Safety summary

What happened

On 18 September 2020, an Extra EA-300 aeroplane, registered VH-EXR, was conducting circuits at Caloundra Airport, Queensland. A Guimbal Cabri G2 helicopter, registered VH-LTO, joined the circuit ahead of VH-EXR and conducted a stop-and-go on the active runway. VH-EXR landed on the runway and collided with the rear of the hovering helicopter during the landing roll, resulting is substantial damage to both aircraft but fortunately no injuries.

What the ATSB found

The ATSB found that the pilots of VH-EXR did not expect the helicopter to join the 1,000 ft circuit pattern and did not assimilate the helicopter pilot’s radio calls. As a result, they were unaware of the helicopter ahead of them in the circuit.

It was also identified that, on the final leg of the circuit, the pilots of VH-EXR were focused on an additional aircraft ahead of the helicopter. Although a visual inspection of the runway was carried out by the pilots prior to landing, the focus on the additional aircraft, in conjunction with the pilots of VH-EXR not being aware of the helicopter’s presence, resulted in them not sighting the helicopter and continuing the approach to the runway. The nose‑high attitude of EXR during the landing manoeuvre prevented visual identification of the hovering helicopter until immediately before the ground collision, leaving no time for avoiding action.

Safety message

This occurrence highlights the importance of having an awareness of the circuit procedures for differing types of aircraft. Multiple options are available to helicopter traffic at non-towered airports including the active 1,000 ft circuit pattern. A helicopter performing a stop-and-go will usually require significantly more time to clear the runway compared to an aeroplane performing a touch‑and‑go.

The accident also illustrates that, even for experienced pilots, visual identification of unknown traffic is difficult. The alerting provided by circuit‑related radio broadcasts greatly assists the process of sighting traffic that may be a collision risk. Safety around non-towered airports is one of the ATSB’s SafetyWatch priorities.

The investigation

The occurrence

On 18 September 2020, at 1215 Eastern Standard Time,^[1] the student pilot of a Guimbal Cabri G2 helicopter registered VH-LTO (LTO), departed Redcliffe Airport, Queensland, for a navigation training flight via Caloundra Airport, Queensland. The student pilot was the only person on board.

At about 1230, an Extra EA-300 aeroplane, registered VH-EXR (EXR), taxied for runway 12 at Caloundra Airport to conduct a series of circuits. On board were two pilots. The pilot in command (PIC) occupied the front seat and a second pilot occupied the rear seat for the purpose of a check flight.

At 1236, a Sling aircraft (Aircraft 3), already conducting circuits on runway 12 at Caloundra, contacted EXR on the Caloundra Common Traffic Advisory Frequency (CTAF) for the purpose of traffic separation between themselves and EXR. EXR acknowledged the transmission.

At approximately 1237, the rear seat pilot of EXR broadcast on the CTAF that they were rolling on runway 12 for circuits. The rear seat pilot conducted the take off and approximately two minutes later, contacted Aircraft 3 on the CTAF to request a radio check. Aircraft 3 confirmed EXR’s radio transmission and EXR responded that they were reading Aircraft 3 clearly.

At 1240, the student pilot in LTO made an inbound call on the CTAF reporting that they were 2 NM east of Roy’s Orchard^[2] and on climb to 1,500 ft. The student pilot recalled listening to the CTAF for the active runway in use. At 1242, the student pilot reported that they were now 3 NM to the south of Caloundra Airport at 1,500 ft and would be overflying to descend on the non‑active side of the runway (see the section titled Circuit procedures and Figure 4). The pilot of LTO then proceeded to overfly the airport at 1,500 ft and descended to 1,000 ft on the non‑active side. LTO then joined the downwind leg of the active circuit pattern, via midfield crosswind, and broadcast a joining the circuit call.

The student pilot of LTO reported that, at the time of joining the circuit, they visually identified EXR on the upwind leg and Aircraft 3 on the base leg of the circuit. LTO entered the circuit ahead of EXR and then proceeded on the downwind leg of the circuit at a speed of about 80 kt and at a height of 1,000 ft.

On the downwind leg of the collision circuit, the PIC of EXR reported taking control of the aircraft, including radio transmissions, from the rear seat pilot for the purpose of demonstrating the approach and landing technique.

At 12:45:48, the student pilot of LTO made a broadcast that they ‘were turning a right base runway 12 for a stop-and-go^[3]. 39 seconds later, at 12:46:27, the PIC of EXR broadcast that they ‘were turning base runway 12 for a touch-and-go^[4]number two’. The student pilot of LTO recalled that hearing ‘number two’, provided confirmation that the pilot of EXR had visually identified them and was aware of their intentions.

During final approach the pilot of LTO reduced speed continually by 10 kt for every 100 ft of descent until the aircraft entered a hover at a height of about 7 ft over the runway. The pilots of EXR looked down the runway and identified Aircraft 3 airborne on upwind and elected to continue the approach for a touch-and-go. The PIC of EXR reported that just after landing and prior to advancing the throttle to take off again. LTO appeared ‘directly over the top of the propeller’. The PIC of EXR recalled not having any time to manoeuvre to avoid LTO.

The student pilot of LTO felt and heard a bang as EXR passed underneath. The student pilot maintained control of LTO and landed adjacent to the runway. The student pilot then broadcast a MAYDAY^[5] call over the CTAF which Aircraft 3 relayed to Brisbane Air Traffic Control. The rear seat pilot shut EXR down before the aircraft came to a stop on the runway.

LTO sustained multiple propeller strikes underneath the cabin and separation of the right landing skid (Figure 1).

Figure 1: Propeller strike mark and skid damage to VH-LTO

Source: Aeropower, annotated by the ATSB

The propeller of EXR was destroyed by the impact with the fuselage and landing skid of LTO (Figure 2). The right landing skid of LTO punctured the leading edge and fuel tank of the right wing of EXR (Figure 3). The rear seat pilot reported that the after impact the canopy of EXR was covered in fuel. There were no injuries.

Figure 2: Damaged propeller of VH-EXR

Source: Aeropower, annotated by the ATSB

Figure 3: Leading edge wing damage and fuel tank puncture of VH-EXR

Source:  Aeropower, annotated by the ATSB

Context

Pilot information

The PIC of EXR held a Civil Aviation Safety Authority (CASA) Commercial Pilot Licence (Aeroplane) that was issued in March 2015. The pilot also held a current flight instructor rating in spin training, aerobatics training, and design feature training^[6]. At the time of the occurrence, the pilot had accrued a total flying time of 2,896.3 hours with 455.1 hours on an Extra EA-300.

The rear seat pilot of EXR reported that they held a CASA Air Transport Pilot Licence (Aeroplane), a Multi Engine Command Instrument rating, and a Grade 1 Flight Instructor rating. At the time of the occurrence, the pilot had accrued a total flying time of approximately 16,000 hours.

The student pilot of LTO was undertaking a Commercial Pilot Licence (Helicopter) course that had commenced in January 2020. At the time of the occurrence the student pilot had accrued a total flying time of 65 hours.

Aircraft information

The Extra EA-300, VH-EXR, was manufactured in Germany in 1989 and first registered in Australia in May 2007. It was fitted with a Lycoming AEIO-540-L1B5 reciprocating engine. The fuselage comprises a welded steel tube covered with aluminium and fabric and contains a tandem seating configuration. The wing has a carbon fibre composite spar and carbon composite skins. The landing gear is a fixed taildragger style with composite main legs and fibreglass wheel pants.

The Guimbal Cabri G2, VH-LTO, was manufactured in France in 2014 and first registered in Australia in October 2018. It was fitted with a Lycoming O-360-J2A reciprocating engine. The Cabri G2 has two side by side seats, a three-bladed fully articulated main rotor and a Fenestron type tail rotor. It has skid style landing gear and an all composite monocoque fuselage.

Circuit procedures

The Caloundra entry in the En Route Supplement Australia (ERSA)^[7]stated that right circuits were to be flown on runway 12 as part of the noise abatement procedure. This applied to both aeroplane and helicopter operations.

In addition, the CASA Visual Flight Rules Guide stated the following in regard to helicopter circuit operations at non-controlled airports such as Caloundra:

Helicopter pilots can choose to fly a circuit similar to a fixed-wing aircraft but may also fly a circuit either in or contra to the circuit direction at a height of at least 500 ft above the aerodrome elevation and closer to the runway. This can only be done if the associated landing site is outside the runway strip in use; the non-standard circuit does not cross the extended centreline of the runway in use and pilots broadcast their intentions. Check the relevant ERSA for any noise abatement procedures.

The Visual Flight Rules Guide also stated the following in regard to a recommended circuit join at non-controlled airports:

Overfly or circle the aerodrome at least 500 ft above the circuit altitude, which may be 2000 ft or more above the aerodrome elevation. When you have determined the circuit direction position the aircraft to a point well clear (normally the non-active side of the circuit) before descending to a circuit altitude that equates to the aircraft’s performance.

VH-EXR can be classified as a high-performance aircraft as it is capable of a downwind speed of greater than 150 kt. The recommended circuit height for a high-performance aircraft in the CASA Visual Flight Rules Guide is 1,500 ft.

The student pilot of VH-LTO overflew Caloundra Airport at 1,500 ft above the airport elevation prior to descent on the non‑active side of the circuit. On this occasion, that arrival height was appropriate as the pilots of VH‑EXR were conducting circuits at 1,000 ft.

Figure 4: Arrival procedure for a non-controlled airport (left direction circuit). The circuit direction was right at Caloundra.

Circuit naming convention and arrivals procedure for a left turning circuit.

Source: CASA Visual Flight Rules Guide

Recorded information

Avdata^[8] recorded all VHF transmissions made on the Caloundra CTAF (Table 1). These recordings were obtained by the ATSB and captured relevant transmissions leading up to the occurrence. These included:

• A total of six radio calls broadcast from the pilot of LTO, including two calls prior to LTO’s arrival over Caloundra Airport
• The circuit calls made by the pilot/s of EXR and Aircraft 3, including the conversation regarding separation from each other
• The MAYDAY call broadcast by the pilot of LTO after the collision.

Table 1: Caloundra CTAF transcript

Airservices Australia WebTrak^[9] data recorded the movements of EXR, LTO, and Aircraft 3 at the time of the occurrence. A snapshot of the data prior to the collision (Figure 5) showed:

• Aircraft 3 was airborne and departing runway 12
• LTO on late final for runway 12
• EXR on early final for runway 12

Figure 5: WebTrak data snapshot with aircraft positions prior to collision at 12:47:10

Source: Airservices Australia and Google Earth, annotated by the ATSB

Radio serviceability

The ATSB conducted transmission and receiving tests of the radio and intercom system in EXR, including testing of the helmet and headset that were used during the occurrence flight. No faults were identified. The Avdata receiver at Caloundra Airport was also tested with no faults identified. The radio in LTO was unable to be tested as it had been removed for access during repair of the aircraft.

The rear seat pilot of EXR conducted a radio check with Aircraft 3 just after take-off at 12:39:15. The pilot did not recall the reason for the radio check but stated that they ‘sometimes carry out a radio check to have confidence in the serviceability of the radio’.

Awareness of helicopter

The PIC of EXR reported that a series of circuits were planned for the purpose of a check flight for the rear seat pilot.

Aircraft 3 was conducting circuits on runway 12 prior to being joined in the circuit by EXR. The PIC of Aircraft 3, cognisant that the much faster EXR would be joining them in the circuit, initiated a conversation over VHF radio stating that EXR could go around them if they needed to and that they would monitor their location (Table 1).

The rear seat pilot controlled EXR whilst also operating the radio for the first two circuits. Both circuits resulted in a go-around^[10]. During the first go-around the rear seat pilot recalled hearing a broadcast from LTO. The pilot further recalled that the transmission was possibly a downwind joining call, but they did not recall hearing any further radio transmissions from LTO. On the downwind leg of the collision circuit, the front‑seat PIC of EXR took control of the aircraft, including operation of the radio, to demonstrate a circuit to the rear seat pilot. The PIC of EXR recalled that they did not hear any of the radio transmissions from LTO.

The rear seat pilot further went on to state that due to their expectation for a helicopter to be conducting a 500 ft above ground level circuit to a helipad, the radio call did not require their immediate attention as they expected there would be no conflict and that LTO would make another broadcast.

On the collision circuit, the PIC of EXR made a radio broadcast while turning onto the base leg, stating that they were number two for landing. The PIC recalled that this was due to visually identifying Aircraft 3 ahead on late final. During the subsequent turn onto the final leg of the circuit, both pilots of EXR stated that a visual check of the runway was conducted and noted that Aircraft 3 was airborne and on the upwind leg of the circuit (Figure 5).

The PIC of EXR stated that due to the cockpit visibility limitations of EXR while on final, they performed a side slip to visually check the runway. At this time, the PIC of EXR commented to the rear seat pilot that Aircraft 3 was going to interfere with their next circuit due to inadequate spacing. The PIC of EXR also assessed that the spacing was sufficient to carry out a touch and go. Neither pilot of EXR visually identified LTO prior to landing. Webtrak data recorded that no avoidance manoeuvring was carried out by EXR prior to the collision.

The student pilot of LTO recalled that, when they were on the final leg of the circuit for their stop‑and‑go, they heard EXR broadcast number two for landing and that this gave them an understanding that the pilots of EXR were aware of LTO’s presence.

In discussing the presence of LTO, the PIC of EXR commented to the ATSB that ‘I think we must not have heard the helicopter’s joining the circuit call, and then we haven’t seen them on the runway’. They further stated, ‘helicopters approach Caloundra Airport regularly, but most remain clear of the circuit’. The rear seat pilot of EXR commented that ‘I’ve never known helicopters to be hovering over runways and that helicopters will usually fly lower and keep out of the way of circuit traffic’.

Safety analysis

At about 1236, Aircraft 3 contacted EXR on the Caloundra CTAF for the purpose of establishing separation, as they were aware that the faster EXR would be joining them in the circuit. EXR responded to Aircraft 3 over the CTAF, indicating that both aircraft’s radios were serviceable. A subsequent radio check requested by EXR to Aircraft 3 confirmed this serviceability. Additionally, testing was carried out after the accident on EXR’s radio transmission and receiving functions and Caloundra Airport’s Avdata equipment, with no faults found.

The student pilot of LTO broadcast six radio calls on the CTAF. These calls were all recorded by Avdata, indicating the serviceability of LTO’s transmissions. The student pilot also recalled hearing CTAF transmissions, while inbound to Caloundra, indicating the serviceability of the receiving function of LTO’s radio.

The rear seat pilot reported hearing a broadcast from the pilot of LTO that may have contained information that they were joining downwind however the pilot could not recall the exact content of the broadcast. This call was likely the broadcast at 12:42:09 (Table 1). The rear seat pilot of EXR was conducting a go-around at this time. The rear seat pilot also reported an expectation that helicopters would generally remain clear of circuit traffic. The PIC of EXR reported not hearing any of the calls made by the pilot of LTO and observed that, while helicopters regularly flew into Caloundra Airport, the majority remained clear of the circuit. This indicated that both the pilots of EXR were not expecting helicopter traffic in the active 1,000 ft circuit and that, possibly in combination with focussed attention on their own flight activity, led to the pilots not assimilating the radio calls made by the pilot of LTO.

As a result, both pilots were unaware that the helicopter had joined the 1,000 ft circuit. The PIC of EXR made a base call stating that they were number two, recalling that this was due to visually identifying Aircraft 3 on late final and not LTO which was also ahead of them. The student pilot of LTO heard this call and interpreted it as meaning that they had been sighted by the pilots of EXR. Consequently, they believed that separation between their helicopter and EXR had been established.

The pilots of EXR recalled visually clearing the runway prior to landing and only sighting Aircraft 3 on upwind, identifying that it would likely interfere with their next circuit. This focus on the position of Aircraft 3 hampered the visual identification of LTO ahead of them on the runway. Believing the runway was clear, the PIC of EXR then continued the approach and landing. The nose‑high attitude of EXR during the landing manoeuvre prevented visual identification of the hovering helicopter until immediately before the ground collision.

Findings

From the evidence available, the following findings are made with respect to the collision on the runway between, aeroplane: Extra EA 300 VH-EXR and helicopter: Guimbal Cabri G2 VH-LTO.

Contributing factors

• The pilots of the Extra did not assimilate the helicopter pilot’s radio calls, probably due to an expectation that the helicopter would not join the 1,000 ft circuit pattern.
• The pilots of the Extra were unaware of the presence of the helicopter in the 1,000 ft circuit pattern and did not sight the helicopter prior to landing, resulting in a collision on the runway.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the pilots of VH-EXR
• the student pilot of VH-LTO
• Caloundra Airport (Sunshine Coast Regional Council)
• Aeropower Pty Ltd
• Airservices Australia
• Civil Aviation Safety Authority

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the pilots of VH-EXR
• the student pilot of VH-LTO
• Aeropower Pty Ltd
• Civil Aviation Safety Authority

Submissions were received from:

• the pilots of VH-EXR

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1.  Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2.  A common inbound reporting point for Caloundra Airport, approximately 5 NM to the south.
3.  A circuit procedure where the helicopter is transitioned into a hover over the runway, the engine temperatures and pressures are checked, and then the helicopter is transitioned back into forward flight.
4.  A circuit procedure in which the aircraft lands on the runway and takes off again without coming to a complete stop.
5.  MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance.
6.  Flight Instructor Rating Design Feature endorsement: allows the instructor to instruct and endorse for any design feature they hold such as tailwheel undercarriage and manual propeller pitch control.
7.  En Route Supplement Australia (ERSA): a directory for Australian aerodromes that includes details of an aerodrome and details of available air traffic and ground services, navigation aids and public facilities and any special procedures.
8. Avdata: A service which records all VHF transmission at an airport for billing purposes.
9.  WebTrak: An information service provided by Airservices Australia that displays aircraft movements and noise monitoring data.
10.  Go around: a flight path taken by an aircraft after an aborted approach to landing.

Safety summary

What happened

On 1 September 2020, a Virgin Australia Regional Airlines Fokker 100 aircraft, registered VH‑FNR, was being operated on a scheduled passenger flight from Perth Airport to West Angelas aerodrome, Western Australia. During the landing, the take-off/go-around (TOGA) mode activated, disarming automatic deployment of the lift dumpers. Manual activation of the lift dumpers and reverse thrust did not occur on the first or second attempts by the flight crew. On the third attempt, the lift dumpers and thrust reversers deployed. During the landing roll, an engine speed caution activated as reverse thrust had been selected between the idle and maximum reverse positions.

What the ATSB found

The ATSB found that, during the landing phase, the TOGA mode activated uncommanded for an undetermined reason. This subsequently prevented automatic deployment of the lift dumpers.

It was also established that the aircraft likely landed so softly that the weight on wheels sensors did not immediately activate. This delayed manual activation of the lift dumpers and deployment of reverse thrust.

What has been done as a result

While no faults were found with the TOGA system, the operator has requested that the aircraft manufacturer develop guidance documentation for maintenance of TOGA switch travel and resistance.

Safety message

This incident illustrates that, despite the high reliability of modern flight control systems, flight crews can still be faced with non-normal situations that require their combined judgement and expertise to safely manage.

The investigation

The occurrence

On 1 September 2020, at about 1514 Western Standard Time,^[1] a Fokker F28 Mk 0100 (Fokker 100) aircraft, registered VH-FNR and operated by Virgin Australia Regional Airlines departed for a scheduled passenger flight from Perth Airport to West Angelas aerodrome, Western Australia. The first officer (FO) was the pilot flying and the captain was the pilot monitoring.^[2]

At about 1642, the flight arrived at West Angelas and the flight crew reported that, after touching down right wheel first, they selected the engine thrust reverser levers to the idle position. However, the reversers did not deploy and the levers returned to the stowed position. The FO selected reverse idle a second time. The captain then noted that the thrust reverser and lift dumper deployed messages did not appear on the multi‑function display unit and therefore called ‘negative reverse, negative lift dumpers’ in accordance with standard procedures. The FO noted that the levers had returned to the stowed position again, and moved the levers beyond reverse idle and applied manual braking. Both thrust reversers and lift dumpers then deployed. The flight crew did not recall any bouncing on landing, which they described as a ‘single positive landing’.

Shortly after, an engine speed caution ’N1 in Prohibited Range’ activated for the left engine, as reverse thrust had been selected between idle and maximum reverse. The captain took over control of the aircraft and returned the thrust reverser levers to idle. The landing continued normally to the end of the runway.

At the end, the captain observed that the go-around (GA) flight mode was active on the primary flight display, with the associated pitch-up attitude direction on the flight director. The multi-function display unit was also indicating take-off/go-around (TOGA) thrust mode. This confused the flight crew as they had not activated the TOGA triggers and were on the ground. The flight crew notified operations and maintenance staff, then grounded the aircraft.

Context

Take-off/go-around modes

The take-off and go-around modes are selected by pulling two TOGA triggers located on the thrust levers (Figure 1). When pulled in-flight, the go-around mode is selected, and the aircraft will direct a rotation to a safe climb-out pitch attitude and maintain the current heading. The thrust levers are initially advanced to go-around thrust and then managed to maintain a climb rate of 2,000 ft per minute or airspeed of 200 kt. In addition, the speed brake is automatically retracted if it has been extended and the lift dumpers are disarmed.

If a performance-decreasing windshear is detected, pulling the TOGA triggers will instead activate the windshear recovery mode.

Figure 1: Fokker 100 throttle quadrant

Source: Fokker 100 Aircraft Operating Manual, annotated by the ATSB

Take-off/go-around triggers

Each TOGA trigger contains three internal switches that are operated simultaneously when the trigger is pulled. One switch is connected to each of the flight control computers, and one energises relays to inhibit the anti-icing system and disarm the lift-dumpers. It is only necessary for a single trigger to be pulled for the aircraft to respond.

If one of the switches connected to the flight control computers malfunctions, or the flight computers receive different signals, a ‘no autoland permitted’ (NO ALAND) warning and an autothrottle failure alert is generated. The flight crew did not report receiving any NO ALAND warnings. If the third switch fails, only the lift dumper arming system and anti-ice system would be affected.

The flight crew reported that the motion to actuate the TOGA triggers was an intentional movement that they did not believe could happen accidentally. With one hand resting on the thrust levers, the two middle fingers would need to be extended down behind the thrust levers to reach under the TOGA triggers and pull them up.

Reverse thrust

Each engine has a thrust reverser installed that, when deployed, deflects exhaust flow vertically and forward to slow the aircraft. The thrust reversers for each engine operate independently and are deployed by lifting the thrust reverser lever to either the reverse idle or reverse maximum (‘max’) positions (Figure 1). To lift the thrust reverser lever, the thrust levers must be in the idle position. Thrust reversers will not deploy unless the aircraft is on the ground, as sensed by either of the weight on wheels sensors. More than reverse idle cannot be applied before the reverser doors are completely deployed.

If the engine speed (N1) remains in the restricted reverse range between 57 per cent and 75 per cent for more than 2 seconds, a caution will be presented. After 7 seconds, a warning is presented, and an engine fan inspection is required.

Lift dumpers

The lift dumpers are used to greatly reduce lift and increase braking effectiveness after touchdown. They consist of five hydraulically controlled doors on each wing. The system can be armed to deploy automatically on landing. In this case, the lift dumpers extend when the landing gear wheels spin up on touchdown and the thrust levers are at idle. They retract when the system is disarmed or when thrust levers are advanced. When armed, the system will disarm automatically if the TOGA triggers are activated, or when a thrust lever is advanced to maximum thrust. If the system is not armed, and the aircraft is on the ground, the lift dumpers will extend when reverse thrust is selected.

Weight on wheels sensors

The two main landing gears each have a weight on wheels sensor to detect whether the aircraft is on the ground. Each is a proximity sensor that activates when the landing gear is compressed by at least 20 mm. When the landing gear is compressed, the sensor reads a ‘ground’ state. When uncompressed, the sensor reads an ‘air’ state.

Flight data analysis

The aircraft was fitted with a flight data recorder and a cockpit voice recorder, which were downloaded by the ATSB. The cockpit voice recorder contained 2 hours of audio from the subsequent flight and none from the incident flight. The flight data recorder contained 500 hours of data, including the incident. The flight data was analysed, and selected timings and parameters are presented in Figure 2 and Figure 3. Of note:

• At the activation of TOGA mode, the aircraft had an airspeed of 126 kt with engines at idle.
• The main landing gear touched down within 0.6 seconds after TOGA mode activation.
• The nose wheel touched down after about 3 seconds, however, it took a further 5 seconds before the aircraft recognised that it was on the ground (had positive weight on wheels), and deployed thrust reversers and lift dumpers.

Figure 2: Landing sequence of events

Source: ATSB

Figure 3: VH-FNR flight data for the landing

Source: ATSB

Maintenance actions

Before returning the aircraft to Perth, the TOGA switches, weight on wheels sensors, lift dumpers, thrust reversers, flight computers, and autothrottle systems were tested by maintenance personnel. No anomaly or unserviceability was found.

After relocating to Perth, the wiring of the TOGA switches and operation of the autothrottle system were tested, with no defects found. The aircraft was then returned to service and at the time of publication of this report, there had been no recurrence.

Landing forces analysis

Accelerometer data from about 200 landings of VH-FNR prior to the incident were aggregated. The maximum G loading, and average between the maximum and minimum G loadings (range) during each landing were calculated. The incident landing had a maximum G loading lighter than about 85 per cent of touchdowns, and range of G loadings during landing smaller than about 90 per cent of touchdowns.

Safety analysis

Activation of TOGA mode

Based on the required hand action and the flight crew’s recollection of the incident, the ATSB assessed that the flight crew did not likely activate TOGA mode inadvertently by pulling the TOGA triggers. Rather, the FO’s hands would have been in the process of reaching for and lifting the thrust reverser levers.

In addition, no system or mechanical faults were found, and there has been no recurrence of the incident, which indicated there was not a persistent fault. Therefore, the reason for the TOGA mode activation could not be established. However, the activation of the TOGA mode resulted in the disarming of the lift dumpers, preventing automatic deployment on touchdown.

Weight on wheels sensing

The weight on wheels sensors gave an intermittent weight on wheels signal during landing, even after all wheels had touched down. This prevented reverse thrust from being deployed and the lift dumpers from extending manually. While not an issue in this incident, research has shown that a delay in the deployment of reverse thrust and/or lift dumpers have contributed to runway overrun events (Jenkins & Aaron, 2012).

The intermittent signal was most likely due to a softer than typical landing, combined with the lift‑dumpers not automatically deploying. Failure of the sensors was unlikely, as the sensors settled to a ground state and no further incidents with the sensors had been recorded at the time of publication of this report.

Findings

From the evidence available, the following findings are made with respect to the avionics system event involving Fokker F100, VH-FNR, on 1 September 2020.

Contributing factors

• During landing, the take-off/go-around mode activated uncommanded for an undetermined reason, preventing automatic deployment of the lift dumpers.

Other findings

• The aircraft landed so softly that the weight on wheels sensors did not immediately activate, which delayed the deployment of reverse thrust and manual extension of the lift dumpers.

Safety actions

Safety action by Virgin Australia Regional Airlines

While no issue with the TOGA switches were identified, the operator has advised the ATSB that they have contacted the aircraft manufacturer and requested the development of guidance for maintenance of TOGA switch travel and resistance.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Virgin Australia Regional Airlines
• flight crew
• Fokker Services.

References

Jenkins, M., & Aaron Jnr, R.F. (2012). Reducing runway landing overruns, Boeing AERO, 47, 15-19. Retrieved from www.boeing.com/commercial/aeromagazine/articles/2012_q3/3/ 

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Virgin Australia Regional Airlines
• flight crew
• Fokker Services.

Submissions were received from Fokker Services. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1.  Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2.  Pilot flying (PF) and pilot monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances, such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.

Overview of the investigation

On 15 September 2020, the ATSB commenced an investigation following notification of main rotor blade delamination involving a Robinson R44 Raven I helicopter, registered VH-RJN. The blade defect was identified on 3 April 2020 while the helicopter was undergoing maintenance at Mareeba Airport, Queensland.

In the days prior, VH-RJN was being operated from Gunnawarra Station, Queensland. On the morning of the 3 April 2020, the pilot conducted a pre-flight inspection of the helicopter. No issues were identified other than an intermittent engine starter, which the pilot/owner intended to have rectified later that day by flying the helicopter to a maintenance organisation at Mareeba Airport.

The pilot conducted an inspection of a station fence line in preparation for the arrival of cattle that were being mustered through the property. The pilot then returned to the station homestead before departing to Mareeba for rectification of the starter issue.

While en route to Mareeba, overhead the Herberton Range, the pilot reported encountering a brief period of moderate turbulence that subsided once clear of the range. The helicopter was landed at Mareeba without issue. After resolving the engine starter defect, the maintenance organisation advised the pilot/owner that during a post-flight inspection one of the main rotor blades was found unserviceable. A patch of paint had dislodged from the upper skin at the blade tip due to the development of corrosion damage at the interface with the tip cap (Figure 1).

Figure 1: Main rotor blade tip corrosion damage

Source: ATSB

During the investigation, the ATSB:

• Interviewed the pilot/owner of VH-RJN.
• Obtained the helicopter’s maintenance records.
• Conducted a technical examination of the defective main rotor blade which confirmed that corrosion had developed on the underside surface of the blade in the region of the tip cap. A small portion of the underside skin displayed evidence of minor disbonding at the intersection with the spar-to-skin bond line. The corrosion had progressed underneath a region of primer that had been applied as a protective measure against paint erosion along the leading edge of the blade.

Reasons for the discontinuation

The ATSB uses its limited resources for maximum safety benefit, and in this case there was no effect on the conduct of the flight and that the defect was discovered during a post-flight inspection of the helicopter.

The pre-flight inspection requirements for the main rotor blade are cited by the helicopter manufacturer in the Pilot’s Operating Handbook, as well as within the Maintenance Manual during the conduct of scheduled maintenance. In addition to those requirements, the helicopter manufacturer had previously released a service bulletin that was intended to reduce the likelihood of corrosion developing at the blade tips by a modification to the blade; SB-103 Main Rotor Blade Tip Plate Permanent Removal and Sealant Application. The service bulletin recommended that a plate attached between the blade tip and the tip cap be removed. In this instance the tip cap plate from VH-RJN had remained in place, which may have influenced the development of the corrosion.

A review of the available records on the CASA defect reporting database during the period 2018‑2020 determined that corrosion and associated disbonding at the blade tip has been identified in other instances. The blade damage was typically found during routine maintenance.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

Overview of the investigation

At 0415 Eastern Standard Time on 24 August 2020, a Pacific National containerised waste train, 1221, travelling from Clyde to Tarago, came to a stand near Lake Bathurst (248.400 km). Upon inspection, the train crew reported that the train had derailed the trailing wheels of the lead bogie of the 34^th wagon. The derailed wagon, RQEY1962D, suffered damage to the lead bogie and frame. The train had travelled approximately 2.7 km in a derailed state which resulted in damage to track infrastructure. There were no reported injuries to staff or members of the public.

John Holland Rail was the rail infrastructure manager for the line.

ATSB’s preliminary evidence collection revealed:

• A package unit bearing assembly on the R2 wheel of the trailing axle of the lead bogie of wagon RQEY1962D seized. After the seizure, the axle journal continued to rotate within the seized bearing as the wheelset rolled on. This caused significant frictional heat and wear of the journal which resulted in the journal shearing off and separating from the wheelset. This is known as a screwed journal. This caused the bogie to collapse under the 34th wagon.
• The remains of the failed bearing were inspected at Bearing Engineering Services at Auburn on 14 September 2020. The inspection found that the class D package unit bearing that had failed was effectively destroyed in the incident. The screwed journal section was not recovered from the derailment site however the outer ring and bearing adaptor were recovered from the bogie. The adapter, bearing cup, bearing cones, spacer, outer seal wear ring and cages were fused together and most bearing rollers were lost.
• An inspection of maintenance records found the bearing was previously reconditioned on 4 March 2019. Maintenance was completed on the wagon, bogie, wheelset and bearings as required by Pacific National’s wagon maintenance manual.
• There were no issues identified with the train management of train 1221.
• There were no identified track defects in the region approaching the derailment site.
• Wayside detectors that monitor wheel impacts and elevated bearing temperatures did not report impacts or temperatures above alarm limits. Immediately prior to the derailment at Burradoo the R2 bearing temperature was recorded as 60°C, 20°C higher than all other bearings on the wagon, this is below the alarm limit for warm bearings.

Reasons for the discontinuation

The ATSB considered the contributing factors to the derailment were a result of a failed bearing. The reasons for that failure were unable to be conclusively determined.

In response to the incident, Pacific National have proposed the following safety actions be initiated:

• Conduct a review of current Pacific National audit programs on bearing overhauler practices with respect to verifying that systems are in place to ensure correct grease quantities are applied to bearings.
• Conduct a review of current Pacific National audit programs on wheelset overhauler practices with respect to verifying systems are in place to ensure that axle journals are within the specified limits for diameter.
• Review the wagon maintenance manual (WMM 01-12) to determine if the impact levels and allowable response periods are appropriate to manage the risk of bearing failure for D class wheelsets.
• Develop data analytics capability to assess if combining the various wayside monitoring measurements could provide an improved insight into the risk of asset failure.

Based on this information, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues or identify opportunity for the enhancement of transport safety. Consequently, the ATSB has discontinued this investigation.

Safety summary

What happened

On 31 August 2020, a Regional Express (REX) SAAB 340B, registered VH-ZRH, and a Shine Aviation Piper PA-31, registered VH-ITF, were both being prepared for their respective passenger transport flights at Carnarvon, Western Australia.

At about 1704 local time, VH-ZRH entered runway 22 just after VH-ITF had commenced its take-off roll on the same runway. The pilot of VH-ITF immediately advised the crew of VH-ZRH that they were rolling and then rejected the take-off. VH-ZRH stopped just inside the runway strip.

What the ATSB found

The ATSB found that, although the crews of both aircraft were aware that they were mutual traffic, their expectations led to an incorrect understanding of the other’s position and/or intentions. This situation led to them not recognising the potential conflict and therefore not directly communicating with each other.

The lookout conducted by the flight crew of VH-ZRH prior to entering the runway was not effective and likely to have been influenced by the crew’s expectation that VH-ITF had already departed.

What has been done as a result

REX advised that the incident was discussed amongst its checking and training organisation for future training events. The operator also published related policy items in an operations notice to highlight the requirements for operating in non-controlled environments. REX also reviewed its human factors and non-technical skills training specifically in relation to communication.

Shine Aviation planned for the incident to be used as a learning tool in order to promote discussion of behaviours and best practice with respect to communications in CTAF environments.

Safety message

This incident highlights the potential effects that expectations can have on how a flight crew perceives information. It is important that flight crew remain vigilant while maintaining situational awareness to counter any expectation bias. Pilots should not hesitate to contact another aircraft if there is any uncertainty as to their position and/or intentions.

The ATSB’s SafetyWatch highlights the broad safety concerns that come out of the bureau’s investigation findings and from occurrence data reported by industry. One of those safety concerns is that insufficient communication between pilots operating in the same area is the most common cause of safety incidents near non-controlled aerodromes. The ATSB booklet A pilot’s guide to staying safe in the vicinity of non-controlled aerodromes outlines many of the common problems that occur at non-controlled aerodromes.

The Civil Aviation Safety Authority has also produced important safety advice for Radio procedures in non-controlled airspace.

The investigation

The occurrence

On 31 August 2020, a Regional Express (REX) SAAB 340B, registered VH-ZRH, and a Shine Aviation Piper PA-31, registered VH-ITF, were both being prepared for their respective passenger transport flights at Carnarvon, Western Australia. VH-ITF was flying to Geraldton with one pilot and two passengers. VH-ZRH was flying to Perth with three crew (two pilots and one flight attendant) and 30 passengers. Both flights were being conducted under instrument flight rules (IFR).

At 1659:10 Western Standard Time,^[1] the pilot of VH-ITF contacted Melbourne centre air traffic control and advised them that they were taxiing at Carnarvon for runway 22 (Figure 1). Melbourne centre advised the pilot that there was no other IFR traffic. Shortly after, the pilot broadcast on the Carnarvon common traffic advisory frequency (CTAF) that they were taxiing for runway 22. At about 1700, the pilot broadcast on the CTAF that they were entering and backtracking runway 22.^[2]

While on the aerodrome apron, the flight crew of VH-ZRH observed VH-ITF taxi past. The first officer was outside the aircraft conducting external inspections and the captain was on the flight deck at the time. The CTAF was not yet being monitored (nor was it required to be at that stage), and therefore VH-ITF’s radio calls during this period were not heard by the pilots of VH-ZRH.

At 1702:51, the crew of VH-ZRH contacted Melbourne centre to advise taxi details. Melbourne centre advised the crew to stand by. While waiting for Melbourne centre, the captain directed the first officer to broadcast on the CTAF that they were about to taxi. Although the pilot of VH-ITF heard this taxi call, they did not respond, nor was there any other response to VH-ZRF’s CTAF broadcast. The crew of VH-ZRH then commenced taxiing for runway 22.

At 1703:16 Melbourne centre advised the crew of VH-ZRH that IFR traffic for them was VH-ITF. Melbourne centre stated that VH-ITF was taxiing at Carnarvon for Geraldton and had planned the same route (as VH-ZRH) at 9,000 ft. The crew of VH-ZRH acknowledged the traffic information at 1703:36.

At 1703:44 Melbourne centre contacted the pilot of VH-ITF to confirm they had received the information about VH-ZRH taxiing. The pilot of VH-ITF confirmed they had. At this time, VH-ITF was approaching the threshold of runway 22 and about to turn around and line up. VH-ZRH was approaching the holding point^[3] for runway 22. The flight crew of VH-ZRH subsequently reported that they did not hear the exchange between Melbourne centre and the pilot of VH-ITF.

As they approached the holding point, the crew of VH-ZRH completed a lookout for traffic. The first officer stated they were not able to see left (towards the runway threshold) due to their seat position and the aircraft window configuration and therefore they only cleared to the right and front. The captain cleared to the left and front, observing the runway, runway threshold and approach areas. The captain stated that they did not see VH-ITF on the runway.

At about this time, the pilot of VH-ITF broadcast on the CTAF they had lined up and were rolling on runway 22. The flight crew of VH-ZRH did not hear this transmission. Since they believed the runway to be clear, the first officer of VH-ZRH broadcast that they were entering and backtracking runway 22, just prior to passing the holding point at about 1704.

By this time the pilot of VH-ITF had advanced the throttles to about three quarters (of full travel) and they had commenced the take-off roll. The pilot heard and observed VH-ZRH enter the runway and they immediately advised VH-ZRH they were rolling on runway 22. Shortly after, the Carnarvon aerodrome reporting officer (ARO) also advised the crew of VH-ZRH that VH-ITF was on the runway. The pilot of VH-ITF subsequently rejected their take-off and commenced backtracking on runway 22.

The flight crew of VH-ZRH did not hear the pilot VH-ITF’s full transmission but did realise what had occurred and immediately stopped a few metres past the holding point (Figure 1) and prior to crossing the edge of the runway. They then advised the pilot of VH-ITF that their transmissions were readability two^[4] and quite scratchy.

The flight crew of VH-ZRH then vacated runway 22, repositioned on taxiway alpha and advised VH-ITF that they would hold short of runway 22. VH-ITF then departed before VH-ZRH continued with their flight.

Figure 1: Aircraft positions at the time of the runway incursion
 

Source: Google Earth, annotated by the ATSB

Context

Personnel information

The captain of VH-ZRF had a total of 3,088 flight hours, with 2,851 hours on type. They commenced with REX in 2015 and had been a captain since mid-2019.

The first officer had a total of 1,976 flight hours, with 577 hours on type. They had previously worked as a flight instructor and charter pilot (single and multi-engine aircraft) before commencing flying at REX in 2019.

The pilot of VH-ITF had a total of 1,476 flight hours, with 265 hours on type. Their previous experience included flight instruction and charter flying with about 15 months flying multi-engine aircraft.

All three pilots indicated that they were not tired or fatigued prior to commencing their flights.

Aircraft information

VH-ZRH was a SAAB 340B, serial number 340B-392. The SAAB was a twin turboprop engine aircraft capable of carrying up to 36 passengers. It is normally crewed by two pilots and a flight attendant.

VH-ITF was a Piper PA-31 Navajo, serial number 31-7812014. The Navajo was a twin piston-engine aircraft capable of carrying up to 8 passengers. It is normally operated by a single pilot.

Operations at non-controlled aerodromes

Civil Aviation Regulation 166 C (Responsibility for broadcasting on VHF radio) stated that, when operating at non-controlled aerodromes, a pilot was to make a broadcast whenever ‘it is reasonably necessary to do so to avoid a collision, or the risk of a collision’. A civil aviation advisory publication^[5] provided further guidance on this as follows:

Whenever pilots determine that there is a potential for traffic conflict, they should make radio broadcasts as necessary to avoid the risk of a collision or an Airprox event. Pilots should not be hesitant to call and clarify another aircraft’s position and intentions if there is any uncertainty.

Both aircraft had been provided traffic advice by Melbourne centre, which clearly indicated that the other aircraft was taxiing at Carnarvon at the same time. Considering the aerodrome configuration (Figure 2), it was reasonable to assume that a potential conflict existed.

Although the crews of both aircraft made appropriate common traffic advisory frequency (CTAF) broadcasts of their position and intentions, they did not communicate directly with one other.

Figure 2: Carnarvon aerodrome chart
 

Source: Airservices Australia, annotated by the ATSB

Traffic awareness

Although the crew of VH-ZRH had acknowledged the traffic information provided by Melbourne centre, both pilots did not realise that VH-ITF was still taxiing at Carnarvon.

Both pilots believed that VH-ITF had already departed by the time they were ready to taxi. They stated that this belief was due to multiple factors, including:

• The pilots estimated at least 10 minutes elapsed between observing VH-ITF taxi past and the incident. They believed this should have been more than sufficient time for VH‑ITF to have already departed. Based on the recorded radio transmissions, the ATSB estimated that the incident occurred at about 1704, 5 minutes after VH-ITF’s taxi call to Melbourne centre and about 1 minute after VH-ZRH commenced taxiing.
• They did not receive a response to their CTAF taxi call at 1703 from VH-ITF’s pilot.
• They did not observe any traffic on their aircraft’s traffic collision avoidance system (TCAS). The operator subsequently conducted an operational check of the aircraft’s TCAS and no technical faults were identified.

When VH-ITF taxied past them on the apron, the flight crew of VH-ZRH were not yet monitoring the CTAF, nor were they required to do so at that point. The crew were using COM 1 for company communications and COM 2 was not used until ground power was connected, which was sometime after VH-ITF had taxied past. ATSB estimated that this was likely to be after VH-ITF had commenced backtracking on runway 22. Therefore, the crew of VH-ZRH would not have heard VH-ITF’s taxi call or entry/backtracking call on the CTAF and were not able to maintain awareness of VH-ITF’s position.

When providing traffic information to the crew of VH-ZRH, the Melbourne centre clearly stated that the VH-ITF was ‘taxiing at Carnarvon for Geraldton’. The crew of VH-ZRH advised that, in their experience, ATC will provide the same information about another aircraft until they receive a departure call from that aircraft, which can occur sometime after the aircraft has become airborne.

The crew of VH-ZRH did not hear Melbourne centre pass traffic information to VH-ITF, nor did they hear VH-ITF’s CTAF transmission that they were lining up and rolling. The crew stated that, at about the same time as those transmissions, they were confirming the assigned transponder code. Due to an error in the initial readback, the code had to be read back again, which delayed the code’s input. This possibly diverted their attention long enough to not hear the transmissions.

The pilot of VH-ITF believed that VH-ZRH was aware of their position on the runway and would hold short until they had departed. This belief was developed because they had heard Melbourne centre providing VH-ZRH with traffic information. It was then reinforced once VH-ITF had turned around on runway 22 and they had VH-ZRH visual, and thus assumed the crew of VH-ZRH also had them visual.

Visibility from taxiway alpha holding point

Although the captain of VH-ZRH did not see VH-ITF prior to entering the runway, immediately after the incident the captain and first officer were able to see VH-ITF. Upon repositioning at the holding point, the captain noted that the background buildings and terrain made it difficult to identify VH-ITF on the runway threshold.

The ATSB reviewed images of the runway threshold from the holding point on taxiway alpha. Although the images did support the captain’s view of potential difficulty in identifying an aircraft on the threshold, it was noted that the aerodrome reporting officer (ARO), who was positioned on the apron adjacent to taxiway alpha, had VH-ITF in sight.

The pilot of VH-ITF stated that there were no impediments to visibility and, although they were looking from the opposite direction, had VH-ZRH in sight.

VHF transmission quality

The flight crew of VH-ZRH recalled that the transmissions from VH-ITF were faint and quite scratchy. This was supported by the ARO. The ATSB reviewed the CTAF recording and noted that VH-ITF’s transmissions were distinctly weak in comparison to those from VH-ZRH or the ARO but they were still audible and understandable. There was no indication that VH-ITF’s transmissions to Melbourne centre were degraded in any way.

Following the incident, Shine Aviation noted a history of issues relating to VH-ITF’s VHF radio COM 1, all of which were in 2018 and had been already actioned. On 30 September 2020 (after this incident), VH-ITF again experienced an issue with VHF radio COM 1 and maintenance action was commenced to ascertain the cause. The ATSB noted that COM 1 was being used for CTAF transmissions at the time of the incident on 31 August 2020.

VH-ITF’s initial CTAF transmissions were not heard by the crew of VH-ZRH since they were not yet monitoring the CTAF. VH-ITF’s lining up and roll call was probably missed by the crew of VH‑ZRH due to a combination of VH-ITF’s weak CTAF transmission and VH-ZRH’s crew having diverted their attention to transponder code confirmation and entry. However, the ATSB noted that the crew of VH-ZRH also did not perceive the exchange between VH-ITF and Melbourne centre, which was on a radio for which no communications difficulty was identified.

While the crew of VH-ZRH described VH-ITF’s transmissions as faint and difficult to hear, the ATSB noted that, immediately after the incident, communications between VH-ITF and VH-ZRH were established and continued without issue.

There were multiple radio transmissions regarding the movement of VH-ITF, between various parties, over two radio channels (COM 1 and COM 2). It was evident that the crew of VH-ZRH had received (and acknowledged) at least one of these communications advising that VH-ITF was traffic for them, so it was reasonable to assume that a potential conflict existed. Considering the crew’s diverted attention towards their transponder code input at the time of these communications, VH-ITF’s weaker transmissions alone were not considered contributory to the incident.

Safety analysis

In this incident, the crews of both aircraft were provided with sufficient information to aid their situational awareness and be alerted to traffic relevant to them. However, the pilots did not fully comprehend the traffic picture and/or did not recognise the potential conflict that existed.

Although the flight crew of VH-ZRH believed VH-ITF to have departed, the traffic information provided to them by Melbourne centre clearly stated that VH-ITF was still taxiing at Carnarvon. Although it is possible that a controller could provide such information in cases where an aircraft had departed and the crew had not yet made a departure call, the statement that VH-ITF was taxiing (and was therefore a potential conflict) should have been assumed to be true until the crew could confirm otherwise.

Expectations strongly influence where a person will search for information and what they will search for (Wickens and McCarley 2008), and they also influence the perception of information (Wickens and others 2013). In simple terms, people are more likely to see or hear what they expect to see or hear, and less likely to see or hear things they do not expect. Expectations are more likely to have an influence when some of the available cues are not salient. In this case, the flight crew had developed an expectation that VH-ITF had already departed, and it is likely that this expectation then strongly influenced their perception of subsequent information.

In particular, this expectation bias likely influenced the flight crew’s ability to visually scan for traffic prior to entering the runway. As they were not expecting traffic to be there, the captain looked but did not see VH-ITF on the threshold. The ATSB notes that although the background potentially masked VH-ITF from the captain’s scan, the ARO was able to see VH-ITF from a similar position.

The pilot of VH-ITF was fully aware that VH-ZRH was taxiing and, having heard all of that crew’s transmissions, assumed they were equally aware of VH-ITF. The pilot expected VH-ZRH would hold short and, therefore, a potential conflict did not exist. Consequently, the pilot did not believe there was a need for direct radio contact with the other crew to clarify their intentions.

As the pilot of VH-ITF had VH-ZRH visual, they were able to quickly reject the take-off when VH‑ZRH entered the runway.

Findings

From the evidence available, the following findings are made with respect to the runway incursion involving a SAAB 340B, VH-ZRH at Carnarvon Airport, Western Australia, on 31 August 2020.

Contributing factors

• The flight crew of VH-ZRH were not aware, as they entered the runway, that VH-ITF had commenced its take-off roll. As a result, a potential conflict existed that required the pilot in command of VH-ITF to reject their take-off.
• The lookout conducted by the flight crew of VH-ZRH before entering the runway was not effective in identifying VH-ITF on the runway threshold. This was likely influenced by the crew’s expectation that VH-ITF had already departed.
• Although both flight crews were aware that they were mutual traffic, they both had an incorrect understanding of the other’s position and/or intentions, which led to them not recognising the potential conflict and therefore not directly communicating with each other.

Safety actions

Safety action by Regional Express

Regional Express (REX) reported that the flight crew had been debriefed on all aspects of the incident. The incident was also discussed amongst the REX checking and training organisation for consideration in future training outcomes.

REX also published an operations notice (for pilots) that included related policy items to highlight the requirements for operating in non-controlled environments. It also reviewed its human factors and non-technical skills training specific to communication.

REX advised that operations at non-towered aerodromes continues to be a focus of its safety promotion activities, with recent articles being published in its September 2021 Group Safety Newsletter.

Safety action by Shine Aviation

Shine Aviation’s internal investigation recommended this incident be used as a learning tool to promote discussion of behaviours and best practice with respect to communications in CTAF environments.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew of VH-ZRH
• the pilot of VH-ITF
• Regional Express
• Shine Aviation
• the Carnarvon Shire Council
• the Civil Aviation Safety Authority
• Airservices Australia.

References

Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Wickens, CD & McCarley, JS 2008, Applied attention theory, CRC Press, Boca Raton, FL.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the captain and first officer of VH-ZRH
• the pilot of VH-ITF
• Regional Express
• Shine Aviation
• the Civil Aviation Safety Authority.

Submissions were received from:

• the captain of VH-ZRH
• the first officer of VH-ZRH
• Regional Express.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST) is Universal Coordinated Time (UTC) + 8 hours.
2. The recorded transmissions from the Carnarvon CTAF were not timestamped, however, the ATSB was able to approximate their timings relative to the recorded air traffic control communications which were accurately timestamped.
3. A holding point signifies the entry to the runway environment. It is set back by a clear area around the physical runway but still crossing the holding point is considered entering the runway.
4. The radio transmission readability scale used in aviation is 1 to 5, where 1 is unreadable and 5 is perfectly readable.
5. Civil Aviation Advisory Publication 166-01(v4.2) Operations in the vicinity of non-controlled aerodromes

Overview of the investigation

The ATSB commenced an investigation into an unforecast weather event involving a Qantas Boeing 737-838 aircraft, registered VH-VYZ, which occurred at Adelaide Airport, South Australia on the morning of 16 August 2020.

The weather forecast used for pre-flight planning did not require the carriage of fuel for an alternate destination, however, the flight crew requested additional fuel for other operational reasons. Once airborne, an updated forecast identified fog at Adelaide that was expected to clear prior to the aircraft’s estimated time of arrival. The flight crew prepared for possible diversions in the event that the weather did not clear at the expected time.

During the flight, there was an unexpected outage of Bureau of Meteorology (BoM) services at Adelaide, which resulted in an updated forecast not being available prior to the crew’s calculated latest divert time. However, the weather forecast received earlier in the flight was still valid for the expected time of landing.

After the latest time to divert had passed, the crew received an updated forecast indicating that the fog would clear later than originally expected. Despite the extended fog duration, there was still sufficient fuel on board for the aircraft to operate safely for more than 30 minutes beyond the new clearing time.

During the approach phase, the flight crew interrogated the automatic terminal information service^[1] multiple times noting that the observed conditions were improving. They also received verbal advice from air traffic control that the conditions were improving.

At 0914 Central Standard Time,^[2] the flight crew conducted a missed approach due to lack of visual references and commenced holding in the vicinity of the airport. About 30 minutes later, just before 0945 the flight crew made another approach deciding to use the aircraft’s autoland^[3] system in order to minimise their workload. Weather camera images provided by the Bureau of Meteorology showed that the weather during the second approach had improved since the time of the missed approach.

The captain reported being visual at the minima and the aircraft landed safely, well above minimum fuel reserves.

As part of the investigation the ATSB:

• interviewed the flight crew,
• collected and examined the weather data including forecasts, weather and camera images,
• examined the recorded flight and air traffic data,
• examined the operator’s flight planning procedures and in-flight decision making in relation to weather.

The ATSB found that at all stages of the flight the operator and flight crew acted in accordance with the regulations and in alignment with operational guidance.

In 2013, the ATSB published a safety research report into the effects of Australian aviation weather forecasts on aircraft operations at Adelaide and Mildura Airports (AR-2013-200). The results of the report encouraged the retrieval of weather forecasts at the latest possible time prior to arrival. In this case, that weather was not available due to the outage and that aspect is being investigated by the BoM.

Reasons for the discontinuation

Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues or important safety lessons. Consequently, the ATSB has discontinued this investigation.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

__________

1. Automatic terminal information service (ATIS) is a continuous broadcast of recorded aeronautical information at airports containing information including current weather.
2. Central Standard Time (CST): Coordinated Universal Time (UTC) + 9.5 hours
3. The autoland system automates the landing procedure of the aircraft’s flight, supervised by the flight crew.

This investigation was conducted under the Transport Safety Investigation Act 2003 (Commonwealth) by the Office of Transport Safety Investigations (NSW) on behalf of the ATSB in accordance with the Collaboration Agreement. Released in accordance with section 25 of the Transport Safety Investigation Act 2003.

Safety summary

What happened

On 29 July 2020 at 0508, a loaded Pacific National (PN) coal train MB526 collided with the rear of a One Rail Australia (ORA) coal train AH378. MB526 was routed behind AH378 on number 3 arrival road in Kooragang Coal Terminal. At the time of impact, MB526 was moving at approximately 16 km/h. AH378 was stationary due to technical issues that occurred while it was unloading coal.

The collision resulted in significant damage to the rail infrastructure and the derailment of the last two wagons of AH378 and the leading locomotive of MB526. The derailed locomotive and wagons also came into contact with two adjacent stationary trains, BC346 and HV274. These trains sustained minor damage. The driver of the derailed locomotive experienced minor injuries.

What the ATSB found

While AH378 was unloading at Kooragang Island Coal Terminal, several penalty brake applications, associated with a fault in its electronic pneumatic brake system, disabled the train bringing it to a standstill. The crew investigated the faults using a series of technical exercises, which then caused the End of Train (EOT) light on AH378 to be extinguished. The disablement of AH378 constituted a Condition Affecting the Network (CAN) but the crew did not report it to the Kooragang Network Controller as they were required to do. As the Kooragang Network Controller was unaware that AH378 was disabled on number 3 arrival road, they set a signal for MB526 which allowed it to proceed, with caution along number 3 arrival road. When the crew of MB526 saw the shunt proceed signal combined with information they had received earlier, they were expecting any train ahead to be operating farther along the track and illuminated with an EOT light.

The terminal area where the accident occurred was poorly lit by artificial trackside lighting and the absence of the EOT light on AH378 reduced its conspicuity. Light produced by an overhead gantry, above the accident site, may also have caused disabling glare for the drivers of train MB526. In combination, these factors reduced the likelihood that the drivers of MB526 would have seen train AH378 in time to prevent a collision.

The crew’s expectations combined with glare from a nearby overhead signal gantry concealed the presence of AH378 until it was too late to avoid a collision.

What has been done as a result

On 1 August 2020, PN issued notices that informed drivers that on receiving a shunt proceed signal within Kooragang Coal Terminal, they must not exceed 8 km/h and should also proceed as if the line ahead is already occupied.

ORA added programmed monitoring of EOT lights into its asset management plan. ORA also circulated safety information (Notice to Drivers -HV-0046) to their drivers which reminded them of the requirement to communicate all conditions affecting the network to network control.

The Australian Rail Track Corporation (ARTC) provided advice to rail operators to clarify, the operation of trains with defective EOT lights. ARTC also updated information contained in the Rail Access Standard general information.

Safety message

This accident highlights the importance of train crews communicating conditions affecting the network to network control. It also emphasises the need for train crews operating in areas of restricted visibility to be prepared to stop short of any obstruction on the track.

The occurrence

On 29 July 2020, PN was operating freight train MB526 between Maules Creek and Kooragang Coal Terminal, New South Wales (NSW). Ahead of MB526 was the ORA-operated coal train AH378.

At approximately 0305^[1], AH378 entered 3 arrival road in Kooragang Coal Terminal making its way towards number 3 dump station.

At approximately 0325, MB526 departed Branxton Station (215.540 km) in the Up^[2] direction with two crew on board, comprising the driver and second person. The two crew had just taken over the train at Branxton and had been informed by the departing crew, that a train was somewhere ahead of MB526 with an extinguished EOT light (referring to, but not identifying, HV274).

At 0352, MB526 approached Lochinvar Station (202.600 km) and made a 35 % brake application. The crew identified no issues with the brakes at the time. At approximately the same time, AH378 commenced discharging at number 3 dump station (177.288 km^[3]). The journey of MB526 is illustrated in Figure 1.

Figure 1: Incident location and path of MB526

Source: Geoscience annotated by OTSI

While unloading, AH378 experienced several Electronically Controlled Pneumatic (ECP) brake penalties^[4] and eventually came to a stand at 0410. The crew of AH378 called for technical assistance from ORA rolling stock maintainers to rectify the situation. AH378 was stationary as the crew and maintainers diagnosed the cause of the ECP penalties.

At approximately 0427, PN coal train HV274 (proceeding under Block Working, due to an extinguished EOT light), entered arrival road 1 and came to a stop a short time later, approximately 45 m before number 1 dump station (177.310 km).

At 0433, the MB526 second crew member called the PN Kooragang team leader on the phone. The team leader advised MB526 that they would be tipping at dump station 3 and that AH378 was ahead of them with approximately half a load to tip.

At 0434, the Australian Rail Track Corporation (ARTC) Kooragang Network Controller, set signal K23 (175.384 km) to a ‘shunt proceed’ aspect. The controller was unaware of the technical difficulties AH378 was experiencing when this occurred.

At 0451, MB526 entered Kooragang yard limits (170.047 km) and proceeded along a route with clear signals. The crew of MB526 were carrying out several observational duties as they passed the series of signals that authorised MB526 to continue towards number 3 dump station.

At 0457, the AH378 crew ended ECP^[5] in an effort to rectify the brake penalties on AH378. It is likely the crew were unaware, that ending the ECP also extinguished the EOT light. The unlit rear of AH378 was located at approximately 176.165 km. The crew of AH378 did not inform the Kooragang Network Controller of this action.

At 0503 MB526 passed signal K17 (174.982 km), which was set at caution, the train was travelling at approximately 18 km/h with the headlights set to Bright to improve visibility in an area of the yard with little or no trackside lighting. At 0503:36, the crew confirmed that points 107 and 111 (175.177 km) were correctly set. After the driver confirmed that they were not on the same arrival road as BC246 (arrival road 4), the driver set the train speed to 15 km/h.

At 0506:07, MB526 entered arrival road 3 and approached signal K23 (175.384 km), the crew confirmed the signal was set to a calling on aspect, meaning they could proceed past the signal. MB526 passed K23 signal in throttle notch 2 at approximately 9 km/h, slowly accelerating to approximately 18 km/h as it later passed the 176.096 km mark. Shortly after passing K23 (0506:15), the crew identified the rear of the earlier reported unlit train (HV274) on arrival road 1 and discussed challenges with seeing an unlit wagon in the dark. During this discussion, MB526’s headlight, was switched to Dim mode then switched off (175.495 km). The headlight remained off while the crew continued the conversation until 0506:50 when the headlight was turned back on to Dim mode (175.609 km). MB526’s loco data logger shows the train had travelled for approximately 35 seconds and 114 m with the lights off.

When the lights were turned on, unbeknownst to the crew, MB526 was approximately 550 m from the unlit rear of AH378, travelling at 13 km/h and accelerating.

At 0508:47, the driver of MB526 made an emergency brake application after the assistant driver shouted a warning when they saw the unlit rear wagon of AH378 appear close ahead, out of the darkness.

At 0508:49, MB526 collided with the rear wagon of AH378 on arrival road 3 at Kooragang Coal Terminal, between signals K23 and K31 and came to a stop at approximately at 176.160 km (Figure 2).

Figure 2: Kooragang Island with approximate location of trains at time of incident

Source: OTSI, modified and annotated by OTSI

As a result of the collision, MB526’s lead locomotive (9211) derailed to the left, impacting and derailing a wagon of ORA coal train BC246 on arrival road 4. The wagon (PHWH0214S) remained upright and coupled to the remainder of BC246. AH378’s rear two wagons (PHEH01514D and PHEH01513R), derailed to the right and struck PN coal train HV274, derailing a wagon (NHRH50410Q), this wagon remained upright and coupled to HV274 (Figure 3).

Figure 3: Collision site

Source: OTSI, modified and annotated by OTSI

The incident also resulted in damage to approximately 70 m of rail and concrete sleepers on number 2 and 3 arrival roads.

Context

Train crew

MB526 was operated by two crew: a driver and an assistant driver. Both crew were appropriately qualified. Neither driver was originally rostered to work the morning of the accident. At around 2000 on 28 July, a PN rostering clerk called each driver and requested they undertake a shift starting 0015 on 29 July. There was a 90-minute stand-up/call time for this shift, meaning the drivers would be called at 2245. The start time for the drivers’ shift was subsequently pushed back to 0215 and the drivers were called at around 1215.

The driver and assistant driver, both advised the PN internal safety investigation they went to sleep immediately after accepting the job and achieved a reasonable quality sleep. Based on the available information, the drivers probably each achieved around 4 hours sleep prior to commencing their shift.

Both drivers reported having a sleep-in on the day prior to the accident, and neither reported feeling fatigued at the time of the accident. Considering that the accident did not occur at a time of day typically associated with the nadir of circadian alertness, and that the development of the accident was not indicative of fatigue-related performance problems, the ATSB did not identify fatigue as a contributory safety factor.

Environmental conditions and visibility

On the morning of the accident, the sun rose at 0645, with astronomical twilight starting at 0521. It was not raining at the time of the accident, but rain had fallen overnight, and the ground was wet. Environmental conditions at the time of the accident were dark.

The area where the accident occurred was not lit by artificial trackside lighting except for the overhead gantry signal lights. As MB526 travelled along arrival road 3, the two stationary trains on the adjacent arrival roads 1 and 4 created a corridor and may have blocked ambient light. During interview, the drivers of MB526 recalled that conditions on arrival road 3 were very dark.

MB526 was equipped with a front-facing video camera and the ATSB reviewed footage of the approach along arrival road 3. The video (as captured in Figure 4) showed that conditions were dark, and that after the train drivers extinguished the headlights, nothing was visible outside apart from distant artificial lighting.

Figure 4: Video onboard MB526 three seconds apart, showing outside visibility with headlights on Bright mode (upper), Dim mode (middle) and off (lower)

Source: Pacific National

The rear of train AH378 was 110 m before the overhead gantry signal K31, in MB526’s direction of travel. Video footage from MB526 showed that as the train approached the gantry, the gantry lights appeared to produce a halo of light which occluded the surrounding area. The rear of train AH378 only became visible in the video footage a few seconds prior to impact. The drivers of train MB526 did not mention any problems associated with the overhead gantry but did recall that AH378 appeared to “come out of nowhere” (Figure 5).

Figure 5: MB526 front of train CCTV frames over 7 seconds

Source: Pacific National annotated by OTSI

The ATSB investigation did not examine the visibility of trains at the Kooragang freight terminal including around the overhead gantry and relied on the information provided by the drivers and the CCTV footage. While CCTV footage indicated the gantry may have produced glare, the appearance of glare is different in recorded video compared to as seen by the human eye.

The driver also recalled that because the PN Kooragang team leader had advised the crew of MB526 earlier in their journey that the train ahead was dumping at dump station 3 and was halfway through dumping their load, they expected this to be completed and the train to have moved off by the time they arrived at that section of track. Because of this, the driver was not expecting a train to be positioned underneath the gantry and their gaze was focussed further down the track.

Train information

MB526 consisted of three 92 class locomotives and 82 ECP loaded coal hopper wagons. The three 92 class locomotives were arranged with 9211 in the lead, 9203 second and 9207 in the third position. The drivers were operating the train from locomotive 9211.

The 92 class locomotives were 22 m in length and weighed 139 tonnes. They had two 350W headlights and two 100W ditch lights at either end. The locomotives had a crew of two, the driver and assistant driver. The train crew were appropriately qualified.

The 82 wagons were of the NHEH class, which weighed (empty) approximately 22 t each, were arranged in packs of four which had a combined capacity of 432 cubic metres of coal. MB526 was approximately 1325 m in length and the 82 wagons had a combined loaded weight of 9840 t.

AH378 consisted of three XRN class locomotives and 96 PHEH/PHYH coal hopper wagons. The train length was 1478 m, with a total mass of 11348 t. The train was equipped with ECP braking and an extinguished EOT light.

Headlights

The lead locomotive of MB526 had two 350W headlights and two 100W ditch lights. The headlights could be operated in two brightness settings: Bright and Dim. The light switch panel in the locomotive enabled the train driver to turn the headlights on and off and select the brightness setting.

The driver said that after they passed the unlit rear of train HV274, they extinguished their headlights to demonstrate to the assistant driver the difficulties of seeing an unlit train in the dark conditions. At interview the driver said that it was often easier to see an EOT light with the headlights on Dim mode. The driver said that Dim mode offered reduced reflections from adjacent wagons in dark conditions, which allowed the earlier identification of an EOT light.

The front-facing video from MB526 showed the driver turned the headlights to Dim mode before turning the headlights off after passing HV274. When the headlights were turned to Dim mode, visibility ahead of the train was significantly reduced.

ECP and EOT

Electronically controlled pneumatic braking system is an electrically controlled system that applies or releases the service brake on each wagon simultaneously at the driver’s command. The system connects from the locomotives to each wagon both electrically and pneumatically. The simultaneous application of braking force on each wagon improves braking performance and assists in train handling.

The system includes a failsafe feature that automatically applies the brakes if the electrical connection between the wagons be broken or the air supply lost.

The ECP cable also provides power to the train EOT light (Figure 6), if the ECP fails or is turned off, the EOT light extinguishes. The EOT light on the rear wagon of AH378 was extinguished at the time of the accident. The last wagon on AH378 also had reflective discs to assist with visibility in lowlight conditions.

The driver of MB526 said that as they were proceeding along arrival road 3, they were looking for an EOT light to locate the train ahead. Having seen the unlit rear of train HV274, the driver assumed this was the train they had previously been advised was operating without an EOT light, and did not think there would be another train ahead that was also operating without an EOT light.

Figure 6: EOT marker light and impact point

Source: OTSI

Network procedures related to the ‘shunt proceed’ signal

ANSG 606 Responding to Signals and Signs prescribes the rules for responding to signal indications and signs on the ARTC network. It contains a description of how to interpret and respond to track signals which inform train drivers and qualified workers about the status of the line ahead.

The shunt proceed signal authorised the train driver to pass the signal at restricted speed^[6], with the knowledge that another train was occupying the next section. The procedure for responding to a shunting signal included a warning for the driver (Figure 7).

Figure 7: ANSG606 warning to drivers

Source: ARTC

This rule required a driver to travel at a speed that allowed the train to stop within the visible section of the line, short of any obstruction. On a bright sunlit day with unlimited visibility a higher speed could be considered appropriate ‘restricted speed’, as long as the train could stop short of an obstruction. In low light conditions obstructions appear much closer to the front of the train and a lower speed would be appropriate, considering the weight of the train and its effect on stopping distance.

At interview, the driver of MB526 said that because they had received a shunt proceed signal, they did not expect to see a train without a lit EOT light ahead.

Related occurrence

On 26 June 2012, a loaded coal train (Unit 3 BG146) collided with another loaded coal train (Unit 9 BS288) that was discharging at number 2 dump station. The incident occurred very close to the location of the 29 July 2020 incident.

Following the 2012 incident PN issued a Local Safety Notice (LSN No: CH23/12) to train crews. The safety notice described the incident and reminded train crews of the controls already in place to minimise the likelihood of a train collision. These included the PN route knowledge pack for Kooragang Coal Terminal which specified a 15 km/h speed limit for the section where the incident occurred. The safety notice also included a reminder that the Terminal was operated under Yard Working Conditions and that caution signals required the slowing of trains to ensure that the train can be stopped clear of any obstacles that may be on the track.

On 26 September 2012, PN issued a Divisional Safety Notice (DSN 15/12) which superseded the Local Safety Notice. DSN 15/12 imposed a speed limit of 10 km/h on PN trains from signal K13 (174.180 km) until they reached a brick building (adjacent to the position of the July 2020 collision location at 176.160 km). From the point adjacent to the brick building to the dump stations a speed of 5 km/h was imposed (Figure 8). This speed limit was less than the posted 25 km/h ARTC limit.

Figure 8: Kooragang reduced speed limit issued by PN in 2012

Source: PN annotated by OTSI

The PN self-imposed speed limit was discontinued before the time of the July 2020 accident.

ARTC NSW Network Rules and Procedures

Rail movements within the confines of the Kooragang Coal Terminal are subject to a series of network rules and procedures defined by the ARTC. These rules and procedures include instructions for train operators utilising the ARTC NSW network in general and Kooragang specifically.

ANGE 206 Reporting and Responding to a Condition Affecting the Network (CAN), prescribes rules for reporting and responding to unsafe conditions affecting or potentially affecting the ARTC network. This rule mandates that any conditions that can or do affect safe rail operations in the ARTC network must be reported promptly to the Network Control Officer and the appropriate response be implemented.

ANSG 606 Responding to Signals and Signs, prescribes the rules for responding to indications and signs in the ARTC network. It contains a description of how to interpret and respond to track signals which inform train drivers and other qualified workers about the status of the line ahead.

ANSG 608 Passing Signals at Stop, prescribes the rules for passing signals at stop in the ARTC network. This rule provides instruction requiring a driver to communicate with a Network Controller before passing a signal at stop on the wider ARTC NSW network.

ANTR 400 Protecting Trains, prescribes rules for protecting trains in the ARTC NSW network.

ANTR 404 Using Brakes, prescribes rules for using train brakes safely in the ARTC network. This procedure includes a requirement to notify a Network Controller if a train is suffering an abnormality of defect with the brakes.

ANTR 406 Using Train Lights, prescribes rules for using train lights for indication and warning on the ARTC network. It includes a requirement for trains to have at least one white marker at the front and at least one approved red tail light or approved end of train marker at the rear of the last vehicle. The EOT light must be lit in low visibility conditions. This rule also includes a requirement for a Network Controller to arrange for the train to operate as a block train if the EOT is unlit at night. The rule also requires the illumination of a train’s headlights on full at all-times on the ARTC network unless required to be dimmed. The headlights must be dimmed when approaching an opposing train, when hand signals are displayed, when approaching workers near the track and during shunting.

ANTR 416 Disabled Trains, prescribes rules for dealing with disabled trains in the ARTC network. The rule includes requirements for a disabled train’s crew to report to the Network Controller the nature of the failure and to take steps to protect the train.

ANTR 418 Yard limits, prescribes rules for the safe movement of rail traffic within yards in the ARTC NSW network.

ANTR 420 Shunting and marshalling, prescribes rules for making safe shunting movements in the ARTC NSW network.

ANPR 722 Manual Block Working, prescribes rules to prevent rail traffic entries into occupied blocks of track.

ANSY512 Manual Block Working, prescribes the rules for manually maintaining blocks between rail traffic movements in the ARTC NSW network.

Safety analysis

Communication of Condition Affecting the Network

On the morning of 29 July 2020, the driver of AH378 responded to a series of ECP penalties by contacting maintenance personnel to assist with the fault diagnosis of the brake system. During the fault diagnosis of this system, the crew of AH378 did not report the disablement of the train to the ARTC Kooragang Network Controller as required by network rules including ANGE 206 Condition Affecting the Network (CAN) and ANTR 416 Disabled Trains.

At 0457 when the ECP was ended and the EOT light extinguished, the requirements for managing trains under ANTR406 (Block Working) were not implemented. This occurred because earlier at 0434, the Kooragang Network Controller had not been informed that, and did not notice on their display, AH378 was disabled at the dump station. As a result, they set signal K23 to shunt proceed instead of setting to stop and using block working. The shunt proceed signal allowed MB526 to enter the same section of track towards the already disabled AH378.

While MB526 was approaching the rear of AH378 on arrival road 3, the Kooragang Network Controller was involved in carrying out block working of train HV274, which was operating with an unlit EOT light on arrival road 1. The block working involved an increased workload for the 

Kooragang Network Controller. It is likely that the controller, communicating with HV274 and concentrating on ensuring that the correct signals were set to protect the train, did not notice that AH378 was stationary.

Had the Network Controller been informed of or realised that a CAN existed it is unlikely, based on the requirements of block working, that they would have authorised MB526 to enter the section with AH378.

Visibility and headlight use

As the crew of train Pacific National train MB526 travelled along Kooragang terminal approach road 3, their vision of the track ahead was limited by the dark conditions outside. The approach road was unlit by trackside lighting and two other trains occupied the adjacent approach roads 1 and 4, blocking other trackside light sources.

Ahead of train MB526 was train AH378, immediately ahead of the overhead gantry displaying signal K31. Bright lights can sometimes cause visual problems due to extra light being scattered within the eye onto the retina, thereby reducing contrast of the retinal image.^[7] Where this causes some loss of visual capability, this is described as ‘disability glare’. Footage from the forward-facing video recorded from MB526 showed that the gantry lights appeared very bright, which may have caused disability glare for the drivers and impaired their vision of the track (and train) ahead.

Without trackside lighting, the ability of the crew of MB526 to see AH378 was dependent on the light produced by either train. Due to maintenance actions, the end of train marker light at the rear of train AH378 was unlit, greatly reducing the conspicuity of the train to oncoming vehicles.

The crew of MB526 turned off their headlights for around 35 seconds as they traversed the dark approach road, before activating the headlights in Dim mode when they were around 550 m prior to the rear of train AH378. The selection of Dim mode met the requirements of ARTC Network Rule ANTR 406, headlights must be dimmed where shunting is taking place.

In Dim mode, the headlights cast much less light, reducing the opportunity of the drivers to identify objects ahead of the train. However, it was not possible to determine whether the use of Dim mode contributed to the late detection of the rear of train AH378, due to the uncertain impact of glare from the overhead gantry. Further, it is noted that the crew were expecting the rear of any trains ahead to be lit and considered that Dim mode might help with detecting lit objects.

In summary, the drivers of train MB526 were operating in a very dark environment, driving towards an unlit obstacle. These visual conditions were very challenging and reduced the likelihood the drivers would see train AH378 in time to prevent a collision.

Train crew expectancy

Prior to entering the section of track occupied by train AH378, the crew of train MB526 received a shunt proceed signal which meant the track ahead may be occupied but implied there was no CAN on the proceeding track such as a disabled train. The crew had received no information that a train was stationary and disabled without an EOT light, ahead of the overhead gantry, in the area possibly obscured by light glare.

At the beginning of their journey, the crew had been informed there was another train operating ahead of them without an EOT light. When the crew sighted train HV246, they assumed that this was the train about which they had been forewarned. Later in their journey, the crew had been informed that a train ahead was halfway through dumping. Based on this information, the drivers expected any proceeding train to be farther down the track, well beyond the gantry.

These preceding events shaped the drivers’ expectations for the route ahead, and where they were looking. The crew were focussed on the section of track farther along the approach road, past the curve, and were looking for an illuminated EOT light. The drivers’ low expectancy of a train in that section of track, and low expectancy of an unilluminated train reduced the likelihood that they would notice train AH378 in time to prevent a collision.

When interviewed the crew said, that confirming the location of the train with the unlit EOT (HV274) that they had been warned about and the absence of any EOT light in front led them to relax, as the situation appeared as they expected. The driver expected the train ahead was around the corner and was preparing to slow MB526 as they passed the next signal before they reached the turn (Figure 11).

Figure 11: Bend in Kooragang arrival roads

Source: OTSI

Findings

From the evidence available, the following findings were made with respect to the collision between coal trains MB526 and AH378 in Kooragang, NSW on 29 July 2020.

Contributing factors

• Kooragang terminal approach road 3 was unlit by trackside artificial lighting and was very dark. The conspicuity of the stationary train AH378 was reduced by the absence of an illuminated end of train marker. The light produced by an overhead gantry may have caused disabling glare for the drivers of train MB526. In combination, these factors reduced the likelihood that the drivers of MB526 would have seen train AH378 in time to prevent a collision.
• The crew of AH378 did not report the disablement of the train to the network control officer as required under the network rules, ANGE206 Condition Affecting the Network, ANTR 404 Using brakes and ANTR 416 Disabled trains.
• The Kooragang Network Controller did not know or had not noticed that AH378 was disabled at the dump station. As a result, they set signal K23 to shunt proceed instead of setting it to stop and using block working.
• The shunt proceed signal authorised the crew of MB526 onto the section of track occupied by AH378. Based on this and information received earlier in the journey, the crew of MB526 expected any train ahead to be operating farther along the track and that it would be illuminated with end of train lights. The crew’s low expectation of the unlit train AH378 immediately before the gantry, reduced the likelihood they would have detected the train in time to prevent collision.

Other factors that increased risk

• The driver of train MB526 deactivated the train headlights while operating along an unlit section of track. This greatly increased the risk of collision with an undetected obstacle.
• The start time initially allocated by PN rostering to the drivers of train MB526 provided a rest opportunity of 2 hours and 15 minutes. This is significantly below the time normally required to achieve sufficient restorative rest. Had the drivers woken at 2245 as planned, they would have experienced an acute sleep debt and an unacceptable risk of fatigue.

Safety actions

Safety action by Pacific National

On 1 August 2020, PN issued Local Safety Notice 20-71 Responding to Shunt Proceed Indications. This notice reminded drivers that when they receive a shunt proceed signal, they must proceed as if the line ahead is already occupied and at a maximum of 8 km/h.

The 8 km/h speed limit was implemented for operations at Kooragang Coal Terminal (from signal K5 at 172.830 km) and Port Waratah Terminal (from signal PW2 at 164.945 km).

PN participated in regular meetings with the ARTC to discuss concerns raised from the incident.

Safety action by One Rail Australia

ORA instigated a review of their asset management plan to include programmed monitoring of EOT lights. On 28 August 2020, ORA also circulated safety information (Notice to Drivers -HV-0046) to all their drivers. This notice reminded drivers of the requirement to communicate with network control all conditions affecting the network. The notice also informed train crew that when ECP is ended the EOT light extinguishes. ORA provided copies of network rules ANGE232 Responsibilities of Rail Traffic Crews and ARTC Network Rule ANTR416 Disabled Trains with the notice to drivers.

ORA also participated in regular meeting with the ARTC to discuss concerns raised from the incident.

Safety action by Australian Rail Track Corporation

The ARTC provided clarification advice to rail operators, regarding the operation of trains with defective EOT lights. This advice was in the form of two notices (SAFE Notice and Standing Notice).

The ARTC also updated the information contained in the Rail Access Standard (general information). ARTC plans to undertake a review of the Kooragang Operations Protocol and to conduct a risk assessment to ensure the risk of collision is effectively managed and controlled during operations.

The ARTC met with rail operators to improve safe operations on their network.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• One Rail Australia
• Pacific National
• Sydney Trains

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Australian Rail Track Corporation
• Office of the National Rail Safety Regulator
• Pacific National

Submissions were received from:

• Australian Rail Track Corporation
• Office of the National Rail Safety Regulator
• One Rail Australia
• Pacific National

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1.  Times in this report are in 24-hour Australian Eastern Standard Time (AEST).
2.  In NSW, trains travelling towards Sydney travel in the up direction, trains travelling away from Sydney are travelling in the down direction.
3.  Kilometre mark in NSW is the distance a section of rail is from Platform 1 Central Station, Sydney, NSW.
4.  A penalty occurs when the ECP brake system detects a fault and then automatically applies the brakes.
5.  For an explanation of ECP see page 8. Ending ECP refers to the shutting down of the ECP system.
6.  Restricted Speed is a speed that allows rail traffic to stop short of an obstruction within the distance of clear line that is visible ahead.
7.  Davoudian N, Raynham P, Barrett E. Disability glare: A study in simulated road lighting conditions. Lighting Research & Technology. 2014 Dec;46(6):695-705.

Safety summary

What happened

On the morning of 10 August 2020, a Fokker F28 Mk 0100 (Fokker 100), registered VH-NHC and operated by Network Aviation, on behalf of QantasLink, departed Perth Airport, bound for Geraldton, Western Australia. While in the cruise, at about 26,000 ft, the flight crew received an excessive cabin altitude warning, with no associated faults identified. The flight crew donned their oxygen masks and initiated an emergency descent. The oxygen masks in the cabin were manually deployed by the flight crew. Once the aircraft levelled out at about 9,000 ft, the flight crew advised that oxygen was no longer required. The flight crew then continued to Geraldton for an uneventful landing.

Fokker F100 VH-NHC.

Source: Clayton Ferguson

What the ATSB found

An insulation blanket had become wedged in one of the two air outflow valves, preventing modulation of the aircraft’s cabin pressure. In addition, it was established that the insulation blanket had not been correctly secured to the structure, which allowed it to migrate into the outflow valve.

While the manufacturer's instructions for maintenance inspections detailed that insulation blankets could be removed 'as necessary', they did not reference the insulation blanket installation procedure. In addition, it was identified that the insulation blankets were likely not correctly installed prior to being moved for structural inspections. A combination of these two conditions resulted in the insulation blankets not being secured to the structure following maintenance.

What has been done as a result

A fleet-wide inspection by Network Aviation identified that only one of their 17 aircraft had the insulation blankets correctly installed. As a result, they have commenced a fleet-wide program to systematically replace insulation blankets with new items, ensuring correct installation as per the manufacturer’s instructions.

The type certificate holder advised they would amend the relevant maintenance documentation to clarify the insulation blanket manufacture, removal, inspection and installation procedures. In addition, where movement or removal of insulation blankets was required for certain tasks, the job instruction card would reference the insulation blanket installation procedures.

Finally, the maintenance organisation issued a ‘Maintenance Notice’ highlighting the importance of securing the insulation blankets in accordance with the manufacturer’s instructions. This notice was also included as part of the maintenance inspection finalisation paperwork.

The ATSB also alerted the other Australia operators of Fokker 100 aircraft to this occurrence, and in response, they conducted fleet inspections.

Safety message

When performing safety‑critical tasks like aircraft maintenance, it is very important that procedures are clear and consistent across all documentation in order to avoid misinterpretation and error, such as occurred in this incident.

Further, industry best practice recommends that, when removing a part or component, to not assume it had been correctly installed previously. In all cases, the relevant maintenance documentation should be referred to, ensuring the part or component is being installed to the current specifications.

The occurrence

On 10 August 2020, a Fokker 28 Mk 0100 (Fokker 100), registered VH‑NHC (NHC) was being operated by Network Aviation on behalf QantasLink as scheduled flight QF1618 from Perth to Geraldton, Western Australia. On board were five crew and 57 passengers. For this flight, the captain was the pilot flying (PF) and the first officer was the pilot monitoring (PM).^[1]

The pre-flight crew briefing identified the possibility of encountering rain showers and turbulence en route, requiring intermittent illumination of the seat belt signs. The flight crew also discussed the option to conduct an area navigation (RNAV) approach into Geraldton. The flight departed at 0717 Western Standard Time,^[2] which was about 5 minutes behind schedule due to a period of heavy rain delaying the boarding of passengers.

Following a normal departure and climb, with a slight diversion to avoid weather, NHC levelled at flight level 260.^[3] At 0738, after about 8 minutes in the cruise, the flight crew received a master warning alert consisting of a red light and a triple-chime. At the same time, an ‘excessive cabin altitude’ warning and associated emergency procedure displayed on the multi-function display unit (MFDU). The excessive cabin altitude emergency procedure for the flight crew required them to:

• fit oxygen masks
• establish flight crew communication
• descend.

The flight crew donned their oxygen masks, established effective communication with each other and then, at 0739, commenced the procedure for an emergency descent.

The cabin supervisor observed the seat belt sign illuminate and, believing it may be indicating possible turbulence, instructed the other cabin crew to secure the galley. At about this time, one of the cabin crew reported hearing an unusual sound from the flight deck. The cabin supervisor identified the sound as consistent with the flight crew using oxygen masks and directed the cabin crew to prepare for possible decompression procedures. One cabin crew member went to the rear of the aircraft and one remained at the forward station, with the cabin supervisor. The cabin crew then secured themselves in their seats. Shortly after, the flight crew conducted a cabin announcement (PA) ‘attention cabin crew, descent, descent, descent’.

After about 30-60 seconds, when the cabin oxygen masks did not deploy as was expected, the cabin supervisor contacted the flight crew to inform them of the situation. The flight crew reported looking at the cabin altitude indication, and noted it was increasing but had not yet reached the altitude where the masks would automatically deploy. In order to minimise communication with the cabin, during a period of high workload, they elected to manually deploy the oxygen masks.

Once the masks had deployed, the cabin crew commenced their aircraft decompression procedure whereby they direct the passengers to ‘fit oxygen and tighten seat belts’. The forward cabin crew member reported that, when they pulled on the lanyard to initiate the oxygen flow, one of the masks separated and fell to the floor. They fitted the remaining two masks however, they believed there was no oxygen flow. During this time, the flight crew conducted a PAN PAN call^[4] and continued with their emergency descent procedure.

At 0743 the excessive cabin altitude warning extinguished and the flight crew levelled NHC out at an altitude of about 9,000 ft. The PM made a PA to the cabin that oxygen was no longer required. Due to their proximity and desire to avoid a return flight at low level through showers and possible turbulence, the flight crew elected to continue to Geraldton. A short time later, the PF made a PA and advised the cabin the reason for the emergency descent and that they would be continuing to Geraldton. The cabin crew checked the passengers for any injuries, or the need for further oxygen, and then prepared the cabin for landing.

The aircraft landed at Geraldton at 0804, followed by a normal taxi and shutdown. Prior to disembarking the aircraft, the PF stood at the front of the cabin, further detailed the event and offered that passengers could approach any flight, cabin or ground crew if they had any questions or concerns. There were no injuries to crew or passengers.

Post-flight maintenance

A post-flight maintenance inspection identified that an insulation blanket had become wedged in the secondary (air) outflow valve, affecting pressurisation (Figure 1).

Figure 1: Insulation blanket caught in the outflow valve

Source: Network Aviation, annotated by ATSB

1. Pilot flying (PF) and pilot monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and aircraft flight path.
2. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
3. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 260 equates to 26,000 ft.
4. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Context

Pressurisation system

The cabin altitude (pressure) indications are located in the flight deck, in an overhead panel (Figure 2). Cabin altitude is regulated by the primary and secondary outflow valves, which are located at the pressure bulkhead at the rear of the forward cargo compartment. The secondary outflow valve is located alongside the primary outflow valve. The valves operated together to control cabin altitude, in either automatic or manual mode. For this flight, the cabin altitude would have been at about 4,000 ft, for the corresponding cruise altitude of FL 260. An excessive cabin altitude warning activates at 10,000 ft.

Figure 2: Cabin altitude indicator

Source: Network Aviation, annotated by ATSB

The ingested insulation blanket prevented the modulation of one of the outflow valves, affecting cabin pressure control. This resulted in a gradual cabin altitude increase, until the flight crew were alerted, once the cabin altitude had exceeded 10,000 ft.

A review of the flight data for this flight identified the time and aircraft altitude when the excessive cabin altitude warning activated and deactivated however, the recorded flight data did not include any cabin altitude parameters. Therefore, the maximum cabin altitude (pressure) could not be determined.

Oxygen system

The oxygen system in the Fokker 28 Mk 0100 (Fokker 100) consists of three sub‑systems. The flight crew oxygen system was available when required and was a standalone system of storage and distribution, which supplied oxygen for up to three crew. The portable oxygen system, which consisted of a cylinder and mask, was located near the forward cabin crew station. It was typically administered by cabin crew and was available to anyone on board. The primary oxygen system was a ‘fixed drop-down’ system and provided oxygen to the passengers and cabin crew.

There were drop-down systems located above every seat group, in the toilets and above the cabin crew seats. Each location consisted of a chemical oxygen generator, supplying the drop-down masks. A spare mask was available at each location. That is, three masks were available above each dual-seat group, each cabin crew station and in the toilets. Four masks were available for each 3-bay seat group. The forward cabin crew system also had a ‘pull’ lanyard extension, to enable the seated cabin crew to reach the masks, as the unit was not directly overhead (Figure 3).

The chemical oxygen generator consisted of a sodium chlorate core, along with some other trace elements. Application of heat, via the firing mechanism, initiated a chemical reaction that resulted in the production of oxygen. Once the chemical reaction has been commenced, it could not be stopped and oxygen supply generally lasted 10-20 minutes. This allowed sufficient time for the aircraft to descend to an altitude where oxygen was no longer required, typically at, or below, 10,000 ft.

In the Fokker 100, the drop-down masks deploy automatically in the event of the cabin altitude exceeding 14,000 ±500 ft. The flight crew can also manually deploy the drop-down masks at any point. Network’s procedures for flight above FL 250 provided flight crew discretion of cabin oxygen deployment between 10-14,000 ft cabin altitude.

Whether automatically or manually deployed, the drop-down overhead panel will open, and the masks will partly drop, being held up by lanyards. When any mask is pulled toward the individual, the lanyard pulls a safety pin at the firing mechanism, initiating the oxygen generation. The bag may or may not inflate, depending on the individual’s breathing rate. However, an in‑line green indicator, located in the tube of each mask, confirms the flow of oxygen.

Figure 3: Cabin oxygen system

Source: Network Aviation, annotated by ATSB

When asked how they assessed that the forward cabin crew oxygen system was not working, the cabin supervisor advised:

• they could not feel any airflow
• the mask did not inflate
• they could not hear any airflow.^[5]

Post-occurrence maintenance included replacement of oxygen generators where passengers had been located and refitting of the system on unoccupied seats, where the generator had not been activated. Network’s maintenance department advised that the forward crew oxygen generator had been activated, evidenced by the configuration of the firing mechanism and colour-change of the chemical indicator dots (Figure 4).^[6]

Figure 4: Oxygen generator firing pin and activated forward cabin crew generator

Source: Network, annotated by ATSB

With regard to the detached oxygen mask, Network advised it was not able to determine if the mask had separated due to it being pulled, or if it had not been connected at last maintenance. Irrespective of the detached mask, Network also advised that oxygen should have flowed to the remaining masks in that unit. Further, the cabin crew had the option to use any spare passenger masks.

Explosive, or rapid, decompressions (a rate greater than 7,000 ft/min) are very rare. The majority of decompression events are ‘gradual’, stemming from issues such as leaking door seals, incorrect system mode selection by flight crew and mechanical-related problems. In many cases, the oxygen system is not required.

AR-2008-075-1 Staying safe during an aircraft depressurisation (passenger information bulletin) and AR-2008-075-2 Aircraft depressurisation (cabin crew information bulletin) were published by the ATSB to provide comprehensive information regarding depressurisation and oxygen system use.

Insulation blanket information

The insulation blankets installed on the Fokker F100 are made from glass fibre with a foil outer covering. They are located throughout the fuselage and provide thermal insulation^[7] and acoustic damping. Reinforcement strips are fitted on the underside, to prevent sagging of the insulation blanket against the aircraft skin, where moisture may become trapped. The insulation blankets are fixed to the airframe structure via plastic ties (Figure 5 and Figure 6). The aircraft maintenance manual (AMM) tasks 25-53-00-000-814A Remove the insulation blanket assemblies and 25‑53‑00‑400‑814-A Install the blanket assemblies, provided detailed information on removal, inspection and installation of the insulation blankets.

Insulation blankets were available from the manufacturer, with each being assigned a part number, to suit each location. Alternatively, Service Letter 293 (SL 293) permitted local manufacture, detailing manufacture process and installation procedures. SL 293 advised that the insulation blankets were to be installed in accordance with ‘AMM Task 25-28-00-400-814A and/or with double-sided tape’ (of a defined specification). SL 293 did not reference the requirement for the reinforcement strips.

Figure 5: Insulation blanket location and installation

Source: Network Aviation, annotated by ATSB

Figure 6: Typical insulation blanket installation using the plastic ties

Source: Network Aviation, annotated by ATSB

Maintenance procedures

NHC had recently undergone heavy maintenance at Fokker Services Asia (FSA), in Singapore.^[8] The aircraft returned to line on 28 July 2020 and had flown 12 sectors at the time of the occurrence. The heavy maintenance check included internal zonal inspection of the forward cargo compartment (job instruction card (JIC) 062110-00-01) and visual inspection of specific structural locations nearby, and including, the outflow valve area (JIC 533005-00-01). Both JICs advised that linings and sound proofing^[9] was to be ‘removed as required’ to gain access to the inspection locations.

Post-occurrence actions

On 11 August 2020, the flight crew of another Network Fokker 100, reported a slower than expected rate of cabin altitude (pressure) reduction during descent. When the engineers gained access to the outflow valve area, they noted the insulation blanket had migrated and was covering the secondary outflow valve, with parts of the blanket ‘starting to migrate toward the valve opening’. Troubleshooting identified the defect was associated with the outflow valve, which was replaced however, the event also identified another insulation blanket that was incorrectly secured.

On 12 August 2020, following the identification of the incorrectly installed insulation blankets on two aircraft, Network initiated a fleet-wide inspection of insulation blankets located in the area of the primary and secondary outflow valves. The inspection identified that only 1 of their 17 aircraft had the insulation blankets correctly installed, with two aircraft having no insulation blankets fitted. Another aircraft was undergoing heavy maintenance at FSA and already had the insulation blankets removed, so its status could not be determined.

Due to unavailability of the plastic ties and replacement insulation blankets, Network received approval from Fokker Services to temporarily install the blankets under the outflow valves with a defined double-sided tape. These blankets were to be inspected fortnightly, until the replacement blankets and plastic ties were available.

Following notification of the issue from Network, FSA conducted an investigation into how the insulations blankets came to be installed without the required plastic ties. They identified that the JICs for the zonal inspections did not reference the associated AMM tasks for removal, inspection and installation of the insulation blankets.

Flight and cabin crew communications

A sterile flight deck environment incorporates procedures for safety critical phases of flight, such as take‑off and landing, when non-essential activities and communications are not permitted. While it is primarily focused on communication between flight crew members, it also applies to cabin crew contact with the flight deck. In this occurrence, the depressurisation did not occur during a sterile flight deck period.

Network’s emergency procedures manual stated that, communication of safety-related information in an emergency should be ‘clear, concise and direct’.

The flight crew reported that, after the ‘descent’ cabin announcement (PA), they would not expect to hear from the cabin until after the ‘oxygen no longer required’ PA. The cabin supervisor advised that the cabin crew procedure was to instruct the passengers to fit oxygen and tighten seat belts, once the masks had deployed. In addition, cabin crew were trained to contact the flight deck if the oxygen had not deployed after 3 minutes following the descent announcement. The cabin crew reported that, as they did not have any cabin altitude information and the masks had not deployed as anticipated, they elected to contact the flight crew to inform them of the situation.

Previous occurrences

A search of the Civil Aviation Safety Authority (CASA) Service Difficulty Report and ATSB databases, between 1 January 2000 and 1 October 2020, did not identify any occurrences of an insulation blanket being ingested in an outflow valve of a Fokker 100. A search of the ATSB database identified an insulation blanket-associated depressurisation occurrence involving a Boeing 737, in 2018. The cargo flight, with three persons on board, identified the pressurisation issue on climb. The crew donned oxygen and conducted an emergency descent. The aircraft then returned to the departure airport and for a normal landing.

5. Following the occurrence, the rear cabin crew reportedly advised they knew their mask was working as they could ‘hear’ the oxygen flowing.
6. Heat is generated during the oxygen generation chemical reaction, which will change the indicator dots from white to black.
7. Thermal insulation includes preventing the cargo area and components of the aircraft, such as the water system, from freezing during flight.
8. Fokker Services Asia is part of Fokker Services, which is the current Type Certificate Holder for this aircraft type.
9. The terms soundproofing and insulation blankets are interchangeable for this aircraft type.

Safety analysis

Introduction

During cruise, the flight crew were alerted to increasing cabin altitude and subsequently initiated an emergency descent, to an altitude of about 9,000 ft, as per their procedures. The crew then elected to continue to their destination, avoiding a low altitude return flight in poor weather, and conducted a normal landing. Post-occurrence inspection identified that an insulation blanket had been ingested into one of the outflow valves, affecting the aircraft’s ability to maintain cabin altitude (pressure).

This analysis will discuss the maintenance procedures and practices that resulted in the insulation blanket not being correctly secured to the aircraft structure and the communication between the cabin and flight crew.

Maintenance procedures

The aircraft had recently undergone heavy maintenance checks, which included zonal structural inspections. The job instruction cards (JICs) detailed the requirements for the structural inspections and advised that the insulation blankets could be ‘removed as necessary’ but there was no reference to the aircraft maintenance manual insulation blanket removal and installation procedures.

From the available information, it was not possible to determine how long the insulation blankets had been unsecured. However, based on the maintenance history, they are unlikely to have been installed correctly when the aircraft returned to service following the most recent heavy maintenance checks.

The majority of the aircraft’s insulation blankets are located behind panels and covers where, movement in the event of not being correctly installed, is generally hindered. In contrast, the insulation blankets located in the same area as the outflow valves, are subject to the varying rates of airflow required to modulate cabin pressure and, if not correctly secured, are free to migrate.

Service Letter 293 did not identify the need for reinforcement strips during manufacture and had offered double-sided tape as an alternative way of securing the insulation blankets to the aircraft structure. While not directly linked with this occurrence, the inconsistency between the service letter and the AMM increased the risk of incorrect installation of insulation blankets. Further, insulation blankets without the reinforcement strips not only allowed them to sag, and come in contact with the aircraft skin, but the increased flexibility meant they were more likely to be ingested into an outflow valve.

In this occurrence, it could not be determined if the insulation blanket was original from the factory or locally manufactured, as per the service letter. Whichever the case, it was apparent that the insulation blanket had not been correctly secured, highlighting the importance of consistency across documentation, to reduce the risk of misinterpretation.

Industry best practice recommends that, when removing a part or component, to not presume it had been correctly installed previously. In all cases, the relevant maintenance documentation should be referred to, ensuring the part or component is being installed to the current specifications.

Flight and cabin crew communication

With the introduction of reinforced cockpit doors, it has been recognised that this has had the effect of introducing an additional psychological barrier between flight crew and cabin crew. There has been a history of misunderstanding and hesitancy by cabin crew of informing flight crew of critical and sometimes life-threatening situations occurring in or external to the cabin of the aircraft.^[10]

In this occurrence, the action of the cabin supervisor to question a possible safety issue was in line with industry expectations and procedures. While they may have queried the lack of oxygen masks sooner than as per their training, it was still in line with safety best practice. Further, there was no requirement by the flight crew to respond if they were in a critical stage of flight.

10. FAA AC 120-48A ‘Communication and Coordination Between Flight Crewmembers and Flight Attendants’, dated 27 January 2020.

Findings

From the evidence available, the following findings are made with respect to the depressurisation and emergency descent involving a Fokker 100, registered VH-NHC, 167 km south‑south‑east of Geraldton Airport, Western Australia, on 10 August 2020.

Contributing factors

• While the manufacturer's instructions for the zonal inspections detailed that installation blankets could be removed 'as necessary', they did not reference the insulation blanket installation procedure. This resulted in insulation blankets not being secured to the structure. [Safety issue]
• An insulation blanket became wedged in the secondary outflow valve, affecting aircraft pressurisation and resulting in the requirement for an emergency descent.

Other factors that increased risk

• The instructions for local manufacture and installation of insulation blankets were not consistent with the aircraft maintenance manual procedures, which increased the risk of migration and ingestion into an outflow valve.

Other findings

• The cabin supervisor had no way to determine that the cabin altitude had not yet passed the threshold for oxygen mask deployment. Therefore, their action in choosing to contact the flight deck during the emergency descent, to inform the flight crew that the masks had not deployed, was consistent with safety best practice.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Flight crew and cabin supervisor
• Network Aviation
• Civil Aviation Safety Authority
• Fokker Services
• Fokker Services Asia

References

Australian Transport Safety Bureau 2008, Staying safe during an aircraft depressurisation, Safety publication AR-2008-075(1).

Australian Transport Safety Bureau 2008, Aircraft depressurisation, Safety publication AR‑2008‑075(1).

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew and cabin supervisor, Network Aviation, Civil Aviation Safety Authority, Fokker Services, Fokker Services Asia, Onderzoekbaad (Dutch Safety Board) and the Transport Safety Investigation Bureau of Singapore.

Submissions were received from:

• Network Aviation
• Civil Aviation Safety Authority
• Fokker Services
• Transport Safety Investigation Bureau of Singapore.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Safety issues and actions

Maintenance Publications

Safety issue number: AO-2020-041-SI-01

Safety issue description: While the manufacturer's instructions for the zonal inspections detailed that installation blankets could be removed 'as necessary', they did not reference the insulation blanket installation procedure. This resulted in insulation blankets not being secured to the structure.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 28 July 2020, the driver of Aurizon train 9261 told the Queensland Rail (QR) network control officer (NCO) the train was approaching its limit of authority at Sellheim Station, where it would stop to cross road-rail vehicle ZH42 travelling in the opposite direction. As 9261 entered the station, the driver triggered a counter in the locomotive cab to measure the distance travelled. The driver then stopped 9261 next to a trackside information sign that displayed the text ‘Stop at this point unless holding DTC (direct traffic control) Authority to Mingela’. The driver determined the train to be complete and in-clear of the track section to the rear and supplied a release code to the NCO.

The NCO confirmed the location of train 9261 and issued an authority for ZH42 to continue onto the track section that 9261 had reportedly vacated. Shortly after, the driver of ZH42 advised the NCO that the rear wagons of train 9621 were not in-clear and estimated that two and a half wagon lengths were occupying the track section ahead.

What the ATSB found

QR had installed the information signs at Sellheim Station in 2015 as a measure to address noise complaints from members of the public living near the station. The signs were located 940 m past the block limit boards (BLBs), whereas the maximum train length permitted was 1,009 m, and drivers were not advised of the distance from the signs to the BLBs. When installing the information signs, QR personnel did not complete a formal infrastructure change approval process or risk assessment to consider the potential operational implications of the signs.

The driver of 9261 used the information sign location as a reference point for stopping rather than cross-checking the in-cab counter readout against the train comparison length. Subsequently, the driver erroneously provided the NCO with a release code for the Charters Towers to Sellheim section block.

QR’s DTC system provided limited functionality for an NCO to verify the physical availability of a released section block prior to issuing an authority to the opposing rail traffic. This placed increased reliance on a second (opposing) train crew checking the other train to detect the occupied section block in sufficient time to avoid a collision.

What has been done as a result

Queensland Rail (QR) undertook a risk assessment of the information signs at Sellheim Station and subsequently moved the signs to the 110.109 km point, approximately 134 m east of the first location. The revised location provided about 1,060 m between BLBs and the associated information signs. QR also started a program of works to find locations on the Mount Isa Line and other lines where inconsistencies existed between the trackside infrastructure and the information contained in route maps, signalling arrangement diagrams and the DTC software.

Safety message

Given the limitations of DTC, rail traffic crew of the first traffic to stop at a directional travel station to undertake a cross or pass with other rail traffic must ensure their traffic is complete and in-clear before releasing the section block to the NCO.

In addition, rail infrastructure managers should carefully consider the potential for information signs to be misinterpreted by rail traffic crew, particularly if such signs contain the word ‘Stop’.  This occurrence also highlights the importance of rail infrastructure managers conducting appropriate change management and risk assessment processes when introducing changes to their infrastructure.

The occurrence

Prior to arriving at Sellheim

On 28 July 2020, an Aurizon rail traffic crew (driver and co-driver) took control of train 9261 at Hughenden on the Queensland Rail (QR) Mount Isa Line to travel toward Stuart (near Townsville) in Queensland (Figure 1). After leaving Hughenden at about 0354,^[1] the crew travelled in an easterly direction toward Charters Towers under a series of direct traffic control (DTC) authorities issued by the QR network control officer (NCO).

Figure 1: Referenced locations on the Mount Isa Line 

Source: Queensland Rail, annotated by the ATSB

At about 0900, as train 9261 approached Charters Towers, the rail traffic crew received their next authority from the NCO to leave Charters Towers and travel through to the block limit board (BLB) SM23 at Sellheim Station.

Shortly after, the driver of a road-rail vehicle ZH42, travelling in a westerly direction from Mingela toward Sellheim (Figure 1), contacted the NCO to advise of a driver change and to confirm the current authority to travel to BLB SM16 at Sellheim Station, where ZH42 would stop for the cross with train 9261. The NCO confirmed the authority and informed the driver of ZH42 that 9261 would likely be the first to arrive at Sellheim.

At about 0930, the driver of 9261 told the NCO they were approaching the limit of authority at Sellheim. The NCO was aware there had been an earlier issue with the correct operation of the western end trailable points, so asked the driver to check the train’s position on approach. Shortly after, the driver responded, confirming that the trailable facing points functioned correctly for the train movement.

Arrival at Sellheim

The driver recalled that, as the lead locomotive of 9261 passed BLB SM18 and entered the down track^[2] at Sellheim, they triggered the counter in the cab to measure the distance the locomotive then travelled. The driver stopped 9261 at a point next to an information sign erected adjacent to the down track.

The driver later recalled being aware that the train was 997 m long and the in-cab counter was reading 940 m.^[3]However, they stated that the significance of the counter’s indication did not register with them at the time.

The co-driver later recalled observing the driver start the in-cab counter when they entered Sellheim and also observed the driver check the counter prior to providing the release code to the 

NCO. However, the co-driver did not observe the counter as it was on the driver’s side of the cab, and it was not normal practice for the driver to read out the value from the in-cab counter.

At about 0936, the driver of 9261 provided the NCO with a release code for the section block between Charters Towers and Sellheim Station (to the rear of 9261). After receiving the release code, the NCO responded by communicating an understanding that the train was intact and in-clear^[4] at BLB SM18 in the down road at Sellheim (Figure 2). The driver of 9261 confirmed the NCO’s understanding and inquired about how long it would be before the cross with ZH42 could occur.

Figure 2: Sellheim Station and location of 9261 and ZH42

Location of BLBs and signs is indicative only (not drawn to scale).

Source: Queensland Rail, annotated by the ATSB

At 0945, the NCO contacted the driver of ZH42 to determine the vehicle’s location. The driver advised that ZH42 had passed the eastern end approach board to Sellheim Station and they would supply a release code to the NCO shortly. The NCO decided to issue an extension of the DTC authority for ZH42 that would allow the vehicle to travel through Sellheim Station without stopping and continue to Charters Towers.^[5]

At about 0949, the crew of 9261 contacted the NCO asking when their next authority would be available. Shortly after, the NCO again contacted the driver of ZH42 to request a release code for the Mingela to Sellheim section. The driver of ZH42 advised the release code was available but that they were stationary at BLB SM16 as the rear of train 9261 was not in-clear. The driver of ZH42 estimated that two and a half wagon lengths (at the rear of 9261) were occupying the block section ahead (Figure 3).

Figure 3: Rear wagons of train 9261

Image taken after train 9621 moved approximately one wagon length. Rear wagons of 9261 were still foul of BLB SM18.
Source: Queensland Rail, annotated by the ATSB

At about 0950, the NCO radioed an instruction to the crew of 9261 to not move their train, but the NCO did not receive any acknowledgement of this instruction. At about this time, the driver of 9621, who had overheard the earlier communications between the driver of ZH42 and the NCO, had begun moving the train forward to clear the block section to the rear. Shortly after, the driver of 9261 contacted the NCO by mobile phone, advising they had moved forward to clear the block section and to further discuss the circumstances of the occurrence.

Following a discussion between the driver of 9261 and the NCO about moving the train forward,^[6] the driver confirmed that the lead locomotive initially stopped at the information sign. The driver also advised that the length of the train was 997 m^[7]and the in-cab counter had recorded 940 m. The driver indicated to network control a belief that the train should have bunched sufficiently during braking to clear the section block to the rear as the driver had recently undertaken a cross at Sellheim when driving a similar type of train of similar length with no issue.

The NCO then began addressing the DTC authorities, issuing a restraining authority^[8] to the driver of ZH42 and seeking the release of the Mingela to Sellheim section block to recover from the occurrence and allow 9261 to proceed.

__________

1.  All time references in this report are in local time (Eastern Standard Time).
2.  Rail traffic on the Mount Isa line travelling in the down direction are travelling towards Townsville.
3.  The counter displayed 94. Distance travelled was measured as a multiple of 10 m.
4.  In-clear: occurs when rail traffic on a bidirectional single line, in other than remote controlled signalling territory, is brought to a stand at a station to allow other rail traffic to cross or pass.
5.  The speed of rail traffic departing from a turnout curve and trailing through the points was restricted to a maximum of 25 km/h until traffic had cleared the points. a>
6.  Neither the driver or co-driver of 9261 recalled hearing the instruction from the NCO not to move the train.
7.  The driver quoted the documented effective train length. Effective train length adds an allowance for train slack and a handling safety factor to the documented static train length.
8.  Restraint authority: used when it is necessary to stop and hold rail traffic at a designated signal, BLB or location.

Context

Rail vehicle information

Train 9261

Aurizon train 9261 had a static length of 968.4 m that equated to a comparison^[9]  length of 997.1 m. The train included locomotives 2805 and 4049 and 66 freight wagons^[10]for a gross mass of 3,705 t.

Train 9261 supplied a freight service between Phosphate Hill and Stuart (near Townsville). Although normally crewed by a single driver, in this case 9261 was crewed by two drivers, as the automatic train protection system on locomotive 2805 was unserviceable at that time.

Road rail vehicle ZH42

Queensland Rail (QR) maintenance road-rail vehicle ZH42 had a driver and two other persons on board. Vehicle ZH42 was on-tracked at Stuart for the purpose of undertaking a track inspection patrol between Stuart and Pentland (Figure 1) as well as the re-certification of category 3^[11] driver qualifications for the driver and another rail safety worker on board at the time.

Train 9261 rail traffic crew information

The driver and co-driver on 9261 held current assessments as fit for duty per the requirements of the National standard of health assessment for rail safety workers. The crew also held current assessments for route accreditation for the Stuart to Hughenden section of track. Following the occurrence, Aurizon arranged screening tests for the presence of an illicit drug or alcohol, which returned a negative result for both the driver and co-driver.

Both drivers had over 25 years driving experience and they were both experienced in conducting driver-only operations and operating as a two-driver crew. Both drivers had many years’ experience operating on the Mount Isa Line.

On this occasion, the driver operated the train for the first quarter of the trip, then the co-driver operated the train for the second quarter. The driver took over again at Mungunburra (119 km prior to Sellheim).

The driver and co-driver were based at Townsville. Table 1 shows the driver’s hours of work for the week leading up to the occurrence. They stayed overnight at operator-provided accommodation at Hughenden and commenced duty at 0340 on the morning of the occurrence, following a 12.5-hour rest period.

Table 1: Actual duty times for the driver over previous week

The driver recalled having a wake-up call at 0250 on 28 July. They also recalled going to bed at about 2030 the previous evening and obtaining about 5 hours sleep of reasonable or normal quality. The driver considered themself as being a night-time person and feeling ‘a bit tired’ due to the early start. They could not recall the amount of sleep they had the previous night but regarding it as being beneficial for achieving sufficient sleep. The driver estimated normally getting about 8 hours sleep a night when not working.

The co-driver worked the same shifts on 27–28 July, worked a short shift during the day on 26 July, and had the previous 2 days off duty. The co-driver recalled getting at least 6–7 hours sleep during the night prior to the occurrence and feeling fine at the time of the occurrence.

The drivers stated that the quality of the accommodation at Hughenden was suitable. The driver reported that there were no distractions present, either externally or in the locomotive cab, when they entered Sellheim.

Queensland Rail infrastructure information

Information signs

QR used signage to convey the following types of information to rail traffic crew:[4]

• information or advice
• safety critical instructions
• system of safeworking or area of control.

The background colour of a sign indicated the purpose of the sign to rail traffic crew, as follows:

• red, indicated ‘Stop’
• yellow, conveyed ‘Warning’
• white, conveyed information or advice.

To address noise complaints from residents (see Infrastructure change management processes), on 30 November 2015^[12] QR installed information signs on the up and down track at the 110.243 km point, away from the limit of authority at block limit boards (BLBs) SM23 and SM25 (Figure 2). The signage displayed the text ‘Stop at this point unless holding DTC Authority to Mingela’ on a white background (Figure 4). The format of the sign (white background) conveyed to drivers that the text was for information or advice. Although the sign displayed the word ‘stop’, it was not meant to be interpreted by rail traffic crews as a stop board.

Figure 4: Information sign at Sellheim Station

Train depicted is not 9261.

Source: Queensland Rail, annotated by the ATSB

The actual track length available between the up and down starting BLBs^[13]at Sellheim Station was 1,240 m. When rail traffic crew stopped the locomotive of their train at the nominated point, the track length between the information sign and BLB SM16 or SM18 to the rear reduced to approximately 940 m, effectively shortening the track length on which a train could be stopped and be clear of the section to the rear.

When the signs were installed, train notice TN15-09327 was issued. The notice advised of the kilometre mark where the signs were installed and the wording of the sign, and it also stated that the signage was ‘…erected to stop all trains at nominated point clear of local residence unless RTC have DTC authority to Mingela’. It did not specify the distance between the signs and the BLBs 16/18.

The information signs were not located on driver route maps, network maps or the location specific instructions in QR’s general appendix (MD-14-36).

QR advised that information signs were used throughout its network. QR also advised that, as far as could be determined, no other information signs, similar to the ones at Sellheim providing advice to stop, had been installed at other locations on the Mount Isa Line.

Maximum train length

According to its Mount Isa System Information Pack, QR derived the maximum train length for operation on the Mount Isa Line from:

• infrastructure restrictions for crossing/passing other trains
• requirements for braking performance of the train
• capacity of the route
• draw gear capacity
• train handling
• requirements for road/pedestrian access across the track

The maximum train length allowed on the Mount Isa Line was 1,009 m. This length only applied west of Stuart as other limitations/restrictions applied between Stuart and Townsville jetty. Reduced lengths also applied on other lines in the network, such as the North Coast Line.

Variations of train length (greater than the maximum train length allowed) for a particular train configuration were possible west of Stuart, however changes needed ratification as part of access agreement negotiations with QR. At Sellheim Station, the default maximum allowed train length (1,009 m) on the Mount Isa Line west of Stuart exceeded the agreed 940 m track length available between BLB SM18 or SM16 and the location of the respective information signs.

Infrastructure change management process

After receiving complaints from residents at Sellheim about noise from idling trains, in 2014 QR moved the siding at the station.

Following further complaints in July 2015, representatives of QR, Aurizon and another rolling stock operator agreed (during an onsite meeting) that trains waiting for an authority to proceed to Mingela may be stopped at a nominated location away from the limit of authority at BLBs SM23 or SM25, and that an information sign could be installed at that location.

QR personnel advised the ATSB that the distance of 940 m was selected in consultation with Aurizon and the other rolling stock operator because at that time Aurizon had a maximum train length of 925 m. The other operator was operating trains up to the maximum permitted train length.

Prior to installing the signs, QR advised the other parties that the proposed change would need to undertake an information change request process.

QR procedure MD-11-157 (Infrastructure change management) outlined QR’s processes for requesting a change to track or structures infrastructure owned by QR or infrastructure or processes that interfaced with QR track or structures infrastructure. Infrastructure changes could be assessed using a standard process or a short process. A short process could be used if the proposed change did not require significant design, track modification, signalling modification or overhead line equipment modifications.

Conducting the short process required that a detailed risk assessment be conducted in accordance with QR standard MD-11-1338 (Risk management), the complexity be reviewed to determine if a safety management plan was required, and an infrastructure change approval form be completed.

The risk assessment component of the ‘short’ change process used the QR template ‘Simple safety risk assessment tool’ (MD-11-7056). The template was to be used in conjunction with the QR document Risk assessment criteria (MD-13-561), which detailed the consequence and likelihood matrix used in determining the anticipated risk exposure.

The tool and associated guidance material assisted attendees through the safety risk assessment process and enabled the recording of contextual information about the proposed change, the objective of the change, and a description of the identified risks associated with that change. For each identified risk the tool stepped attendees through processes to analyse the hazard and determine the organisation’s exposure, establish appropriate treatments (controls) and record the expected residual risk following application of the treatments.

QR located documentation for an information change process relating to the movement of the siding in 2014, but could not locate any documentation to indicate that the information change request process or a detailed risk assessment was conducted for the installation of the information signs.

Subsequent changes and events

In 2016 Aurizon increased its train lengths, with the longest service having a comparison length of about 1,005 m (within the 1,009 m maximum train length allowed on the Mount Isa Line). When this change occurred, the potential problem with the location of the information signs at Sellheim was not identified. QR personnel advised that this was an oversight, and related to the fact that the sign was not identified when considering that change (given the sign was not a signal or BLB and did not appear on any driver route maps or network maps).

On 1 November 2019, QR sent an email to Aurizon informing receipt of further public complaints about noise from trains stopped at the eastern end of Sellheim Station. QR summarised the work undertaken to mitigate the complaints, including the installation of the information signs. The email noted the signs’ placement was to allow eastbound rail traffic to be in-clear at the western end and requested Aurizon reinforce this issue with its rail traffic crews.

Aurizon forwarded the QR email internally to team leaders and asked them to remind drivers to follow the ‘direction’ and stop at the information sign. Additionally, Aurizon asked team leaders to report any circumstances that did not allow its drivers to follow the instruction. There was no record of any issue raised in response.

There was no record of Aurizon raising an issue with QR in relation to rail traffic crew working a train exceeding 940 m responding to the information sign at Sellheim, and managing a cross with opposing rail traffic.

Safeworking requirements

Direct traffic control territory safeworking arrangements

The QR safeworking system of direct traffic control (DTC) used on the Mount Isa Line operated on the principle of absolute block working, which provided that only one rail traffic movement would be authorised on any one block (section of track) at any one time. The NCO issuing a DTC authority up to a nominated BLB effectively transferred ownership of the affected block(s) from the NCO to rail traffic crew. After exiting a block, the rail traffic crew could transfer ownership back to the NCO with the provision of a release code.

The transfer of block ownership was primarily through numerical codes communicated verbally between the NCO and rail traffic crew. In addition, the DTC system software supplied an oversight function when generating and validating the codes. It compared the GPS location of the locomotive against the selected block(s) to be released, and those that would remain in the authority when the release was finalised. This occurred through a combination of functionality in the DTC driver workstation equipment in the locomotive cab and the controller workstation equipment in the network control centre.

The driver workstation calculated whether the current locomotive GPS location was within the block(s) that would remain in the authority after the release and, if not, triggered an alarm requiring confirmation of the release. The driver workstation did not hold information on the train length, so it could not prove the location of the rear vehicle of the train when calculating the release.

On receipt of the release code from the rail traffic crew, the NCO selected the rail traffic and entered the code into the control workstation. The control workstation calculated whether the current GPS location was within the blocks that would remain in the authority after the release and, if not, displayed a prompt requiring confirmation of the release. The control workstation did hold information on the train length and used this information to confirm that the length of the train would fit within the blocks still in the authority.

QR standard MD-10-113 (Direct traffic control manual) summarised the limitations of the system. It stated that, although the DTC system design created and validated authorities for issue by the NCO, it could not:

• detect if blocks that were currently occupied, or to be occupied, were released by the rail traffic crew or by the NCO
• detect if a block that was available to the NCO was physically unavailable for traffic for any reason such as a track defect.

Procedure for crossing rail traffic at a DTC station

For a cross at a directional travel station,^[14]such as Sellheim Station, the NCO relied on the rail traffic crew stopped at the location to confirm their train was complete and in-clear of the section block to the rear (that is, for train 9261, the Charters Towers to Sellheim section block).

Following receipt of confirmation and the release code from the rail traffic crew, the NCO could then issue the next electronic authority or extend an existing authority for the opposing rail traffic to proceed and occupy the vacated block (that is, for road-rail vehicle ZH42, the Sellheim to Charters Towers section block).

To facilitate this, the DTC manual required rail traffic crew of the first rail traffic arriving at the station to:

- check the points indicator is in the normal position

- if necessary, stop the rail traffic clear of the points and reset them to the correct position

- enter the station, on the road indicated on the DTC Authority, at a maximum speed 25 km/h

- stop the rail traffic within the clearance point boards^[15]

- make sure the rail traffic is complete

- report to Network Control Officer the rail traffic is in clear and complete and release unoccupied blocks

- check the points, and if necessary, correctly set them for the opposing rail traffic

The opposing rail traffic crew arriving at the station were to:

- check the opposing rail traffic is clear and complete

- tell the opposing rail traffic crew their rail traffic is clear and complete, or otherwise

- obtain an Authority to proceed^[16]

- proceed in accordance with the Authority

- release unoccupied blocks when clear and complete

The DTC manual also stated that, when approaching a station or when passing other rail traffic, a rail traffic crew should travel at controlled speed. The QR standard MD-10-107 (General operational safety manual) defined controlled speed as ‘…a speed that allows rail traffic to stop short of an obstruction within half the distance of clear line that is visible ahead’.

Procedure for checking in-clear and complete

MD-10-107 required that when rail traffic was stopped at a station in single line bidirectional territory (such as the Mount Isa Line) to cross other rail traffic, its crew must check the rail traffic was complete and in-clear by:

- verbal confirmation of another who can see the rear of train signals, or

- visually determining the correct rail vehicle is at the rear of the rail traffic, or

- the correct number of rail vehicles are on the rail traffic, or

- carrying out a brake pipe leakage test

Note: A rail traffic driver may assume the rail traffic is complete if the Brake Pipe Leakage Test is successful.

- make sure the rail traffic is in clear by comparing the length of the rail traffic with the capacity of the main line or loop

- if rail traffic is not in clear, tell Network Control Officer and rail traffic crew of opposing rail traffic

- protect the rail traffic, if necessary

For an unattended station such as Sellheim, the crew of the first rail traffic to arrive could satisfy the requirements by conducting a brake pipe leakage test and comparing the train length to the available track length in the station (if stopping at the limit of authority) or the distance travelled by the locomotive after entering the station. The crew of the second rail traffic to arrive could satisfy the requirement for checking in-clear and complete through receipt of verbal confirmation from the crew of the first rail traffic that they had sighted the rear of train signals on the second rail traffic after it had entered the station.

If the crew of the second rail traffic to arrive found the first rail traffic not to be in-clear of the track ahead, the crew were to:

- stop clear of other rail traffic

- tell rail traffic crew of other rail traffic their rail traffic is not in clear

The crew of the first rail traffic to arrive were then to pull in-clear of the opposing track, if possible.

If the second crew found the first rail traffic to arrive was not complete, they were to tell the other crew and notify the NCO. The second crew were not to proceed until authorised by the NCO.

Aurizon rolling stock operator information

Aurizon rail traffic crew working the Mount Isa Line were required to follow the applicable safeworking rules published by QR for DTC working, as well as other instructions implemented by Aurizon. To manage a cross with opposing rail traffic, the Aurizon crew of the first train to arrive were to undertake several tasks, including:

• stopping the rail traffic within the clearance point boards, or in the case of 9261 at Sellheim within the information sign and BLB (SM16/SM18)
• making sure the rail traffic was complete
• reporting to the NCO that the rail traffic was in-clear and complete.

Aurizon advised that no discrete procedures, or work/local operating instructions, were provided to drivers to explicitly address the unique requirement for stopping a down direction train at the Sellheim Station information signs.  

Drivers stopping a train at a BLB for the limit of authority or, in the case of 9261 on 28 July 2020, the information sign, were essentially required to perform the same sequence of tasks. These involved:

• the correct operation of the locomotive in-cab counter
• the choice of static or comparison train length for use in conjunction with the in-cab counter
• deciding if the train was in-clear
• cross-checking the train was in-clear and complete before releasing a section block.

Aurizon advised that drivers received training in the above tasks as part of the traction competency, route knowledge and verification of competence training provided to rail traffic crew during the initial driver training and reaccreditation of competency processes.

Aurizon advised that Sellheim was infrequently used to perform crosses. It also stated that its trains on the Mount Isa Line varied in length from 620 m to 1,005 m.

The driver of train 9261 reported that they may have performed crosses at Sellheim on about 15 previous occasions, but could not recall how many they had done since the maximum train length had been extended. As noted in the occurrence, the driver indicated they had done a cross recently at Sellheim and on that occasion they had encountered no problem when stopping at the information sign. The driver stated that they always stopped at the relevant stop boards and never had a problem doing so, so had assumed on this occasion that stopping at this sign would have meant their train was in-clear. The co-driver could not recall conducting a cross at Sellheim since the Aurizon maximum train length had been extended.

__________

•  
  9.  Comparison length: for the purposes of comparison with the length of crossing loops, defined as static length plus 2 per cent of static length and 125 mm per vehicle coupler
  10.  Comprising 40 VFMQ loaded fertiliser wagons and 26 OSZY unloaded acid tankers
  11.  Qualification applicable to a worker who is trained and accredited to drive either a section car, hi-rail rollingstock, or a track vehicle.
  12.  QR standard MD-12-189 (Queensland Network Rules and Procedures), QR6007 Signs – General.
  13.  Network Manager Townsville Network Control Centre Train Notice TN15-09327, issued 27 November 2015.
  14.  Starting BLBs are usually numbered 16 and 18 for the up direction and 23 and 25 for the down direction.
  15.  Directional travel station: station at which the points are normally set to allow simultaneous entry and exit of trains through the up and down lines.
  16.  Clearance point boards were typically not provided at directional travel stations on the Mount Isa Line, a>
  17.  Following receipt of the required release code from the first rail traffic crew to arrive, the NCO may have already provided the opposing rail traffic crew with an extension to their authority to proceed.

Safety analysis

Introduction

Train 9621 and road-rail vehicle ZH42 were undertaking a cross in single line bidirectional territory at Sellheim Station. Train 9621 arrived first, and the driver stopped the train at the information sign advising drivers to stop, which was located 940 m passed the block limit board (BLB) 18 and 300 m prior to BLB 23. This resulted in the train, with a length of 997 m, still occupying the previous block.

The driver of 9261 released the previous block (rear of BLB 18) to the network control officer (NCO), who then extended the authority of ZH42 to enter that occupied block.

A rail vehicle receiving authority to enter an occupied block obviously increases the risk of a collision. In this case, the last line of defence was the requirement for the rail traffic crew of ZH42 to travel at controlled speed (that is, be able to stop within half the distance of the line of sight ahead). The crew complied with the requirement and stopped prior to reaching the rear of 9621.

Information sign location and design

The Queensland Rail (QR) train notice TN15-09327 identified the 110.243 km point as the nominated position of the information signs at Sellheim, but it did not specify the measurement of track length available for standing a train between each sign and its respective BLB (SM18 or SM16). Additionally, neither the signs nor other trackside monument displayed a measurement to inform rail traffic crew of the available track length from the signs to the BLBs. The published track length to stand a train at Sellheim Station was 1,240 m, however the positioning of the information sign left an available track length of around 940 m for a train stopped at that point.

The instruction to stop a train at the information sign was not safeworking related; rather it was intended to convey advice to rail traffic crew to avoid further noise complaints from the public. It was therefore not compulsory for rail traffic crew to stop at that point, meaning a driver could choose to pass the sign by a distance sufficient to ensure the rear of their train was in-clear, while still stopping short of the respective limit of authority at BLB SM23 or SM25.

Nevertheless, a driver choosing to travel past the information sign and closer to the limit of authority could have been exposed to criticism should receipt of further public noise complaints occur. In addition, the language in the train notice (‘stop all trains’) and a subsequent reminder email from Aurizon management to its train crews (referring to a ‘direction’ to stop) conveyed a stronger intent than purely advisory information.

With rolling stock operators working trains of varying length up to the maximum permitted train length on the Mount Isa Line of 1,009 m, rail traffic crew of some down direction trains would have had insufficient standing room to accommodate their entire train length if they stopped at the information sign. This would result in the section block to the rear remaining occupied, placing increased reliance on the rail traffic crew's implementation of procedural controls to identify whether the rear of the train was in-clear prior to providing the section block release to the NCO.

QR installed the information sign at Sellheim in 2015. This was the only location on the Mount Isa Line that displayed advice for rail traffic crew to stop short of the limit of authority. There was no earlier report where the incorrect provision of a release code at this location resulted in the crew of an opposing train finding a rail vehicle fouling the track section ahead. However, the ATSB notes that Aurizon had only been operating trains up to the maximum length at that location for 4 years.

Change management and risk assessment processes

To undertake an infrastructure change, such as installing the information signs at Sellheim, QR personnel were required to conduct an infrastructure change approval process. Given the nature of the change, only a ‘short’ change process was required; nevertheless, this still required a risk assessment and other evaluations.

There was no evidence to indicate that the formal change management process or risk assessment was conducted prior to installing the sign. It is apparent that QR personnel consulted with rolling stock operators when making the change, and considered Aurizon’s maximum train length at that time as part of that process. However, a formal risk assessment should have involved relevant personnel in a process to identify risks associated with the change, identify the causes and consequences of the risk, identify and evaluate the existing controls to minimise risk, and determine of any additional treatments were required to minimise risk.

It is difficult to conclude using hindsight whether a formal risk assessment would have identified the potential problems with the signs’ design and/or location. It is possible that the relevant personnel may have considered that the Aurizon maximum train length at that time and the existing controls in place for managing DTC working would have been sufficient. However, it is also possible that a formal risk assessment would have considered the potential operational implications of the sign, noted that the other operator was using trains longer than 940 m, and concluded that the signs did not provide sufficient information regarding their location relative to the BLBs. 

Aurizon changed its maximum train length after the signs were installed, which increased the opportunity for rail traffic crews to make errors and therefore the risk associated with the signs’ design and placement. Unfortunately however, there was no obvious mechanism for this change to trigger a review of the location of the signs.

In summary, although there was consultation between QR personnel and rolling stock operators prior to the installation of the information signs at Sellheim, QR personnel did not complete a formal infrastructure change approval process or risk assessment to record their consideration of the potential operational implications of the signs. This resulted in a missed opportunity to identify the limitations with the location and design of the information signs.

Section block release

QR procedures required rail traffic crew undertaking a cross with opposing rail traffic to make sure their train was in clear by comparing the length of their train with the length of the main line or loop. As trains run on the Mount Isa line were generally less than the maximum train length,^[18] a rail traffic crew stopping the locomotive at the limit of authority BLB would likely be in-clear.

However, a rail traffic crew of a down direction train using the information sign at Sellheim Station as the stopping point would need to check the train’s length against the distance the locomotive travelled after passing the respective BLB (SM18 or SM16), to determine if the rear of the train was in-clear. If the distance travelled was insufficient for the train length, the rear vehicle(s) would still occupy the section block to the rear and the driver could therefore not supply a release code to the NCO. This would likely result in a delay in undertaking the cross, as the opposing rail traffic could not receive an extension to their authority and would need to stop at their limit of authority.

The static and comparison train lengths of 9261 were about 968 m and 997 m respectively. Depending on the extent of bunching/stretching of the train, its overall length could have been between 28 to 57 m longer than the standing distance available between BLB SM18 and the associated information sign. Although Aurizon did not publish any procedures or work instructions specifically addressing the use of the in-cab counter to determine a train was in-clear when stopping at the Sellheim Station information signs, the use of the tool for this type of application was common practice for the drivers operating trains on the Mount Isa Line.

For the cross between train 9261 and rail vehicle ZH42, the driver of 9261 used the information sign location as a reference for the locomotive stopping point rather than consciously cross-checking the in-cab counter readout against the train comparison length to determine if the locomotive had travelled sufficient distance for the rear of the train to be in-clear. Although the driver was aware of the train static and comparison lengths and the readout on the in-cab counter, these separate sources of information were not assimilated when undertaking the task of determining whether the train was in-clear. Subsequently, the driver erroneously provided the NCO with a release code for the Charters Towers to Sellheim section block.

The driver’s decision to supply a release code was likely based on their recent experience working a similar train where no issue had arisen during a cross when stopped at the sign, and the driver’s assumption that always stopping at the relevant stop board (or in this case an information stop sign) would ensure the train would be in-clear.

The ATSB also considered other potential reasons for the driver’s error on this occasion. There was no evidence of any notable distraction during the task. It is possible that the driver was experiencing a level of fatigue associated with the early start (with a wake-up call at 0250) and only 5 hours sleep the previous night. However, given the length of time awake, the time of day of the occurrence, and the fact that the driver had only been operating the train for a short period (after a period acting as co-driver), there was insufficient evidence to conclude the existence of a significant level of fatigue at the time of the occurrence. 

On this occasion, the driver was accompanied by a co-driver. However, the co-driver was not actively involved in cross-checking the train length with the information from the in-cab counter, nor did this appear to be normal practice when a train was crewed by two drivers. Although a second driver would not always be present for the operator’s operations at Sellheim Station, it provided an opportunity on this occasion for ensuring safety-critical actions were monitored and checked. The ATSB has previously noted the important role that effective teamwork can play in transport operations.^[19] Having the driver verbally call out relevant information during activities such as a cross, and having the co-driver confirm that information, would help reduce the risk associated with an individual driver’s error.

DTC traffic control system

The procedures for direct traffic control (DTC) safeworking required the crew of the first rail traffic arriving at the station to enter at 25 km/h and, after stopping, make sure their rail traffic was complete and in-clear before providing a release code to the NCO. For the second rail traffic to arrive, the procedure typically required the crew to enter at 25 km/h, stop and check the opposing rail traffic was in-clear before obtaining the next authority from the NCO. As in this instance, an error by the first rail traffic crew in providing a release code when the rear of their rail traffic was not in-clear, would usually be identified by the second rail traffic crew prior to them obtaining their next authority from the NCO.

To facilitate traffic flow, the DTC safeworking system made provision for the NCO in receipt of the release code to extend the authority issued to the second crew, prior to their arrival at the station. This would allow the second rail vehicle to pass through the station without stopping, though the procedures still required the crew to check the opposing rail traffic was in-clear and complete before doing so.

It was noted that the DTC workstations did not have functionality to trigger an alarm for the NCO if the rear of the first rail traffic was not clear. This meant an error by one rail traffic crew in providing a release code when their rail vehicle was not in-clear increased reliance on the second (opposing) rail traffic crew checking the other vehicle to detect the occupied section block in sufficient time to avoid a collision.

Although restricting the speed of the second rail vehicle to 25 km/h reduced the risk, it did not eliminate the risk. In situations arising from adverse environmental conditions or track alignment, the rail traffic crew might not sight the vehicle(s) of the opposing train in sufficient time to avoid a collision. For example, on 27 February 2018 at Oonoomurra on the Mount Isa Line, a westbound train collided with the wagons on the rear of the opposing train that were foul of the track.

In summary, the QR direct traffic control (DTC) system supplied limited functionality for the NCO to verify the physical availability of a released section block prior to issuing an authority to an opposing rail traffic crew. This limitation increased reliance on the crews of both rail vehicles correctly applying the procedure for crossing rail traffic at a DTC station. Accordingly, future technological developments to the DTC system (and similar systems) to ensure that NCOs are provided with information when trains are not in-clear would further reduce risk.

__________

18.  Trains greater than the maximum train length may be operated on agreement with QR. In such cases other procedures applied when undertaking a cross or pass at a directional travel station.
19.  For example, see ATSB investigation RO-2018-007, Collision with floodwater involving freight train 6792, Little Banyan Creek, Queensland, on 7 March 2018.

Findings

From the evidence available, the following findings are made with respect to the safeworking irregularity (and subsequent rail vehicle receiving authority to enter an occupied block) involving train 9261 at Sellheim station, Mount Isa Line, Queensland, on 28 July 2020.

Contributing factors

• Queensland Rail installed information signs advising rail traffic crew to stop at a point 940 m past a block limit board (BLB) at Sellheim Station, a location where the maximum train length (for normal operations) was 1,009 m, without advising drivers of the distance from the sign to the BLB. This placed increased reliance on rail traffic crew of down direction trains stopping at the sign to effectively implement procedural controls to identify whether the rear of their train was in-clear.
• The driver of 9261 used the information sign location as a reference for the locomotive stopping point rather than cross-checking the in-cab counter readout against the train comparison length to determine if the locomotive had travelled sufficient distance for the rear of the train to be in-clear. Subsequently, the driver erroneously provided the network control officer with a release code for the Charters Towers to Sellheim section block when their train was not in-clear.
• The Queensland Rail direct traffic control system provided limited functionality for a network control officer to verify the physical availability of a released section block prior to issuing an authority. This placed increased reliance on a second (opposing) train crew checking the stationary train to detect the occupied section block in sufficient time to avoid a collision.

Other factors that increased risk

• When installing the information signs at Sellheim, Queensland Rail personnel did not complete a formal infrastructure change approval process or risk assessment to consider the potential operational implications of the signs.

Safety actions

Safety action not associated with an identified safety issue

Additional safety action by Queensland Rail

Following the occurrence involving train 9261, Queensland Rail (QR) reviewed the nominated location of the information signs. QR undertook a risk assessment in conjunction with its infrastructure change management procedure, subsequently moving the signs to the 110.109 km point, approximately 134 m east of the first location. The revised location provided about 1,060 m between BLB SM18 or SM16 and the associated information sign. QR notified rolling stock operators of the changed location via train notice TN20-09749.

Additionally, QR started a program of works to find locations on the Mount Isa Line and other lines where inconsistencies existed between the trackside infrastructure and the information contained in route maps, signalling arrangement diagrams and the DTC software.

Additional safety action by Aurizon

Following the occurrence involving train 9261, Aurizon created a ‘safety share’ surrounding the incident as part of toolbox meetings with its Stuart operations staff to emphasise actions to prevent a recurrence. Actions nominated included checking the counter reading. In July 2021, Aurizon advised that it was continuing to deliver train handling coaching (including the use of counters) to its train crew through toolbox talks.

Aurizon also commenced a review to identify other instruction boards and practices on loops and sidings which may cause full length trains to be foul of the previous section when stopped. In addition Aurizon, advised it would investigate a potential requirement for rail traffic crew and/or ground staff to cross call counter distances and train wire length to mitigate the risk of remaining foul of rear signals/authorities and the prevention of roll back SPADs when performing crosses or stopping in loops. 

Glossary

BLB                 Block limit board. Sign used in direct traffic control (DTC) territory to define the limit of a particular block section.

DTC                 Direct traffic control. DTC is an absolute block safeworking system used to control the movement of trains in non-signalled territory.

NCO                Network control officer

ONRSR           The Office of the National Rail Safety Regulator

QR                   Queensland Rail

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Aurizon
• Queensland Rail
• the network control officer
• the rail traffic crew of train 9261 and road-rail vehicle ZH42
• recorded data from the Townsville network control centre and train 9261’s event recorder.

References

National Standard health assessment for rail safety workers 2017, National Transport Commission.

Queensland Rail Rules and Procedures, MD-12-189, QR 6007 Signs-General, V6.0, 26 August 2019.

Queensland Rail Observance of Signals Manual, MD-10-109, v3.0, s2.7, v5.1, 10 August 2020.

Queensland Rail Mount Isa system information pack, v3.1, 20 February 2017.

Queensland Rail Infrastructure Change Management Procedure, MD-11-1157, v3.0, 30 July 2020

Queensland Rail SEMS Standard, Direct Traffic Control Manual, v3.1, 28 October 2019, Module DT-1 General, s1.6 Computer operations.

Queensland Rail SEMS Standard, General operational safety manual, MD-10-107, v5.0, 10 May 2019, Module GS-2, s2.9 Rail traffic in clear and complete.

Queensland Rail Train notice TN15-09327, 27 November 2015, General information: Signalling arrangements – Sellheim Yard, 30 November 2015.

Queensland Rail Simple Safety Risk Assessment Tool, MD-11-7056, v3.0.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Aurizon
• Queensland Rail
• the rail traffic crew of rail vehicle 9261
• the Office of the National Rail Safety Regulator.

Submissions were received from:

• Aurizon
• Queensland Rail
• The Office of the National Rail Safety Regulator

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.