of experience in command of vessels operating in the Great Barrier Reef, of which 13 years was on Trinity Bay. The master was also approved to act as master of vessels (including Trinity Bay) that were exempt from the Torres Strait and Great Barrier Reef compulsory pilotage requirements. As master of Trinity Bay, they generally completed 48 transits of the inner route and Torres Strait pilotage areas annually.

The chief mate had about 11 years of seagoing experience and held a valid Australian chief mate’s certificate of competency (Mate <80m NC)[28] acquired in December 2018. The chief mate commenced employment with Sea Swift in late 2017 as a deckhand and was promoted to second mate shortly after obtaining their mate’s qualifications. They were subsequently promoted to chief mate and had about 12 months’ experience in the rank. The chief mate was approved to act as a navigational watchkeeper on vessels exempt from the compulsory pilotage requirements.

Operations

During a typical 4-week roster, the crew would generally undertake 4 return voyages, routinely departing Cairns on a Friday afternoon, calling at Horn Island, Weipa and Thursday Island before returning to Cairns the following Wednesday.

Trinity Bay had been operating to the same ports of call for about 10 years utilising the same routes that were marked in permanent red ink on paper charts (Figure 2) and saved on the ECS. Both northbound and southbound routes between Cairns and Thursday Island were generally laid outside of the two-way route between the mainland and Harrington Reef, to avoid larger shipping traffic.

Bridge watchkeeping

Trinity Bay’s deck officers maintained a traditional 4-on 8-off watchkeeping schedule at sea although the master tended to keep watch for the first 6 hours after departure and the last 6 hours before arrival at ports to ensure rest hour requirements were complied with. During daylight hours, the officer of the watch (OOW) was the sole watchkeeper with an additional lookout (usually a deckhand) posted in hours of darkness. The vessel maintained a fatigue management log and recorded crew hours of rest in accordance with the vessel’s certificate of operation and STCW guidelines. Based on the available evidence, it was considered unlikely that levels of fatigue likely to influence performance were experienced by either the master (during the passage planning) or by the OOW (at the time of the grounding).

Safety management system

Trinity Bay operated under Sea Swift’s safety management system (SMS) as required by the relevant marine orders,[29] and the International Safety Management (ISM) Code.[30] The SMS included procedures for voyage planning, internal audits and management of change, among others.

Passage planning

Trinity Bay’s SMS procedures for passage planning reflected the general principles and guidance in SOLAS[31] and the IMO’s Guidelines for voyage planning.[32] The SMS stated that the purpose of voyage planning was:

To plan and display the vessel’s passage for the intended voyage berth to berth, to monitor and verify the vessel’s position throughout the voyage in relation to reported dangers to the safe navigation of the vessel.

IMO guidelines stated that the development of a passage plan and the close and continuous monitoring of the vessel's progress and position during the execution of such a plan, was essential for the safety of life at sea and protection of the marine environment. The guidelines directed masters and watchkeepers to ensure there was systematic bridge organisation that provided for cross-checking of individual human decisions so that errors could be detected and corrected as early as possible.[33]

Trinity Bay’s SMS included a standard work instruction (SWI) that outlined the procedures for passage planning. The SWI required that, prior to commencing a voyage, a documented passage plan was developed, printed out, signed by the master and watchkeepers, and retained on the bridge for use during the voyage. The second mate was the designated navigation officer on board Trinity Bay with responsibility for passage planning while the master was responsible for oversight and approval. In practice, the second mate was generally occupied with cargo operations with the master consequently assuming responsibility for passage planning. The second mate retained other navigational responsibilities such as chart corrections and publication updates. 

The SWI also required that only routes approved by the designated person ashore (DPA) were to be used when passage planning and that any deviations from the approved route (other than for collision avoidance) had to likewise be approved by the DPA.

The use of standardised DPA-approved passage plans had been successfully implemented in Sea Swift’s Northern Territory operations and it was the intention to develop and adopt similar plans in the Queensland fleet. However, at the time of the grounding, there were no DPA-approved routes in existence for operations in Queensland.

Crews operating vessels in Queensland used several different passage planning tools based on their individual preferences including ones based on Microsoft Word documents and an Excel workbook. Following a review of tools in use across the Queensland fleet, Sea Swift shore management identified the Excel workbook as being the most suitable to form the basis of a standardised set of passage plans. The operator decided that a draft of the Excel workbook would be trialled on a ship (Biquele Bay) and would subsequently be introduced across the fleet as a standardised passage planning tool. Sea Swift reported that, at the time of the grounding, the Excel workbook was still being trialled and that there had been no official direction or advice to commence using the passage planning spreadsheet more widely.

Internal audits

The SMS included an internal audit process to verify the ship’s compliance with the SMS.

On 7 October 2020, an internal audit of Trinity Bay conducted by the ship’s marine manager identified several non-conformances related to the navigation requirements of the SMS. The audit recorded a non-conformance which stated that the ship’s passage plans were not in accordance with the passage planning SWI. Other identified non-conformances related to position fixing on charts, chart corrections and use of appropriate charts. The master at the time (the master on board at the time of the grounding) rectified some of the non-conformances and logged intended safety action for others.

Shortly after the audit, the master completed their 4-week roster, signed off, and then signed on again about 4 weeks later. About 2 weeks after their return, on 20 November, the ship’s marine manager sent the master a reminder to close out the safety action on the passage planning non‑conformance noting that there had been sufficient time for the ship ‘…to get the passage plan up to standard’. In response, the master decided to obtain and use what they believed to be a passage planning tool containing approved waypoints and routes to develop new passage plans.

The master requested and received copies of the draft Excel workbooks they knew were being trialled on board Biquele Bay and used these to construct new routes and to compile new passage plans (see the section titled Trinity Bay’s passage plans).

Risk and change management

The SMS also provided guidance for risk and change management to control change within the organisation and its business. The change management procedures sought to reduce the health, safety, environmental and quality (HSEQ) hazards that could occur as a result of change, to control the occurrence of HSEQ events, to manage the way change was introduced and to maintain a high level of HSEQ competence.

The SMS procedures and guidance for the risks related to the management of change were not applied to the planned introduction of standardised passage plans and the operator did not consider them to be appropriate or useful in the circumstances.

Trinity Bay’s passage plans 

Trinity Bay’s original routes and passage plans had been used without incident for at least the preceding 10 years. The ship’s passage plans had remained largely unchanged during that time with only minor amendments made to accommodate new ports or irregular port calls. The SMS divided passage planning into 4 stages: appraisal, planning, execution, and monitoring. 

Appraisal

Appraisal is the process of gathering all available and relevant information to enable the planning officer and master to identify hazards to navigation and to designate appropriate safety margins in accordance with prudent seamanship and company requirements.

Trinity Bay’s SMS required that an overall assessment of the voyage be made by the master, in consultation with the planning officer and other deck officers, after all relevant information had been gathered. The passage plan document included a checklist of items to be considered, publications to be referenced and general navigation checks to be performed as part of the appraisal process. However, the appraisal for the new route from Thursday Island to Cairns relied almost exclusively on the master’s knowledge and past experience operating in the region and their belief that the waypoints in the workbook were safe and DPA-approved. Publications such as the sailing directions were not referenced for the new route, nor were other deck officers consulted.

Planning

The SMS stated that once a full appraisal had been carried out, a detailed plan was to be developed. The plan was to cover the whole voyage, from berth to berth, in accordance with the procedures in the SMS. In particular, the procedure required the master to ensure that only official nautical charts and publications were used for navigational purposes.

On 20 November 2020, following the reminder from the marine manager to address the non‑conformance, the master of Trinity Bay emailed the master trialling the workbook and requested a copy of the ‘…updated and latest passage plan from Cairns to Horn Island return.’. The master subsequently received two draft Excel workbooks named ‘Passage Plan CNS‑HI’ and ‘Passage Plan HI‑CNS’. The master trialling the draft workbook stated they had sailed the routes the previous week and that they were planned using the ‘Waypoints master list’ embedded in the workbooks (bottom tab in Figure 5). Following receipt of the draft passage planning workbooks, Trinity Bay’s master recalled that they spent about 30 hours developing 6 new passage plans for Trinity Bay’s regular voyages.

On 4 December, the master signed off once again and, in handover notes to the relieving master, stated that they had ‘…made up our new passage plans in the new Master Waypoint Spreadsheet format that management want us to use...’. In January 2021, following their return to the ship, the master loaded the newly developed routes into the ECS and subsequently used them.

Trinity Bay’s new routes

The draft workbooks consisted of a ‘COVER PAGE’, a ‘WAYPOINTS MASTER LIST, a ‘PASSAGE CALCULATION SHEET’ and a ‘PASSAGE PLAN FORM’. The ‘WAYPOINTS MASTER LIST’ consisted of named and numbered waypoints organised in sequence forming route segments (Figure 5).

Figure 5: Excel workbook ‘Passage Plan CNS‑HI’

Image of the passage planning spreadsheet detailing route segments and their associated waypoints, and coordinates.

Source: Sea Swift, annotated by the ATSB

Routes were constructed by selecting the relevant waypoints (or sequences of waypoints) from the ‘WAYPOINTS MASTER LIST’ tab (column B in Figure 5) and entering the waypoint numbers in sequence in the ‘PASSAGE CALCULATION SHEET’ tab. This resulted in the respective coordinates of each waypoint being populated in the ‘PASSAGE CALCULATION SHEET’ and functions embedded in the workbook calculated the distances and courses to steer for the various legs defined by the selected waypoints.

The waypoints, coordinates, distances and courses were also populated automatically in the ‘PASSAGE PLAN FORM’ tab, which was then printed off, signed, and retained on the bridge as part of the passage plan document. The ‘PASSAGE PLAN FORM’ tab also included a column called ‘PASSAGE PLAN NOTES’ where additional useful information such as details for parallel index lines could be entered. This column was not populated automatically and needed to be completed by the officer compiling the passage plan.

Trinity Bay’s master used the ‘Passage Plan CNS‑HI’ workbook (Figure 5), to construct the new route from Thursday Island to Cairns. Part of this route included a segment from Adolphus Channel to Cairns and the master utilised the waypoints listed for this segment directly from the ‘WAYPOINTS MASTER LIST’. This included a leg from waypoint 97 (Adolphus Channel) to waypoint 98 (Furze Point) which passed directly over Harrington Shoal (Figure 6). Additionally, the route planned using these waypoints also resulted in the preceding leg being laid across Mid Rock, a charted underwater rock.

Figure 6: Section of chart Aus 839 showing new route legs

Source: Australian Hydrographic Office, annotated by the ATSB

Navigation on ECS

The planning phase also included plotting the intended route onto appropriate charts and visually checking that every leg of the planned route was in safe water and clear of navigational dangers.

Once the new routes were planned, the master manually entered the waypoints directly into the ship’s ECS computer. The master stated that when entering the waypoints into the ECS, they visually checked that each waypoint was in safe water. They did not check the legs connecting the various waypoints and did not identify that the route leg connecting waypoint 97 to waypoint 98 passed directly over Harrington Shoal (Figure 7).

The newly created waypoints and route was not marked on paper charts, which were the ship’s primary means of navigation. There was also no independent verification of the route by another deck officer, nor was there a briefing for watchkeepers before commencing the voyage.

Figure 7: Image of Trinity Bay’s ECS screen

Image of TRANSAS ECS screen taken after grounding showing Trinity Bay’s planned route and track in vicinity of Harrington Shoal.

Source: Sea Swift, annotated by the ATSB.

ATSB analysis

During the investigation, the ATSB examined both workbooks that were received by Trinity Bay’s master, the final, printed passage plan document and the route saved on the ECS program.

The ATSB analysis identified several discrepancies in the ‘Passage Plan CNS‑HI’ workbook (used by the master to create the route from Thursday Island to Cairns) as summarised below and in Figure 8:

• There were 3 waypoints (numbered 28, 96, 97) named ‘Adolphus Channel’ with the latitude and longitude for waypoints 96 and 97 differing from those of waypoint 28
• the listed relative position (bearing and range from ‘Quetta Rock beacon’) for waypoint 28 was incorrect and inconsistent with the respective latitude and longitude coordinates
• the resulting leg between waypoint 97 and 98 in the spreadsheet’s sequence for a route from Adolphus Channel to Cairns passed directly over Harrington Shoal
• the leg preceding waypoint 97 passed over Mid Rock
• there were two distinct waypoints numbered 28— ‘Adolphus Channel’ and ‘Quetta Rock’—with different coordinates for each.

Examination of the other workbook (the ‘Passage Plan HI-CNS’ workbook) found that waypoints 97 and 98 differed from those with the same name and number in the workbook used by the master to construct the new route. In the ‘Passage Plan HI-CNS’ workbook’ waypoint 97, although still named ‘Adolphus Channel’, had coordinates that were different, and matched those of waypoints 28 and 96 in the workbook used by the master. Additionally, in this workbook, waypoint 98 was an entirely unique waypoint named ‘Harrington Reef’.

The analysis showed that a passage constructed using the same numbered waypoints (waypoints 97 and 98) but taken from the ‘Passage Plan HI-CNS’ workbook would have resulted in a route that passed Harrington Shoal safely (Figure 8).

Examination of Trinity Bay’s printed passage plan document for the grounding voyage also showed that the parallel index lines listed for the new route’s legs from waypoint 97 to waypoint 98 and from waypoint 98 to waypoint 99 were incorrect. However, these incorrect parallel index lines corresponded to the equivalent legs had the route been constructed using the ‘Passage Plan HI‑CNS’ workbook. This indicated that the master likely used the incorrect waypoints from the ‘Passage Plan CNS‑HI’ but copied the parallel index line information for the equivalent route legs from the ‘Passage Plan HI‑CNS’ workbook.

Figure 8: ATSB analysis showing discrepancies in waypoints and resulting routes

The chart figure on the left shows the route passing over Harrington Shoal using waypoints from the ‘Passage Plan CNS – HI’ workbook. The chart figure on the right shows a route, constructed with the same numbered waypoints but from the ‘Passage Plan HI – CNS’ workbook, passing Harrington Shoal safely.

Source: Australian Hydrographic Office, annotated by the ATSB based on analysis of Sea Swift passage planning workbooks

Waypoint anomaly

Following the grounding, the master reviewed the passage plan and discovered that an additional error had been made while entering the new route’s waypoints into the ECS. Waypoint 97 (Adolphus Channel) whose latitude and longitude coordinates were 10° 41.96’ S 142°38.69’ E had been incorrectly entered into the ECS as 10° 42.21338’ S 142° 38.84375’ E. The master was unable to explain the discrepancy although the error was probably made in the course of using the ECS computer mouse to ‘drop’ waypoints onto the displayed electronic chart.

The difference in the waypoint coordinates equated to the incorrectly entered waypoint being about 0.30 miles south-east of the coordinates for waypoint 97 detailed in the printed passage plan (Figure 9). Routes using either waypoint resulted in the following leg passing directly over Harrington Shoal although the preceding leg was moved about 0.15 miles away from Mid Rock.

Figure 9: Section of chart Aus 839 showing incorrectly input waypoint

Source: Australian Hydrographic Office, annotated by the ATSB.

Execution and monitoring

The execution and monitoring phases occur concurrently. The planned route, which has been checked and approved, is executed and the vessel’s progress against the route is monitored using all available means. Any concern or doubt with regard to the passage plan or the safety of the ship required the officer of the watch to call the master and, in the meantime, take appropriate action to ensure the safety of the vessel. Having not identified Mid Rock or Harrington Shoal as potential dangers to navigation on the route during the planning stage, the last opportunity to do so was during the monitoring phase of the passage.

On 15 January 2021, on departure from Cairns and prior to using the new routes for the first time, the master’s night orders cautioned watchkeepers that the ‘…new route of plotter will not line up exactly with chart route. Follow plotter route…’. The orders also instructed watchkeepers to ‘…stay within cross track error guidelines on plotter unless avoiding traffic…’.

On the day of the grounding, the OOW was primarily monitoring the ship’s passage using the ECS and was focussed on ensuring the vessel remained within the route’s cross track limits as displayed on the ECS. They were also plotting radar fixes on the paper chart Aus 839 at about 15‑minute intervals. However, the most appropriate scale chart for the area was Aus 292 which was not used. Furthermore, the new route was not plotted on the paper charts, which still retained the original routes marked in red ink.

The OOW’s radar fix, plotted at 0715, (Figure 10) showed the vessel on track to pass dangerously close to Mid Rock, a charted underwater rock with a depth of 4.9 m. However, the OOW was not alerted to the danger and continued with the passage eventually passing about 0.18 miles from Mid Rock at about 0720.

Figure 10: Chart extracts showing Trinity Bay's passage close to Mid Rock

Source: Sea Swift and Australian Hydrographic Office, modified and annotated by the ATSB.

Radar fixes on the paper chart at 0745 and 0800 similarly showed the ship on track to pass over Harrington Shoal (Figure 11). While the OOW started to become concerned when they observed that the relative aspect of Harrington Reef west cardinal mark was different to what they were accustomed to, they nevertheless assessed that it was safe to continue the passage.

In both the above instances, the ECS display would also have shown the ship standing into danger.

Figure 11: Chart extracts showing Trinity Bay's passage leading up to grounding

Source: Sea Swift and Australian Hydrographic Office, modified and annotated by the ATSB.

Great Barrier Reef and Torres Strait vessel traffic service (REEFVTS)

Background

The Great Barrier Reef and Torres Strait regions are internationally recognised for their cultural and environmental significance. The Great Barrier Reef Marine Park was established in 1975 and added to the World Heritage list in 1981. IMO subsequently named the Great Barrier Reef as the world’s first particularly sensitive sea area (PSSA) in 1990 followed by the Torres Strait in 2005.

In December 2004, the Queensland and Australian Governments established the Great Barrier Reef and Torres Strait vessel traffic service (REEFVTS) with the stated purpose to:

• make navigation in Torres Strait and the inner route of the Great Barrier Reef safer by working with shipping to give the best possible information on potential traffic conflicts and other navigational information;
• minimise the risk of maritime accidents, and therefore avoid the pollution and damage which such accidents can cause to the marine environment in the Great Barrier Reef and Torres Strait; and
• assist with quick response if a safety or pollution incident does occur.

Additionally, the Great Barrier Reef Marine Park Zoning Plan defined a designated shipping area (DSA) to help minimise impacts on the park from shipping activity. In 2014, a Two-Way Route system, designed to keep ships clear of charted hazards and to assist in safe and efficient navigation, was adopted by the IMO and implemented within the DSA.

REEFVTS authority and area

The Great Barrier Reef and Torres Strait Ship Reporting System (REEFREP) is a mandatory ship reporting system established under SOLAS and given effect by AMSA’s marine order 63 (MO 63)[34] which required ships, including Trinity Bay, to report to REEFVTS when navigating within the REEFVTS area (Figure 12).

REEFVTS is operated 24 hours a day by Maritime Safety Queensland (MSQ) under a memorandum of understanding with AMSA.

Figure 12: REEFVTS area boundary at the time of the grounding

Source: Reef VTS user guide, annotated by ATSB.

REEFVTS monitoring systems

REEFVTS monitors and communicates with ships to ensure safe and efficient navigation within the compulsory reporting area. REEFVTS achieved this objective by maintaining a vessel traffic image[35] of shipping in the REEFVTS area and by providing ship masters and pilots with ship encounter information, maritime safety information and navigational support. Vessel traffic service operators (VTSOs) used a decision support tool (DST) to display the vessel traffic image and to monitor vessels in the REEFVTS area.

MaritimeCONTROL

MaritimeCONTROL was a new DST, introduced at REEFVTS in December 2020 to replace the previous system. The MaritimeCONTROL system integrated information and data from ships transiting the REEFREP area making it accessible via a single monitoring tool. The system displayed the REEFREP area overlayed with information such as ship positions, routes, and navigation features using several sources, including automatic identification system (AIS) information, radar and satellite data.

The system allowed for the configuration of boundaries to areas of critical interest including potential grounding areas, shallow water areas and other areas hazardous to navigation. These boundaries enabled the generation of visual and audible alerts to alert the VTSO to the development of situations potentially dangerous to navigation including area penetration alerts, shallow water alerts, alerts for entry and exit to the REEFREP area, line crossing alerts for critical turns and alerts if a vessel’s speed slowed significantly (indicative of grounding) (Figure 13).

Figure 13: MaritimeCONTROL display showing visual alerts for Trinity Bay

Image of MaritimeCONTROL screen showing ENC overlay of the Two-Way route and route adherence area penetration boundaries. The top right of the screen shows visual potential grounding alerts for Trinity Bay as a result of its breach of the green area boundary around Harrington Reef and Wyborn Reef.

Source: Maritime Safety Queensland, annotated by the ATSB.

MaritimeCONTROL also allowed for specific routes to be configured into the system including options for deep, moderate, and shallow draught routes with multiple route variations within the Two-Way route capable of being monitored. Routes outside of the Two-Way route system but within the DSA, used by smaller, shallower draught ships were also incorporated into MaritimeCONTROL.

REEFVTS was normally advised of a ship’s intended route by the marine pilot or ship’s master upon entry to or on commencement of the ship’s voyage within the mandatory reporting area. However, the VTSO could also allocate routes based on familiarity with a vessel’s operations or could request a master to clarify their intended route. Once allocated, the system monitored the progress of vessels on these routes and, if a vessel significantly deviated from the route, a route adherence alert was generated.

The responsibility for maintaining the systems and software used in REEFVTS monitoring, including MaritimeCONTROL, was delegated to MSQ.

System fault

On 10 January 2021, a fault was identified and reported to MaritimeCONTROL’s vendor by MSQ. The level 2 fault,[36] was associated with AIS tracking and resulted in multiple spurious route adherence alerts being generated in different locations continuously. The high number of spurious alerts generated continuous audible and visual alerts on the system display. By 4 February 2021, a software fix had been developed and testing had commenced, however the issue was not resolved until 12 August 2021.

In the meantime, REEFVTS operators were authorised to mute the audible alerts, although the visual active alert panel continued to be triggered and remained highlighted on the display screen whilst the alert state existed (Figure 13).

Vessel Traffic Service operator (VTSO)

At the time of the occurrence, REEFVTS operated out of the MSQ VTS Centre in Townsville, Queensland. REEFVTS was continually staffed by one operator and supported, if required, by another VTSO (who otherwise usually performed port VTS duties). The VTSO staff comprised 8 permanent and 4 casual employees rotating through 12-hour shifts for 2 days, then 2 nights, followed by 4 days off.

On the day of the grounding, the duty VTSO commenced their shift at 0600 following 4 days off. Their duties required them to monitor applicable vessels[37] in the REEFREP area ( Figure 12) using the MaritimeCONTROL system. At the start of their duty period, there were 41 active ship movements within the monitoring area with 2 more ship entries expected. This was under the threshold of 45 movements, detailed in REEFVTS operating procedures, where an additional VTSO could be called in to assist monitoring.

Between 0600 and 0822 that morning (when the master of Trinity Bay called REEFVTS to advise of the grounding), the VTSO was subject to 80 alerts, 42 of which were spurious and the result of the reported fault.

Trinity Bay alerts

At 0710 on 19 January 2021, Trinity Bay triggered a route adherence alert followed by a potential grounding alert at 0712. The alerts were a result of Trinity Bay diverting from the monitored route (assigned by the VTSO to the vessel based on past experience) and breaching the alert boundary surrounding Mid Rock.  At 0717, following an interaction with a different ship, the VTSO acknowledged the Trinity Bay alerts. At 0719, after managing multiple route adherence and potential grounding alerts generated by another ship, the VTSO investigated Trinity Bay’s alerts and determined there was no cause for concern. At about that time, Trinity Bay was passing close to Mid Rock.

The VTSO recalled that, after departing Thursday Island for Cairns, Trinity Bay ‘triggered a couple of alerts’. In the VTSO’s experience, this was not unusual as coastal traders, particularly Trinity Bay, typically transited on the margins of configured routes and while this often triggered alerts, further investigation by the VTSO generally found the ship to be in safe water within the DSA. On this occasion, they investigated the alerts and determined that the ship was not in danger of grounding (as was typically the case in their experience) and that no action was necessary. They then turned their attention to managing other tasks and alerts.

At 0736, ship encounter information (SEI) was generated for Trinity Bay and forwarded to the ship by the VTSO. Between 0736 and 0759, the VTSO was occupied with various tasks including radio communications with other ships, manually generating and transmitting SEI, and acknowledging numerous alerts for other ships (see Appendix A – REEFVTS alerts leading up to the grounding for more detailed information).

At 0759, as Trinity Bay approached Harrington Shoal, the ship triggered a route adherence alert, which was acknowledged by the VTSO at 0800 (Figure 13). At 0801, Trinity Bay triggered a potential grounding alert and at 0809, the ship triggered a slow speed alert (indicating grounding), both of which the VTSO acknowledged. The ship grounded about a minute later at 0810. However, the 3 alerts leading up to Trinity Bay’s grounding were not investigated by the VTSO, who remained unaware the ship had grounded until notified by the master.

Workload

The VTSO’s recollection of the number of active movements, the number of alarms on the day and the challenge of managing them indicate that they were probably experiencing a sustained period of high workload (overload). The number of ship movements in the REEFREP area on the morning of the grounding was close to the threshold where additional resources would generally be required. In addition, the number of system-generated false alerts added significantly to the VTSO’s workload. The VTSO recalled experiencing ‘10 times the normal workload’ and that they couldn’t concentrate or effectively monitor the ships within the REEFVTS area as a result.

Workload is described by Wickens and Hollands, 2013:

Mental workload characterises the demands of tasks imposed on the limited information processing capacity of the brain in much the same way that physical workload characterises the energy demands upon the muscles. In any resource-limited system, the most relevant measure of demand is specified relative to the supply of available resources.

Humans are limited in the amount of new information their brain can process at once. Once this limit of cognitive resources has been reached their performance starts to decline with increased error rates and delayed responses resulting in cognitive overload and thus mental fatigue. Factors that can increase workload can range from excessive task demands, time pressures, a lack of operator skills and knowledge, or environmental conditions.

This overload can create operator stress and lead to an increase in errors (Kum, Furusho, Duru & Satir, 2007). When workload gets too high for the available resources, task shedding can occur (Green et al., 1996), resulting in some tasks being shed altogether, and others being shed in a non-optimal manner (Wickens et al, 2013).

In the 70 minutes before being alerted to the grounding, the duty VTSO was subject to over 50 alerts, 5 of which were alerts generated by Trinity Bay, with the last 3 directly forewarning of the grounding. The alerts generated by Trinity Bay at 0710 and 0712 (as it approached Mid Rock) were acknowledged immediately but were not investigated by the VTSO until about 0719 (7 minutes later). These alerts were determined not to require VTSO action, and the ship proceeded to pass dangerously close to Mid Rock and inside the alerting area boundary around Mid Rock. The following 3 alerts at 0759, 0801 and 0809 were generated as Trinity Bay approached Harrington Shoal. These alerts were also acknowledged but this time were not investigated until the VTSO was notified of the grounding.

Alarm fatigue

Between 0600 (when the VTSO commenced duty) and 0822 (when the VTSO was alerted to the grounding), the duty VTSO received over 80 alerts of which at least 42 were false, generated as a result of the system fault.

Li and others (2017) explain that alarm fatigue refers to distrust or neglect of triggered alarms. In general, alarm fatigue can occur from alarm flood, false alarms, indistinct alarms and more. In a VTS context, alarm fatigue would impair the performance of VTSOs, reduce their situation awareness and increase the possibility of human errors occurring. The research goes on to explain that system design plays a large role in reducing alarm fatigue by addressing issues with false alarms and restoring operators’ trust in the system.

In an aviation context, air traffic controllers are exposed to multiple signals, which is a sensory stimulus that serves the general function of notifying a human operator of a situation that might require their intervention (i.e., an alarm, alert, or warning) (Ruskin et al. 2021). Signals that are perceived as unreliable are likely to provoke the so-called ‘cry wolf effect’. 

The ‘cry wolf’ effect is a general syndrome whereby excessive alarms, many of them seemingly unnecessary to the operator (such as false alerts), lead to a distrust, or disuse, in the alarm system. In turn, this operator distrust, or disuse, leads to a disregard of (or late response to) some true alarms (Lee & See, 2004; Parasuraman & Riley, 1997). This leads to a loss of trust in the system developing over time.

Research has found that false-alarm prone automation reduces overall performance, particularly affecting operator compliance and reliance (Dixon, Wickens & McCarley, 2006). In addition, research has shown that when an individual has to detect specific types of targets or stimuli over an extended period, their performance level will decrease, (Wickens and Hollands 2013).

The VTSO described having to manage a ‘horrendous amount of alerts’ that were appearing faster than they could be addressed, including a significant number of false alarms, particularly whilst they were trying to manage genuine alerts requiring follow-up or action. Managing these false alarms increased the already high workload and reduced the VTSO’s ability to concentrate and effectively monitor the ships within the REEFVTS area.

Coastal pilotage

In 1991, following the declaration of the Great Barrier Reef as the world’s first particularly sensitive sea area (PSSA) the previous year, Australia introduced compulsory pilotage for ships of 70 m or more in length and all type/size of loaded tankers.[38] Under the Navigation Act 2012 (Nav Act), compulsory pilotage was required for applicable vessels in the Great Barrier Reef area north of Cairns[39] and the Hydrographers Passage (Figure 12). Pilotage is separately and additionally required in these areas under the Great Barrier Reef Marine Park Act 1975 (GBRMP Act). In 2006, the Nav Act’s compulsory pilotage regime was extended to include the Torres Strait[40] following its own recognition as a PSSA. These pilotage areas are defined in marine order 54 (MO 54)[41] and/or the Great Barrier Reef Marine Park Regulations 1983.

The Australian Maritime Safety Authority (AMSA) is responsible for the safety regulation of coastal pilotage including ensuring that domestic commercial vessels (DCVs) complied with the relevant requirements.

Pilotage exemptions

The master or owner of a vessel could apply for an exemption from the legislated requirement to engage an AMSA-licenced marine pilot in a compulsory pilotage area. The Nav Act and the GBRMP Act have separate and discrete requirements relating to pilotage and an exemption granted under one Act does not equate to an exemption under both.

To operate as ‘coastal pilot exempt’, a vessel must have a current ‘exemption’ certificate issued by AMSA and/or the Great Barrier Reef Marine Park Authority (GBRMPA). Where an exemption is required exclusively for operations in the Torres Strait and/or the Great North East Channel pilotage area, a pilotage exemption is required under the Nav Act and granted by AMSA. Where an exemption is required for the Inner Route, Hydrographers Passage, or the Whitsundays (pilotage areas which are the subject of both Acts), separate applications must be made to AMSA as well as the GBRMPA.

In addition to the vessel exemption, the Nav Act requires that the master and any navigational watchkeepers on watch when the vessel is in a compulsory pilotage area should also have current AMSA ‘approval’ to act in their positions on the exempt vessel.

Depending on the pilotage area for which the exemption was sought, applications addressing the prescribed information[42] were required to be made to AMSA and/or the GBRMPA in accordance with the requirements of the corresponding act. AMSA and/or the GBRMPA then assessed the applications including a technical assessment of the vessel, the qualifications and experience of the master and nominated navigational watchkeepers, and a consideration of the associated environmental risks before deciding.

Trinity Bay’s exemption

On 6 November 2018, AMSA conducted an audit and inspection of Trinity Bay following an application for a coastal pilotage exemption. The inspection and audit were undertaken using an audit checklist and included assessment and/or verification of:

• the prescribed information required to be provided in the application
• the validity of the master’s and navigational watchkeepers’ certificates of medical fitness
• the validity and appropriateness of relevant qualifications (including seafaring Certificates of Competency and radio operator’s certificates) for the master and navigational watchkeepers
• details of recent navigational experience in the compulsory pilotage areas of the master and navigational watchkeepers
• the validity of the vessel’s Certificate of Operation (and, if held, the Certificate of Survey)
• a review of the vessel’s passage plans and their substantial compliance with the requirements of SOLAS and the IMO guidelines
• a review of the application of appropriate navigational techniques and methodology including evidence of substantial compliance with passage plans
• evidence of substantial compliance with REEFVTS reporting requirements and knowledge of REEFVTS services, operations and interaction
• the status of relevant nautical publications and references held onboard
• the nautical chart folio, application of Notices to Mariners, maritime safety warnings, meteorological warnings, updates and associated procedures
• carriage of GBRMPA zoning information and charts
• watchkeeping arrangements including relevant fatigue management policies and procedures
• standing orders and night order’s content and understanding
• automated watchkeeping alarms and bridge navigation watchkeeping alarm system status.

The audit recorded that compliance with a passage plan was evidenced during the audit, including that radar was the primary means of position fixing used on board. It was also noted that ECS was only used as an aid and that it provided a cross track error alarm capability.

Having conducted the audit, reviewed the information in the application, and considered the vessel’s risk profile (including maximum draught, areas of operation, navigational equipment onboard and the experience of the master and crew), the vessel was deemed to have met the requirements for an exemption. On 10 December 2018, AMSA issued a certificate of exemption for Trinity Bay valid for 5 years. Separately, endorsements were granted for the master and navigational watchkeepers approving them to act in those positions aboard Trinity Bay.

A letter detailing the assessment and recommending that Trinity Bay be exempted from the requirement to carry a licensed coastal pilot was subsequently forwarded to the GBRMPA on 21 November 2018. Consequently, the GBRMPA issued a vessel exemption for the same period.

Similar occurrences

Over the past 2 decades, flag administrations and agencies with a responsibility to investigate safety occurrences have investigated several groundings with certain common recurring themes relating to the planning and monitoring phases of the passage planning process.

Kaami

On 23 March 2020, the general cargo vessel Kaami ran aground on Sgeir Graidach shoal in the Little Minch on the west coast of Scotland, while on passage from Drogheda, Ireland to Slite, Sweden. The crew were safely evacuated from the vessel by coastguard helicopter and Kaami was successfully refloated by salvors on 4 May 2020. There were no injuries but the damage to Kaami’s hull was extensive, and the ship was declared a constructive total loss.

The United Kingdom’s MAIB investigated the grounding and published Report No. 7/2021. The investigation concluded that:

• a full appraisal of information was not made in the voyage planning process
• a visual check of the route using appropriately scaled electronic navigation charts was not conducted
• the ECDIS route safety check was not carried out
• a second check of the voyage plan did not take place which meant the plan was created by a single person in isolation, and monitoring of the passage was ineffective.

Additionally, they concluded the watchkeepers at Stornoway Coastguard Operations Centre did not intervene prior to Kaami’s grounding as they were unaware of the developing situation.

Ovit

On 18 September 2013, the Malta registered chemical tanker Ovit grounded on the Varne Bank in the Dover Strait while on passage from the Netherlands to Italy. The ship’s primary means of navigation was ECDIS using MARiS 900 ECDIS units. The passage plan passed directly over the Varne Bank in the English Channel. The ship refloated on a rising tide about 2.5 hours after grounding with only minor paint damage.

The United Kingdom’s MAIB investigated the grounding and published Report No. 24/2014. The investigation concluded that the passage had been planned over the Varne Bank by an inexperienced, junior officer. The plan was not properly checked for navigational hazards using the ECDIS route checking function nor was it checked by the master.

CFL Performer

On 12 May 2008, the Netherlands registered dry cargo ship CFL Performer grounded on Haisborough Sand off the East coast of England while on passage from Suriname to the United Kingdom. The ship’s primary means of navigation was ECDIS using Furuno FEA-2107 ECDIS units. The ship’s route was planned across Haisborough Sand, a shoal about 10 mile long and 1 mile wide, where the charted depth of water was considerably less than the vessel’s draught. The ship grounded about 29 minutes after the OOW adjusted course to follow the ship’s planned route. The ship was refloated shortly after with no reported injuries, damage or pollution.

The United Kingdom’s MAIB investigated the grounding and published Report No. 21/2008. The investigation concluded that the route plan was not adequately checked for navigational hazards in either the planning or monitoring stages of the passage plan process. The ECDIS’s route check page was not used to check each leg of the route for navigational hazards. The investigation also found that none of the ship’s bridge watchkeeping officers had been trained in the use of ECDIS and that the ECDIS’s watch vector (look-ahead function) was not activated.
 

Introduction

On the morning of 19 January 2021, the general cargo ship Trinity Bay grounded on Harrington Shoal while transiting the inner route of the Great Barrier Reef Marine Park mandatory pilotage area, on passage from Thursday Island in the Torres Strait to Cairns, Queensland. The ship sustained minor hull damage with no reported injuries or oil pollution.

Harrington Shoal was a charted feature in the Great Barrier Reef and Trinity Bay had successfully transited the area, about 8 times per month, for the preceding 10 years, but on this occasion was using a new passage plan for the voyage south to Cairns.

This analysis examines, among other factors, the operator’s safety management system (SMS) and introduction of standardised passage plans, the voyage planning process, shipboard use of unofficial electronic chart system (ECS) and REEFVTS surveillance and monitoring.

Crew fatigue, the Australian Maritime Safety Authority’s (AMSA) pilotage exemption processes and the management of change processes of the operator (Sea Swift) and REEFVTS were also considered and discounted as factors that contributed to the grounding.

Safety management system

Sea Swift’s SMS required that only designated person ashore (DPA)-approved routes be used for navigation. While Sea Swift was in the process of trialling a draft passage planning tool (an Excel workbook) with the intention of introducing standardised passage plans in the future, at the time of the occurrence there were no DPA-approved routes in existence in the operator’s Queensland fleet. This meant that vessels were effectively unable to comply with this SMS requirement.

In the absence of DPA-approved routes, crews on ships including Trinity Bay, continued to operate using proven routes that, in some cases, had been in use for over 10 years. However, during an internal audit, a non-conformance related to passage planning was recorded against the ship. In seeking to rectify the non-conformance, Trinity Bay’s master sought, and obtained, what they believed were safe, DPA-approved waypoints from the ship trialling the passage planning workbook. Trinity Bay’s master then used waypoints from this workbook to construct new routes, including the route from Thursday Island to Cairns. However, the waypoints defining one of the legs on the route to Cairns, as listed in the workbook, resulted in a route leg passing dangerously close to Mid Rock.

More significantly, a route leg also passed directly over the charted navigational danger of Harrington Shoal.

Passage planning

Planning

Passage planning procedures in Trinity Bay’s SMS generally reflected IMO guidelines and international best practice on the subject. Key elements of the planning phase involved laying out (or plotting) the route on the ship’s primary means of navigation (paper charts), visually checking the route for dangers and engaging an independent check to verify that the route was safe. In this instance, the master entered the waypoints for the new routes directly into the ship’s electronic chart system (ECS).

While the master reported checking that the waypoints were in safe water, the route legs between the waypoints were not visually checked for dangers, nor did the ECS possess automatic route safety checking functions. Furthermore, had the new waypoints and route been plotted on the ship’s paper charts, the physical act of drawing the route leg over Harrington Shoal would have made the danger obvious and readily identifiable. Finally, there was no independent verification of the passage plan sought from another deck officer, which meant that another opportunity to identify the danger during the planning phase was lost.

The failure in the planning phase to detect that the route was plotted across Harrington Shoal and close to Mid Rock meant that an unsafe passage had been planned and put into use. The remaining opportunity to detect the danger was the monitoring phase of the passage plan process.

Monitoring

Once the passage had been put into use, it fell to the officers of the watch (OOW) to execute and monitor the ship’s progress against the passage plan. The OOW was required to ensure that the ship remained safe at all times within the parameters set out in the approved passage plan and that the master was called in the event there were concerns with the passage.

On board Trinity Bay, the route in use was only displayed on the ECS and not plotted on the official paper charts which retained the ship’s old routes. The master’s night orders acknowledged this, advising OOWs that routes on the ECS and paper charts would differ and that the route displayed on the ECS was the route to be executed and monitored. Consequently, the OOW focussed on keeping the ship on the planned route displayed on the ECS.

Radar position fixes plotted on the paper charts by the OOW showed the ship on track to pass dangerously close to Mid Rock. Similarly, position fixes on the paper charts in the time leading up to the grounding, clearly showed the ship on track to ground on Harrington Shoal. In both instances, the danger posed to the ship should have been readily evident on the paper chart based on projecting the ship’s track (as indicated by the consecutive radar fixes) forward. Additionally, effective monitoring of the ship’s progress on the ECS should also have alerted the OOW to the fact that the route was laid across the shoal.

The OOW identified that parallel index lines listed in the passage plan did not correspond to the new route’s legs and observed that the ship appeared closer to the Harrington Reef west cardinal mark than usual. However, these did not alert the OOW to an issue with the route and they did not investigate further or call the master. There were several opportunities for the OOW to detect that Trinity Bay was running into danger however the monitoring of the passage was ineffective and, consequently they were unaware of the danger until the ship grounded.

REEFVTS

On the morning of the grounding, the duty vessel traffic service operator (VTSO) was very likely experiencing a sustained high workload. They were managing multiple vessel movements within the REEFREP area with the number of movements close to the REEFVTS-defined threshold when additional VTSO assistance would generally be required. Additionally, a known technical fault in the REEFVTS monitoring and surveillance system used by VTSOs resulted in a significant number of spurious alerts and alarms being generated. Consequently, the VTSO was also subject to a large number of false alarms interspersed with legitimate alerts requiring action.

The sustained high workload, compounded by likely alarm fatigue as a result of the system fault, probably resulted in decreased performance and in the VTSO being unable to adequately address and investigate all incoming alerts in an optimal manner. The VTSO’s experience and familiarity with Trinity Bay’s regular and relatively incident-free history of operations in the reef, also likely influenced their expectation that alerts generated by the ship were less likely to be indicative of a potential adverse situation developing.

In the 10 minutes leading up to Trinity Bay’s grounding, there were 3 alerts forewarning of the potential grounding. However, while these alerts were acknowledged, they were not investigated and the VTSO remained unaware of the situation until notified of the grounding by the master via mobile telephone.
 

Findings

From the evidence available, the following findings are made with respect to the grounding of Trinity Bay on Harrington Shoal, Queensland on 19 January 2021.

Contributing factors

• Trinity Bay’s master used an uncontrolled, erroneous draft passage planning tool to make a new passage plan with the aim of addressing a recent internal audit non-conformity about passage planning and to comply with the operator’s requirement to use approved routes and waypoints.
• An independent verification of the new passage plan, as required by the operator’s procedures and by best practice was not done, and no one identified that the ship’s planned track passed directly over the charted danger of Harrington Shoal.
• The new planned tracks were entered into the electronic chart system instead of being annotated on the paper charts, the primary means of navigation, which indicated tracks along the ship’s usual passage plan.
• Trinity Bay’s officer of the watch was not monitoring the ship’s progress effectively, resulting in the ship passing dangerously close to the charted danger of Mid Rock at about 0720 before grounding on Harrington Shoal 50 minutes later.
• In the time leading up to the grounding and subsequently, route adherence alerts, potential grounding alerts and slow speed alerts associated with Trinity Bay were acknowledged by the duty operator at REEFVTS but not followed up. This was due to the operator experiencing a sustained period of elevated workload combined with a high level of expectancy that the ship was not at risk as it frequently transited the area.
• An ongoing technical fault in the REEFVTS monitoring and surveillance system caused an abnormally high number of erroneous alerts and alarms. Consequently, REEFVTS operators were experiencing sustained periods of elevated workload, including that of the operator at the time of the Trinity Bay’s grounding. (Safety issue)

REEFVTS monitoring

Safety issue number: MO-2021-001-SI-01

Safety issue description: An ongoing technical fault in the REEFVTS monitoring and surveillance system caused an abnormally high number of erroneous alerts and alarms. Consequently, REEFVTS operators were experiencing sustained periods of elevated workload, including that of the operator at the time of the Trinity Bay’s grounding.

Safety action not associated with an identified safety issue

Additional safety action by Sea Swift

In response to the incident, Sea Swift advised the ATSB that:

• the TRANSAS electronic chart system program was removed from service.
• a mentoring and audit program was implemented across the operator’s fleet to ensure crew understood the operator’s safety management system requirements on passage planning and navigation and that it was effectively implemented.
• the operator was investigating fully compliant electronic chart display and information system options for its vessels.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the master and chief mate on board Trinity Bay
• Australian Maritime Safety Authority
• Maritime Safety Queensland
• Sea Swift.

References

Australian Maritime Safety Authority, 2016, Marine Order 27 – Safety of navigation and radio equipment 2016, AMSA, Canberra.

Australian Maritime Safety Authority, 2014, Marine Order 54 (Coastal pilotage) 2014, AMSA, Canberra.

Australian Maritime Safety Authority, 2019, Marine Order 63 (Vessel reporting systems) 2019, AMSA, Canberra.

Australian Maritime Safety Authority, 2018, Marine Order 504 – Certificates of operation and operation requirements - national law, AMSA, Canberra.

Dixon SR, Wickens CD, McCarley JS. How do automation false alarms and misses affect operator compliance and reliance? In Proceedings of the Human Factors and Ergonomics Society Annual Meeting 2006 Oct (Vol. 50, No. 1, pp. 25-29). Sage CA: Los Angeles, CA: SAGE Publications.

Green, R. G., Muir, H., James, M., Gradwell, D., & Green, R. L. (1996). Human factors for pilots. Second edition. Ashgate, UK.

International Maritime Organization, 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London.

Kum S, Furusho M, Duru O, Satir T. Mental workload of the VTS operators by utilising heart rate. TransNav, International Journal on Marine Navigation and Safety of Sea Transportation. 2007 Jun 1;1(2).

Lee JD, See KA. Trust in automation: Designing for appropriate reliance. Human factors. 2004 Mar;46(1):50-80.

Li F, Lee CH, Xu G, Chen CH, Khoo LP. A QFD-enabled conceptualization for reducing alarm fatigue in vessel traffic service centre. In Transdisciplinary Engineering: A Paradigm Shift 2017 (pp. 821-828). IOS Press.

Parasuraman R, Riley V. Humans and automation: Use, misuse, disuse, abuse. Human factors. 1997 Jun;39(2):230-53.

Ruskin KJ, Corvin C, Rice S, Richards G, Winter SR, Ruskin AC. Alarms, alerts, and warnings in air traffic control: an analysis of reports from the Aviation Safety Reporting System. Transportation research interdisciplinary perspectives. 2021 Dec 1;12:100502.

Sea Swift Integrated Management System (IMS) Standard Operating Procedures (SOP) IMS-SOP-020 Marine Operations, revision 1.8, 23 October 2020.

Sea Swift Integrated Management System (IMS) Standard Work Instruction (SWI) IMS-SWI-020.21 Passage Planning, revision 1.4, 3 November 2020.

Wickens CD, Hollands JG, Banbury S & Parasuraman R (2013) Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the master and chief mate of Trinity Bay
• Sea Swift
• Australian Maritime Safety Authority
• Maritime Safety Queensland

Submissions were received from:

• Australian Maritime Safety Authority

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
 

Overview

On 28 December 2020, at about 1438 local time, a Dynaero MCR-01 VLA, registered VH-SIP, departed Serpentine aircraft landing area (ALA), Western Australia, to conduct a post-maintenance check flight. At about 300 ft above ground level, the engine began to run rough, however continued to operate. Shortly after, the aircraft was observed to aerodynamically stall,[1] pitch nose-down, and impact terrain. The pilot, who was the sole occupant, was fatally injured, and the aircraft was destroyed.

Aircraft return to service

Post-maintenance flight checks

On 27 December 2020, the new owner and a flight instructor were a conducting post-maintenance check flight of VH-SIP at Serpentine ALA, after undergoing maintenance after an extended period of inactivity (see Return to service tasks). As they departed from runway 05[2] on climb, at about 200–300 ft above ground level (AGL), the engine lost power and began to run rough. The instructor, who was the pilot in command, reported that they lowered the nose and reduced power, which cleared the rough running and allowed the aircraft to continue flight. There was sufficient power available to continue a reduced climb and conduct a circuit back onto runway 05.

The instructor recalled they then initiated a missed approach on short final approach to runway 05 and commenced a full power climb. While the aircraft engine power initially responded, rough running was again experienced at about 200–300 ft AGL. The instructor again reduced power, cleared the rough running, and conducted a slow climb before making a final landing back on runway 09. Both occupants identified the smell of fuel in the cockpit at the time.

The instructor, the new owner and several other people including the pilot of the accident flight (pilot) assisted a licenced aircraft maintenance engineer (LAME) with troubleshooting the engine rough running that afternoon. Numerous engine-runs were conducted on the ground with multiple witnesses stating that they were able to replicate the rough running and partial power loss during the static full power tests on the ground, both with and without the electric fuel pump assistance. The owner stated that the engine seemed to run smoother with the electric fuel pump on, however engine coughing and rough running was replicated on all of the full power runs to varying degrees. Other witnesses recalled the engine stopping when the throttle was reduced after the engine runs, one capturing the stoppage on video.

Engine troubleshooting

To try and diagnose the problem, basic fuel system troubleshooting was conducted by another LAME on behalf of the original LAME, who was no longer at the airfield. This included the draining and cleaning of the fuel filter on direction of the original LAME by phone. A witness described the contaminants within the fuel drain sample and filter as a significant amount of ‘brown gunk’. The engine troubleshooting continued until early evening, when the aircraft was then hangered for the night with the original LAME scheduled to conduct troubleshooting on the aircraft the next day.

The owner and instructor made the decision to return back to Queensland without the aircraft and have the aircraft ferried over when the rectification work was completed. The pilot, who was known to the LAME, volunteered to ferry VH-SIP from Serpentine to Queensland after working with the LAME to correct the engine problem. The owner accepted the offer before departing Serpentine Airfield back to Perth.

Evening activities

That evening, the local aero club held a dinner at the airfield (see social function). Witnesses confirmed that the pilot attended the event, retiring to their accommodation at about 0200 the following morning.

Accident flight

On 28 December 2020, the pilot and LAME met at the airfield at about 1100. The LAME did not recall the pilot was any different to usual, however did remark that the pilot was consuming significant amounts of water. The pilot assisted the LAME with the running of the engine and mentioned that they had never flown an aircraft as small or light before and had not operated a Rotax engine previously. Subsequently, the LAME explained the absence of a mixture control, use of ignition systems and the operation of the electric inflight adjustable propeller.

The LAME removed the aircraft cowls and inspected the engine compartment for a fuel leak before replacing a newly installed mechanical engine driven fuel pump with the old pump to test positive fuel flow without any blockages as part of the troubleshooting sequence. The LAME identified that the fuel flow increased with the activation of the electric fuel pump.

The pilot conducted a troubleshooting check flight in VH-SIP at about 1415, with the support of a number of ground crew including several LAMEs. On return from the first flight, the pilot reported that the engine was not developing full power (5,500 RPM),[3] and was not able to produce much greater than 4,000 RPM. The LAME provided an additional brief to the pilot on the use of the automatic propeller system and requested further ground runs of the engine.

At about 1438, the pilot conducted a further post-maintenance troubleshooting flight from runway 09 (Figure 1). The LAME stated that they expected the aircraft operation to be a high-speed ground run. At about 300 ft AGL, witnesses described audible changes in the aircraft engine noise, and observed a noticeable change in aircraft performance. They observed the aircraft visibly slow and begin a left turn. Further change in the engine noise was heard before the aircraft was described to commence another left turn towards runway 23. At about 200 ft AGL, witnesses described the left turn beginning to tighten and the aircraft visibly slowing with a nose-high attitude. At about 150 ft AGL, the aircraft’s left wing dropped and the aircraft entered a steep rotating descent to the left. The pilot was unable to recover control of the aircraft before it impacted with terrain.

Figure 1: Aircraft’s flight path and accident site location

Source: Google Earth, modified by the ATSB

Context

Pilot information

Licencing

The pilot held an air transport (Aeroplane) pilot licence. This licence was for single and multi-engine aircraft, with endorsements for tailwheel aircraft, manual propeller pitch change, gas turbine engines, pressurisation and for aircraft with retractable undercarriage.

Aeronautical experience

General experience

The pilot’s logbook showed a total flying experience of 5,999.8 hours, up to the last recorded flight on 31 November 2019, when the pilot ceased airline flying with a carrier in the US, before moving back to Australia.

Aircraft specific experience

The majority of the pilot’s total flight time was conducted in multi-engine, piston and turbine aircraft operations. However, since the pilot’s return to Australia, they had conducted a tailwheel design feature endorsement, an aeroplane flight review, and a number of private flights of the local aeroclub aircraft based at Serpentine ALA.

Although the pilot had considerable experience, a review of the pilot’s logbook records found that they had not previously flown Rotax-powered aircraft or the Dynaero MCR-01 VLA.

Medical

The pilot held a valid class 1 and class 2 medical certificate, with the last examination conducted on 23 January 2020. The pilot’s class 2 medical was valid until 23 January 2022 and included restrictions requiring the wearing of distance vision correction and additionally, that reading correction must also be available whilst exercising the privileges of the licence.

Recent history

The night before the accident, a number of airfield members met for an informal social dinner at the clubhouse facilities. It was reported that a number of people attended the dinner, and that alcohol was consumed as part of the social event. Witnesses reported seeing the pilot drinking alcohol during the dinner, 1 witness recalled that the pilot engaged in a ‘fairly heavy’ drinking session consuming a significant quantity of alcohol. The witness recalled the pilot being in a good state of mind, being exceptionally chatty and, later on, recalled them stating that the pilot was ‘really drunk’.

The social function ended at about 0130 on the morning of the accident. Another witness recalled seeing the pilot shortly before driving home from the airport at about 0147, but did not believe that the pilot was significantly impaired by alcohol at that time. The pilot’s quantity and quality of sleep could not be determined.

Post-mortem and toxicology

A post-mortem indicated that the cause of death was due to multiple injuries that were sustained as a result of the collision with terrain. Toxicology indicated low levels of carbon monoxide, consistent within normal levels, and did not detect any common drugs. Toxicology did not detect levels of alcohol within either blood or urine samples.

Aircraft information

General

The Dynaero MCR-01 VLA is a low-wing, high performance, experimental amateur-built aircraft. It was supplied in kit form and VH-SIP was constructed for the education and recreation of the previous owner. The Dynaero MCR-01 VLA was promoted as suitable for cross-country flying, with an airspeed range from 56 to 200 kt. It could be operated between +3.8 g and -1.5 g,[4] however aerobatic flight and intentional spinning of the aircraft were prohibited.

Airworthiness and maintenance history

The aircraft was constructed from a kit and had a special certificate of airworthiness issued on 15 May 2003, and was first flown on 22 May 2003. The aircraft was powered by a horizontally opposed, 4-cylinder, dual carburettor, Rotax 912 ULS-FR, that was manufactured in May 2002.

On 6 November 2003, the canopy of VH-SIP shattered while the aircraft was in flight. This led to a loss of control and the aircraft entering a spin at altitude. After recovering controlled flight, the pilot conducted a forced landing into a paddock, which resulted in significant damage to the aircraft. VH-SIP was repaired over a period of about 18 months, and during this time, the carburettors were removed, cleaned and refitted. The aircraft was returned to service in April 2005.

Among other work carried out on the aircraft, the logbook recorded that, in September 2006, the carburettors were again cleaned and refitted. The aircraft did not fly between November 2009 and November 2013 (4 years). In August 2013, the original owner conducted maintenance on the aircraft for the last time. The aircraft was flown on 4 occasions in 2014, and then was inactive for over 5 years.

On 13 January 2019 the aircraft logbook indicated that work had been conducted on the fuel system and carburettors of VH-SIP, including a new fuel drain valve, removal and cleaning of the carburettors, the installation of new idle jets, O rings and new carburettor float bowl gaskets. Oil and oil filter replacements were also carried out, and the fuel system was flushed with 10 L of aviation gasoline (AVGAS) before being ground run.

In 2020, the aircraft was offered for sale. A pre-purchase inspection was undertaken on 22 May 2020 by a Recreational Aviation Australia Level 2 maintenance engineer on behalf of a prospective buyer. The engineer did not consider the aircraft to be in an airworthy condition due to contaminants in the carburettors, unactioned carburettor float service bulletins, and the mandatory rubber component replacement requirements had not been carried out. Subsequently, the condition of the aircraft was reported to the prospective buyer and the sale did not proceed.

The licenced aircraft maintenance engineer (LAME) at Serpentine ALA was contacted by another prospective buyer in early December 2020 to conduct a pre-purchase inspection before the aircraft was due to be auctioned. The LAME advised the prospective owner that they considered the aircraft to be in good condition, however it would require an annual inspection. Several days later the LAME was contacted by the buyer and advised of the successful acquisition of the aircraft and requested that the LAME carry out the work required to issue a maintenance release. The last entry in the aircraft maintenance log was on 27 December 2020, the day prior to the accident. It showed the most recent work conducted by the LAME.

Engine preservation and return to service

Preservation and storage requirements apply to aircraft engines fitted to an aircraft, as well as uninstalled engines. The Rotax operator’s manual had preservation and storage requirements for long out-of-service periods that were required to be repeated every year the engine was inactive. This included inhibiting the engine both internally and externally and covering all of the engine’s openings to protect it from dirt and humidity. The line maintenance manual limited the storage period for engines to 24 months, and if this period had been exceeded, the engine required overhaul.

The engine manufacturer had an aircraft engine return to service schedule for Rotax 912 engines after a prolonged period or during preservation. These requirements included conducting the normal 100-hour inspection before flight if the engine has been preserved for greater than 12 months.

Return to service tasks

At the request of the new owner, the LAME performed the return to service over a period of several days. The LAME recalled that, during this work, the floats were removed from the carburettor bowls and weighed for discrepancies, refitted, and a carburettor balance was conducted. The LAME also recalled conducting a fuel calibration by draining and replacing the fuel at set increments to ascertain if the fuel quantity markings were correct. Additional work carried out included a periodic inspection, instrument and systems checks, a compression test, engine idle adjustment, and engine ground runs.

Logbook entries detailed that the airframe was inspected in accordance with the Dynaero schedule and considered airworthy along with entries stating:

• the propeller was inspected and found to have nil defects evident
• the engine was inspected in accordance with the BRP-Rotax 912 maintenance manual and CASA AD/ENG/4 with nil defects evident
• service bulletins for the flaps, main landing gear attach, trim tab attach, and canopy attach were carried out
• pitot-static leak tests
• engine-driven fuel pump was replaced
• the 5-year carburettor rubber part and coolant hose replacement was carried out in addition to fitting a new fuel pump and spark plugs.

A maintenance release was issued by the LAME on 27 December 2020 at an aircraft time in service of 439.3 hours. There were 3 endorsements on the maintenance release:

• an engine oil and filter change at 489.3 hours
• a periodic inspection by 539.3 hours or 26 December 2021
• the oil and fuel hoses to be changed by February 2021.

The LAME recalled that the oil and fuel hose replacement entry had been added because the required parts were not available to be sourced and therefore could not be fitted during the aircraft’s return to service.

The other required parts were supplied by the engine importer directly to the LAME in mid-December 2020. Some of these parts were replaced during the return to service, however a few unused parts in their original packaging were found in the aircraft at the accident site.

After the aircraft was returned to service, it underwent a number of other maintenance troubleshooting checks the day prior to, and the morning of the accident. These checks included the removal and replacement of key parts, such as the refitting the original time-expired engine‑driven fuel pump for troubleshooting purposes, however these changes were not documented.

The pilot also conducted several ground runs along runway 09 before becoming airborne and conducting a circuit.

Fuel

The aircraft operated on AVGAS and had the capacity to carry 79 L of usable fuel, in one 80 L main tank. The aircraft was reportedly refuelled prior to the proposed departure from Serpentine ALA the day before the accident, and the new owner estimated that about 60-65 L would have been on board at the time of the accident. ATSB investigators confirmed a strong smell of fuel at the accident site.

Weight and balance

Weight and balance information retrieved from the accident site indicated the aircraft had an empty weight of 261 kg and a maximum take-off weight of 490 kg. The difference left about 229 kg of useable payload for the pilot and fuel. Weight and balance calculations placed the centre of gravity towards the forward limit of the envelope, and within limits.

Amateur-built aircraft

Pilots and passengers of experimental aircraft in Australia accept the risk that the aircraft may not meet the same airworthiness safety standards as certified aircraft, and operate these aircraft on the basis of informed participation.[5] Most amateur-built aircraft are constructed in Australia for the owners education and leisure, however in time many are sold to other private operators.

Operating limitations

Aircraft operating limitations were contained within the aircraft flight manual and the relevant stall airspeed limitations are detailed in Table 1.

Table 1: Stall speeds at 400 kg maximum take-off weight

The flight manual also described the recommended glide speed of the Dynaero MCR‑01 VLA of 70 KIAS with a 13.4:1 glide ratio,[7] indicating that the Dynaero MCR-01 VLA has a higher glide speed compared to many other low inertia aircraft in a similar weight category.

Aerodynamic stall speeds considerably increase beyond a 30° angle of bank turn (Table 1). Pilots should be aware these of characteristics during emergency manoeuvring.

The Dynaero MCR-01 VLA flight manual indicates the emergency procedure for an engine failure after take-off (Figure 2). Specifically mentioned, for engine failures immediately after take-off, is not to attempt a 180° turn to return to the runway.

Figure 2: Engine failure on take-off procedure

Source: Dynaero MCR-01 VLA flight manual

Meteorological information

Bureau of Meteorology graphical area forecast for the Serpentine local area indicated that at the time of the accident, that visibility was greater than 10 km with nil significant weather issues. However, moderate turbulence was expected below 10,000 ft over land in thermals and dust devils.

At about the time of the accident, Jandakot Airport, about 30 km to the north of Serpentine, recorded an easterly wind of about 13 kt with visibility greater than 10 km and no significant cloud or weather.

Witnesses at the airfield described the weather as a ‘belting easterly’ and similar to the previous day with hot, dry and windy conditions.

Wreckage information

Site and wreckage examination

The accident site was located in relatively flat and open farmland (Figure 3), about 200 m east of the threshold of runway 23 at Serpentine ALA. The ATSB conducted an examination of the site and wreckage and identified:

• ground impact marks indicated that the aircraft had impacted terrain nose-down, upright and with left rotation
• flaps were in the retracted position.

No pre-impact defects were identified with flight controls or aircraft structure. The fuel tank, located between the cockpit and engine compartment, had ruptured and a quantity of fuel had leaked into the soil. There was no pre- or post-accident fire.

A damaged GPS device, instrumentation including a fuel flow indicator, the engine, propeller, and fuel lines, were recovered from the accident site for further technical examination by the ATSB.

Figure 3: Accident site

Source: ATSB

Engine examination

The engine was disassembled and examined at a Civil Aviation Safety Authority (CASA) approved engine overhaul facility under the supervision of the ATSB. Apart from impact damage, the main engine components were generally in good condition.

Testing and dis-assembly of the carburettors and fuel system identified:

• the left carburettor was missing a clip that attached the float needle valve to the float hinge bracket
• corrosion was identified in both carburettor bowls and on both sets of carburettor floats
• significant corrosion deposits were found on the float needle valve, seat and on the valve tip
• carburettor floats were the incorrect type
• the right carburettor float guide pin was bent, causing float contact with side of carburettor bowl
• fuel line internals were perished and brittle with splitting at the securing end.

Further details relating to the engine teardown can be found in Appendix B – Engine examination.

Partial power loss

Partial power loss on take-off

The ATSB booklet, Avoidable Accidents No.3: Managing partial power loss after take-off in single engine aircraft (AR-2010-055) (Australian Transport Safety Bureau, 2013), describes partial engine power loss as a situation when the engine provides less power than commanded by the pilot, but more power than idle thrust:

This kind of power loss is more complex than a complete failure, and it can be much harder to stay ahead of the aircraft. The pilot is thrust into a situation where the engine is still providing some power; however, the power may be unreliable, and the reliability may be difficult to assess. As a result, pilots are uncertain about the capabilities of their aircraft, and what their options are.

Partial engine power loss can range from providing very little power to almost full power, with varying levels of reliability of the remaining engine power. When faced with a partial power loss, pilots should not try to diagnose the engine problems at the expense of maintaining aircraft control.

On take-off, once the aircraft climbs to a point where it does not have enough runway to land straight ahead, but is not high enough to safely return to the aerodrome for a landing, it has reached a ’no return’ to the runway decision point (Figure 4). From this point, until the aircraft climbs to a height allowing safe return to the runway, the pilot is faced with conducting a forced landing beyond the prepared surface of the airfield. Decisions made by the pilot in command can be critical to the safety of flight at this point. 

Figure 4: No return decision point

Source: Google Earth, modified by the ATSB

In the event of any emergency during critical phases of flight, such as below 200 ft above ground level (AGL) on take-off in a single engine aircraft without runway remaining, pilots should focus on the priorities of:

• Aviate: maintain glide speed and assess whether the aircraft is maintaining, gaining or losing height to gauge aircraft performance
• Navigate: fly the aircraft to make a landing, if height and power are limited, then an into wind landing, 30° left or right of the centreline is a safer option
• Communicate: Mayday call as appropriate.

Pre-take-off safety brief

The pre-take-off safety brief is a verbal and mentally prepared response, through the pre-visualisation of an emergency on take-off and is generally conducted once all engine run-ups are complete and prior to entering the runway. The brief mentally prepares a pilot with pre-programmed responses to possible unexpected events during this critical phase of flight when decision making time is short.

These anticipated actions in response to certain stimuli, assist pilots in making better decisions in accepting emergency circumstances and safely managing emergencies, especially when an off-airfield landing may be the safest option.

The briefing should include the pilot in command’s intentions in the event of an engine related problem during the take-off roll and after take-off, both with runway remaining and without. This formulates pre-existing mental models of possible actions should an emergency arise. 

A pre-take off safety brief should include:

• consideration of the runway in use, it’s length, surface, boundary fencing and possible forced landing areas beyond the runway, including terrain and obstacles
• wind direction and strength, which will indicate the safest into wind turning options to safely maintain airspeed and provide a lower groundspeed in case of a forced landing beyond the airfield boundary
• consideration of required height and direction of turn, to conduct a turn back to the runway

The ATSB Avoidable Accidents booklet provides sound guidance to pilots on this subject and concludes that:

Generally speaking, if you self-brief your plan of action just before flight, you have more chance of ‘staying ahead’ of the aircraft and being able to concentrate on flying.

The turn back

The turn back is described as the conduct of an emergency manoeuvre to reverse the direction back towards the take-off runway, to either conduct a landing on the reciprocal runway or to land at another runway at the original departure point.

During this critical time, the pilot must assess four main considerations for the safe conduct of a turnback:

• Is the height sufficient to safely turn the aircraft back to the runway?
• Is there remaining power available to continue to climb or maintain height?
• Can a safe airspeed be maintained during the turn, taking into account the increased stall Speed associated with an increased angle of bank to prevent aerodynamic stall?
• assuming that the engine may fail at any time, is the remaining power reliable?

The ATSB Avoidable Accidents booklet noted:

A turnback requires accurate flying during a period of high stress to prevent a stall and possibly a spin occurring. If an aerodynamic stall and or spin occurs, given that these circumstances are likely to be at low level, there is little likelihood of a successful recovery.

There are many scenarios where it might be considered inappropriate to conduct a turnback. For example, consideration should be given to additional hazards such as other aircraft, obstacles, an unfavourable wind component, increased stall risk during a low-level turn and surrounding terrain.

Pilot decision making during partial power loss

The ATSB Avoidable Accidents booklet also detailed influences on decision making affecting pilots:

The course of action chosen following such a partial power loss after take-off can be strongly influenced by the fact that the engine is still providing some power, but this power may be unreliable. As the pilot, you may also have a strong desire to return the aircraft to the runway to avoid aircraft damage associated with a forced landing on an unprepared surface.

Based on an analysis of partial power loss accidents after takeoff, the booklet further noted that pilot decision making is also influenced by the amount of power loss experienced. In situations where power loss is substantial, pilots are more likely to recognise this as being close to a complete loss of power and typically conduct a forced landing outside of the runway environment. However, if the remaining power is sufficient to continue climb, albeit at a reduced rate, pilots were able to take advantage of increased options, such as a continuing a circuit or conducting a turn back towards the runway.

However, the ATSB identified a period between these 2 areas that represented a region of heightened uncertainty (Figure 5). In this region, excess power was not available to climb but there was sufficient power to prevent appreciable descent, resulting in a period of flight uncertainty where the aircraft may not be able to maintain height without bleeding off airspeed, eventually resulting in the aircraft slowing to maintain or gain height and increasing the risk of aerodynamic stall.

Figure 5: Region of heightened uncertainty during partial power failures on take-off

Source: ATSB

The ATSB identified that 8 out of 9 partial power loss accidents resulting in fatal injuries occurred with mid-range power loss. Inconsistent power or engine surging from high to low RPM present complex problems to the pilot. Inability to maintain height with partial power loss usually leads to aircraft stall and loss of control, mostly resulting in collision with terrain.

Transition to unfamiliar aircraft

General competency

In order for a pilot to operate a different aircraft type already covered by their licence category and class rating, they need only be satisfied that they are competent under Civil Aviation Safety Regulation (CASR) 1998.

CASR 61.385 Limitations on exercise of privileges of pilot licences – general competency requirement stated:

(1) The holder of a pilot licence is authorised to exercise the privileges of the licence in an aircraft only if the holder is competent in operating the aircraft to the standards mentioned in the Part 61 Manual of Standards for the class or type to which the aircraft belongs, including in all of the following areas:

(a) operating the aircraft’s navigation and operating systems;

(b) conducting all normal, abnormal and emergency flight procedures for the aircraft;

(c) applying operating limitations;

(d) weight and balance requirements;

(e) applying aircraft performance data, including take-off and landing performance data, for the aircraft.

Guidance on transition

While no definitive Australian guidance provided advice on the transition of pilots to unfamiliar aircraft, the Federal Aviation Administration (FAA) advisory circular AC90-109A – Transition to Unfamiliar Aircraft (U.S. Department of Transportation Federal Aviation Administration, 2015) is a widely recognised and utilised publication providing a sound basis to consider the hazards of transitioning to unfamiliar types of aircraft, whether certified or experimental.

The AC recognises the importance of providing guidance to pilots transitioning between aircraft types, or to experimental aircraft with differing design features to high performance and complex aircraft. It recommends that pilots’ should develop a training strategy (Figure 6) for mitigating the risks of operation of an unfamiliar aircraft type.

The FAA AC recommend that:

Prior to flying an unfamiliar airplane, all pilots should review the hazards and risks outlined in this AC, and complete the training recommended before operating the airplane. Accident data has shown that there is as much risk in “moving down” in performance as “moving up.” For example, consider a pilot who has substantial experience in high-performance corporate, airline, or military airplanes. The knowledge and skills used to safely fly at high speeds, high altitudes, and over long flights will, by themselves, not prepare the pilot for the challenges of a low-inertia, high-drag airplane.

Figure 6: FAA recommended airplane transition training approach

Source: FAA AC90-109A

The guidance recommends firstly that pilots should consider undertaking flight training with a qualified flying instructor in the proposed transition aircraft, the same make and model or an aircraft that exhibits the same design features or characteristics of the transition type. If instruction is unavailable, seek another experienced pilot to conduct a familiarisation flight; however, if unwilling, at least discuss the differences and expected characteristics of the transition aircraft.

The guidance further recommended that pilots take a risk management approach to formally identify the hazards and mitigate any known or elevated risks identified.

These may include:

• specific type training in the transition aircraft or similar type/design features
• safety equipment such as helmets, fire extinguishers or parachute
• condition, maintenance and history of the transition aircraft
• review of aircraft operating limitations
• plan transition flights to conservatively build up manoeuvres and aircraft experience
• conducting initial flights in benign weather conditions

Fitness for flight

Regulatory requirements

CASA identifies that any amount of alcohol in your body may affect a pilot’s fitness to safely operate an aircraft.

Subparagraphs 91.520(2)(b)(i), (ii) and subregulation 91.520(5) of CASR outlines a crew member for a flight (pilot) commits an offence if they consume alcohol at any time during the period of 8 hours ending when the flight begins, or if a test of a body sample of the crew member to determine the level of alcohol in the sample was taken at the time of carrying out the duty (and) the test reveals that the permitted level for alcohol (within the meaning of Part 99) is exceeded.

Part 99 of CASR defines –

permitted level means:

• (a)    for a testable drug—a level of the drug specified in subregulation (2A) for the purposes of this paragraph; and
• (b)   for alcohol—a level of alcohol of less than 0.02 grams of alcohol in 210 litres of breath.

This means pilots should give considerable and reasonable thought to the amount and rate of alcohol consumption in order to determine if residual alcohol levels may affect cognitive functions, such as decision making, reduced attention and physical ability during the intended flight.

Post alcohol impairment

Post-alcohol impairment (PAI) has been defined as performance impairment after alcohol is no longer detectable. While the performance decrement of pilots under the influence of alcohol is well known and documented, the effect of post-alcohol impairment, commonly known as a ‘hangover’, is less tangible.

Although pilots must not operate an aircraft within 8 hours of the consumption of alcohol, a pilot’s ability to make normal and emergency decisions may be impaired even after the blood alcohol concentration (BAC) has returned to zero.

Research conducted for the ATSB (Newman, 2004) into alcohol and human performance highlighted that:

In simple terms, alcohol impairs human performance…

It has detrimental effects on cognitive functions and psychomotor abilities. Risk taking behaviour may result, and a full appreciation of the consequences of a planned action may not be possible… Adverse effects can also persist the day after alcohol ingestion, with reductions in alertness, concentration and vestibule-ocular function, and increases in anxiety all being reported…

Alcohol has been shown to impair registration, recall, and organisation of information, leading to increased reaction times and/or a greater number of errors…

…performance has also been found to suffer most when an unexpected or unanticipated event occurs.

A study found that 14 hours after alcohol ingestion leading to a BAC of at least 0.10%, pilots performed much worse at a flight simulator task at a time when their BAC had returned to 0 (Yesavage & Leirer, 1986). Pilot performance was measured and found worse on almost every level, with detriments to precision and accuracy being highlighted. It was also found that pilots were not able to accurately judge their own degree of impairment and concluded that such performance effects would still be measurable sometime after 14 hours.

The ATSB study (Newman, 2004) also found that:

The alcohol-induced impairment of cognitive performance becomes more evident when the nature of the flying task becomes more complex and demanding, such as in an emergency situation. A pilot suffering from the effects of post-alcohol impairment may not handle such a high-workload emergency appropriately, due to reduced attention, a slower rate of information processing, increased reaction time, and poor decision-making. All of these could ultimately result in an accident.

Safety analysis

Introduction

On 28 December 2020, the pilot of a Dynaero MCR-01 VLA, registered VH-SIP, was conducting post-maintenance troubleshooting check flights at Serpentine Airfield, Western Australia. While at about 300 ft above ground level (AGL), on the second flight for the day, the engine began to run rough. Shortly after, and while most likely attempting to return to the airfield, the aircraft’s left wing was observed to drop, the nose pitched down, rotate to the left, and impact terrain.

This analysis will explore airworthiness considerations pertaining to VH-SIP, its return to service, the pilot’s experience on the aircraft type and its effect on emergency management, and the effects of post-alcohol impairment.

Return to airfield and stall

A partial power loss occurred at about 300 ft AGL on take-off from runway 09. Although alternative ‘off-runway’ landing areas were available, the pilot elected to continue flight while manoeuvring the aircraft towards the eastern end of runway 15. 

Manoeuvring an aircraft to return to the airport during critical periods of the initial climb, with inconsistent and unreliable power output, significantly increases risk.

With a combination of turning downwind, marginal power and performance, potentially an attempt to maintain altitude, probably led to the aircraft decelerating. During a further left turn towards runway 15, this decrease in airspeed likely resulted in the left-wing stall at about 200 ft AGL, that did not afford the pilot an opportunity to successfully recover.

Airworthiness of VH-SIP

Return to service

VH-SIP had 3 periods of inactivity, about 18 months, 4 years, then 5 years. There was no record in the logbooks for VH-SIP to indicate its engine had been preserved, however the logbook states the carburettors were cleaned on 3 occasions, with the most recent being in January 2019.

The requirement to replace time-limited components every 5 years was partially carried out. Some of the fuel lines that were not replaced were found to be in poor condition when examined at the overhaul facility after the accident. However, it could not be determined if this contributed to the engine rough running prior to, and on the day of the accident.

Engine defects and partial power loss

The preliminary examination of the engine at the accident site, and the subsequent engine examination at an overhaul facility did not identify any pre-impact mechanical defects. However, both carburettors were found to contain contamination, most likely forming during the aircraft’s extended periods of inactivity.

This contamination that was not rectified prior to the aircraft being released for service, or during the subsequent troubleshooting of the engine rough running. Additionally, there was no record of the fuel system being inspected and cleaned in accordance with the manufacturer’s requirements when carburettor contamination has been identified.

The flooding that was observed during multiple tests of the left carburettor, was the result of significant contamination on its float needle valve and seat. Given the amount of contamination, the left carburettor was likely flooding prior to the accident, and as carburettor flooding is known to result in fuel odour, would have been the likely source of the reported fuel smell.

It’s possible the contamination in both carburettors, along with the absence of the clip that attached the float needle valve to the float hinge bracket, resulted in the rough running of the engine at high power settings.

Ongoing maintenance of an aircraft’s fuel system is essential to ensure fault-free operation of its engine. In particular, the reliability of carburettors is dependent on their condition, and by following the manufacturers maintenance requirements and service bulletins.

Unfamiliarity with aircraft type

Although experienced in passenger transport operations and heavier multi-engine aircraft, the pilot was not as experienced in flying lighter general aviation aircraft, with even less experience in very light, low inertia aircraft such as the Dynaero MCR-01 VLA.

The safe conduct of post maintenance flights and troubleshooting of aircraft systems requires pilot familiarity and experience in the aircraft type, its design features and its normal and emergency operating parameters.

Although appropriately licenced, the pilot had never flown a Dynaero MCR-01 VLA previously and had limited experience with low inertia aircraft, as well as the engine and the propeller type fitted to VH-SIP.

The conduct of a post maintenance flight with limited pilot experience and knowledge in the aircraft and its systems, increased the likelihood that the pilot would be unable to effectively manage any in-flight emergency.

Post alcohol impairment

Post-alcohol impairment is of particular importance in aviation. While regulations require a minimum time between drinking and flying, there is considerable evidence that pilot performance may be impaired for much longer periods. Post-alcohol impairment can increase the potential for spatial disorientation for up to 48 hours. While a pilot may be legally able to fly eight hours after drinking, the residual effects of alcohol may seriously impair their performance when they need it most, such as during an emergency.

Witness accounts of reported alcohol consumption the night before the accident, increased the likelihood that the pilot would have been experiencing some level of post alcohol impairment that may have contributed to reduced cognitive function which could have affected the pilot’s decision making during the partial power loss after take-off.

Findings

From the evidence available, the following findings are made with respect to the partial power loss and collision with terrain involving, Dynaero MCR-01 VLA, VH-SIP near Serpentine Airfield, Western Australia, on 28 December 2020.

Contributing factors

• Shortly after take-off, the engine experienced a partial power loss. The pilot turned the aircraft to the left most likely in an attempt to return for landing.
• At about 200 ft above ground level, with low airspeed and no flap selected, the left wing aerodynamically stalled. This resulted in the aircraft entering into an upright spin, at an altitude that limited an effective recovery.
• Multiple tasks in the aircraft’s return to service after a significant period of inactivity were not carried out adequately before the aircraft was released to service.
• The left carburettor contained contamination that likely resulted in flooding at low power, and rough running at high power settings.
• The pilot did not adequately manage the risk of transitioning to an unfamiliar aircraft type, further increasing the risk of not being able to adequately manage in-flight emergencies during post maintenance flights.

Other factors that increased risk

• The pilot had probably consumed a significant amount of alcohol the night before the accident, which increased the risk of post-alcohol impairment.

Glossary

AGL                  Above ground level

ALA                  Aircraft Landing Area

ATSB                Australian Transport Safety Bureau

AVGAS             Aviation gasoline

BAC                 Blood alcohol concentration

CASA               Civil Aviation Safety Authority

FAA                  Federal Aviation Administration

GPS                 Global positioning system

KIAS                 Indicated airspeed

LAME               Licenced aircraft maintenance engineer

PAI                   Post alcohol impairment

RPM                 Revolutions per minute

VFR                  Visual flight rules.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• witnesses that operated the aircraft the day before the accident flight
• Civil Aviation Safety Authority
• Western Australian Police Service
• aircraft manufacturer
• engine manufacturer
• maintenance organisation
• Airservices Australia
• Bureau of Meteorology
• accident witnesses
• video footage of VH-SIP the day before the accident flight and other photographs and videos.

References

Australian Transport Safety Bureau. (2013). Avoidable Accidents No. 3 Managing partial power loss after takeoff in single-engine aircraft. Canberra: Australian Transport Safety Bureau.

Newman, D. G. (2004). Alcohol and Human Performance from an Aviation Perspective: A Review. Canberra: Australian Transport Safety Bureau.

U.S. Department of Transportation Federal Aviation Administration. (2015, July 06). AC 90-109A Transition to Unfamiliar Aircraft. Washington DC: U.S. Department of Transportation Federal Aviation Administration.

Yesavage, J. A., & Leirer, V. O. (1986). Hangover effects on pilots 14 hours after alcohol ingestion: a preliminary report. American Journal of Psychiatry, 1546-1550.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Civil Aviation Safety Authority
• the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile
• engine manufacturer
• a LAME witness
• the aircraft owner
• maintenance organisation.

Submissions were received from:

• Civil Aviation Safety Authority
• A LAME witness.
• the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Sequence of events

Source: ATSB
 

Overview

At approximately 0407 on 8 January 2021, Pacific National (PN) freight train 5936, travelling in the up direction (towards Sydney) failed as a result of wheelslip inside Boronia tunnel No. 3 while travelling on the steep grade on Cowan bank. Following discussion between the Signaller Hornsby North (SHN) located in the Homebush Control Centre (HCC) and the Train Service Delivery Manager Central Coast (TSDMCC) located in the Rail Operations Centre (ROC), the train crew were directed to propel the train backwards into the Hawkesbury River Up Refuge siding in order to keep the up main line clear.

Two members of the train crew, the assistant driver and a trainee assistant driver were required under the network rules for propelling trains to walk back along the length of the train to the last vehicle in order to direct the propelling movement. Because of the terrain and lack of a safe place beside the track the two workers needed to walk on the adjacent down main line. In order to protect these workers, the driver of 5936 requested protection from the SHN. This protection was provided in the form of rail signals placed to stop to prevent a train from entering the area.

While the workers made their way to the rear of the train, the driver of 5936 reported at interview that they were suffering the ill effects of diesel exhaust inhalation as the leading locomotive was inside Boronia tunnel No. 3 and exhaust fumes had built up in the tunnel and entered the cab. There was no breathing apparatus available to the driver on board to assist with managing this situation.

Once the two workers were in position at the rear of the train, the driver of 5936 confirmed with the SHN that the route was set for the movement and proceeded to propel the train backwards, under the direction of the two workers, towards Hawkesbury River Up Refuge siding. As the two workers were walking in advance of the train on the adjacent down main line, they observed the lights of an oncoming train. The two workers told the driver of 5936 to stop the propelling movement and the train was brought to a stand. The workers jumped clear of the down main onto the adjacent cess area, with one of the workers suffering an injury.

A passenger train, 247B, passed the workers on the down main, travelling in the up direction around train 5936. The driver of 5936 contacted the SHN and requested an explanation from the signaller about why a train had been permitted to run on the down main while there was meant to be a signal block in place to protect the workers.

The SHN told the driver the signal block had been removed once the propelling movement started, mistakenly thinking the workers were clear of the down main line. The signaller was not familiar with either the propelling procedure or the network terrain and was not aware that the workers were still walking adjacent to and in front of the propelling freight train, as they are required to do under the Sydney Trains Network Rules. The incident was not reported at the time by the SHN. The incident was reported by the driver of 5936 to their control centre, but it was not acted upon at the time. The incident came to notice when the trainee worker reported an injury resulting from jumping out of the way of train 247B.

Context

Train information

Train 5936 consist

Train 5936 was a Pacific National freight train hauling grain from Moree Wheat Silo to Bomaderry. It consisted of four 82 class diesel electric locomotives (8214, 8213, 8244, 8232) hauling a consist of 52 loaded wheat hopper wagons (25 x NGKF wagons and 27 x NGPF wagons).

The train length was 831.6 m and the mass was 4134 t.

Figure 1: 82 class Pacific National locomotive

Source: Pacific National 

Train 5936 journey

Train 5936 departed Moree Wheat Silo on Thursday 7 January 2021 at 1230. There was a crew change at Morandoo at 0030 on Friday 8 January 2021. The incoming crew consisted of a driver, an assistant driver and a trainee assistant driver.

Train 247B

247B was an eight car OSCar NSW TrainLink passenger service operating from Newcastle to Central.

Train crew information 5936

Driver

The driver was an employee of Pacific National with 21 years and four months experience. The driver possessed the requisite qualifications to operate the type of train and to operate over the route. They were trained in protection arrangements for in-service rail traffic in 2016.

Assistant driver

The assistant driver was an employee of RailTrain, a rail labour hire company with a contract with Pacific National, with four months experience. The assistant driver possessed the qualifications to be a second person but did not possess the requisite qualifications to operate the type of train over the route. The assistant driver was trained in protection arrangements for in-service rail traffic in September 2020.

Trainee assistant driver

The trainee assistant driver was an employee of RailTrain with three weeks experience. The trainee assistant driver did not possess the requisite qualifications to be a second person or operate the type of train over the route. The trainee assistant driver was trained in protection arrangements for in-service rail traffic in December 2020.

Signaller information

The SHN advised they were first qualified in signalling in 2002, however Sydney Trains could not locate any signaller training records for this worker until 2007. The SHN had worked at a variety of signal boxes and control centres including Penrith, Springwood, Auburn, Katoomba, Blacktown, and a number of control panels in the Homebush Control Centre.

Signaller performance

Between 2015 and 2021 the SHN had received coaching, counselling or retraining, post incident on 18 separate occasions. These incidents included:

• Faulty manipulation of signalling equipment that resulted in delays
• Misrouting of trains
• Incorrect setting of train route
• Delays in setting of routes.

The most serious incident involved an occurrence at Penrith where the SHN had allowed a freight train to enter a section that was subject to Block Working. Block Working is an operational method where rail traffic is not permitted to enter a section until previous rail traffic is reported as clear of the block ahead. In this case it was a set of track machines that do not operate signalling track circuits like a train. To secure their safety, these machines operate under Block Working conditions.

Allowing a following train to enter the section without ensuring the track machines were clear of the block ahead ran the risk of a collision.

Signaller training

The SHN held all the necessary safeworking qualifications to operate the Hornsby North panel at HCC. Sydney Trains manages the safeworking certification and qualifications arrangements for rail safety workers through two standards, the Network Rules and Network Procedures Certification Standard, and the Network Rules and Network Procedures Training Standard.

Each standard contains a matrix of information. The Certification Standard details those competencies applicable to each role and assigns a code to that role. The code is then expanded upon in the Training Standard that details the specific Rules and Procedures applicable to that role, and what must be contained in the training package for that role.

The code for a signaller is C105, Control Rail Traffic Movements level 1. For the code C105, a training package must contain instruction in 51 Network Rules, 39 Network procedures and how to complete 10 different Network Forms. The training package for signallers includes the Train Working Network Rules for propelling trains, NTR 424, and protecting activities associated with in-service rail traffic, NTR 432.

Each Rule, Procedure and associated forms may have several individual requirements, so the knowledge requirement for a signaller runs into several hundred individual steps, processes and tasks.

In addition to the Network Rules and Network Procedures, Sydney Trains has other operating requirements known as Operator Specific Procedures, Special Instructions and General Orders. The signaller role training requirements in these procedures, instructions and orders are not captured by the Network Rules and Network Procedures training process.

A signaller must have current knowledge and competency in a large array of rules, procedures, instructions, and orders to perform safely and efficiently.

Localised training and assessment

Each signal control panel in the Sydney Trains network has its own Localised Training and Assessment (LTA) process. The LTA for Hornsby North panel does not include scenario-based training to deal with a failed train on Cowan Bank, despite it being a common occurrence, nor any network familiarisation training to ensure that signallers can visualise the network they are managing.

Network Control

Rail Operations Centre (ROC)

Sydney Trains has a centralised control room called the Rail Operations Centre (ROC) where a number of functions are co-located. The functions include train control and supervision, incident management, customer information, security and infrastructure control. Working within the ROC are Train Service Delivery Managers (TSDM) and Network Incident Managers (NIM) who work with signallers, train crew and others to manage train operations, work on track and other functions.

Train Service Delivery Manager (TSDM)

TSDM is the Sydney Trains business term used for what is referred to in the Sydney Trains Network Rules and Procedures as the Network Controller. TSDM are responsible for train running, planned possessions and planned work on track authorities. There are five TSDM areas, Central Coast, North, Main, Illawarra, and South West.

The TSDM principally involved in this incident was the TSDM Central Coast. The TSDM Central Coast is described as the TSDMCC in this report.

Figure 2 Rail Operations Centre (ROC) control room

Source: Sydney Trains

Signal box operations

Sydney Trains has a number of small signal boxes and larger control centres in the network where signallers control the trackside signals to give proceed authorities[1] for trains to operate. Signallers also provide protection for workers doing maintenance and other activities, such as train crew attending to their train while in service.

Signallers do this by putting signals to stop and applying blocking facilities[2] to prevent them from being cleared, thereby excluding trains from entering the area where work is occurring. There are several Network Rules and Procedures that govern this activity.

Assurance and oversight of signallers is undertaken by Signal Box Operations (SBO), who provide line management functions and ensure operational requirements are delivered safely and in accordance with the relevant rules, procedures and standards. This assurance activity can take the form of:

• review of recorded audio to check compliance with communications protocols and application of rules and procedures
• review of applicable forms and documents to ensure that details have been completed as required
• review of similar incident types to check on outcomes and application of standard requirements.

SBO is an operating section of the Sydney Trains Customer Operations Branch. SBO is responsible for managing all signallers and signal boxes in the network.

Location

Sydney Trains network – Cowan Bank

Cowan Bank is a steep and curving section of track that runs from Hawkesbury River up to Cowan station, a distance of approximately 9 km. The section consists of the Up and Down Main lines, features four tunnels and the signalling system is rail vehicle detection bi-directional.

Trains travelling in the up direction towards Sydney from Hawkesbury River encounter steep rising gradients as much as 1:37. A rising gradient refers to the graded rate of ascent. A 1:37 rising gradient means that for every 37 m travelled, the track rises 1 m.

The bi-directional signalling system means trains can operate in either direction on either track as there are signals provided to control movements in both directions. This type of signalling is a feature in areas on the network where there are steep grades and trains have a greater risk of being unable to continue due to mechanical faults, or as in the case with 5936, excessive wheel slip.

The rail line winds through a narrow corridor and access and space is limited. The line in the section from Hawkesbury River to Cowan station is formed of many cuttings made into the hillside to house the rail tracks.

Figure 3: Entry to Boronia Tunnel No. 3 in the up direction

Source: Sydney Trains

Hawkesbury River Up Refuge siding

The Hawkesbury River Up Refuge siding is located within the Hawkesbury River yard. The yard consists of the Up and Down Main lines, the Up Refuge siding, No. 1 and 2 sidings and various points and signals to permit trains to operate. The Up Refuge siding has a stowing capacity of 877 m including the use of No. 2 siding.

Figure 4: Diagram of Hawkesbury River

Rail lubricators

Rail lubricators are engineering devices designed to deliver rail lubrication to the wheel-rail interface to reduce wear and wheel squeal noise. Three rail lubricators were installed and active on the Up Main track between Hawkesbury River and Cowan at the time of the incident.

Delivery of excessive lubricant to the rail can induce wheel slip in a train, leading to a lack of adhesion between the rail and the wheel face and the train being unable to continue.

Rail safety systems and rules and application

Protecting activities for in service rail traffic

Sydney Trains describes their Train Working (NTR) Rules as prescribing the Network requirements for operating trains and track vehicles, including the maintenance of train integrity, and management of equipment defects by Operators, Train Crews and Track Vehicle Crews. Train Working Network Procedures (NPR) describe how particular actions are to be done to apply the Network Rules.

Sydney Trains has specific Train Working Network Rules (NTR) and Procedures (NPR) for protecting people when attending to trains which are in service on the network. The Network Rule is NTR 432 Protecting activities associated with in-service rail traffic and the associated Network Procedure is NPR 750.

The rule and procedure cover situations including where train crew leave their cab to get down on the track and conduct repairs or undertake other activities.

The activities that are undertaken by workers and subject to this form of protection include minor repairs to rolling stock, re-coupling burst air hoses, removing minor obstructions from the track and conducting roll by inspections.

This Train Working rule for protecting people when attending to trains in service and the associated procedure were introduced in 2016, after the SHN had received their foundation training and qualifications, to provide a greater level of prescription about how these on track activities were managed. Previously these activities were managed under the Work on Track (NWT) suite of rules using Absolute Signal Blocking rule NWT 308.

According to RailSafe, Work on Track (NWT) rules prescribe the Network requirements for undertaking activities in the rail corridor and mandate the ways to plan for and achieve the separation of rail traffic from people working on or about track. Principally aimed at maintenance and infrastructure repair, not in-traffic protection.

The new rule and procedure under Train Working (NTR) rules provided a level of assurance for both the signaller applying the protection and the in-traffic worker seeking the protection by compelling the parties to give and receive assurances about the location of the work and the type of work being done. It has similar assurances to the work on track requirements for other tasks like maintenance and infrastructure repair.

NTR 432 operational requirements

NTR 432, Protecting activities associated with in-service rail traffic, has very explicit instructions about what information must be exchanged between the Qualified Worker requesting the protection and the signaller.

Requesting protection

When requesting the protection of activities associated with in-service rail traffic, the Qualified Worker must:

• Provide the train number or track vehicle number
• Identify the lines on which the protection is required
• Nominate the activity location as being:
  • between any two stations
  • completely within a nominated dead-end siding, or
  • completely within the limits of a platform.

Absolute Signal Blocking (ASB)

ASB is a network rule for working on track, Work on Track NWT 308, Absolute Signal Blocking. It works on the principle of rail signals being set to stop with blocking facilities applied to exclude rail traffic from the work area. Within the rule there are several options to provide protection, including:

• Having two controlled absolute signals set to stop with blocking facilities applied or
• Having one controlled absolute signal set to stop with blocking facilities applied and
• Removing an ESML/EOL key, or
• Securing points to prevent access, or
• There being an easily reached safe place available and providing a lookout.

In the case of protecting workers under NTR 432 and NPR 750 Protecting activities associated with in-service rail traffic, while signals are used to protect workers, similar to using ASB, the protection itself is not ASB, as the assurances and requirements are different to ASB and are contained in separate train working rules and procedures, NTR 432 and NPR 750. It is a subtle but important distinction.

ATRICS overview

ATRICS stands for Advanced Train Running and Information Control System, a bespoke system developed in-house by Sydney Trains. ATRICS is a computer-based control system that interfaces with signalling assets to control and monitor their status. It also has an interface with the timetable to automatically set routes for rail traffic.

A signaller will oversee rail traffic operating through the control area of each signalling panel, however in normal circumstances, ATRICS will set routes based on the timetable inputs. The signaller intervenes to control signals manually when there is a need, such as protecting work on track.

The signal control panel the SHN was operating was an ATRICS controlled panel within Homebush Control Centre.

Applying and removing blocks to signals

When a signaller applies blocks to signals on an ATRICS control panel, there are two methods to do so. Manually placing blocks on signals is done directly by the signaller in response to an incident or another circumstance such as a Condition Affecting the Network, where there may be a potential obstruction to the track or other hazard. In this circumstance, the signaller can place and remove signal blocks with no other intervention.

However, when placing signals to stop and placing blocks to protect work on track or workers attending to in-service trains, there are very specific requirements in the rules and procedures about how this is done.

According to NTR 432, Protecting activities associated with in-service rail traffic, the signaller must use an electronic Absolute Signal Blocking (ASB) form to record the application of the signal protection. The extract of the rule is below:

The Signaller must:

• Use a system-generated ASB form, or if that is unavailable, an NRF 018 Absolute Signal Blocking (ASB) form to record the protection details
• Issue a unique protection number to the Qualified Worker requesting the protection.

When using the system-generated ASB form, ATRICS generates a unique code which is associated with the protection and is provided to the worker who has requested the protection. This code is used when ending the protection as an identifier of the correct protection.

NTR 432 requires the use of a system generated form, if it is available, to record the details of the protection. This form is the same as used when applying protection for ASB.

Figure 5: ASB form on ATRICS workstation

Propelling trains

Propelling trains under the network rule NTR 424, Propelling rail traffic, can be a dangerous activity, as a worker or workers may be walking in front of a moving train, and as the driver is not at the end of the movement in the direction of travel, they do not have visibility of the worker(s). There is no procedure that accompanies the network rule to identify and manage risks associated with this activity, unlike other activities that are governed by a rule and a procedure.

Network Communications

NGE 204 is the network General Rule (NGE) applicable to communications. NGE 204 says, in part:

Communication in the Network must be:

• Clear, brief and unambiguous
• Relevant to the task at hand
• Agreed to its meaning before being acted upon.

Communication between the SHN and the driver 5936

The driver of 5936 did not specifically request protection under NTR 432, Protecting activities associated with in-service rail traffic. They requested that a block be put on the signals, and that is what the signaller did. Neither party followed the requirements of NTR 432 in particular the required safety critical communication exchange. The transcript of the recorded audio between the SHN and the driver of 5936 at the time protection was requested is below.

SHN: OK um do you need any protection there for that?

Driver 5936: Yes, if he’s gotta walk on the ah on the opposite track, we definitely need protection. A block for the whole way over.

HNAC: Righto then …ok so …. I’m just putting some blocks on there now….. Just stand by while I do that.

DR5936: Roger that over.

HNAC: Righto I’ve done that there now, so um, I haven’t, so nothing can come up….on that line for ya there so, when you’re ready to walk back and get into position you’re able to do that for me now please.

DR5936: Roger that my mate will walk back now ah so his got the blocks, so his gotta walk back another 832 metres and then get ahead of me. Bit of a way. And then I will proceed down as safely as I can possibly can over.

HNAC: ok thank you for that driver.

Neither party to this conversation specifically mentioned protection being required under NTR 432, which is the relevant rule in this circumstance. All they refer to is “blocks”.

The driver of 5936 did not specify where and for how long the two crew members would be required to walk on the Down Main line while the propelling movement was taking place.

Fatigue management

The SHN was subject to the Sydney Trains rostering and fatigue management arrangements contained in the procedure Managing Shift Work and Rostering procedure, SMS-08-OP-3128 V1.2.

The Pacific National train crew were subject to fatigue management requirements that were derived from their labour management system. No issues of concern were discovered with the fatigue management requirements for the train crew.

The Sydney Trains rostering and fatigue procedure included eight rostering principles to be observed in order to reduce or manage the cumulative effects of fatigue. These eight rostering principles, and a description of these principles, are reproduced below from the Sydney Trains procedure:

The planned, or master, roster and shifts the SHN actually worked for the period from 28 December 2020 to 8 January 2021 is included in the table below.

Environmental conditions

The Bureau of Meteorology (BOM) Terry Hills weather station (located approximately 12.0 km from Cowan Station) recorded a minimum temperature of 15.4˚C and maximum temperature of 20.6˚C. The weather station also recorded 2 millimetres of rain on the date of the incident. The track was wet and slippery and the driver of 5936 reported these conditions added to the degree of difficulty in conducting the propelling movement of a train in excess of 4000 t down a steep gradient. However, while the conditions made the propelling movement difficult, it did not contribute to the incident itself.

Breathing apparatus and welfare of the train driver

Train 5936 was stopped in Boronia tunnel no. 3 for over thirty minutes before the propelling movement commenced. The driver reported at interview suffering health effects from exposure to diesel fumes while stopped in the tunnel. Unlike their coal fleet, Pacific National bulk trains carrying products such as grain do not carry breathing apparatus as part of their standard on board kit.

Reporting incidents

NGE 234, Responsibilities of Signallers is the network rule applicable to the responsibilities of signallers and contains a requirement relating to reporting incidents. Specifically stating, Signallers must:

…..promptly report breaches of Network Rules and Network Procedures to the controlling officer and the Network Controller.

Related occurrences

On 2 March 2022 at 0121, Pacific National freight train CA80 failed on the Down main line at Wondabyne, NSW in the Sydney Trains network. The recovery process for this train, as determined by the Sydney Trains Network Incident Manager, involved attaching a following freight train, 1423, to the rear of CA80 and pushing it out of the section to Gosford.

A member of the crew of CA80 was on the track and attached the air hoses of 1423 to CA80. No protection was provided to this worker and as a result, a passenger train, 282L, passed by on the adjacent Up Main line as the worker was walking back to the crew cab of CA80. This worker had to take evasive action and move off the track to avoid being struck by 282L.

No protection was provided to this worker using the required network rules and procedures, NTR 432 Protecting activities associated with in-service rail traffic and related procedure NPR 750.

At approximately 0030 on 21 August 2019, freight train 4WM2 operated by Pacific National stopped at signal W26U near Waterfall, NSW. The train crew consisting of driver A and B were directed by the Waterfall Signaller at 0200 to remarshal the train. The train could not continue and was required to return to Coalcliff to clear the main line.

Remarshalling the train required one of the drivers to enter the danger zone to apply hand brakes on the wagons. Driver A requested safeworking protection from the Waterfall Signaller before entering the danger zone without incident.

The locomotives were detached and operated to Waterfall, before travelling to Helensburgh and returning to the stabled wagons near Waterfall.

On arrival at the stabled wagons, driver B requested safeworking protection again from the Waterfall Signaller. Driver B entered the danger zone to release the hand brakes from the stabled wagons. At about 0417, driver A signalled (hand signals and red marker lights) to the driver of an approaching passenger train (404A) to stop. The train was travelling on the adjacent track towards driver B in the danger zone and the driver of 404A made an emergency brake application to stop the train. The train stopped before arriving at the location of driver B and there were no physical injuries.

The safeworking network rule and procedure for protecting activities associated with in-service rail traffic, NTR 432 and NPR 750, were not used effectively to ensure workers were protected from rail traffic. The requests for protection were informal and did not detail the required activities or protection. Both drivers of 4WM2 unknowingly entered the danger zone without appropriate protection and were at risk of being struck by rail traffic.
 

Introduction

Pacific National train 5936 failed inside Boronia tunnel No. 3 on Cowan Bank in the up direction as a result of wheel slip from excessive lubricant and was unable to lift its load up the grade. The driver of 5936 reported the train failure to the SHN. The SHN reported the incident to the Sydney Trains TSDMCC and their decision on how to manage the incident involved propelling the train backwards down Cowan bank and into the Hawkesbury River Up Refuge siding to clear the main line.

To undertake the propelling movement, a qualified worker needed to be located at the rear of the train, to supervise the movement backwards down the Cowan Bank. This was a standard requirement in the Sydney Trains Network rules for propelling trains. Under the rule, if there is not a designated safe place on the rear of the train, the worker must walk in advance of the movement in a safe place. Where the worker walks, depends on a few conditions, like the terrain, the availability of a safe place and the layout of the rail environment.

Train 5936 had three people in the driver’s cab, the driver, an assistant driver and a trainee assistant driver. The driver of 5936 intended to send the assistant driver and the trainee assistant driver to the back of the train to supervise the movement.

The driver of 5936 requested protection from the SHN in the form of signals put to stop and blocked on the Down Main line. This prevented trains from entering the area where the two workers needed to walk to reach the rear of 5936. Once confirmed, the assistant driver from 5936 and the trainee driver exited the driver’s cab and walked on the adjacent Down Main line to the rear of the train.

Once the two crew members were in place at the rear of the train, the driver advised the SHN that the propelling movement was about to commence and asked the SHN to confirm that the route was clear back to the Hawkesbury River Up refuge siding. The two workers continued to walk on the Down Main line adjacent to the rear of 5936, as there was no other safe place to walk.

As the propelling movement continued, the two crew members observed the lights of a train travelling towards them in the up direction on the Down Main line. The two crew members alerted the driver of 5936 of the presence of the oncoming train and to stop the movement, then they jumped clear of the Down Main into the Down Cess area.

Cowan Bank terrain and operational features

Cowan bank is known to have some challenging operational features. For example, access on the up side of Cowan Bank is problematic for a worker needing to walk along the rail line as the corridor is often butted up against the rock face of cuttings and there is no safe place.

To give a worker a continuous safe place to walk while supervising a propelling movement, a safe place is created on the adjacent track by applying protection in the form of setting rail signals to stop and blocking them to stop rail traffic entering the affected area.

Trains failing to make the steep grade on Cowan Bank is a regular occurrence and there are two main options to deal with the situation. In some cases, a rescue engine is brought in from Gosford or elsewhere north of the incident location to push the train up the grade.

The alternative is to propel the train back down the grade into the Hawkesbury River Up Refuge siding. This option can only work if the train is a suitable length to fit into the siding, which has a capacity of 877 m. 5936 was 831.6 m and therefore suitable to fit safely inside the siding, so the decision was made by the TSDMCC to propel the train back towards Hawkesbury River.

Rail lubrication on Cowan Bank

There were three operational rail lubrication devices installed on Cowan Bank to service the Up Main between Hawkesbury River Yard and the Cowan Station. Sydney Trains engineers had assessed that the rail lubricators should have similar settings as those used in the Blue Mountains in order to deliver optimal lubrication. These adjustments were made in February 2021.

Sydney Trains conducted an engineering review post incident into these devices and determined that excess lubrication contributed to the wheelslip. This led to the train becoming disabled and unable to continue up the Cowan Bank. This resulted in the need to propel the train backwards to the Hawkesbury River Up refuge siding.

Sydney Trains determined post incident and in response to a spate of similar events where freight trains were unable to lift their load due to loss of traction from excess lubricant on the wheel-rail interface that further adjustments were necessary to ensure the amount of lubrication provided did not adversely affect wheel adhesion to the rail head, particularly for loaded freight trains.

The decision to propel 5936 and run passenger trains using bi- directional signalling

Discussion between SHN and TSDMCC

When the SHN and TSDMCC became aware of the inability of 5936 to lift its load up the Cowan Bank, a discussion took place to determine what to do with the train. The discussion canvassed the option of using a rescue engine to assist, however, given the time and location, it was considered unlikely to result in a timely outcome. The TSDMCC determined that the best course of action was to propel 5936 backwards down Cowan Bank into the Hawkesbury River Up Refuge siding.

The TSDMCC checked reference documents to ensure the Up Refuge siding was long enough to contain 5936, and once confirmed, gave the instruction to SHN to direct the driver of 5936 to propel back into the siding.

The TSDMCC and SHN also discussed the need to run any AM peak passenger services via the Down Main using the bi-directional signalling. This discussion indicated there was a concurrent plan developing not only to remove 5936 from the main lines but also to facilitate the continued operation of passenger services in the up direction for the AM peak.

Implication of the decision to propel 5936

The TSDMCC and SHN knew that workers would have to walk to the back of the train to manage the propelling movement. The recorded audio indicated there was a suggestion that a passing train could be used to transport the workers via the Down Main, but there was no train due in that direction for nearly an hour so that was dismissed.

Both the TSDMCC and the SHN knew there would be a worker or workers out of the train and on the track at some point to facilitate and manage the propelling movement.

What the propelling decision meant to the driver of 5936

The degree of difficulty in making this manoeuvre was considerable. The driver had to slowly reverse a train of over 4000 t and nearly 900 m long down a steep gradient, in the dark and in the rain. The train also had to negotiate tunnels, and in the case of 5936, the leading locomotive was still within Boronia tunnel No. 3. The driver reported at interview suffering ill health effects from diesel exhaust whilst being stopped in the tunnel.

Recorded audio of exchanges between the SHN and the driver of 5936 indicated numerous calls were made during the movement, which likely disrupted the concentration of the driver during what was a high cognitive load due to a difficult manoeuvre under complicated circumstances. Other recorded audio of exchanges between the SHN and the TSDMCC indicated there was particular focus on continuation of passenger train services, especially in the up direction for the AM peak.

Protecting workers attending to in-service rail traffic

Compliance with the requirements of NTR 432 and NPR 750

In the case of the workers involved in propelling 5936, the driver needed to nominate the activity location as being between two points. This did not occur. They also did not describe that two workers would be walking all the way behind and adjacent to the train as it propelled backwards towards Hawkesbury River yard, past the station and into the Up Refuge Siding.

NTR 432 also stated that the signaller must:

• Use a system-generated ASB form, or if that is unavailable, an NRF 018 Absolute Signal Blocking (ASB) form to record the protection details
• Issue a unique protection number to the Qualified Worker requesting the protection.

The SHN did neither of these things in this circumstance.

Sydney Trains internal safety investigation into this incident found evidence that similar events of managing failed freight trains where the requirements of NTR 432 and NPR 750 were not applied. Recent ATSB investigations listed in the Related Occurrences section of this report also found this error in practice.

Suitability of NTR 432 to protect workers

NTR 432 is a Train Working rule about protecting workers while on the track, however it is not included in the suite of other rules devoted to the same purpose, specifically Work on Track (NWT).

NTR 432 is designed to protect people on the track when attending to their train while it is in service however is included in the suite of rules devoted to train working. This suite contains rules more specific to the operation and use of the train, rather than the protection of workers and includes rules such as:

• NTR 400 Protecting rail traffic,
• NTR 402 Inspecting trains,
• NTR 404 Using brakes
• NTR 406 Using lights.

The Work on Track (the NWT) series of rules, is more specific to protecting workers and includes rules such as:

• NWT 300 Planning work in the rail corridor
• NWT 302 Local Possession Authority
• NWT 304 Track Occupancy Authority
• NWT 306 Track Work Authority
• NWT 308 Absolute Signal Blocking.

NTR 432 appears out of place in the suite of train working rules given it is a rule devoted to protecting workers who are on the track performing rail safety work. In this case, the workers were attending to a train while it was in service however required protection while doing so because they were on the track. However, NTR 432 is not included in the Work on Track suite of rules which are devoted to protecting workers while on the track.

Evidence from the Sydney Trains investigation report into the incident indicated that rule NTR 432 was not applied in other cases where it should have been. It is possible that NTR 432 was not applied correctly because rail safety workers were not familiar enough with it as a rule to be followed while working on track. As rule NTR 432 is contained in a suite of rules devoted to train operations, and not within the suite devoted to protecting people while on track (the NWT suite). It is possible that its importance and application may not be understood by rail safety workers.

Suitability of NTR 432 to manage propelling movements

NTR 432 Protecting activities associated with in-service rail traffic includes a number of requirements which must be met through satisfying the assurances contained within the rule. One of the assurances relates to the mobility of the rolling stock and reads:

Unless conducting a roll by inspection, the Qualified Worker must make sure that the associated rail traffic will not be moved until the activity is completed.

If the intention of NTR 432 was to protect workers attending to in service rail traffic, then this rule may not be suitable for use during a propelling movement. NTR 432 contains a prohibition on rolling stock movement, except when conducting a roll by inspection. That being the case, there are no approved measures available under the current set of rules to protect workers supervising a propelling movement.

Signaller operational assurance

The Sydney Trains investigation examined the assurance regime for signallers relating to the application of the requirements of NTR 432 and NPR 750 - Protecting activities associated with in-service rail traffic. The investigation found that the SBO group did not undertake assurance activity related to the correct application of relevant rules and procedures for protecting workers attending to in-service rail traffic.

The investigation identified other similar incidents that were also not managed in accordance with the requirements of NTR 432. Examples of where the requirements of NTR 432 and NPR 750 were not applied are listed in the Related Occurrences section of this report.

ATRICS and the application of signal protection

Applying and removing blocks to signals

The SHN did not apply blocks to the protecting signals in accordance with NTR 432 and NPR 750 and did not use the ATRICS generated form to record the placement of the protection. The SHN applied the blocks to the protecting signals manually and removed them without the authority of the person requesting the protection, the driver of 5936.

Communication between the SHN and the driver 5936

The driver of 5936 did not specifically request protection under NTR 432. They requested that a block be put on the signals, and that is what the signaller did. Neither party followed the requirements of NTR 432 or observed the assurances. The transcript of the recorded audio between the SHN and the driver of 5936 at the time protection was requested is below.

SHN: OK um do you need any protection there for that?

Driver 5936: Yes, if he’s gotta walk on the ah on the opposite track, we definitely need protection. A block for the whole way over.

HNAC: Righto then …ok so …. I’m just putting some blocks on there now….. Just stand by while I do that.

DR5936: Roger that over.

HNAC: Righto I’ve done that there now, so um, I haven’t, so nothing can come up….on that line for ya there so, when you’re ready to walk back and get into position you’re able to do that for me now please.

DR5936: Roger that my mate will walk back now ah so his got the blocks, so his gotta walk back another 832 metres and then get ahead of me. Bit of a way. And then I will proceed down as safely as I can possibly can over.

HNAC: ok thank you for that driver.

Neither party to this conversation specifically mentioned protection being required under NTR 432, which is the relevant rule in this circumstance. All they refer to is “blocks”.

The driver of 5936 did not specify where and for how long the two crew members would be required to walk on the Down Main line while the propelling movement was taking place.

Signaller training, performance, and competence management

Signaller knowledge of propelling trains

The SHN did not understand the requirements of NTR 424 - Propelling Trains. At interview, the SHN expressed a lack of knowledge about the activities of the workers on the ground directing the propelling movement. Specifically, the SHN did not understand that the two workers directing the propelling movement were still walking in front of, and adjacent to, train 5936 when it was propelled down Cowan Bank.

The SHN expressed some surprise that the workers were in that position and assumed they were riding on the freight rolling stock once the propelling movement started. The practice of riding on moving freight rolling stock has been prohibited since 2004.

Once the propelling movement started, the SHN removed the blocks on the protecting signals and allowed train 247B to run in the Up direction on the Down Main through use of the bi-directional signalling system.

During the conversation with the driver of 5936 after the near miss incident with 247B, it was apparent that the signaller was not aware that the workers were still on the protected track walking in front of the propelling movement.

Driver 5936 Yes Hornsby ah my ah mate down the back just said you just put a train up on the down around us over.

HNAC Yeah that’s correct.

Driver 5936 Ah I thought we had a block on over

HNAC Yeah that’s when you actually, when you weren’t moving, when you were actually on the (pauses) when you walking back over.

Driver 5936 He’s still walking back. He’s gotta walk me back to get into the siding over HNAC OK (speaks under their breath) well you’ve moved back.

Driver 5936 Yes ‘cause he was on the down calling me back, that’s the only safe place for him to stand over.

HNAC (12 seconds of silence and clears his throat) OK that trains trains gone and there are no other trains on the down. I have got blocks on on um up at Cowan (silence for a few seconds) just stand-by.

Driver 5936 Roger.

HNAC Yes so you’re right to proceed there driver um keep proceeding I’ve got the um all the routes and the signals set for you to go into the Refuge Loop there at Hawkesbury River driver. Thank you driver.

Driver 5936 5936 out.

HNAC (groans) Hornsby North Panel out.

Driver 5936 Roger that, we have everything set so there is nothing definitely going to come either way towards us now over.

HNAC That is correct driver.

Driver 5936 Roger so I can my mate to ah get back on the down in a safe place. HNAC That is correct.

Driver 5936 Roger that well we start again over.

This conversation, after the near miss happened, resulted in the incorrect re-application of protection required by NTR 432. The SHN reapplied the blocks manually with communication assurances not observed as required by the rules and procedures. The conversation revealed that the SHN did not understand the workers positioning during the propelling movement and had made an assumption that the signal blocks could be safely removed, without confirmation from the driver as required.

Safety Refresher Training

At interview, the SHN advised that the job of a signaller involves the use of many rules and procedures, and that signallers are expected to be current and competent with all these requirements all of the time. The SHN specifically stated that he did not know the workers were walking in front of train 5936 during the propelling movement because he was not familiar with the requirements of NTR 424 Propelling Trains, even though it was a mandatory requirement for signallers to know this rule.

The SHN also advised that they had not attended any refresher, or scenario-based training for several years. The SHN advised that the only safeworking training they received, other than initial training, was when there were rule changes, as there was in the case of the introduction of NTR 432 in 2016. A briefing session was provided to explain the new rule and procedure. The SHN advised that when they had enquired about receiving refresher training, their management’s response was they could not be released because of operational requirements.

The Sydney Trains investigation report into this incident identified that its Customer Operations Branch had not delivered any safety refresher training for signallers since 2009. Other rail safety workers such as Protection Officers on the other hand received a form of refresher training and competency assessment which included periodic recertification in safeworking rules and procedures along with formal assessment.

Following its investigation report finding, Sydney Trains advised that a pilot of a revised refresher training program for signallers was commenced in April 2021.

Network familiarisation

Signallers control the operation of signals, points and other infrastructure in a defined geographical area. What the signaller sees and understands of the network is what is represented on their signal display panel, which is a schematic array and does not depict the geography or topography or other features of the network.

The SHN advised at interview that they had never been to Hawkesbury River Yard or seen the Cowan Bank, or any other part of the network they had controlled during their career. Signallers are not provided the opportunity to visit their area of operation to make them familiar with the area of the network that they controlled. The mental model that the SHN reported they had of Cowan Bank did not include key features such as the steep grade, the winding rail corridor and the lack of safe places and access.

A review undertaken as part of this investigation of the Sydney Trains competence management system for signallers revealed that network familiarisation or route knowledge was not a feature of the initial or ongoing training requirements for signallers.

Sydney Trains commenced a trial program of network familiarisation for protection officers in December 2020 designed to provide awareness and knowledge of the layout and risks in the network, to help workers perform more safely and efficiently, but at the time of writing it was not being rolled out to signallers.

Signaller fatigue

The incident happened around 0430, which is a known time of the window of circadian low, or the time of maximum sleepiness, for most people.

Two of the eight rostering principles were not met in relation to the roster of SHN in the eight days leading up to the incident. The two principles, and the nature of the departure from these principles, are outlined below. The acronym HNAC stands for Hornsby North Area Controller, and is the term used by Sydney Trains to describe the signaller operating the Hornby North panel.

An extract of the Sydney Trains Investigation report into this incident relating to fatigue is reproduced below:

Rostering Principle #4: Limit night shifts and early morning starts. Aim for no more than six consecutive shifts where 8-hour shifts are worked. ‘

The Hornsby North Area Controller (HNAC) was rostered for two consecutive early morning shifts on 2- 3 Jan 2021 and six consecutive night shifts on 4-9 Jan 2021. While the incident occurred at the sixth consecutive shift (where HNAC signed in on 7 Jan 2021 at 10pm) and was just at the limit of this rostering principle, the increase in the FAID score over this period had reached 93 by this shift. 

Although this FAID score had not reached the business unit threshold of 100, it was on the upper limits of approaching the threshold. Furthermore, it is difficult for humans to adjust from the two extremes of an early morning shift to a night shift without the opportunity to have an adequate break in between to prepare and adjust to the sleep impacts of night shift.

Rostering Principle #7: Breaks between cycles. Make sure there are adequate breaks between shift cycles. Days off should be a minimum of two consecutive days.

The HNAC had single days off on 28 Dec 2020, 30 Dec 2020, and 1 Jan 2021—each time after a night shift before commencing the consecutive shifts leading up to the day of the incident. Having less than 48 hours between shift cycles, especially after completing night shifts, does not provide an individual with enough opportunity to have restorative sleep to recover from any sleep debt that has accumulated from working night shifts. With the HNAC working single night shifts between these single days off, it is likely that the HNAC had accumulated an amount of sleep debt from only having the opportunity for restorative sleep during daytime, which is not as restorative as obtaining sleep during night time. The HNAC then commenced the sequence of consecutive early morning and night shifts, which would have further contributed to additional sleep debt leading up to the day of the incident.

According to the Managing Shift Work and Rostering procedure, when departures from these rostering principles occur, line managers must intervene and put in place measures to try and correct the situation. There was no intervention by the Sydney Trains line manager for SHN to adjust or amend the roster.

Sydney Trains acknowledged in their internal investigation report into this incident that the requirements for the procedure Managing Shift Work and Rostering were not being followed. Sydney Trains adopted a recommendation from their internal report as follows:

Review the business unit Fatigue Risk Management System / processes to ensure that there is an ability for the business unit to identify the fatigue risk associated with different rostering patterns and to detect adherence to rostering principles with mitigating fatigue risk controls to be implemented for these instances.

The issue of departures from the Managing Shift Work and Rostering procedure, and the subsequent lack of managerial intervention, have been raised previously in the ATSB investigation RO-2019-18 Westmead.

Signaller rest regime

At interview, the SHN stated that they were well rested for the shift prior to the incident. SHN recounted how they had an effective rest regime at home when working night shift and had obtained sufficient rest, had slept as usual from about 0730 to 1530, and felt fit and able to carry out their shift.

It is unknown whether the amount of sleep was sufficient to allow for recovery from the five consecutive shifts. It is possible that the SHN was affected by the cumulative effects of fatigue given the deviations from two rostering principles leading up to the day of the incident. However, the evidence is not definitive, and it is not possible to ascribe fatigue as a contributing factor with sufficient certainty.

Breathing apparatus and welfare of the train driver

Train 5936 came to a stand inside Boronia No. 3 tunnel and was there for around 30 minutes before the propelling movement commenced. According to the driver’s statement, the lead locomotive exited Boronia tunnel around 0441, therefore the driver was exposed to diesel fumes for around 35 minutes. The driver reported in their statement at interview that they were starting to feel unwell and had trouble seeing as their eyes had started to weep.

This physical discomfort existed while the driver undertook the difficult manoeuvre of propelling the train down the Cowan Bank.

Pacific National did not supply breathing apparatus or other mitigation measures to crews on its bulk trains, despite these trains operating through tunnels. Breathing apparatus was provided on locomotives that service the coal network in the Hunter Valley, as there were some long tunnels. The network manager specified that trains operating there must carry and use breathing apparatus in the case of train failure or some other mishap.

Safe Work Australia produces guidance on managing exposure to diesel fumes. The guidance says, in part:

Short-term (Acute) effects

Short term exposure to high concentrations of diesel exhaust can irritate the eyes, nose, throat and lungs and cause light-headedness, coughing, phlegm and nausea. Very high levels of diesel exhaust exposure can lead to asphyxiation from carbon monoxide poisoning.

The driver of 5936 reported feeling effects that were consistent with short-term effects of high concentration exposure to diesel exhaust listed above. The Safe Work Australia guidance does not provide any detail on the timeframes that these effects are likely to lead to more serious effects such as asphyxiation from carbon monoxide poisoning, as this would be subject to a range of factors, such as the health of the individual, the environment and ventilation and other factors.

However, based on the evidence of the driver, they indicated they were affected by diesel fumes, as they were on a disabled train in a tunnel for an extended period and were experiencing physical discomfort.

Once the two other crew members left the cabin to walk to the end of the train to supervise the propelling movement, the driver was alone. The Safe Work Australia guidance says that extended exposure to very high levels of diesel exhaust can lead to asphyxiation. If this were to happen while undertaking a propelling movement with a 4000 t freight train then there would be a risk of the movement becoming out of control.

While the effect of diesel exhaust on the driver did not directly contribute to this incident, it is a factor of increased risk in that it may have contributed to loss of control of the train in other circumstances.

Incident reporting

The SHN did not report the safeworking breach or the incident to the TSDMCC or anyone else. Signallers have clear accountabilities to report incidents in Network Rule NGE 234 - Responsibilities of Signallers.

Signallers must:

• Promptly report breaches of Network Rules and Network procedures to the controlling officer and the Network Controller.

The recorded audio of the conversation between SHN and the driver of 5936 clearly identified that a safeworking breach and a safety incident had occurred, i.e., the signals had been cleared without the authority of the driver and consequently, two workers had to jump clear of the track to avoid being struck by a train.

The incident was not reported until some days later when the trainee assistant driver reported an injury to Pacific National as a result of having jumped off the track. Pacific National then reported the incident to Sydney Trains who were then able to trace the events back to the original incident.

Findings

From the evidence available, the following findings are made with respect to the near miss with train crew from train 5936 at Hawkesbury River on 8 January 2021.

Contributing factors

• The signaller did not apply or remove blocks to the protecting signals in accordance with NTR 432, Protecting activities associated with in-service rail traffic and NPR 750 and did not use the ATRICS generated form to record the placement of the protection.
• Sydney Trains’ internal safety investigation identified similar incidents i.e., where a freight train failed, that were not managed in accordance with the requirements of NTR 432, Protecting activities associated with in-service rail traffic. Recent ATSB investigations also identified examples where the requirements of NTR 432 and NPR 750 were not adequately applied.  (Safety issue)
• Sydney Trains’ assurance and audit processes for signal box management did not routinely detect non-conformances with NTR 432, Protecting activities associated with in-service rail traffic.  (Safety issue)
• Sydney Trains’ signaller refresher training, to keep signallers’ skills and knowledge up to date, had not been in place since 2009. (Safety issue)
• The driver of 5936 and signaller did not comply with the requirements of NGE 204, Network Communication as communications were casual, ambiguous, and unclear so did not conform to prescribed protocols.
• The Signaller Hornsby North did not understand that under the requirements of NTR 424, Propelling rail traffic, the worker(s) on track were walking next to or in front of the movement to direct the train.
• The Signaller Hornsby North did not receive advice from the driver to clear the protecting signals and remove the protection and did not receive confirmation that workers were clear of the danger zone as per the requirements of NPR 750.

Other factors that increased risk

• The Signaller Hornsby North did not report the incident as per NGE 234, Responsibilities of Signallers.
• Sydney Trains signallers were not provided with network or route familiarisation training for the area they controlled.
• Cowan Bank was a known problem area for failed freight trains however there were no local established procedures for managing such incidents in that area.
• Rail lubricators were overactive and delivered too much lubricant to the rail surface, which contributed to the likelihood of a train becoming disabled.
• Lack of breathing apparatus in train 5936 meant the driver was exposed to potentially dangerous levels of diesel fumes because they were in Boronia tunnel No. 3 for over 30 minutes while organising and performing the propelling movement.
• Network rule NTR 432, Protecting activities associated with in-service rail traffic was designed to protect workers while on the track but is not included in the suite of rules devoted to this purpose.
• Network rule NTR 432, Protecting activities associated with in-service rail traffic was not suitable to protect workers on track supervising a propelling movement as the rule prohibited the movement of rail traffic except for conducting a roll by inspection.
• Network rule NTR 424, Propelling rail traffic, does not cover protection arrangements for workers and there is no specific supporting procedure to provide guidance in how to do that.

Safety issues and actions 

Requirements of NTR 432 and NPR 750 not applied

Safety issue number: RO-2021-SI-01 

Safety issue description: Sydney Trains internal safety investigation identified similar incidents i.e., where a freight train failed, that were not managed in accordance with the requirements of NTR 432, Protecting activities associated with in-service rail traffic. Recent ATSB investigations also identified examples where the requirements of NTR 432 and NPR 750 were not adequately applied.

Assurance and audit process

Safety issue number: RO-2021-002-SI-02

Safety issue description: Sydney Trains assurance and audit processes for signal box management did not routinely detect non-conformances with NTR 432.

Signaller refresher training

Safety issue number: RO-2021-002-SI-03

Safety issue description: Sydney Trains Signaller refresher training, to keep signallers’ skills and knowledge up to date, has not been in place since 2009.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Sydney Trains Systemic investigation report
• Sydney Trains recorded audio from Homebush Control Centre and the Rail Operations Centre
• Rostering data for the Sydney Trains signaller
• Sydney Trains Network Rules and Procedures
• Pacific National investigation report
• Interviews with the Sydney Trains signaller and Pacific National train driver