On the afternoon of 2 July 2020, the pilot of a Cessna 208B aircraft, registered VH-DQP, was conducting a ferry flight from Cairns to Redcliffe, Queensland. After encountering unforecast icing conditions and poor visibility due to cloud, the pilot climbed from 10,000 ft to 11,000 ft. When the aircraft was about 53 km west-north-west of Sunshine Coast Airport, air traffic control attempted to contact the pilot regarding the descent into Redcliffe. No response was received from the pilot at that time, or for the next 40 minutes. During this time, air traffic control, with the assistance of pilots from nearby aircraft, made further attempts to contact the pilot of VH‑DQP.
When the aircraft was about 111 km south-south-east of the intended destination, the pilot woke and communications were re-established. The pilot was instructed by air traffic control to land at Gold Coast Airport. The pilot tracked to the Gold Coast and landed safely without further incident.
What the ATSB found
The ATSB found that the pilot was likely experiencing a level of fatigue due to inadequate sleep the night before and leading up to the incident. Further, operating at 11,000 ft with intermittent use of supplemental oxygen likely resulted in the pilot experiencing mild hypoxia. This likely exacerbated the pilot’s existing fatigue and contributed to the pilot falling asleep.
Safety message
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported by industry. One of the priorities is Fatigue, which is a physical and psychological state typically caused by prolonged wakefulness and /or inadequate sleep. Most people generally underestimate their level of fatigue and tend to overestimate their abilities. The incident emphasises the importance of pilots monitoring their own health and wellbeing, to ensure that they are well-rested and adequately nourished, especially when conducting single pilot operations.
Further, it demonstrates that, although mild hypoxia is not known to impair complex cognition it has been found to increase fatigue and decrease vigour. Symptoms of hypoxia can begin very subtly at lower altitudes and can also begin to show below 10,000 ft for people who are smokers, unfit, or fighting off an illness.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report and allow for greater industry awareness of findings that affect safety and potential learning opportunities.
The occurrence
On 2 July 2020, at about 1230 Eastern Standard Time,[1] the pilot of a Cessna Aircraft Company 208B aircraft, registered VH-DQP (DQP), departed Cairns on a ferry flight to Redcliffe, Queensland under instrument flight rules.[2] The pilot initially maintained 10,000 ft, however, during the flight they encountered unforecast icing conditions and poor visibility due to cloud. Consequently, at about 1541, the pilot climbed to flight level (FL)[3] 110.
At about 1634, the pilot made first contact with air traffic control’s (ATC’s) Burnett sector. About 20 minutes later, when the aircraft was about 29 NM (53 km) west‑north‑west of Sunshine Coast Airport, Queensland, ATC attempted to contact the pilot regarding the descent into Redcliffe. No response was received from the pilot. Air traffic control, with the assistance of pilots from nearby aircraft, continued attempts to contact the pilot of DQP. The aircraft was observed by ATC to overfly Redcliffe and continue tracking toward Brisbane. During this time, ATC declared an uncertainty phase[4] and contacted the Australian Maritime Safety Authority Joint Rescue Coordination Centre and the Australian Defence Force for support.
At about 1713, ATC asked the pilot of a Royal Flying Doctor Service Beechcraft B200 aircraft, which was departing Brisbane, to intercept DQP. The B200 pilot intercepted the aircraft but was unable to establish communications with the pilot of DQP. The B200 pilot then attempted to attract the pilot’s attention by dipping the aircraft’s wings and approached DQP in an effort to activate its traffic alert and collision avoidance system.[5] The pilot did not respond to these attempts. At about 1725, ATC upgraded the uncertainty phase to a distress phase.[6]
At about 1735, after 40 minutes without contact and when about 60 NM (111 km) south‑south‑east of Redcliffe (Figure 1), communications with the pilot of DQP was re-established. Air traffic control instructed the pilot to conduct an immediate descent to 8,000 ft and to change to a discrete ATC frequency. After a minute of no change in the aircraft’s altitude, ATC again instructed the pilot to change frequencies and to use oxygen as they were treating the situation as a hypoxic event. This was also reiterated to the pilot of DQP by the B200 pilot. Air traffic control reported that the pilot sounded ‘groggy’ and ‘not really with it’ upon first contact and took a few minutes before slowly commencing the descent to 8,000 ft.
Figure 1: VH-DQP flight path and distance from Redcliffe Airport
Source: Google Earth, annotated by the ATSB
Upon changing frequencies, ATC instructed the pilot to land at Gold Coast Airport. The pilot accepted the instruction at first, but then later advised that they would prefer to continue to Redcliffe instead. Air traffic control reiterated that, given the situation it would be better for the pilot to land at the Gold Coast as there was runway lighting and emergency services available.
The pilot accepted the instruction and tracked to the Gold Coast, while the B200 pilot continued to follow and monitor the aircraft. Air traffic control reported that the pilot continued to sound ‘groggy’, but gradually improved on approach to land.
The aircraft was landed safely at 1801 and the pilot was attended by the Gold Coast aircraft rescue and firefighting officers and the aerodrome safety officer. The officers conducted a visual observation of the pilot. The pilot, who reported falling asleep, declined first aid and an ambulance.
Context
Pilot information
The pilot previously held an Air Transport Pilot Licence (Aeroplane), but at the time of the incident was exercising the privileges of a Private Pilot Licence, with a valid Class 2 Aviation Medical Certificate. The pilot had a total flying experience of about 20,000 hours and had accrued 500 hours on the Cessna 208. They had been retired from full-time flying for about 10 years and had been ferrying aircraft for about 12 years The pilot reported that, on the day of the incident, they:
Boarded a flight from Brisbane at 0730 and arrived at Cairns at 1000.
Had a light breakfast and a cup of tea between 0500-0530, and a small bottle of water on the flight up to Cairns. After departing Cairns in DQP and established in the cruise, the pilot had a sandwich and a milk coffee.
Had the heater on while in the cruise at FL 110. The heater was on for about 20 minutes, and it was reasonably warm in the cockpit. The pilot believed that this contributed to falling asleep.
Had a low workload prior to falling asleep and had no memory of commencing the descent. Upon waking up, the pilot was confused and had not realised how far off course the aircraft had flown.
Did not recall ATC advising that they had been out of communication for a significant time.
They were a non-smoker.
They did not take any medication or have any pre-existing medical conditions that would have contributed to the incident.
Had a chest infection for several months, which had cleared up in the weeks prior to the incident.
Sleep history
The pilot recalled having disturbed sleep the night before the flight, which had been a regular occurrence, on and off for the last 1-2 years. They could not estimate the amount of time asleep the night before the incident. However, a typical night would consist of going to bed at around 2230 and waking up at around 0030. They would then tend to lie awake for 1-2 hours before drifting off into a mildly disturbed sleep. The night before the incident, the pilot went to bed at 2230 and woke up between 0500 and 0530. The pilot reported feeling a little tired on the day of the incident but was okay to fly.
Hypoxia
Hypoxia is the result of a lack of oxygen to the body tissues. The most common type of hypoxia in aviation is altitude (hypobaric) hypoxia and is associated with breathing air at low barometric pressure. Hypoxia can be prevented by pressurising the aircraft or by breathing supplemental oxygen. VH-DQP was not pressurised.
The onset of hypoxia can be insidious and may not necessarily be noticed by a pilot. Symptoms of altitude hypoxia relevant to this incident, include sleepiness, drowsiness, slurred speech, confusion, impaired cognition and decision making. Loss of consciousness is also a symptom of hypoxia, however, a person would not typically regain consciousness without additional oxygen.
According to the International Civil Aviation Organization (2012), the threshold of hypoxia is generally considered to be about 3,300 ft as no obvious physiological reaction to decreased atmospheric pressure has been reported below this altitude. As altitude increases above this level, the first detectable symptoms of hypoxia begin to appear, and a more realistic threshold would be around 5,000 ft. However, symptoms become more pronounced above 10,000 ft.
Studies have found that hypoxia between 8,000-12,000 ft does not impair complex cognition, but at FL 120, can increase fatigue and reduce vigour. These effects can be subtle and can depend on the individual (Legg et al., 2015, Bouak et al., 2018). Factors that can increase an individual’s susceptibility and severity of the symptoms can include illness, fatigue, physical fitness and activity, mental health and the use of certain medications and drugs (Campbell & Bagshaw, 2002, Nethus et al., 1997), cabin temperature, altitude, rate of ascent and duration at altitude (Skybrary, 2019).
Supplemental oxygen
Civil Aviation Safety Authority Civil Aviation Order 20.4 – Provision and use of oxygen and protective breathing equipment stated that:
A flight crew member who is on flight deck duty in an unpressurised aircraft must be provided with, and continuously use, supplemental oxygen at all times during which an aircraft flies above 10 000 feet altitude.
Civil Aviation Order 20.4.4 – Duties of crew members in relation to oxygen and protective breathing equipment also stated that a crew member must check the serviceability of the oxygen system of the aircraft prior to take-off.
The pilot reported checking the oxygen system pressure but did not complete a full oxygen system check prior to the flight, as they were not expecting to use the system. No oxygen masks were supplied on the aircraft, however, the pilot kept a personal mask in their flight bag. A post‑incident inspection was conducted by the Civil Aviation Safety Authority on the aircraft, in particular, the oxygen system, with no defects found.
The pilot reported that they started using oxygen about 5-10 minutes after receiving the ATC clearance to climb to FL 110. After this, the pilot was taking a ‘sniff’ of oxygen on and off for a total of about 15-20 minutes while maintaining FL 110.
Speech analysis
The ATSB conducted a speech analysis on the pilot’s radio transmissions to determine if the pilot was experiencing hypoxia. The pilot’s response times, delay between mic‑keying and speaking, their average speech rate, their voice pitch, their mic un-keying delay, and the duration to annunciate the aircraft’s call-sign were analysed.
The speech analysis found that these aspects were all affected above 10,000 ft. However, the ATSB was unable to confirm if the pilot was hypoxic as the speech characteristics may have been influenced by other factors.
Dehydration
The pilot reported possibly being dehydrated after drinking minimal amounts of water throughout the day, having only consumed about 500 ml, and not having the need to go to the toilet from the time they first arrived at Cairns to later that night after 2000. Dehydration is caused by excessive water loss and can result from not drinking enough water (Flight Safety Foundation, 2001). A symptom of dehydration includes fatigue.
Medical advice
The ATSB engaged an aviation medical specialist to determine if the pilot was suffering from hypoxia. The specialist concluded that the intermittent use of supplemental oxygen would not have been sufficient to offset the cumulative effects of hypoxia. Despite this, while a degree of hypoxia was likely, this would not have resulted in a loss of consciousness when operating at FL 110. It was more plausible that the pilot fell asleep. This was likely to due to acute and chronic fatigue from the sleep issues described by the pilot, and inadequate fluid intake and diet.
On 8 November 2018, a Piper PA-31-350 was being used for a freight flight from Devonport to King Island, Tasmania. During the flight, the pilot fell asleep and overflew their destination with the autopilot engaged. About 78 km past the intended destination of King Island Airport, the pilot awoke and manoeuvred the aircraft back to King Island. The investigation concluded that the pilot was very likely acutely fatigued to a level affecting performance, predominately due to the lack of recent sleep and hours awake. Although there was opportunity, the pilot did not plan or obtain sleep prior to commencing the night shift.
On 1 September 2013, the pilot of a Cessna 210 aircraft was conducting a private flight from Port Macquarie to Bankstown, New South Wales. Prior to the flight, the pilot reported feeling a little tired and unwell. During cruise, the aircraft entered controlled airspace above Williamtown without a clearance. Air traffic control tried to contact the pilot, but no response was received. At that time, an uncertainty phase was declared, and ATC again attempted to contact the pilot. About 20 minutes later, the pilot recalled waking up. Believing they may have fallen asleep, the pilot checked the aircraft’s instruments to determine their location. The pilot then realised they had entered controlled airspace without a clearance twice. In a state of shock, the pilot decided to descend the aircraft to 2,500 ft to regain the original flight plan track. They continued the flight to Bankstown without further incident.
Safety analysis
Use of supplemental oxygen
After departing Cairns for Redcliffe, the pilot was initially intending to operate at 10,000 ft but climbed to FL 110 due to weather. In which case, the pilot was always required to use supplemental oxygen. However, the pilot reported only using oxygen intermittently during the flight. According to the ATSB’s medical specialist, the occasional use would not have been sufficient to offset any cumulative effects of hypoxia.
Fatigue and mild hypoxia
While en route, the pilot became unresponsive for about 40 minutes and flew past their destination. The pilot reported falling asleep, although they only felt slightly tired, and suspected the warm cockpit environment might have been contributed this. However, a sleep history review indicated that it was likely that the pilot was experiencing chronic fatigue due to their reported inadequate sleep the night before and disturbed sleep over an extended period leading up to the incident. Most people generally require 7-8 hours of sleep to achieve a maximum amount of alertness and performance. Inadequate sleep can result in sleep debt, which is the difference between the amount of sleep you should be getting, and the amount acquired below that. Sleep debt can be cumulative and can result in degraded performance and uncontrolled sleep episodes (Orlady & Orlady, 1999, Hawkins, 1993).
It was also reported that the pilot sounded ‘groggy’ and did not seem to comprehend ATC instructions when communications were restored. While they did gradually improve with time, this suggested that the pilot may have been experiencing sleep inertia. When awakening from a deep sleep, an individual will typically feel the effects of sleep inertia including sleepiness, disorientation and impaired cognitive performance. These effects can last for 5 minutes or up to 30 minutes, with impaired performance for over an hour if an individual is abruptly awoken. It has been found that the effects of sleep inertia can be greater with sleep deprivation and restriction (Groeger et al., 2011, Hilditch & McHill, 2019).
In addition, the influence of operating at FL 110 while only intermittently using supplementary oxygen was also considered. Research has shown that hypoxia at FL 120 can increase fatigue and reduce vigour. Further, although a common symptom of hypoxia is loss of consciousness, it is not typical for someone experiencing hypoxia to regain conscious, while still operating at the same altitude and without additional oxygen. Therefore, from the information obtained by the medical specialist and from studies conducted on mild hypoxia at moderate altitudes, the ATSB determined that it was unlikely that the pilot had lost consciousness solely due to mild hypoxia. Rather, the pilot had fallen asleep likely due to a combination of fatigue and mild hypoxia, possibly exacerbated by dehydration and diet.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the pilot incapacitation involving a Cessna 208B, registered VH-DQP that occurred 56 km west-north-west of Sunshine Coast Airport, Queensland, on 2 July 2020.
Contributing factors
The pilot did not appropriately use the supplemental oxygen system while operating at flight level 110, likely resulting in mild hypoxia.
During the flight, the pilot’s ability to remain awake was likely reduced by a combination of fatigue and mild hypoxia.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
the pilot
Airservices Australia
Royal Australian Air Force Institute of Aviation Medicine
the Civil Aviation Safety Authority.
References
Bouak, F., Vartanian, O., Hofer, K., & Cheung, B. (2018). Acute mild hypoxic hypoxia effects on cognitive and simulated aircraft pilot performance. Aerospace Medicine and Human Performance, 89(6), 526-535. doi: 10.3357/AMHP.5022.2018
Campbell, R.D., Bagshaw, M. (2002). The Basics of Flight Physiology. Human Performance and Limitations in Aviation. (3rd ed., pp. 11-38). Blackwell Science.
Flight Safety Foundation. (2001). Dehydration Presents Unique Risks for Pilots. Human Factors and Aviation Medicine, 48(4):1-6. Retrieved from https://flightsafety.org/hf/hf_jul-aug01.pdf
Groeger, J.A., Lo, J.C.Y., Burns, C.G., Dijk, D.J. (2011). Effects of Sleep Inertia After Daytime Naps Vary With Executive Load and Time of Day. Behavioural Neuroscience 125(2), 252-260. doi: 10.1037/a0022692
Hawkins, F.H. (1993). Fatigue, Body Rhythms and Sleep. In H.W. Orlady (Eds.), Human Factors in Flight (2nd ed., pp. 56-83). Ashgate.
Hliditch, C.J., & McHill, A.W. (2019). Sleep inertia: current insights. Nature and Science of Sleep 11, 155-165. doi: 10.2147/NSS.S188911
Legg, S.J., Gilbey, A., Hill, S., Dubray, A., Iremonger, G. & Mündel, T. (2015). Effects of mild hypoxia in aviation on mood and complex cognition. Applied Ergonomics 53(2016), 357-363. doi: 10.1016/j.apergo.2015.10.002
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 4 July 2020, a Robinson Helicopter Company R44 Raven I helicopter, registered VH-NBY and operated on a private flight, departed an industrial property 3 km north of Broome Airport, Western Australia on a local flight. On board were the pilot and 3 passengers.
The pilot made a vertical departure to climb clear of obstacles before transitioning forwards. At that time witnesses heard a loud bang, and the empennage and tail rotor system of the helicopter broke away. The helicopter initially continued to climb and rotated to the right with increasing angular velocity.
Control of the helicopter was then lost, and it collided with terrain on its right side in a nose low attitude. The pilot and a passenger seated on the right side of the helicopter were fatally injured and the two passengers on the left side were seriously injured. The helicopter was destroyed.
What the ATSB found
Following the onset of vibration in the tail rotor pedals, an overstress fracture of the attachment lugs of the tail rotor gearbox input cartridge occurred. The source of the loading that led to the overstress fracture was not conclusively determined however, shortly after take-off, it led to separation of the tail rotor gearbox from the helicopter. This in turn led to fracture of the aft tail cone bulkhead and separation of all components attached to it, including the horizontal and vertical stabilisers.
Although presented with limited time and the stress associated with the emergency event, the pilot did not apply the pilot’s operating handbook procedure for responding to a tail rotor emergency. Prompt application of the procedure would have reduced the likelihood of loss of control, and therefore improved the potential for survivability. The pilot’s response may have been influenced by them not having a valid flight review for the helicopter type at the time of the accident.
Following identification of the vibration during the previous 2 flights, ground running of the helicopter was conducted by maintenance personnel, with no fault identified. However, as the vibration was reported to only occur in flight, and no defect was identified, it was reasonable to have concluded that the problem may still be present. As such, the safest next step (recommended by the helicopter manufacturer) was the conduct of a graduated flight check by a solo pilot. However, the next and final flight involved the conduct of a high‑power towering take-off from a confined area with 3 passengers on board.
The unnecessary carriage of passengers resulted in a significantly more severe outcome following the in‑flight break‑up.
Safety message
The pilot’s operating handbook for this helicopter stated that the onset of unusual vibrations can indicate impending failure of a critical component. Pilots should land as soon as possible and formally declare the helicopter unserviceable. Crucially, the helicopter should not be returned to service until the source of the vibration, both on the ground and airborne, has been found and rectified.
The registered operator of an aircraft has ultimate responsibility for its airworthiness. This accident demonstrates the importance of following a conservative troubleshooting process that minimises risk. The tools to manage airworthiness are freely published by the Civil Aviation Safety Authority and include the correct use of an aircraft’s maintenance release to clearly communicate the state of the aircraft and any required maintenance action.
Finally, private pilots do not have the benefit of regular flying and frequent training and checking afforded to commercial pilots. Therefore it is recommended that private pilots do not rely on minimum training and checking and currency to keep them safe. Instead they are encouraged to assess their risk profile and seek opportunities to maintain and develop their skills with a flight instructor.
The occurrence
Overview
At about 1436 local time on 4 July 2020, a Robinson Helicopter Company R44 Raven I helicopter, registered VH-NBY and owned and operated by a private pilot, departed an industrial property in Bilingurr, a northern suburb of Broome, Western Australia on a local flight. On board were the pilot and 3 passengers.
The pilot made a vertical departure to climb clear of obstacles before transitioning forwards. At that time witnesses heard a loud bang, and the empennage and tail rotor system of the helicopter broke away. The helicopter initially continued to climb and rotated to the right with increasing angular velocity.
Control of the helicopter was then lost, and it collided with terrain on its right side in a nose low attitude. The pilot and a child seated on the right side of the helicopter were fatally injured. An adult and a child seated on the left side were seriously injured. The helicopter was destroyed.
Detection of vibration
On 22 June 2020, VH-NBY was repositioned from the industrial site to Broome Airport, about 3 km to the south, by another helicopter pilot. During that approximately 6 minute flight, the pilot noticed a vibration in the tail rotor pedals which they described as ‘tapping with spoons’, adding that the sensation was noticeable but not strong. Upon landing, the pilot advised the owner of the aircraft (accident pilot) about the vibration. This was the first report of such vibration in this helicopter.
On the afternoon of 2 July 2020, the owner of the helicopter met a friend at Broome Airport. The owner flew VH-NBY indirectly back to the industrial site; the flight took around 18 minutes. During that flight, the owner sent a text message to the other pilot confirming that the helicopter had a problem.
Upon landing, further discussion about the vibration took place between the 2 pilots. It was reported that they were both concerned about the vibration, and that the owner described the vibration as roughness through the tail rotor pedals. Another person familiar with the reported vibration stated that the owner of the helicopter believed the vibration indicated a tail rotor balance problem. They said it was thought to be due to excessive application of paint to the leading edges near the tips of the tail rotor blades[1] at the previous 100 hourly scheduled maintenance inspection, around 4 flight hours prior. The owner requested the other pilot to contact their local approved maintenance organisation (AMO) to assess the vibration.
The AMO advised that the vibration was described to them not as tapping with spoons, but as ‘jackhammers’. It could not be determined if this change in description was due to a variation in pilot detection thresholds, worsening of the condition, or for emphasis.
Engineering actions
Maintenance troubleshooting
On the morning of 3 July 2020, the helicopter was due to be delivered to the AMO’s hangar at a nearby station. However, no pilots were available to relocate the helicopter, so the engineers attended the industrial site where the helicopter was located.
The chief engineer was the attending licenced aircraft maintenance engineer (LAME). The engineers reported that a review of maintenance records during preparation for the job identified that VH-NBY’s tail rotor blades had not been painted at the previous 100 hourly inspection, rather they were painted about 50 flight hours prior to that.
The planned maintenance activity was to measure and, if necessary, correct the dynamic balance of the tail rotor.
Witnesses stated that at around 1500 the engineering team, consisting of the owner of the AMO (a pilot), the chief engineer LAME, and an apprentice aircraft maintenance engineer (AME), arrived on site. The worksheet for the job stated, ‘Pilot reported tail rotor vibe’.
The owner of VH-NBY was also on-site when the AMO pilot and engineers arrived. They spoke briefly and the AMO pilot stated that they advised their intended course of action was to rub back the paint and measure dynamic balance of the tail rotor. The owner departed shortly after.
The team completed a daily inspection of the helicopter, including a close inspection of the tail cone, tail rotor, and empennage of the helicopter. This included searching for signs of damage, and/or movement or fretting in the aft flex plate, and all rivets and component attachment hardware. No issues were detected. The engineers then attached the electronic vibration monitoring equipment, and the AMO pilot operated the helicopter at flight rotor rpm on the ground. The tail rotor balance was confirmed to be well within limits.
The LAME reported that they then used fine grit sandpaper to make a cosmetic correction to the paint which had been previously applied to protect the leading-edge tips of the tail rotor blades. The dynamic balance of the tail rotor was measured again and found to be well within limits.
The AMO pilot reported that no vibrations were felt in the tail rotor pedals while the helicopter was operating. Additionally, the LAME leaned into the cabin and placed their hands on the tail rotor pedals and was unable to detect the described vibration. The AME also felt the tail skid,[2] attached to the bottom of the vertical fin, but did not detect any excessive vibration.
Requirement for further diagnosis
The troubleshooting identified to the AMO engineering team that it was highly unlikely the tail rotor balance was a potential source of the reported vibration. The electronic vibration monitoring equipment was removed from the helicopter. The LAME reported wanting someone to fly the helicopter as they wanted to determine if the reported vibration in the pedals was detectable in flight.
The AMO pilot elected not to hover or fly the helicopter in the industrial site as they felt that it was too confined and were concerned about foreign object damage if they hovered the helicopter. The site owner stated that they could have made the area safe for a test flight if they had been requested to do so.
The LAME advised that the test regime they wanted a pilot to apply was:
hold the helicopter light on the skids, and check for vibration
then if necessary, hover the helicopter and check for vibration
then if necessary, fly the helicopter, and check for vibration.
The LAME completed the work pack, closing the job, and added a note that said:
Carried out tail rotor balance check. Found to be 0.05ips. No adjustments made. Nil defect found. Owner was notified flight check to be carried out.
The LAME stated that they passed the requirement for a maintenance check flight to the owner of the AMO. The owner of the AMO stated that they in turn advised both the owner and the pilot who first detected the vibration of the findings, of the requirement to fly the helicopter to provide more information.
The requirement for a maintenance check flight was not recorded on the helicopter’s maintenance release.
Post‑maintenance communication
The AMO engineering team stated that, as there was a fault reported, but no fault found during ground running, that a maintenance check flight was necessary to continue the troubleshooting to provide more information.
While still on-site with the helicopter, telephone records showed that the owner of the AMO called the pilot who first reported the vibration at 1530. The call lasted about 4 minutes. The owner of the AMO reported that during this call the pilot was advised that the tail rotor balance was good and that a pilot was needed to fly the helicopter. The pilot was unable to fly the helicopter that afternoon, however reported being told that the helicopter was ‘good to go’ and said there was no mention of a check flight requirement.
Immediately after that call, the owner of the AMO called the owner of the helicopter. They spoke for about 3 minutes. The owner of the AMO stated that during this call they advised the owner of the helicopter that the tail rotor balance was good, the engineers did not find anything wrong, and that a maintenance check flight was required. The owner of the AMO reported that the owner of the helicopter was also unavailable to fly the helicopter.
The owner of the AMO stated that they then intended to meet the first pilot in person to discuss the vibration issue, however they could not locate them, and was unable to contact them by phone again.
With respect to verbal notification of the requirement of a maintenance check flight for further diagnosis, there were differing accounts of whether this was communicated to the owner of the helicopter. A friend of the owner of the helicopter, who overheard the call on car speakerphone, agreed that the owner was told there was nothing wrong with the balance of the tail rotor, but disagreed with mention of the need for a maintenance flight.
Accident flight
The helicopter’s next flight was the accident flight on the afternoon of 4 July 2020. The flight was conducted as a private operation under the visual flight rules. The helicopter was configured with the front doors removed and rear doors installed.
The owner of VH-NBY had accommodation at the site and was familiar with the industrial location. Nearby buildings, high fences, vehicles, and trees necessitated a vertical departure. The prevailing easterly wind at around 10 kt favoured a departure over unoccupied ground.
The pilot started the helicopter at about 1428. The pilot then loaded 2 children and an adult into the helicopter. Due to the helicopter landing site being located within Class D airspace for Broome Airport, the pilot was required to obtain a clearance from air traffic control (ATC) to depart from the site. At 1434, the pilot contacted Broome ATC and received a clearance to depart the site. At about 1436, the pilot made an airborne call to ATC.
There were 4 witnesses at the industrial site at the time the helicopter took off (Figure 1). Their accounts of the departure varied between the pilot holding a low hover for a few seconds before conducting a steep departure, and the pilot making a steep departure directly from the ground without a hover.
Figure 1: Location of witnesses
Source: ATSB
Witnesses familiar with this departure process stated that nothing appeared out of the ordinary, the engine sounded normal and the helicopter climbed as expected. None of the witnesses saw or heard the helicopter make contact with any obstacles or foreign objects, or observed any items leave the cabin of the helicopter.
Nearby witnesses described hearing a bang as the helicopter reached an estimated height of about 55 ft. One witness described the sound as like a ‘metal bar hitting a metal pole’. Recordings from closed circuit television (CCTV) nearby showed a rearward movement of the upper vertical fin, and the helicopter nose pitch up, followed by parts releasing from the tail section. The empennage, tail rotor gearbox and surrounding components separated and tumbled from their attachments at the rear of the tail cone. A small section of one tail rotor blade was also identified in the security vision departing from the helicopter.
The helicopter continued climbing to about 75 ft while rotating twice to the right with increasing angular velocity, before rolling and descending rapidly toward the ground. The helicopter impacted heavily onto a road surface, about 30 m from the departure point (Figure 2). Calculations from a security camera recording showed that the duration from the first moment of the disturbance of the vertical fin to a total loss of control of the helicopter, was about 2.7 seconds.
The helicopter struck the road surface predominantly on its right side and in a nose-low attitude. The pilot, and a passenger, both seated on the right side of the helicopter were fatally injured. The front and rear left seat passengers were seriously injured. The helicopter was destroyed.
Figure 2: Location of aircraft and components following in-flight break-up
Source: ATSB
Post-impact events
Witnesses and neighbours were able to reach the occupants and begin recovery within seconds of the event. A forklift was used to lift the fuselage by the mast fairing to allow access to the right side of the passenger compartment. Australian Defence Force personnel and Western Australia Police Force officers were also nearby and quickly conducted triage and treatment prior to fire and ambulance services arriving.
The helicopter was fitted with fuel tank bladders. Although a bladder had punctured as a result of the impact, and fuel had subsequently leaked, there was no post-accident fire. Aviation Rescue Fire Fighting Service and Department of Fire and Emergency Services units were deployed to the accident site and together contained the fuel spill and fire risk.
The police, with assistance from the State Emergency Service (SES), closed the street. Police officers from the forensic crash unit documented the accident site and maintained the integrity of the scene until the ATSB arrived. Police and SES personnel protected the accident site for the duration of ATSB’s on-site activities.
Context
Pilot information
Licence
The pilot attained a Private Pilot Licence (Helicopter) PPL(H) in May 2015 and held an endorsement for the Robinson R44 helicopter. To exercise the privileges of this flight crew licence, a pilot is required to have a current aviation medical certificate and helicopter flight review (HFR). A logbook for the pilot was not able to be located, however a family member estimated the pilot’s total flying experience to range between 1,200 and 1,500 flight hours.
Medical
The pilot had previously held a Class 2 aviation medical certificate, however that certificate expired on 9 March 2019, and had not been renewed. A review of the pilot’s post-mortem report found no evident natural disease.
Toxicology results showed a 0.012% urine alcohol concentration and zero blood alcohol concentration. The pathologist that conducted the autopsy indicated this was probably from consumption, although a possibility of post-mortem alcohol production also existed.[3] Furthermore, the pathologist considered the low level of alcohol in the urine to be toxicologically insignificant as there was zero alcohol detected in the blood.
Flight review
An HFR is an opportunity for pilots to practice in-flight emergencies with an instructor and to demonstrate the required competence to safely operate a helicopter. HFRs for private pilots have a validity of 2 years. In discussing the aim of a flight review, the Civil Aviation Safety Authority (CASA) published Civil Aviation Advisory Publication (CAAP) 5.81-01 - Flight crew licensing flight reviews, which stated:
Commercial Pilot Licence (CPL) and Air Transport Pilot Licence (ATPL) holders are often part of a system that involves some form of training and checking, whereas the average private pilot is not. With the passage of time and lack of practice some skills and knowledge can degrade. A flight review affords the opportunity to restore these degraded skills and gain new knowledge.
The flight review must be seen in the context of a broader aviation safety philosophy. The flight review, although important (and required by legislation), is one process that contributes to continuing pilot proficiency and consequently the safety of flight. A flight review every two years does not, in itself, ensure safety. Safety is achieved when each pilot takes responsibility for a continuing process of hazard identification and risk management for their own aviation activities.
The Civil Aviation Safety Authority (CASA) required, via document CASA 007/17,[4] that HFRs for Robinson helicopters were to be conducted in Robinson helicopters. The pilot’s last HFR in a Robinson helicopter was a flight of 1.9 hours on 20 November 2017. That HFR expired 20 November 2019.
Following endorsement on a Bell 505 in the United States (US), to validate the endorsement in Australia, the pilot undertook an HFR in a Bell 505 on 31 May 2018. The validity of that HFR was extended to 1 December 2020 by CASA’s COVID management process through EX5720.
While the pilot of VH-NBY had a valid review for other types, in accordance with CASA 007/17(8), they did not have a valid HFR for the Robinson R44 at the time of the accident.
Endorsements
The pilot began a low-level endorsement in October 2018, which was not completed. An external load rating was not conducted or issued at any point.
Despite not having obtained the qualifications required to conduct these activities, the ATSB identified that the pilot had previously performed low‑level flight and external load work.
Training in tail rotor emergencies
The pilot completed PPL(H) training with 74.8 hours of flight time. Despite being required to demonstrate competence in emergencies, including tail rotor failures, to pass a licence test, the pilot’s student progress checklists did not record tail rotor emergencies (failure in forward flight and hover) being briefed or taught. However, on 6 May 2015 the pilot undertook a flight test and tail rotor malfunctions were recorded as tested and passed.
At the time of the accident the pilot had last conducted tail rotor emergencies in a helicopter 2 years and 2 months prior and had not conducted tail rotor emergencies in a Robinson Helicopter for 2 years and 8 months.
Helicopter information
General information
The Robinson Helicopter Company R44 Raven I is a 4‑place, light helicopter, powered by a Lycoming O-540-F1B5, 6-cylinder, horizontally-opposed piston engine. It has a 2‑bladed main rotor system and a conventional 2‑bladed tail rotor.
The R44 helicopter type was approved by the US Federal Aviation Authority (FAA) on 10 December 1992 and approved in Australia on the basis of that certification in 1994. The R44 Raven I was introduced in January 2000.
At the time of the accident, there were 558 R44s on the Australian civil aircraft register. Total R44 helicopters production was around 7,100 helicopters. Together, the worldwide R44 fleet had flown an estimated 17.7 million flight hours.
The tail rotor pedals of the R44 are connected to the tail rotor through a series of bellcranks and push-pull tubes (Figure 3). That is, a continuous physical linkage. Therefore any dynamic movement, such as vibration, associated with the tail rotor system would be transmitted to the pedals.
Figure 3: R44 tail rotor control system
Source: Robinson Helicopter Company, annotated by ATSB
VH-NBY maintenance history
The R44 Raven I helicopter involved in the accident, serial number 2544, was built in May 2018 in the US. It was test flown, then disassembled and shipped to a distributor in Australia by the manufacturer. On 11 September 2018 the helicopter was reassembled by a Robinson Helicopter Company distributor in Queensland and placed on the Australian register as VH-NBY.
Maintenance conducted on VH-NBY is detailed in Table 1.
Table 1: VH-NBY maintenance history
Date
Maintenance
Total time
Notes
30 May 2018
Built at RHC
0.0
Serial number #2544
11 September 2018
Re-assembled in Australia
4.0
Issued certificate of airworthiness on 12 September 2018
28 March 2019
SB-96
46.70
SB-96 Change clutch actuator time delay assembly
13 May 2019
100 hourly inspection
88.62
Nil issues
20 July 2019
100 hourly inspection
SB-99
186.41
SB-99 Battery Electrolyte leakage
29 July 2019
Cargo hook installation
195.03
Onboard Systems Cargo Hook fitted
After 25 August 2019
MR blade repair
224.6
Probably due to main rotor bird strike. Large bird (brown booby)
No documentation of inspection or repair in logbooks or maintenance releases Evidence of paint on blade tip in location of damage
9 October 2019
100 hourly inspection
248.80
Removed emergency locator transmitter
Cylinder head temperature probe replaced
TR blade tips painted and balanced to below 0.2 ips
Around 24 November 2019
Inspection panel replaced
Not recorded
Oil filler access panel cracked at hinge replaced under warranty
No evidence of inspection or repair in logbooks or maintenance releases
24 January 2020
Front right bubble replaced
262.35
Bubble cracked by unrestrained front door on ground Replacement recorded on maintenance release by engineer
4 June 2020
100 hourly inspection
300 hourly inspection
SB-103
286.90
Number 2 cylinder changed due to compression loss SB-103 MR tip plates complied with (95 days overdue)
24 June 2020
Hard wired Spidertracks tracking system
Not recorded
Carried out fault finding to aircraft tracking device. Replaced damaged wiring
Sources: VH-NBY maintenance logbooks, interviews, Western Australia Police Force
Tail rotor blade refinishing
Most areas of Australia present harsh conditions for operation of helicopters. Coastal areas have salt laden air, sand, and dust that may erode main rotors and tail rotors at a rate high enough to render components unserviceable before their life-limit[5] is met. Rotor blade erosion damage has potential to significantly increase the operating costs of helicopters. To combat this, refinishing the tips of Robinson Helicopter tail rotor blades is common practice in Australia (Figure 4).
The R44 maintenance manual allowed for repaint of tail rotor blades where erosion exists. Section 30-00 of the manual stated:
The tail rotor blades are constructed with aluminium skins and root fittings. Maintaining the paint finish will reduce corrosion and erosion.
Section 30-36 carried instructions for painting the tail rotor. Adding paint to the blade tips adds weight that could upset the balance of the tail rotor. Therefore, following painting, the balance of a tail rotor was required to be checked and adjusted if necessary.
The tail rotor blades on VH-NBY were last refinished on 9 October 2019 and the balance was found to be within limits.
Figure 4: Refinished area of tail rotor blades (Paint transfer and damage due to accident)
Source: ATSB
Maintenance release
An aircraft’s maintenance release (MR) (CASA form 918) is a document used to record and communicate the airworthiness of an aircraft between registered operators, pilots, and engineers. It included a section (Part 2) for defects to be recorded (and cleared), and a section (Part 3) to record daily inspections and flight hours.
Part 2
A person with knowledge of a defect is required to record the defect in part 2 of the MR. This would cause the MR to cease to be in force and serve as a notice to pilots and engineers that the aircraft is not to be flown until the defect is resolved. Following the detection of vibration during the flight conducted on 22 June 2020, no defect was recorded on the MR.
When a defect was endorsed, resulting in the MR ceasing to be in force, a qualified person would have to declare the defect resolved in Part 2, to restore the airworthy status of the aircraft. This can include restoration of airworthiness after a successful maintenance check flight.
A requirement for a maintenance check flight following 100‑hourly maintenance on 4 June 2020 was endorsed on the MR. This endorsement was cleared by conducting the flight and finding no defects. While the requirement for a maintenance check flight following the tail rotor balance check of 3 July was written on the approved maintenance organisation’s (AMO) work pack, it was not annotated on the helicopter’s MR.
Part 3
Part 3 of the MR required certification of the daily inspection by a qualified person[6] prior to flight, and the recording of flight hours to manage the ongoing maintenance requirements of the aircraft. If the daily inspection had not been certified, the aircraft must not be flown.
Part 3 of VH-NBY’s MR was incomplete. The only flight recorded was the maintenance check flight of 4 June 2020. The helicopter was flown on 4 separate days after that date, with only one daily inspection being recorded. This does not necessarily indicate that daily inspections were not conducted. For example, the owner of VH-NBY was photographed checking the oil level of VH-NBY on 2 July 2020. This was part of the daily inspection for this helicopter. However, due to the lack of documentation, the extent to which the helicopter was inspected on these dates could not be determined.
No flight time was recorded for any of these 4 flights; however the helicopter was fitted with an hour meter which recorded flight time.
Pilot’s operating handbook advice on vibration
In the safety tips and notices section of the Robinson R44 pilot’s operating handbook (POH), there was advice on vibration and checking for resolution of a problem. It stated:
7. A change in the sound or vibration of the helicopter may indicate an impending failure of a critical component. If unusual sound or vibration begins in flight, make a safe landing and have the aircraft thoroughly inspected before flight is resumed. Hover helicopter close to the ground to verify the problem is resolved, and then have aircraft reinspected before resuming free flight.
The following tail rotor driveshaft failure in the United Kingdom (UK) in 2003 demonstrated the success of this staged approach in a situation whereby the source of vibration was not as expected and could not be identified on the ground.
The helicopter was being flown to Sywell for a 50 hour maintenance inspection when it developed a lateral vibration with a frequency coincident with main rotor rotation. It was able to land successfully at Sywell where the main rotor drive system was examined. As no apparent problems were identified an engineering test flight was carried out to see if the vibration event could be replicated. Normal handling failed to reproduce the event so a towering climb from the hover was initiated. This produced worsening vibration levels, an increase in engine manifold pressure, and difficulties in yaw control necessitating an immediate descent and landing. After landing it was discovered that the tail rotor was not rotating. An inspection of the tail rotor drive system revealed a failure of the tail rotor drive shaft aft of the whirl mode damper bearing. The subsequent AAIB [Air Accidents Investigation Branch] investigation could not find any evidence to explain the cause of the failure….
The decision to carry out a test flight however, given the circumstances, was considered to be the normal course of action to take when troubleshooting a defect of this kind. The engineers had already undertaken a full inspection and testing on the ground of the main rotor system, with no defect detected. They continued testing the helicopter in a logical manner and were fully aware of the implications of undertaking a test flight. The quick reaction of the test pilot following the onset of the failure kept the situation under control, no one was injured and the helicopter suffered only minor damage.
Controllability
Centre of Gravity
The components lost in flight had a direct effect on controllability of the helicopter. Along with the obvious loss in primary yaw control, a significant change of centre of gravity occurred (Figure 5).
The ATSB recovered almost all of the components that had separated from the rear of the helicopter. These components weighed 17.7 kg. A weight and balance calculation used 18 kg to account for some missing fragments, and oil from the tail rotor gearbox.
As fuel leaked from the wreckage and no fuel records were kept, it was not possible to determine exactly how much fuel was onboard VH-NBY for departure. However, with full fuel the helicopter would have been below the maximum allowable all-up weight. The minimum required flight fuel was calculated to be 34 L. This was based on a 10 minute flight with 20 minutes of reserve and 4 L of unusable fuel. The actual fuel load was probably higher as 30 L of fuel was drained from the wreckage and an unknown, but substantial, quantity of fuel was released post‑accident.
While there was a large shift forward in centre of gravity it is highly likely that VH‑NBY’s centre of gravity remained within limits following the in-flight break-up (Figure 5).
Figure 5: Centre of gravity calculations
Source: Robinson Helicopter Company, annotated by the ATSB
Emergency procedure
R44 POH
Loss of the empennage of the helicopter is an extreme event, causing significant disruption to the controllability of the helicopter. The helicopter’s POH includes information on handling a loss of tail rotor thrust. The manufacturer confirmed that symptoms of this occurrence are nearly identical to a loss of tail rotor thrust.
The POH stated:
LOSS OF TAIL ROTOR THRUST IN FORWARD FLIGHT
Failure is usually indicated by nose right yaw which cannot be corrected by applying left pedal.
1. Immediately enter autorotation
2. Maintain at least 70 KIAS if practical
3. Select landing site, roll throttle off into overtravel spring, and perform autorotation landing.
LOSS OF TAIL ROTOR THRUST IN HOVER Failure is usually indicated by nose right yaw which cannot be stopped by applying left pedal.
Immediately roll throttle off into overtravel spring and allow aircraft to settle
Raise collective just before touchdown to cushion landing.
Energy available for engine off landing
The energy to successfully land a helicopter in an engine off situation comes from a combination of available potential and kinetic energy in the form of height, forward speed and rotor RPM. A pilot can utilise that energy to maintain drive to the main rotor and create lift.
As shown in Figure 6, at the time the empennage and tail rotor system detached the helicopter was being operated within the R44 height/velocity diagrams ‘avoid’ area. In practice, this meant that there was probably insufficient total energy to be able to conduct the required power‑off landing without damaging the helicopter.
Figure 6: R44 Raven I height / velocity diagram
Source: Robinson Helicopter Company, annotated by the ATSB
Site and wreckage information
Location
The industrial site at Bilingurr contained private residences, a hangar, and a large shed. The fenced property provided storage for assets of an associated business. The effect of COVID-19 restrictions meant that more equipment than normal was stored in Bilingurr (Figure 7). As a result, the site was more confined than usual, presenting an increased risk for helicopter operations.
The site at Bilingurr was used as the home base for the helicopter and partly intended for use for the arrival or departure of helicopters (Figure 8). The operator stated that the site was operated as a basic helicopter landing site (HLS)[7]. However, helicopters had been used at the site for at least 4 years. The CASA civil aviation advisory publication (CAAP) 92(2)[8] detailed guidelines and provided advice for development and operation of helicopter landing sites. The site did not meet the guidance of CAAP 92(2) with respect to arrival and departure profiles, nor was it required to do so.
Figure 7: Bilingurr site equipment storage
Source: Google Earth, annotated by the ATSB
Figure 8: Helicopter landing site at the industrial site in Bilingurr
Source: Supplied, annotated by the ATSB
Meteorological information
Weather data recorded by the Bureau of Meteorology showed that at the time of the accident the weather was suitable for helicopter operations. There were clear skies, the temperature was 33º C, and the wind was a south-easterly at about 19 km/h.
Recorded closed‑circuit television imagery
A portion of the flight shortly after take-off and then most of the subsequent break-up sequence was captured on three nearby closed-circuit television (CCTV) security cameras (Figure 9). A fourth CCTV camera at Broome Airport also captured the occurrence. The recordings were of high value to the investigation. Analysis of the recordings identified the break-up sequence and showed that the rotor rpm was operating in its normal range at the time of the accident.
The break-up sequence of events is described in Table 2. Images showing the continuity of the event recorded by the closest cameras are shown in Figure 10.
Figure 9: Nearby CCTV locations and relative fields of view
Source: Google Earth, annotated by the ATSB
Table 2: CCTV timeline of event
Time (seconds)
CCTV 1
CCTV 2
CCTV 3
0.0
Helicopter climbs to around 30 ft at a calculated rate of about 325 ft/min.
Not in frame.
Not in frame.
0.5
Helicopter enters extreme top left of frame.
3.7
Helicopter enters frame.
Helicopter exits frame, not yet rotating.
4.0
Empennage vertical fin rotates top back/bottom forward around its mount.
Estimated moment of tail rotor blade contact with fuselage.
All but empennage of helicopter in frame.
Section of tail rotor blade enters frame at high speed.
Not in frame.
4.2
Helicopter nose pitches up.
Helicopter nose pitches up.
Section of tail rotor blade enters frame. Helicopter shadow shows helicopter rotating to the right.
Helicopter continues climbing and completes a full right rotation. Fuselage rolls about 20° to the left.
Estimated moment of loss of control.
Not in frame.
Clear shadow of the helicopter in frame shows completion of first rotation to right.
7.7
Helicopter continues climb and makes a second full right rotation.
Shadow shows second full rotation.
8.1
Helicopter continues to rotate. It rolls and descends before becoming inverted. The main rotor contacts the right skid and both separate.
Helicopter re-enters frame with 90° right roll before becoming inverted.
Helicopter re-enters frame with 90° right roll before becoming inverted, and impacting ground nose low on its right side.
Figure 10: Continuity of the accident sequence on nearby security cameras (CCTV)
Source: Western Australia Police Force, annotated by the ATSB
Wreckage information
All components of the tail section of the helicopter were accounted for and recovered at the accident site. All fastener and assembly hardware was recovered. Most of the components and fragments were found between 0‑36 m to the left of the intended track (Figure 2). There were 4 main wreckage areas comprising the fuselage, tail rotor blade tip, empennage, and tail rotor system, including the tail rotor gearbox (TRGB).
The fuselage lay on its right side and was complete apart from the right skid tube, the outboard half of one main rotor blade, and components from the aft flex-plate back. The tail rotor blade section was found 13 m from the fuselage, slightly to the right along the intended track. The empennage which carried a large section of aft tail cone bulkhead, was left of the intended track at a distance of 30 m from the fuselage. The TRGB and tail rotor system were also left of track, 36 m from the fuselage.
On-site examination showed that the aft tail cone bulkhead had fractured together with the input cartridge lugs, and that the tail rotor blades had struck the empennage and tail cone. To determine the sequence and mechanism of failure, the components were transferred to the ATSB technical facilities in Canberra, Australian Capital Territory for detailed examination.
Flight controls
Inspection of the wreckage confirmed that all components and attaching hardware of the flight controls were present and displayed no pre-accident damage. As such, continuity of all flight controls almost certainly existed prior to the in-flight break-up. Furthermore, following the loss of the empennage and tail rotor system, control of the cyclic, collective and throttle would have remained available to the pilot.
Tail cone
Onsite examination showed that the forward end of the tail cone was securely attached to the fuselage of the helicopter with correct attaching hardware. At the aft end of the tail cone, the skin was cut and torn through from repeated impact and flailing of rotating driveshaft components (Figure 11).
Source: ATSB
Aft flex plate
The rear of the tail rotor drive shaft sustained severe rotational contact against the tail cone structure. Inspection confirmed that the attachment hardware between the tail rotor gearbox input yoke, rear flex plate, and tail rotor drive shaft was correctly oriented and all attaching hardware (nuts, bolts, and washers) was assembled in accordance with Robinson requirements.
The fracture surfaces of the flex plate attachment were examined at very high magnifications using a scanning electron microscope (SEM). The fracture surface was comprised of predominantly dimples from micro-void coalescence indicating the fracture was by ductile overstress. There was no evidence of pre-existing fatigue cracking that might have otherwise predisposed the flex plate to premature fracture.
Tail rotor gearbox input yoke
Both arms from the input yoke to the TRGB fractured and separated from the body of the yoke (Figure 12). The fracture surfaces of one of the yoke arms contained distinct progression bands that suggested the component had fractured under cyclic loading. Subsequent optical and SEM examination of the fracture identified features of cyclic overstress. There was no evidence of fatigue or any other damage that might have indicated the yoke arm fractures occurred prematurely.
It was concluded that the attachment yoke arms had fractured from cyclic bending loads during the break-up sequence.
Figure 12: Tail rotor gearbox input yoke
Source: ATSB
Aft tail cone bulkhead
During the conduct of this investigation, the ATSB was advised of aft tail cone bulkhead fractures caused by impact to the horizontal stabiliser during ground handling in Robinson helicopters. The ATSB made a request of the Australian helicopter industry to provide information on these events (see Appendix B). Received information showed that damage during ground handling was unlikely to be a factor in this occurrence as these incidents produced a different fracture plane, compared with that present in VH‑NBY. Additionally, the associated impact damage typically present on stabiliser surfaces of affected helicopters, was not present on VH‑NBY.
Examination of the aft tail cone bulkhead from VH-NBY showed that it had fractured into several pieces (Figure 13). The primary fracture plane was through the horizontal centre line. All 4 attachment bolts and their threaded inserts[9] had been pulled free of the bolt hole within the casting (Figure 14). The fracture features of the bulkhead attachment bolt holes where the TRGB input cartridge had been mounted, were consistent with tensile overstress. There was some mechanical damage and associated impressions on the mating surfaces, but no evidence of fretting was found on any of the contact surfaces that might have otherwise indicated the bolts had insufficient tension.
SEM examination of the fracture surfaces confirmed a predominantly brittle surface of cleavage facets.[10] Some minor locations showing shrinkage pores[11] and micro-dendritic defects[12] were observed, however, these were limited along the fracture surface and not considered to be contributory to the break-up. The SEM examination confirmed that the cast bulkhead had fractured in a brittle instantaneous manner. There was no evidence identified to indicate the surfaces had been rubbing, nor was there evidence found of any progressive crack mechanism (fatigue) through the structure.
Figure 13: Aft tail cone bulkhead and input cartridge (shown in red)
Source: ATSB
Figure 14: Threaded bolt holes of the aft tail cone bulkhead
Source: ATSB
The interior of the fragmented tail cone structure, which was still attached to the aft tail cone bulkhead section showed curling of the skin and contact marks from rotating contact damage by the flailing drive shaft.
Empennage
The empennage separated following fracture of the aft tail cone bulkhead. There was impact damage on the lower vertical fin from a tail rotor blade strike and the upper fin had ground impact damage following the break-up. The horizontal fin also displayed minor levels of post break-up damage. The bulkhead had fractured horizontally and retained the bolts and a lug from the TRGB input cartridge (Figure 15). The tail skid situated below the lower vertical fin was unmarked.
Figure 15: Empennage
Source: ATSB
Input cartridge examination
The input cartridge is a machined part fitted to connect the TRGB to the aft tail cone bulkhead. It contains 4 lugs designed for bolting to the bulkhead. The examination confirmed that all 4 attachment lugs that abutted against the cast bulkhead had fractured during the accident sequence. Each of the lugs had deformed and twisted across the section, and the hole within each lug was elongated or deformed and a thread profile from the attachment bolts had been impressed within the bore of the holes (Figure 16).
The contact areas of each lug showed no evidence of fretting or wear damage that might suggest the surfaces had been ‘working’ or that the input cartridge had been loose and moving about during service.
The fracture surfaces of each of the 4 lugs were examined in detail using an optical microscope. The surfaces were clean and free of deposits, flat in shape and texturally quite ‘rough’, indicating that the overstress fracture had occurred in a ductile manner. There was the no evidence of beach marks[13] indicative of fatigue fracture.
A secondary zone of about 1.5 mm in depth was present on each fracture surface. A detailed study of the fracture surfaces of all 4 lugs was completed at high magnifications using an SEM. The examination confirmed that all four fracture surfaces were comprised of two regions, a planar ‘flat’ zone and a larger zone of overstress dimples. There was no evidence of crack progression in any of the lugs that might suggest that the input cartridge had contained a metallurgical defect (pre-existing cracking) that would otherwise have led to an increase in net section stresses from operational loads.
Figure 16: Tail rotor input cartridge
Source: Robinson Helicopter Company and ATSB, annotated by the ATSB
Some evidence of micro movement of the fitted components was found on the washer surface facing the cast bulkhead at location 1 (Figure 17). Here, minor fretting and elongation of the washer was observed.
Figure 17: Input cartridge attachment bolt
Source: Robinson Helicopter Company and ATSB, annotated by the ATSB
Tail rotor gearbox and input cartridge manufacturing records
In 2012 the Robinson Helicopter Company changed the aluminium alloy used to manufacture the input cartridge from 2024 T351 to 7075 T7351. The change in material strengthened the input cartridge to improve outcomes in tail rotor strikes. VH-NBY’s tail rotor gearbox input cartridge was made from 7075 T7351 aluminium alloy.
Examination of the manufacturer’s TRGB and input cartridge build and quality records showed that TRGB serial number 8702 was assembled in a lot of 10 units. During the assembly process, the gear tooth contact pattern and backlash were documented by the manufacturer, and no-issues were identified in the records.
The manufacturer also provided the ATSB with component specifications, which the ATSB used in examination of the components from VH-NBY. The input cartridge was sectioned and measured against its design drawing. Measured dimensions of the input cartridge were confirmed to meet the dimensions of the approved design.
Samples of the input cartridge were also destructively sectioned for metallurgical analysis. Both the chemistry and the strength levels of the material comprising the input cartridge were assessed against the material specifications[14] listed in the design drawing. Semi-quantitative chemical analyses showed that the cartridge alloy was consistent with the chemical composition of aluminium alloy 7075, as specified. Hardness testing showed that the cartridge alloy exceeded the specified minimum strength requirements.
In summary, the input cartridge was found to conform to the approved design specifications.
Disassembly of the TRGB
All hardware associated with the TRGB was accounted for, both at the accident site, and again during the ATSB laboratory examination.
The TRGB and input cartridge were x-rayed prior to disassembly and no anomalies were noted. The TRGB exhibited no internal faults, gear meshing errors or evidence of abnormal operation that might have otherwise been contributory to the failure. Additionally, the magnetic chip plug and oil remaining in the TRGB were checked and no debris, metallic or otherwise, was identified.
Disassembly of the TRGB was witnessed by involved parties.[15]
The fastening torque of the bolts joining the input cartridge to the tail rotor gearbox casting was identified to be very low. Additionally, the adjoining lock wire that formed a secondary security to the keep the bolts tensioned and in place had been pulled away from the security hole on to the bolt head (Figure 18). The anodised surface at the interface of the input cartridge to the TRGB displayed no wear to the finished surfaces. The contact surfaces for each of the washers was examined and there was no evidence of significant fretting.
The absence of any significant wear/fretting to these surfaces indicated that the loosening of the bolts probably occurred from a shock/impulse load through the gearbox on separation from the bulkhead casting.
Figure 18: Tail rotor gearbox and input cartridge
Source: ATSB
Tail rotor pitch control
Bending of the pitch rod confirmed that it was intact and remained connected after the separation of the tail rotor gearbox from its connection to the cast bulkhead (Figure 19). Measurements showed that a 120 mm length of the tail rotor pitch control rod (neutral pedal position) had bent around the bulkhead before fracturing at the bell crank rod end.
Fracture surfaces at the rod-end connection to the bell crank were characteristic cup-and-cone that indicated ductile overstress. The tail rotor pitch change rod was severed during the accident sequence from repeated rotating contact damage at the aft flex plate position. Additionally, there were no anomalies detected in the bell crank, pitch control assembly or pitch links.
Figure 19: Pitch control rod
Source: ATSB
Tail rotor system
The TRGB, tail rotor pitch control assembly, and tail rotor hub and blades assembly had separated from the empennage and were situated 36 m away from the main wreckage.
The examination identified that one tail rotor blade had struck the underside of the tail cone (Figure 20), and tail rotor guard, and a prominent hole had been pierced through the bonded tip cap (Figure 21). The other blade had struck the lower vertical fin (Figure 22).
The tail rotor blade skin surrounding the point of fracture for both blades were examined optically and using an SEM. They showed predominantly angular tear ridges[16] and ductile morphological features[17] on the fracture surfaces. There was no evidence of a pre-existing defect such as fatigue, nor were there any anomalies noted with the blade construction.
The skin surrounding the point of fracture was examined optically and using an SEM with predominantly angular tear ridges and ductile morphological features on the fracture surfaces. There was no evidence of a pre-existing defect such as fatigue, nor were there any anomalies noted with the blade construction.
Figure 20: Tail rotor contact with tail cone
Source: ATSB
Figure 21: Tail rotor system (underside view)
Source: ATSB
Figure 22: Tail rotor contact with lower vertical fin
Source: ATSB
Analysis of the break‑up sequence identified that the TRGB was almost certainly separated from the end of the tail cone at the time of tail rotor blade contact with the tail cone, and with the lower vertical fin.
Tail rotor blade deposit analysis
Examination of each tail rotor blade surface at high magnification using a binocular microscope confirmed the presence of the surface deposits, which was further analysed. Exposure of the blade surfaces to ultra-violet light also identified numerous fluorescing substances.
The ATSB consulted the Australian Centre for Genomics at the Australia Museum, and using their supplied DNA test kits, swabbed the blade surfaces and sent the samples to the museum for analysis. The genomic testing reported no evidence of wildlife DNA that might otherwise indicate the surface deposits were from a wildlife strike.
Summary of examination
Examination by the ATSB of the aircraft on-site, of CCTV footage, and laboratory examination of tail section components found that:
there were no pre-existing defects identified in any of the rotating or static tail section components
there were no missing fasteners or assembly anomalies
the TRGB exhibited no evidence of abnormal operation
the TRGB assembly records showed no abnormalities at the time of manufacture
the input cartridge was found to conform to all aspects of the Robinson design specifications
the input cartridge attachment lugs had no evidence of fatigue cracking and had fractured in overstress
the low fastening torque of the input cartridge was likely a consequence of loads experienced during the in‑flight break-up
micro movement was found on a washer surface facing the cast bulkhead
there was no evidence that the tail rotor blades had been subject to a wildlife strike.
Previous occurrences
Worldwide Robinson R44 fleet
The ATSB analysed worldwide accident data to identify previous occurrences involving loss of the empennage and/or TRGB. That review identified 8 accidents that bore similar post-accident damage signatures to the in‑flight break-up of VH-NBY. The ATSB received valuable support from the Flight Safety Foundation’s Aviation Safety Network, the United Kingdom Air Accidents Investigation Branch, and from the US National Transportation Safety Board (NTSB) to identify and analyse previous relevant accidents.
Analysis of worldwide accident data did not show any statistically significant increase in the frequency of these events between the time periods 2002 to 2011 and 2012 to 2021 (representing the time periods before and after the change in the aluminium alloy used to manufacture the input cartridge – see the section titled Tail rotor gearbox and input cartridge manufacturing records).
Most of these events resulted in only minor injuries. In 2 events a cause was unable to be determined. In 2 more overstress was detected and contact with an object was described as more than likely but the investigation could not identify what.
The pilot of N1241W made a successful ditching following loss of empennage and TRGB (Figure 23). The 3 occupants sustained minor injuries. The NTSB found that 2 of the input cartridge attachment bolts were loose.
Figure 23: N1241W ditching and evacuation
Source: Mike Hartley
Survivability
Crashworthiness
The Robinson Helicopter Company R44 met the airworthiness standards of, and was certified against, US 14 Code of Federal Regulations (CFR) Part 27.[18] The helicopter was certified in Australia on that basis. The standard the R44 had to meet for strength requirements of the helicopter with respect to protection of occupants was Sec 27.561 issued in 1964. It required protection to the occupants from inertial forces of:
(iii) Sideward – 2.0g
(iv) Downward – 4.0g
The R44 (and many other helicopter types) provided very little protection in a sideways impact. The R44 is fitted with energy absorbing skid gear and energy absorbing seats. It is therefore vital to land on the skids to ensure maximum protection for occupants.
Figure 24 shows R44 N797JR which experienced in-flight break-up similar to VH-NBY while hovering at a height of 50 ft (see the section titled Previous occurrences). The pilot reportedly followed the POH emergency procedure and, even though operating in the ‘avoid’ area of the height/velocity curve chart, the severity of the ground impact was cushioned by the energy remaining in the main rotor system, and the helicopter’s skid gear. There was one person on board who had minor injuries.
Figure 24: N797JR post in-flight break-up
Source: NTSB, annotated by the ATSB
Figure 25 illustrates the deformation in VH-NBY from the side impact. The tail rotor gearbox and empennage fractured from the tail cone at around 55 ft and the helicopter fell from about 75 ft above the ground.
Figure 25: Diagram of cabin deformation in VH-NBY
Source: ATSB
Fuel tanks
R44 helicopters were originally fitted with aluminium fuel tanks and rigid fuel lines. These fuel tanks and lines were known to rupture on heavy impact. The manufacturer issued a service bulletin (SB78A) to all owners and operators of R44 helicopters to install crash‑resistant fuel bladders by 31 December 2013. The ATSB and CASA separately highlighted the importance of this modification. Today, all R44 helicopters in Australia must be fitted with fuel bladders and flexible fuel lines.
The aluminium skin of the fuel tanks fitted to VH-NBY split at the riveted joints upon impact. The left tank ruptured, but the fuel bladder remained intact, retaining its fuel. The right tank ruptured and the bladder was punctured on impact by the hydraulic pump which was co-located with the main rotor gearbox (Figure 26).
The puncture allowed the release of fuel, but at a low rate (Figure 27). An unknown quantity of fuel leaked from the bladder and attending fire services contained the spill. About 30 L of fuel remained in the helicopter. Given the previously‑observed rupturing of aluminium fuel tanks during significant impact, without the fuel bladders, the risk of a post-crash fire would probably have been significantly higher.
Figure 26: Fuel tank rupture (view forward)
Source: ATSB
Figure 27: Fuel bladder tear
Source: ATSB
Organisational and management information
Registered operator
The owner of VH-NBY was also a director of the registered operator, Avanova Pty Ltd. This company was one of a group of family-owned and related entities. The group consisted of aircraft operators with air operator’s certificates (AOC), and a maintenance organisation that maintained a fleet of float planes. Avanova Pty Ltd did not have an AOC. An associated entity, of which the pilot was also a director, had an AOC for aeroplanes only.
Avanova Pty Ltd was the registered operator of 5 helicopters and 2 aeroplanes at the time of the accident. The helicopters were used for private, business, and commercial purposes for a tourism company. Commercial usage was for tourism charter under third party AOCs.
Private use of the registered operator’s helicopters involved scenic flights, personal transport, and adventure trips. While still classified as private operations, the helicopters were also used in support of the tourism business. They were used to transport workers to remote areas, as well as the conduct of external load work for maintenance and the recovery of company owned‑ vessels.
Approved maintenance organisation
The approved maintenance organisation (AMO) was an authorised Robinson Helicopter service centre. It was a company which provided services to the helicopter industry in the Kimberley region. The AMO’s facilities, located on a station near Broome, were equipped with appropriate tooling for the specific purpose of maintaining and operating Robinson helicopters.
The owner of the AMO was a highly experienced helicopter pilot with around 20,000 hours flight time, mainly in Robinson helicopters. The AMO employed licenced aircraft maintenance engineers and apprentice aircraft maintenance engineers. The AMO had maintained VH-NBY throughout its service history.
VH-NBY operational history
On 29 March 2019, after a period of being operated privately by a different owner, VH-NBY was transferred and registered to Avanova Pty Ltd for tourism work at the Horizontal Falls area in Western Australia. Under a third-party AOC, VH-NBY commenced commercial operations in Western Australia on 13 April 2019 with 60.3 hours from new. On 22 October 2019 it was returned to private use, with Avanova Pty Ltd remaining the registered operator. The company used the helicopter in support of their tourism operations and for personal use.
Operational use of VH-NBY
A potential cause of unusual vibration leading to tail rotor gearbox input cartridge overstress failure was prior damage or stress to the tail rotor. While no evidence of a pre‑existing defect (including fatigue damage) was identified in any of the tail rotor components, given the potential for a previous loading event to have created invisible damage, the ATSB reviewed the prior usage of VH-NBY for events that may have overstressed critical tail rotor components.
Examples of usage with the potential to damage the helicopter were identified, specifically previous instances of:
excessive manoeuvring
flight in the obstacle environment
loss of control near the ground.
The R44 Raven I POH carried advice on excessive manoeuvring. In the safety tips and notices section it stated:
6. Avoid abrupt control inputs or accelerated manoeuvres, particularly at high speed. These produce high fatigue loads and, over time, could lead to failure of a critical component.
The risk of a rotor or wildlife strike increases the lower an aircraft flies. Additionally, operation close to water and foliage also presents opportunity for unidentified damage (Figure 28). The helicopter’s manufacturer advised that contact with objects such as clothing, water or foliage may cause damage without marking the tail rotor. While examples were found of operation that had the potential to damage the helicopter, no specific evidence was identified.
Figure 28: VH-NBY landing sites
Source: Western Australia Police
Imposition of risk
Intentional non-compliance during previous operation of VH-NBY, and the carriage of passengers on the first flight following ground assessment of the observed vibration prompted an examination of the owner’s risk appetite, and their willingness to expose third parties to risk. For example, the flight conducted on 2 July 2020 was a passenger flight over water following advice of an unusual vibration in the pedals. That flight carried risk of worsening of a condition or failure of a component, without any option to quickly land.
Further examples of imposing risk on third parties without mitigation of that risk were readily found. These activities included:
exceedance of maximum passengers
carriage of unrestrained passengers
external carriage of passengers
landing in uncontrolled public spaces
unapproved low flying with passengers
These activities, several of which were witnessed by other parties, carried significant risk, yet there was no evidence that any action was taken to prevent or report them.
In line with the Civil Aviation Act (1988) and within the resources available to the Civil Aviation Safety Authority (CASA), CASA oversighted authorisation holders, such as pilots, engineers, and commercial AOC holders. For authorisation holders, CASA had three types of surveillance; planned, sector campaign, and response.
Planned surveillance was conducted under the National Surveillance Selection Process (NSSP). CASA prioritised high volumes of fare paying passengers in their oversight of over 2,000 authorisation holders. In line with CASA’s remit, they did not include private pilots in the NSSP.
Sector campaigns looked at specific industry sectors, such as airline heavy maintenance, or air ambulance services. These sector campaigns were conducted with similar priorities of public benefit and addressed the risks specific to specialised groups. Private pilots would not be expected to feature in these programs.
Private pilots were most likely to be subject to oversight in response surveillance. Response surveillance could be triggered by an incident, observation, or a report to CASA about unsafe behaviour or unsafe condition of aircraft.
Management of airworthiness
In 2005 CASA published a document titled ‘maintenance guide for owners/operators’.[19] This publication was revised in 2012 and updated in 2019. It covered the responsibilities of registered owner/operators and stated:
As a registered owner/operator, you are responsible for the continuing airworthiness of your aircraft. This responsibility begins and ends with you.
To assist registered operators, CASA published regulations, advisory publications, and plain language guides. All the information a registered operator needed to manage the airworthiness of their aircraft was published and freely available from CASA’s website.
Related occurrences
Registered operator’s helicopters
When investigating potential opportunities for previous damage to VH-NBY it became apparent that there was a history of unreported accidents and incidents within the registered operator’s Robinson R44 fleet (Table 4). These included tail rotor strikes and total loss of a helicopter resulting in serious injury.
In order to facilitate safety learning from the latter occurrence, detail is included in Appendix A. The loss of another helicopter (collision with water), which occurred in commercial operations was reported by a third party and investigated by the ATSB (see AO‑2017‑047).
Table 4: Unreported accidents and incidents in registered operator’s R44 fleet
Helicopter
Occurrence
Location
Date
VH-SCM
Tail rotor strike
Broome, WA.
September 2016
VH-ZGY
Tail rotor strike
Horizontal Waterfalls, WA
August 2017
VH-ZGY
Collision with water
Raft Point, WA
July 2019
VH-NBY
Bird strike
Broome, WA
August 2019
VH-TUY
Main rotor strike
Unknown
November 2019
VH-NBY
Loss of control
Cyclone Creek
March 2020
VH-NBY, Main rotor bird strike, near Broome, WA. 25 August 2019
During cruise, the helicopter’s main rotor blade struck a bird. The species was brown booby, a large bird with weight up to 1.4 kg and wingspan up to 1.4 m. The surface of one main rotor blade tip was damaged (Figure 29).
The main rotor blade tip was painted at some point after this event. There is no mention of inspection or repair in any of the helicopter logbooks or maintenance releases.
Figure 29: Damage to VH-NBY main rotor following bird strike, and blade at accident site
Source: Western Australia Police, annotated by the ATSB
VH-NBY, loss of control while landing on a vessel, near Cyclone Creek, WA. March 2020
VH-NBY was used in support of recovery of the domestic commercial vessel Jetwave Pearl which had capsized in a storm at Cyclone Creek.
While landing on the vessel Kimberly Quest 2, the skid gear caught the edge of the rubber matting on the helipad. This led to loss of control, the helicopter pitched forward and right before control was recovered. The matting on the deck of the vessel was torn.
It is not known if any tail strike or damage to VH-NBY occurred during this event and the captain of the Kimberley Quest 2 reported that no such incident occurred.
Safety analysis
Introduction
Two pilots detected the existence of an unusual vibration in the tail rotor pedals of R44 VH-NBY. The vibration was referred to an approved maintenance organisation (AMO) which completed troubleshooting involving ground running of the helicopter with no defect identified. Subsequently on the following flight with the pilot and 3 passengers, major sections of the tail that included the empennage and tail rotor gearbox (TRGB) fractured and then separated from the helicopter in-flight. Control of the helicopter was lost, resulting in fatal injuries to the pilot and one of the passengers and serious injuries to the remaining 2 passengers.
In that context, this safety analysis will examine the nature of the defect and the factors that led to it resulting in a fatal accident.
In-flight break-up
Examination of the aircraft and components found that the TRGB was functioning correctly, the TRGB input cartridge was manufactured to design specification, and the helicopter design was certified under the United States 14 Code of Federal Regulations (CFR) Part 27. All attaching hardware from the tail rotor system was present, and there was no evidence of incorrect assembly.
No components showed evidence of continual abnormal operation, or damage such as pre‑existing fatigue cracking.
Break-up sequence
The in-flight break-up of the tail rotor components was a rapid and complex sequence of events. A review of the recorded closed-circuit television (CCTV) and analysis of the physical evidence (tail rotor and empennage components) determined the following likely sequence:
it is likely that the in-flight break-up began at the bolted connection between the TRGB and the aft tail cone bulkhead
dynamic loads during take-off overstressed the attachment lugs of the input cartridge to the TRGB
the attachment bolts and threaded inserts that secured the lugs of the input cartridge were also pulled at about that moment, shearing the internal threads from within the cast alloy bulkhead
the TRGB dislodged, moving rearward and down
the trailing edge of the lower vertical stabiliser was struck by a tail rotor blade. The other tail rotor blade impacted the underside of the tail cone
the resultant shock loading through the stabiliser from the rotor blade impact fractured the cast bulkhead
the stabiliser and gearbox both separated from the tail cone
due to the bending applied from the now out of position gearbox, the bolted interconnection between the rear flex plate, drive shaft and tail rotor input yoke was compromised
impact damage from the flailing driveshaft led to further break-up of the remnant section of bulkhead casting and aft end of the tail cone.
Source of vibration
Vibration in a helicopter can come from a multitude of sources. Tail rotor imbalance, a common source of vibration in pedals, was found to be within limits by the attending engineers the day before the accident. It was therefore considered to be an unlikely source of the vibration felt by the pilots of VH‑NBY. The minor fretting identified in the attaching hardware of the TRGB input cartridge (Figure 17) was indicative of movement with the potential to have increased vibration in the tail rotor system.
Main rotor vibrations ordinarily present as a bounce or lateral shimmy felt through the pilots’ seat, and there were no reported faults with main rotor track or balance. The main rotor drive train displayed no pre-accident damage, and cyclic, collective, and throttle control systems were found to be continuous and displayed no pre-accident damage.
A disturbance in the engine can cause fluctuations of power and therefore change thrust from the tail rotor, which can present as ‘kicks’ in the yaw plane. An engine cylinder change had occurred 4 flight hours earlier, and the helicopter had been test flown with no fault found. Additionally, there were no reported concerns with the engine from the pilots or engineers. The engine was producing power and was stated to sound normal on the day of the accident. Additionally, CCTV analysis showed rotor rpm to be within its normal range.
Tail rotor drive train disturbances were also considered unlikely, as examination of the tail rotor drive train and TRGB found no pre-existing faults.
If an undetected problem existed in any of the above systems, it could not be ruled out, nor linked with certainty to a characteristic vibration that would manifest as tapping in the pedals. Therefore, it was not possible to identify the source of the vibration.
The precursor to this in-flight break-up echoes the pilot’s operating handbook (POH) warning of a change in sound or vibration forewarning of a potential failure of a critical component. In other similar in-flight break-ups, the pilots also reported vibration in the pedals, which have a direct linkage through the control rods and bell cranks to the tail rotor system, prior to component failure.
While the association cannot be made beyond doubt, the reported vibration in the pedals is likely to have been associated with the developing sequence that ultimately led to in‑flight failure of the tail section.
Input cartridge failure
The input cartridge was examined in detail alongside several other input cartridges from other helicopters. The component was found to be made of the correct material and to the approved design. There was no evidence of manufacturing defects that predisposed the input cartridge to prematurely fail. The lug fracture surfaces contained only evidence of overstress, with no indications of pre-existing damage such as fatigue.
There was no evidence of incorrect assembly. The fasteners were all accounted for, and the mating surfaces of the attachment lugs showed accident damage. There were signs of micromovement on one attachment bolt. This suggests that the input cartridge may have moved under load in service and could have been the source of tapping reported in the pedals.
There were no pre-existing abnormalities to the TRGB, nor pre-existing damage to the tail rotor blades that might otherwise explain the source of the extreme loading. The manufacturer advised that it is possible to impart unusual load on a tail rotor system without permanently marking the tail rotor. While opportunity for that to have occurred existed, there was no evidence of any such contact prior to this event. Additionally, witnesses on the day of the accident stated that they did not see any foreign objects contact the tail rotor.
In summary, the source of any potential initiator of the vibration or overstress of the lugs that precipitated the in-flight break-up of the tail section components could not be determined.
Fuel bladders
While the skin of the aluminium tanks had ruptured, the fuel bladders in the tanks retained most of the fuel during the event. A tear in the left bladder made by the hydraulic pump leaked fuel at a rate low enough to significantly reduce the risk of a post-impact fire.
Response to the identified vibration
The tail rotor pedal vibration was first identified during the short flight from the industrial property to Broome Airport. Although the pilot reported it to the owner, it was not annotated as a defect on the maintenance release (MR) and no engineering examination of the helicopter was conducted prior to the return flight.
The vibration was reported to have been light at that stage and thought to be related to paint on the tail rotor, its implication therefore may not have been recognised. However, examination of the helicopter at Broome Airport would have permitted a maintenance check flight to have been conducted in an open area. Compared to the industrial helicopter landing site, this would have offered a safer response in the event of a worsening condition or failure. It also offered the advantage of on-site emergency services.
Following the return flight to the industrial property and having had the opportunity to personally assess the vibration, the owner arranged for examination by maintenance personnel. Again, the defect was not annotated on the MR, although the vibration was conveyed to the maintenance organisation.
In addition to not annotating any defect in Part 2 of the MR, the ATSB identified that the MR had not been correctly used to record the operation of the helicopter for the 4 weeks preceding the accident. While this may have been influenced by the small number of pilots using the helicopter and verbal communication of the tail rotor vibration, it bypassed a vital tool for recording and communicating the airworthiness of the helicopter.
Due to an assessment by the pilot associated with the maintenance organisation that a check flight could not be safely conducted at the industrial property, evaluation of the reported vibration was confined to a ground run of VH‑NBY, with no defect identified. There were varying accounts of what follow‑up troubleshooting was required. As annotated in their maintenance documentation, the maintenance personnel reported that the owner was advised that a check flight should be conducted. However, the pilot that first detected the vibration and the accident pilot were reportedly unaware that a check flight was required. Again, no related entry was made on the MR, removing an opportunity to clearly detail any required actions.
Understanding defect resolution processes is vital for registered operators to manage the airworthiness of their aircraft. The process includes an iterative cycle of fault finding and critical analysis of every step until the reasons for the defect have been identified and rectified. In this case, and irrespective of the understanding relating to the need for a follow‑up check flight, as the vibration was reported during flight, and no defect was identified, or significant corrective action undertaken, following the ground‑based maintenance assessment, it is reasonable to have concluded that the problem may still be present.
In that context, the safest next step was the conduct of a graduated flight check (the stated preference of the attending engineer and consistent with the advice of the helicopter manufacturer) by a solo pilot. By contrast, the next and final flight was conducted with 3 passengers and involved a steep, high-power departure, possibly following a brief pause in the hover. The unnecessary carriage of passengers resulted in a significantly more severe outcome following the in‑flight break‑up.
The pilot’s decision to conduct the flight in this manner may have been influenced by a belief that the vibration was a minor issue associated with excess paint on the tail rotor blades. However, there was also evidence that the pilot was willing to take, and expose others to, elevated risk. Specifically, despite being important safety defences, the pilot did not have a current aviation medical certificate or R44 helicopter flight review at the time of the accident.
Additionally, during a review of the past usage of VH-NBY to identify any previous events that may have damaged the tail rotor, numerous instances of high risk operation by the accident pilot were identified (together with several reportable matters that had not been conveyed to the ATSB). These included the conduct of low flying and external load operations without the required training or qualifications and, more significantly, the carriage of passengers in an unsafe manner on multiple occasions.
The ATSB concluded that the pilot’s high-risk appetite may have influenced the way the accident flight was conducted. It may also have made the pilot less likely to heed the warning in the R44 POH regarding the significant implication of a change in sound or vibration of the helicopter. Finally, while there was no evidence that the identified reportable matters contributed to this accident, the notification of occurrences to the ATSB is an important component of the aviation safety system.
Departure and emergency response
In other similar tail rotor failure occurrences, use of the POH emergency procedure resulted in a safe outcome for the occupants. One of the similar occurrences involving N797JR, happened in a high hover, similar to VH-NBY, though VH-NBY was likely heavier at the time.
The confined area associated with the industrial property required the pilot of VH-NBY to conduct a near-vertical departure, within the avoid area of the height / velocity diagram, limiting the energy available in the helicopter to use in an emergency response. That departure also demanded higher power than the recommended take-off profile over open ground. With the higher power was an associated higher torque, which sought to rotate the cabin of the helicopter to the right with more force. That in turn required higher counteracting thrust from the tail rotor.
CCTV showed that after the initial break-up VH-NBY continued climbing and rotating. The flight manual procedure of lowering the collective and/or closing the throttle would have seen rotation stop or slow, and VH-NBY would have descended. Use of that procedure while the aircraft was still oriented upright would have exposed the skid gear to contact with the ground first, and absorbed the impact energy, improving survivability.
Impairment and response times
Pilot intervention time is an important factor in recovery from an emergency, and unless primed, the stress of an emergency can impair response times. Startle is a stress response to a sudden intense event. It can cause involuntary reflex and cognitive impairment and can last from 0.3 seconds at the low end, to 1.5 seconds for a high intensity response (Rivera and others 2014).
The United Kingdom Civil Aviation Authority (CAA) published a paper on Helicopter Tail Rotor Failures in 2003. The purpose of the paper was to examine tail rotor failures and explore potential mitigators to reduce the incidence and consequences of tail rotor failures. The report related that pilot intervention time is highly variable. The CAA determined an intervention time of 2 seconds was a realistic average to use for their simulator trials.
CCTV analysis showed an approximate 2.7 seconds from contact of the tail rotor blade with the lower vertical fin, to the end of the first rotation. In the case of VH-NBY, the forces in the first rotation would have been roughly equivalent to 2.6 g. The forces in the second rotation would have climbed too high for a pilot to manipulate the controls. As such, the end of the first rotation was probably the last opportunity to prevent the total loss of control. Any impairment greater than 0.7 seconds could have prevented initiation of recovery actions in time to prevent loss of control.
Training and checking of private pilots
Once licenced, private pilots can fly with very little further training and supervision. The regulations require private pilots to demonstrate competence through a helicopter flight review (HFR) every 2 years. Yet over time, a pilot’s skills and knowledge can degrade. The owner of VH-NBY had not demonstrated competence in an R44 for about 2 years and 8 months and had completed a flight review in a Bell 505 within 2 year and 2 months. The emergency procedure for tail rotor failure is similar between the R44 and Bell 505.
A pilot cannot be reasonably expected to maintain competence in emergencies without deliberately exercising their skills and knowledge, supported by independent assessment of their abilities. CASA advises pilots that the two-year cycle of flight reviews does not guarantee safety. Consequently, they encourage pilots to assess their risk profile and seek opportunities to develop their skills, utilising for example training and checking with an experienced instructor.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the in-flight break-up of Robinson Helicopter Company R44 Raven I serial number 2544 registered as VH-NBY on 4 July 2020, 3 km north of Broome Airport, Western Australia.
Contributing factors
Following a period of pedal vibration over at least 2 flights, overstress fracture of the attachment lugs of the tail rotor gearbox input cartridge occurred. The source of the loading that led to the overstress fracture was not conclusively determined.
Two pilots experienced vibration through the helicopter’s tail rotor pedals on separate flights and did not endorse the problem on VH-NBY’s maintenance release. Additionally, following tail rotor inspection and vibration analysis on the ground, the engineers did not endorse the requirement for a maintenance check flight on the maintenance release. As a result, the value of the maintenance release as a tool for communication and management of airworthiness was lost.
A recommendation in the R44 pilot's operating handbook was not followed. It advised pilots that following detection and inspection of an unusual vibration, they should hover the helicopter then have it reinspected before resuming free flight.
The pilot conducted a towering high-power take-off in VH-NBY from a confined area with 3 passengers on board. The unnecessary carriage of passengers resulted in a significantly more severe outcome following the inflight breakup.
Shortly after take-off, following the overstress fracture of the attachment lugs, the tail rotor gearbox separated from the helicopter. This led to fracture of the aft tail cone bulkhead and separation of all components attached to it, including the horizontal and vertical stabilisers.
With limited time and the stress associated with the emergency event, the pilot did not apply the pilot’s operating handbook procedure for responding to a tail rotor emergency. Prompt application of the procedure would have reduced the likelihood of loss of control, and therefore improved the potential for survivability.
Other factors that increased risk
The pilot did not have a valid flight review for the R44 helicopter type or a current medical certificate. The former increased the risk of an inappropriate response to the tail rotor emergency and the pilot was not legally authorised to operate an R44 helicopter at the time of the accident.
The owner of VH-NBY demonstrated acts of non-compliance with multiple aviation safety regulations. Additionally, VH-NBY was operated in a manner that increased the risk of damage or stress to the helicopter on multiple occasions. These actions had an adverse influence on safety and imposed unnecessary risk on passengers and third parties.
Although the registered operator of VH-NBY was responsible for the continued airworthiness of its helicopter fleet, they did not employ a conservative defect resolution process that would have supported further trouble shooting.
Other findings
The attending engineers found that visual inspection of the tail rotor system and associated components, running the helicopter on the ground, and dynamic tail rotor balancing, could not replicate the stated problem. It is likely that the vibration only presented in powered flight.
There was a history of unreported accidents and incidents with the registered operator of VH‑NBY's aircraft, in both commercial and private operations. These occurrences included 2 tail rotor strikes in different R44 helicopters, and a total hull loss of another R44 helicopter (VH‑ZGY) that resulted in serious injuries to a passenger.
Although a fuel bladder was punctured during the accident sequence, and fuel was lost from the tanks, the fuel bladders reduced the flow rate of escaping fuel, which reduced the risk of a post-crash fire.
Glossary
AAIB Air Accidents Investigation Branch (United Kingdom)
ALARP As Low As Reasonably Practical
AOC Air Operator’s Certificate
AME Aviation Maintenance Engineer
AMO Approved Maintenance Organisation
CASA Civil Aviation Safety Authority
EDS Energy Dispersive x-ray Spectrometer
FAA Federal Aviation Administration (United States of America)
HAAMC Head of Airworthiness and Maintenance Control
HFR Helicopter Flight Review
LAME Licenced Aviation Maintenance Engineer
MR Maintenance Release
NTSB National Transportation Safety Board (United States of America)
POH Pilot’s Operating Handbook
PPL Private Pilot’s Licence
RHC Robinson Helicopter Company
SEM Scanning Electron Microscope
SES State Emergency Service
TRGB Tail Rotor Gearbox
TR Tail Rotor
VFR Visual Flight Rules
Sources and submissions
Sources of information
The sources of information during the investigation included the:
pilots of VH-NBY
maintenance organisations for VH-NBY
commercial operators of the registered operator’s aircraft
next of Kin
flight schools attended by the pilot
Civil Aviation Safety Authority
United States National Transportation Safety Board
United Kingdom Air Accidents Investigation Branch
Aviation Safety Network
Western Australia Police Force
Robinson Helicopter Company
Airservices Australia
witnesses
video footage of the accident flight and other photographs and videos of company aircraft
recorded data from the aircraft tracking unit on the helicopter
References
Australian Transport Safety Bureau, AR-2020-014, Aviation Occurrence Statistics 2010 to 2019, 2020, Canberra.
American Society for Metals International, 2004, ASM Handbook, Volume 9: Metallography and Microstructures, Materials Park, Ohio.
American Society for Metals International, 2021, ASM Handbook, Volume 11 Failure Analysis and Prevention, Materials Park, Ohio
Casner SM, Geven RW & Williams RT, ‘The effectiveness of airline pilot training for abnormal events’, Human Factors: The Journal of the Human Factors and Ergonomics Society, 2013 vol. 55, pp.477-485.
Civil Aviation Authority United Kingdom, CAA Paper 2003/1, Helicopter Tail Rotor Failures 2003.
Dismukes RK, Berman BA & Loukopoulos LD, The limits of expertise: Rethinking pilot error and the causes of airline accidents, 2007, Ashgate Aldershot UK.
Flight Safety Foundation, Simulator-based study of Emergencies Yields Insights into Pilot’s Reaction Times, March-April 1999, Vol. 25, No. 2, Alexandria, VA.
Glendon AI, Mckenna EF, Human safety and risk management, 1995, Chapman & Hall, London
Greening L, Chandler CC, Why It Can’t Happen to Me: The Base Rate Matters, But Overestimating Skill Leads to Underestimating Risk, Journal of Applied Psychology, 1997, 27:9, 760-780.
Hunter DR, Risk Perception and Risk Tolerance in Aircraft Pilots, Federal Aviation Administration, DOT/FAA/AM-02/17, 2002.
Klein G, Sources of power: How people make decisions, Massachusetts Institute of Technology 1998.
Landman A, Groen EL, van Passen VV, Bronkhorst AW & Mulder M, ‘The influence of surprise on upset recovery performance in airline pilots,’ The International Journal of Aviation Psychology, 2017 vol. 27, pp.2–14.
Lawton R, Not working to rule: Understanding procedural violations at work, Safety Science, 1998, 28:2, 77-95.
Rivera, J., Talone, A.B., Boesser, C.T., Jentsch, F. and Yeh, M., Startle and surprise on the flight deck: Similarities, differences, and prevalence. In Proceedings of the human factors and ergonomics society annual meeting September 2014 (Vol. 58, No. 1, pp. 1047-1051). Sage CA: Los Angeles, CA: SAGE Publications.
Yates JF (ed), Risk-taking behavior, 1992, John Wiley & Sons, New York, NY.
Zinn, JO. The meaning of risk-taking – key concepts and dimensions, Journal of Risk Research, 2019, 22:1, 1-15.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the registered operator of VH-NBY
Civil Aviation Safety Authority
maintenance organisation for VH-NBY
Robinson Helicopter Company
Submissions were received from the registered operator of VH-NBY and the Robinson Helicopter Company. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – VH-ZGY collision with water
What happened
On 12 July 2019, a private vessel, High Calibre, had repositioned to Raft Point, Western Australia (Figure 30). A Robinson R44 Clipper II, serial number:12491 registered as VH-ZGY was parked on the helipad of the vessel (Figure 31). There were 4 people aboard High Calibre, the owner of the vessel (and helicopter), and 3 individuals. The weather was fine and the water in the bay was calm.
Figure 30: Occurrence location
Source: Google Earth annotated by ATSB
It was reported to the ATSB that 2 people required transfer to another helicopter (VH-NBY) located nearby on-shore, to return to Broome. A witness stated that VH-ZGY had been used twice already that day and had landed to load a third passenger without shutting down. Simultaneously, friends and family of the vessel’s owner were due to arrive at Raft Point via seaplane to holiday aboard High Calibre. It was reported that the transfer to VH-NBY in VH-ZGY needed to be completed in time for the owner to get back to High Calibre and meet their guests.
The owner of the helicopter was piloting the helicopter and sat front right. One passenger sat front left, and the second passenger sat rear right. It was reported that upon take off the helicopter yawed left and then tipped forwards and rolled to the right. The main rotor blades contacted the starboard side of the vessel (Figure 32). The helicopter then collided with water and sank.
While it was reported to the ATSB that a tie-down was still attached under the nose of the helicopter and that initiated the roll over, another witness stated that all tie downs had been removed and stowed. They added that access to the helicopter meant climbing a ladder which put the pilot and passengers at eye level with the deck. Allowing them to check for tie-downs as they climbed.
It is possible that control was lost due to the helicopter remaining tethered. Alternatively, if it had recently landed and was untethered, a mishandled departure may have initiated the roll over. The helicopter was not inspected and the actual cause of the rollover was not determined.
Figure 31: VH-ZGY on High Calibre
Source: Western Australia Police Force annotated by ATSB
The front left occupant had serious injury, the owner sat front right, had severe bruising, and the rear right passenger had minor injuries. The helicopter was destroyed. The Civil Aviation Safety Authority confirmed the loss of VH-ZGY with an insurance agent, and the helicopter was not recovered. High Calibre had significant damage and the hull was penetrated above the water line. High Calibre was repaired in a remote location 11 days later.
Figure 32: Damage to High Calibre
Source: Western Australia Police Force, annotated by the ATSB
Under section 18 of the Transport Safety Investigation Act 2003 a responsible person with knowledge of an immediately reportable matter must report it. The loss of VH-ZGY was not reported to the ATSB.
Safety action
It is not known whether the registered operator took safety action as a result of this event.
Safety message
In 2016 the Federal Aviation Administration in the US released a safety alert SAFO16016. This alert advised pilots of the importance of utilising checklists and performing stabilised hover checks. This allows pilots to ensure vital actions have been performed before departure and allows a pilot to abort a take-off if anything is not right or discovered amiss. While SAFO16016 may require adjustment to suit waterborne operations the principals apply.
The reporting of accidents and incidents is vital for the sharing of lessons learnt that may be implemented by industry, reducing the risk of future accidents and incidents. Additionally, the data the ATSB and other agencies collect through reporting is deidentified and used in Australia and worldwide for analysis of factors impacting aviation safety to improve outcomes for all users of aviation services of all types.
Organisations and individuals that report accidents and incidents contribute to the growth towards a generative safety culture[20] in Australia and around the world. Those organisations and individuals are more able to generate safe outcomes in aviation operations as a result.
Occurrence details
Date and time:
12 July 2019
Occurrence category:
Accident
Primary occurrence type:
Collision with water
Location:
Raft Point, Western Australia
Latitude: 16º 04.34' S
Longitude: 124º 27.45' E
Aircraft details
Manufacturer and model:
Robinson Helicopter Company R44 Clipper II
Type of operation:
Private
Activity:
General Aviation / Recreational
Sector:
Helicopter
Departure:
Raft Point, Western Australia
Destination:
Horizontal Falls, Western Australia
Persons on board:
Crew – 1
Passengers – 2
Injuries:
Crew – 1 minor
Passengers – 1 serious, 1 minor
Aircraft damage:
Destroyed
Appendix B – Robinson Helicopter ground handling incidents
Introduction
In the course of investigation into the in-flight break-up of VH-NBY. The ATSB received anecdotal evidence of aft tail cone bulkhead castings failing after contact of the horizontal stabiliser with a solid object during ground handling.
While the ATSB welcomes reporting of ground handling incidents, it is not a requirement under the Transport Safety Investigation Regulations to report them. Therefore, the ATSB did not have a suitable record of events to examine.
An update to the investigation was published on 17 August 2021. In that update the ATSB sought information from operators who had experienced ground handling issues. Specifically resulting in damage to the aft tail cone bulkhead and tail rotor gearbox input cartridge.
Response from industry
The ATSB is grateful to the large number of members of the helicopter industry in Australia and overseas who provided valuable insight, experience, information, and components to the ATSB. This knowledge and material was analysed in the context of the failure of VH-NBY and supported the investigative process.
Three casting fractures were identified one in each of R22, R44 (Figure 33) and R66. Each was the result of contact of the horizontal stabiliser with a fixed object while ground handling the helicopter.
Figure 33: Ground handling damage to an R44
Source: Supplied
These failures were a known issue and the manufacturer had published service letters for each type on 11 March 2020.
R22 service letter SL-86
R44 service letter SL-72
R66 service letter SL-33
With the support of R44 owners and operators, the ATSB was able to analyse these materials and rule this out as a mechanism of failure for VH-NBY.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
[1] Refinishing the painted tips of Robinson Helicopter tail rotor blades is common practice in Australia, as sand and dust erodes tail rotor blades, potentially reducing their useful life.
[2] Tail skid: A guard device below the empennage to protect the tail rotor blades from ground strike.
[4] CASA 007/17 was superseded by CASA 62/20, and the requirement remained.
[5] The tail rotor blade life limit is 2,200 hours of operation or 12 years, whichever occurs first.
[6] Qualified person: a suitably licenced aviation maintenance engineer or pilot endorsed and current on the aircraft type.
[7] Basic HLS: a place that may be used as an aerodrome for infrequent, opportunity and short term basis for all types of operations, other than RPT, by day under helicopter VMC.
[8] CASA CAAP 92-2(2) Guidelines for the establishment and operation of onshore Helicopter Landing Sites.
[9] Threaded inserts: Robinson Helicopter Company manufacturing required threaded inserts to be fitted at each of the bolt holes in the casting, to secure the bolts.
[10] Cleavage facets: Bright reflective facets remaining following cleavage fracture
[11] Shrinkage pores: Cavities formed in the metal casting process
[12] Micro dendritic defects: A crystal with a treelike branching pattern. It is most evident in cast metals slowly cooled through the solidification range.
[13] Beach marks: The most characteristic feature usually found on fatigue-fracture surfaces are beach marks, which are centred around a common point that corresponds to the fatigue-crack origin. Beach marks can occur due to changes in loading or frequency or by oxidation of the fracture surface during periods of crack arrest from intermittent service of the part or component.
[14] Material specifications: US Federal Specification QQ-A-225/9E Aluminium Alloy 7075, Bar, Rod, Wire and Special Shapes; Rolled, Drawn or Cold Finished. 24 August 1971
[15] Attendance at disassembly: Involved parties could not attend in person due to COVID restrictions. A video link, and on‑site photographer were made available to them.
[16] Angular tear ridges: Tearing caused by ductile overstress following plastic deformation.
[17] Ductile morphological features: fracture features that are characterised by tearing of metal and appreciable gross plastic deformation and expenditure of considerable energy. Ductile fractures are those that occur by microvoid formation and coalescence.
[18] 14 CFR Part 27: Airworthiness standards for normal category rotorcraft. Including subparts covering strength requirements and, design and construction.
[20] Generative safety culture: This is the highest level of Hudson’s safety culture ladder and is described as safety behaviour being integrated into everything the organisation does.
Update: 17 August 2021
Progress since the preliminary report
The ATSB released its preliminary report into the 4 July 2020 fatal accident involving the Robinson Helicopter Company R44 Raven I, registered VH-NBY, on 2 September 2020.
Since the release of the preliminary report, the investigation has reviewed the helicopter’s maintenance documentation, and reviewed the pilot’s training, experience and medical records. Following interviews with a number of parties, gathering of supporting records, and assembling the history of maintenance and operation of the helicopter, the ATSB has established the context of VH-NBY’s operation.
The investigation has also reviewed accident data from multiple sources to identify potentially related occurrences in other R44 helicopters that have occurred in Australia and overseas. Following this activity, the ATSB has gathered additional tail rotor gearboxes, components, and bulkhead castings for examination. Liaison with other organisations has included the manufacturer, the US National Transportation Safety Board, and the UK Air Accidents Investigations Branch.
In addition, the ATSB has examined the wreckage of VH-NBY, collected and examined further components from the helicopter, and analysed CCTV footage. Metallurgical examinations and analysis of the airframe and tail rotor components is extensive and ongoing. Due to the disruptive nature of the event, these activities may not reveal a specific point of failure in the helicopter. Indeed, in similar occurrences overseas, despite extensive materials analysis, contributing factors have not been identified.
The investigation continues through the analysis phase and the ATSB has so far developed and tested many hypotheses related to the treatment of known defects, the component failure, the conduct of flight, and containment of catastrophic failure. The context of the occurrence and the results of ATSB’s analysis will be published in the final report at the conclusion of the investigation.
Should the ATSB become aware of a safety issue that might affect the helicopter fleet, the ATSB will immediately notify relevant parties so appropriate and timely safety action can be taken.
Request for information and materials
The Transport Safety Investigation Regulations 2003, outline the types of occurrences that need to be reported to the ATSB, either as immediately reportable or routinely reportable matters. The regulations also state that such matters only need to be reported for matters that occur during the period beginning when the aircraft is being prepared for take-off and ending after all passengers and crew members have disembarked after the flight.
Accordingly, there may have been events resulting in aircraft damage that occurred during ground handling that were not reported to the ATSB. As a result, information that could aid the investigation’s consideration of potential scenarios likely exists in industry but is currently unknown to the ATSB.
Therefore, the ATSB is seeking the assistance of industry and asks that pilots, operators, and engineers with knowledge of aft tail cone bulkhead or tail rotor gearbox input cartridge damage involving R22, R44 and R66 helicopters to email the investigation team via this link or call the ATSB safety reporting team on 1800 011 034.”
If damaged components are available, the ATSB may seek to recover these for examination.
Preliminary report
Report release date: 02/09/2020
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
The occurrence
On 4 July 2020, at 1428 Western Standard Time,[1] a Robinson Helicopter Company R44 Raven I, registered VH-NBY, was operated for a local scenic flight in Broome, Western Australia. The flight was conducted as a private operation under visual flight rules. On board were the pilot and three passengers.
The departure was from a confined, concreted area within an industrial property in Bilingurr, about 3 km north-north-east of Broome Airport. Nearby buildings, high fences, vehicles, and trees necessitated a vertical departure, and the pilot was familiar with the site.
The pilot started the helicopter, and it remained on the ground for 7 minutes, during which time the pilot arranged clearance for departure from air traffic control. Witnesses reported that the pilot then lifted the helicopter into a low hover for a few seconds before conducting a steep departure.
Three witnesses who were familiar with this departure process stated that nothing appeared out of the ordinary. None of the witnesses saw or heard the helicopter make contact with any obstacles or foreign objects.
As the helicopter reached a height of about 55 ft, witnesses heard a bang. One witness described the sound as similar to a metal bar hitting a metal pole. A recording from a fixed security camera nearby showed that the aft tail cone bulkhead, empennage, tail rotor gearbox and tail rotor assembly all separated from the helicopter in about one second.
The helicopter climbed to around 75 ft while rotating rapidly to the right, before rolling and impacting the ground on its right side, about 30 m from the departure point (Figure 1).
The pilot and a passenger, both seated on the right side, were fatally injured. The front left seat and rear left seat passengers were seriously injured. The helicopter was destroyed.
Figure 1: Location of aircraft and components following in-flight breakup
Source: Google Earth, annotated by the ATSB
Context
Pilot information
The pilot obtained a Private Pilot Licence (Helicopter) in May 2015. A family member estimated the pilot’s total flight hours to be between 1,200 to 1,500 hours, mostly on R44 helicopters. The pilot was also the owner of the aircraft.
Aircraft information
Aircraft history
The Robinson R44 is a four-place, single piston engine helicopter. The R44 was certified in December 1992 and the R44 Raven I was introduced in January 2000. As of the time of the accident, there were 558 R44s on the Australian civil aircraft register.
The R44 Raven I helicopter involved in the accident, serial number 2544, was built in May 2018 in the US. It was disassembled and shipped to Australia by the manufacturer.
The helicopter was first placed on the Australian register as VH-NBY on 28 August 2018. It was reassembled in Queensland in September 2018.
The helicopter was used privately for the first 52.5 flight hours, and spent time in Broome and Timor-Leste. In March 2019 it was transferred to an operator for tourism work at the Horizontal Falls area in Western Australia. During that time two warranty issues were resolved. A seatbelt reel tensioner was replaced in May 2019, and the helicopter’s battery was replaced in July 2019. Also in July 2019, the helicopter was provisioned with an external cargo hook, and it was used for occasional external load operations as well as tourism work after that time.
In October 2019, during a periodic inspection,[2] the tips of the leading edge of the tail rotor blades were painted. This was to repair dust erosion and protect the blades from the sandy, coastal environment. After this inspection, the helicopter returned to private use.
At the time of the accident, the helicopter had 291.0 recorded hours in service.
Recent flights and maintenance
On 4 June 2020, with 286.9 recorded hours in service and 38.1 hours since the last periodic inspection, VH-NBY underwent a periodic inspection and an engine cylinder replacement. The inspection was conducted early because the owner planned to operate the aircraft in a remote location, and needed the maximum time available before the next scheduled maintenance visit. Following the maintenance, a pilot from the approved maintenance organisation conducted a maintenance check flight. This flight took 0.3 hours and the pilot found no anomalies.
The helicopter was collected by a pilot who flew from Broome to Horizontal Falls and then back to Broome. This trip took an estimated 3.0 hours.
On 29 June 2020, the same pilot made a short flight of around 0.1 hours from the industrial area in Bilingurr, where the helicopter was stored, to Broome Airport, where it was to be fitted with a tracking system. That pilot reported feeling a vibration in the tail rotor pedals that felt like someone tapping the pilot’s feet with spoons. The sensation was noticeable yet not strong enough to cause significant alarm. After the flight, the pilot reported the vibration to the helicopter’s owner.
On 2 July 2020, the owner of the helicopter flew the helicopter with a passenger back to the industrial estate via Cable Beach. This flight took around 0.3 hours. After landing, the pilot who first felt the vibration approached the helicopter and discussed the problem with the owner who was still at the controls. The owner stated also having felt the vibration and requested the pilot to arrange engineers to look at it.
The two pilots thought the cause of the vibration was uneven application of paint on the tail rotor at the recent periodic inspection, not realising at the time that the tail rotor was not painted at that inspection, and advised the maintenance personnel of their opinion.
Maintenance activities on site
A licenced aircraft maintenance engineer (engineer), a helicopter pilot (maintenance pilot), and an aircraft maintenance engineering apprentice, all from the approved maintenance organisation, travelled to the industrial estate on the afternoon of 3 July 2020. The owner of the helicopter discussed the vibration problem, then departed the site. Neither of the pilots who had experienced the vibration were present during the inspection.
The engineer visually inspected the flex plate, empennage, gearbox, pitch links, and tail rotor assembly, and found no defects. The engineer and apprentice then used electronic dynamic balancing equipment to measure the dynamic balance of the tail rotor. A sensor was fitted to the top right of the cap that covered the seal around the tail rotor drive shaft.
The maintenance pilot started the helicopter, and could not feel any vibration through their feet from the pedals. The engineer leant in and placed their hands on the pedals, and could not feel any vibration.
The system measured the total vibration level of the tail rotor in inches per second (IPS). The helicopter manufacturer’s balance limit was 0.20 IPS. The tail rotor assembly on VH-NBY measured 0.05 IPS, and therefore the engineer did not need to adjust the tail rotor balance.
The maintenance pilot, who ran the helicopter on the ground, assessed the confined area where the helicopter was stored. As access to the site could not be controlled and the security of objects around the site was uncertain, the pilot elected not to fly the helicopter within the confined area. This meant that tail rotor system could not be not assessed for vibration under load.
The engineer sanded a small amount of paint from the tips of the tail rotor and ran the test again, finding no significant change to the balance. The sensor was removed, the original bolt replaced, torqued to specification with a calibrated tool, lock wire applied, and its security independently inspected.
The engineer and apprentice moved the helicopter on ground handling wheels towards its hangar. This required the person steering the helicopter to handle the helicopter by the tail rotor gearbox, output shaft, and the stinger under the vertical fin (Figure 2). Force was required to lever the front of the skids from the ground, and steer the helicopter. Moving the helicopter did not reveal any movement in the tail rotor gearbox or any other unusual signs.
Figure 2: Exemplar ground handling technique
Source: ATSB
The maintenance pilot called the pilot who originally detected the vibration and the owner of the helicopter one after the other at about 1600 on 3 July 2020. The maintenance pilot stated that the pilot who originally detected the vibration and the owner were advised separately that the engineers had not detected a vibration, and the balance of the tail rotor was good. The maintenance pilot also stated that the owner was told that no changes were made to the balance weights, that the helicopter had not been flown, and relayed an instruction from the engineer to conduct a check flight.
Site and wreckage examination
On-site evidence indicated that the engine was producing power at the time of the occurrence, and there were no signs of contact with obstacles. The helicopter displayed no evidence of pre-existing damage to control linkages, and the tail rotor gearbox shafts could be rotated without resistance. All components from the helicopter were found at the accident site. There was no indication of any fire.
Numerous components were recovered for further examination (Figure 3 and Figure 4).
Figure 3: Major components recovered for examination
Source: ATSB
Figure 4: Component fragments recovered for examination
Source: ATSB
The ATSB developed a scope of work for examining the recovered components and determining factors associated with the in-flight failure. Representatives of the aircraft operator, maintenance organisation, Robinson Helicopter Company (the helicopter manufacturer), Civil Aviation Safety Authority, and Western Australia Coroner were invited to observe the disassembly of the tail rotor gearbox at the ATSB’s technical facilities in Canberra, Australian Capital Territory. Due to limitations associated with COVID-19 restrictions, attendance was through a remote video link.
Prior to its disassembly, the tail rotor gearbox was non-destructively X-rayed and exhibited no evidence of internal damage. No definitive results from other examinations are available at this stage.
Flight manual
In section 10 of the R44 pilot’s operating handbook (POH), the manufacturer included the following safety tip:
A change in the sound or vibration of the helicopter may indicate an impending failure of a critical component. If unusual sound or vibration begins in flight, make a safe landing and have the aircraft thoroughly inspected before flight is resumed. Hover the helicopter close to the ground to verify the problem is resolved, and then have aircraft reinspected before resuming flight.
It is not clear whether there were any vibrations present at the time of the accident flight. Nevertheless, the ATSB reiterates its strong endorsement of this advice, and urges any pilot that experiences unusual vibrations through the tail rotor pedals to land as soon as possible and follow the advice in the flight manual (POH).
Meteorological information
At the time of the accident, the recorded weather conditions at Broome Airport were a light wind of 9 kt from the east, good visibility and a temperature of 33 °C.
Further investigation
The ATSB investigation is continuing. Further investigation will include consideration of:
detailed technical examination of the retained components
collection and examination of further components from the aircraft
the helicopter’s construction, assembly, flight and maintenance history
analysis of security and other video files
policies and procedures for maintenance check flights
related occurrences in Australia and overseas.
The ATSB will continue to consult the helicopter manufacturer, accredited representatives from the United States National Transport Safety Board (NTSB), and any other international agency who has encountered related occurrences.
Should a critical safety issue be identified during the course of the investigation, the ATSB will immediately notify relevant parties so appropriate and timely safety action can be taken.
A final report will be released at the conclusion of the investigation.
Acknowledgements
The ATSB would like to acknowledge the significant assistance provided during the initial investigation response by the Western Australia Police Force in recording, securing and maintaining the integrity of the accident site prior to the ATSB team’s arrival.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Based on closed-circuit television (CCTV) footage and an examination of the wreckage, the ATSB investigation into the fatal R44 helicopter accident near Broome Airport on 4 July 2020 has determined that the helicopter experienced an in-flight breakup. The tail rotor gearbox assembly, tail rotor and empennage assembly separated soon after the helicopter lifted off. The fuselage then fell to the ground out of control.
The ATSB has conducted a detailed examination of the entire aircraft at Broome and is transporting relevant components back to Canberra for more detailed examination. These components include the tail rotor gearbox, tail rotor, empennage, tail cone, tail rotor drive shaft, and flight controls. During this process, the ATSB has been consulting with the Robinson Helicopter Company (the helicopter manufacturer), the US National Transportation Safety Board and the Australian Civil Aviation Safety Authority.
Images of the components that separated are provided at the end of this update. The ATSB will not be releasing the CCTV footage due to its potentially distressing nature. The ATSB is providing access to the footage to relevant experts to assist with the investigation.
Additional information
The ATSB has interviewed a pilot who recently flew the helicopter and maintenance personnel who conducted maintenance on the helicopter. It has also obtained copies of the helicopter’s maintenance records and reviewed other documentation. Based on this information:
The R44 Raven I helicopter involved in the accident (serial number 2544) was manufactured in 2018. It was imported new into Australia and was first registered on the Australian civil aircraft register in August 2018.
The helicopter underwent its last periodic (100 hourly) inspection on 4 June 2020, with 286.9 hours total time in service.
A pilot who flew the helicopter on 2 July 2020 to Broome Airport reported feeling unusual vibrations through the tail rotor pedals. He described it as if something was repetitively tapping through the pedals. The pilot of the accident flight also conducted a short flight in the helicopter and confirmed the unusual vibrations.
Maintenance personnel conducted a dynamic tail rotor balance on 3 July 2020 (the day before the accident). The dynamic tail rotor balance was found to be within limits, and the maintenance personnel could not detect any unusual vibration on the ground.
The accident flight was the first flight since the maintenance was conducted. Overall, the helicopter had 291 recorded hours in service.
The Robinson R44 was certified in December 1992 and the R44 Raven I was introduced in January 2000. There are currently 558 R44s on the Australian civil aircraft register.
Further investigation
In the initial phase of its investigation, the ATSB is focussed on examining the wreckage, reviewing the CCTV footage and reviewing potentially related occurrences.
At this stage the reasons for the in-flight breakup are not known. The ATSB will provide further advice when relevant information is available.
Pilot advisory information
The R44 Pilot’s Operating Handbook (POH) includes the following 'safety tip':
A change in the sound or vibration of the helicopter may indicate an impending failure of a critical component. If unusual sound or vibration begins in flight, make a safe landing and have the aircraft thoroughly inspected before flight is resumed. Hover helicopter close to the ground to verify problem is resolved, and then have aircraft reinspected before resuming free flight.
The ATSB strongly endorses this advice and urges any R44 pilot that experiences unusual vibrations through the tail rotor pedals to land as soon as possible and follow the advice in the POH safety tip.
Images of the separated components
The following images show the empennage (Figure 1), the tail rotor gearbox (Figure 2), the tail cone (Figure 3), and the tail rotor (Figure 4).
Figure 1: VH-NBY empennage
Source: ATSB
Figure 2: VH-NBY tail rotor gearbox
Source: ATSB
Figure 3: VH-NBY tail cone
Source: ATSB
Figure 4: VH-NBY tail rotor
Source: ATSB
This update details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. It contains no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
On the evening of 22 June 2020, a Royal Flying Doctor Service, Pilatus Aircraft Ltd. PC-12/47E registered VH‑OWI was conducting a positioning flight from Jandakot to Albany, Western Australia. Approximately four minutes into the descent to Albany Airport in instrument meteorological conditions the pilot observed an airspeed miscompare indication on the left primary flight display (PFD).
Having assessed that a blocked pitot tube was the likely cause of the issue, the pilot elected to climb the aircraft in an attempt to get clear of cloud. During this climb the pilot’s indicated airspeed increased and exceeded the aircraft’s maximum allowable speed. The pilot reported also receiving an overspeed alert at this time and consequently elected to discontinue the planned flight and return the aircraft to Jandakot.
When unable to obtain visual conditions, the pilot elected to descend the aircraft. During this descent the left indicated airspeed reduced to zero, however, no stall warning was activated. At 6,000 ft visual conditions were obtained, however, the turbulence at this level was severe. At this time the pilot observed a heading miscompare on both the left and right PFDs. Due to the severity of the turbulence at 6,000 ft the pilot climbed the aircraft first to 8,000 ft and then 10,000 ft on the return to Jandakot.
The pilot reported that on approach to Jandakot all indications had returned to normal and remained that way until short final when an altitude mismatch and low airspeed warning was identified on the PFDs.
What the ATSB found
The ATSB determined that during the flight, water entered the aircraft’s pitot tube either as rain or an accumulation of moisture from flying through cloud. Due to a blockage in the pitot tube drain the water had been unable to escape. This in turn obstructed the flow of air to the aircraft’s air data attitude heading reference system, resulting in an incorrect airspeed being displayed on the left PFD and triggering miscompare indications on both PFDs.
In addition, a heading miscompare was likely caused by the aircraft’s movement through an area of moderate to severe turbulence during the return to Jandakot.
Finally, the ATSB found that recent training that the pilot had undertaken helped them to identify the erroneous airspeed data.
Safety message
Spurious instrument readings can create a more complex scenario for flight crew than an instrument failure.
In this case the pilot’s recent training assisted in effectively assessing the situation, determining the likely failure mode and identifying the most accurate source of available data for a safe return to the departure airport.
The investigation
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.
The occurrence
At 2122 Western Standard Time[1] on 22 June 2020, a Royal Flying Doctor Service - Western Operations (RFDS), Pilatus Aircraft Ltd. PC-12/47E, registered VH-OWI (OWI), departed Jandakot Airport, Western Australia (WA) for Albany Airport WA, to collect a patient and transfer them back to Jandakot. The pilot, a doctor and a flight nurse were onboard.
At approximately 2150 the pilot commenced a descent to Albany from flight level[2] (FL) 210. About 4 minutes later, while in icing[3] conditions and passing through FL180, the pilot received an airspeed miscompare,[4] indicated by an amber colouration on the airspeed tape on the primary flight displays (PFD).
At this time the pilot reported that there was a light dusting of ice on the leading edge of the aircraft’s wings and on the radome.[5] The pilot did not deem this level of icing to be a concern and did not observe any issues or receive any alerts from the aircraft’s anti-icing systems.
While continuing the descent the pilot compared the airspeeds displayed on the two PFDs with the airspeed indication on the electronic secondary instrument system (ESIS) (Figure 1). Based on the speed readings from the PFDs and the ESIS the pilot determined that the left PFD was likely displaying incorrect information.
As the descent continued, the pilot observed the airspeed on the left PFD continuing to decrease. The pilot reported to air traffic control (ATC) that a blocked pitot tube was the likely cause of the issue and requested clearance for a climb to FL 230. The pilot believed that this altitude would allow them to establish the aircraft clear of cloud and therefore avoid the worst of the icing conditions.
Source: FlightRadar24 and Google Earth, annotated by ATSB
During the climb, the pilot observed the airspeed displayed on the left PFD increasing. This continued throughout the climb with the pilot observing Vmo[7] and Mmo[8] exceedances on the left PFD and receiving audible overspeed alerts from the aircraft’s avionics. Noting that due to this indicated exceedance the aircraft would need to be grounded for inspection, they elected to discontinue the planned flight and return the aircraft to Jandakot (Figure 2).
Climbing through FL 210, on the return to Jandakot, the pilot reported icing conditions and poor visibility and decided to discontinue the climb. In a further attempt to exit the icing conditions and obtain visual reference, the pilot requested a descent to 8,000 ft. The pilot was advised by ATC, who had been in contact with the Bureau of Meteorology (BOM), that this was the approximate lower limit of cloud. On descent the indicated airspeed on the left PFD reduced to zero, however, the pilot did not observe or hear a stall warning. At 8,000 ft, the pilot indicated to the controller that they had not obtained visual conditions and were encountering moderate turbulence. The pilot requested, and was granted, a further descent to 6,000 ft. During this descent the turbulence increased to severe, and consequently the pilot elected to climb the aircraft back to 8,000 ft.
Throughout the descent to 8,000 ft and then 6,000 ft the pilot noted a difference in the heading data as displayed on the left and right PFDs. The pilot observed that this led to a heading miscompare[9] indication on the left PFD, with the letters ’HDG’ appearing in a yellow box at the top of the compass display. The miscompare continued to increase until there was reported 50‑60° of indicated heading difference between the two PFDs. Further, the pilot also reported that during this sequence the left PFD displayed an incorrect attitude, indicating that the aircraft was level when the nose was approximately 3° below the horizon. This was less than the 5° difference required to trigger a pitch miscompare.
The pilot continued to track to Jandakot, at 8,000 ft with a further climb to 10,000 ft. Approaching Jandakot, the pilot reported that all indications for airspeed, heading and attitude had returned to normal and continued that way until the aircraft was on final approach. During the final approach, the pilot reported a 60 ft mismatch in altitude between the left PFD and the ESIS and a low airspeed warning on the left PFD.
The aircraft was landed and taxied back to the RFDS apron without further incident. The pilot then completed the incident log due to the indicated Vmo and Mmo exceedances.
Context
Aircraft information
The PC-12/47E is a single-engine, turboprop, pressurised aircraft, designed and built by Pilatus Aircraft Ltd in Switzerland. OWI was manufactured as serial number 1232 in 2010 and registered in Australia in January 2011. At the time of the occurrence the aircraft had over 12,600 hours in service and 11,100 flight cycles.
The PC-12/47E pitot tubes[10] are fitted with an electric anti-ice system that uses heating elements to prevent ice build-up. The aircraft is also fitted with an alerting system that activates when the temperature is less than 10 °C and there is visible moisture in the air. In addition, if either system is non-operational a warning will be displayed on the crew alerting system. The pilot did not report receiving any alerts related to the anti-icing system and no errors were recorded in the aircraft data provided to the ATSB.
Post‑flight maintenance
Due to the overspeed reported by the pilot the aircraft was grounded for inspection on its return to Jandakot. RFDS personnel examined the aircraft and reviewed the recorded data.
The initial aircraft examination revealed that a small amount of foreign material was blocking the left pitot tube drain. Following removal of the pitot tube, this material, and a small amount of water, was expelled using compressed air. The composition and source of the material could not be determined as it was not retained for further analysis.
The pitot static and anti-ice systems were inspected, and relevant checks were conducted in accordance with the aircraft’s maintenance manual requirements. No further defects were identified, and the aircraft was returned to service.
The data review performed by RFDS maintenance personnel determined that the overspeed was an instrumentation issue and the aircraft had not actually exceeded its Vmo or Mmo limits. However, several data anomalies were identified. The aircraft was returned to service and RFDS maintenance personnel sent relevant data to the avionics manufacturer for further assessment. The manufacturer identified a number of instances of miscompare in the data. They recommended that the air data attitude heading reference system (ADAHRS) unit be replaced and returned for more detailed examination (see the section titled ADAHRS examination).
Pre-flight inspection procedure
The PC-12/47E standard pre-flight checks required a check of the pitot probes. The requirement was for the pitot cover to be removed and for the pitot tube to be ‘Checked’. There was no stated requirement for the pitot drain to be checked for obstruction.
The operator advised that they had no additional specific requirements relating to the pitot inspection. They advised that the pitot drain hole is visible during the pre-flight inspection, however, a blockage would not be easily identified unless it was external to or protruding from the drain.
Meteorological information
At 1843 on the evening of the incident the Bureau of Meteorology (BOM) issued a SIGMET[11] for severe icing conditions between 1900 and 2300 over a large portion of south‑west WA, for altitudes between 8,000 ft and FL190 (Figure 3). The conditions were predicted to move to the east at approximately 30 kt throughout the forecast window.
A grid point wind and temperature forecast was issued by BOM at 1417 on the day of the incident. The forecast indicated that from 2000, temperatures between Jandakot and Albany would drop to or below 0o C between 7,000 and 10,000 ft.
The relevant graphical area forecasts (GAF) indicated the potential for showers of rain and moderate turbulence. In addition, isolated thunderstorms were forecast with associated severe turbulence and icing.
The terminal area forecasts (TAF) indicated the likely presence of severe turbulence below 5,000 ft at both Jandakot and Albany from the start of the flight reducing to moderate at Jandakot by 2200.
Figure 3: Overlay of SIGMET identified icing area
Source: Bureau of Meteorology and Google Earth, annotated by the ATSB.
Recorded data
The ATSB was provided with aircraft maintenance files (ACMF) data which recorded a range of aircraft parameters for multiple flights, including the incident flight. Only the data feed to the left PFD was recorded. Figure 4 shows the aircraft’s calibrated airspeed[12] and altitude for the incident flight. Also shown on the plot is a red line indicating the Vmo speed of the aircraft.
The indicated airspeed, displayed to the pilot, is calculated by comparing the dynamic air pressure, sensed through the pitot tube, on the aircraft’s wing, with the static air pressure sensed at the static ports on the aircraft’s tail. A blockage of the pitot tube will cause the pressure in the tube (dynamic air pressure) to remain constant while static pressure changes with altitude. This will cause the indicated airspeed to over read during a climb and under read during a descent.
Figure 4: Recorded aircraft altitude and airspeed
Source: ATSB
Air data attitude heading reference system
OWI was fitted with a Honeywell KSG7200 air data attitude heading reference system (ADAHRS). The ADAHRS unit reads data from a range of sensors and inputs throughout the aircraft including aircraft attitude, GPS, magnetometer, air pressure and temperature.
The processed data is then displayed on the relevant PFD. The system consists of two separate units, channel A taking inputs from the sensors on the left of the aircraft for display on the left PFD and channel B, which receives inputs from sensors on the right of the aircraft for display PFD (Figure 5).
Figure 5: ADAHRS unit system schematic
Source: Pilatus, annotated by the ATSB.
The unit has two systems detecting anomalies between channel A and B data. The first system monitors and reviews the input data from the two sources. It identifies differences that fall outside of a certain threshold, flagging these in the maintenance fault log as miscompares for later action by maintenance personnel. This information is not visible to the flight crew.
The second system monitors and reviews the data being displayed on the PFDs. It identifies differences that fall outside of a certain threshold and flags these visibly on the PFD’s for the flight crew. In the case of an identified difference, if the crew identify which data source is incorrect (channel A or B), both PFDs can be selected to the same valid data source.
ADAHRS examination
The ADAHRS unit examination at the manufacturer’s facility did not identify any faults with channel A. Three parameters were identified within the fault log as having miscompared in the manufacturers review, these were pitot pressure, heading and total air temperature (TAT). The pitot pressure miscompare was identified as corresponding with the pilot’s report. The recorded heading miscompare, while significantly smaller than that reported by the pilot, aligned with the timing reported by the pilot. The TAT miscompare that was identified was not deemed to be an issue as TAT data is not used in any calculations within the ADAHRS unit and is not displayed on either PFD.
Crew comment
The pilot advised the ATSB that one of the key things that assisted them in working through the incident was training they had undertaken as part of an operational proficiency check (OPC). As part of the OPC, carried out about a month before the incident, the pilot, under the guidance of a check and training pilot, observed the aircraft’s performance at various engine power setting and aircraft attitude combinations. Their assessment was that this check flight had given them more confidence in the assessment that it was likely a pitot tube blockage and that the right PFD and ESIS were showing the correct information.
Analysis
Pitot tube blockage
Foreign material identified after the occurrence in the left pitot tube drain likely prevented water draining effectively. Consequently, water that entered the pitot tube during flight either as the aircraft was flying through rain, or as water vapour condensing in the tube as it flew through cloud, probably accumulated and blocked the pitot tube.
Both the weather forecasts and the pilot’s report indicate that the aircraft was operating in icing conditions at the time the miscompares and spurious warnings were received. However, as the pitot tubes were fitted with an anti-icing system and the aircraft data indicated that the system was operational anytime the aircraft was operating below 10 °C with visible moisture, it was unlikely that icing contributed to the blockage.
The result of this blockage was that air was unable to flow freely through the pitot tube artificially changing the dynamic pressure recorded by channel A of the ADAHRS unit.
Airspeed miscompare
The incorrect air pressure being fed into the ADAHRS unit from the blocked pitot tube resulted in the airspeed displayed on the left PFD being incorrect. The airspeed over read during climb and under read during descent. The miscompare monitoring functionality of the ADAHRS unit identified the difference between the two displayed airspeeds, triggering miscompare indications on the PFDs.
The manufacturer’s inspection and analysis of the ADAHRS ruled out any technical issues with channel A of the unit causing the erroneous data.
Heading miscompare
Following the airspeed miscompare indication, the pilot detected, and the aircraft’s fault log showed, a heading miscompare. Based on the review of the data and the results of the ADAHRS unit examination no technical reason for the miscompare could be determined.
The miscompare occurred during the aircraft’s descent into increasing turbulence. Based on advice from the avionics manufacturer it is likely that the motion of the aircraft in turbulence caused the unit to miscompare. When the aircraft climbed from 6,000 ft, and exited the worst of the turbulence, the pilot reported that the heading data returned to normal.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the unreliable airspeed indication involving Pilatus PC-12/47E, VH-OWI which occurred on descent to Albany Airport, Western Australia on 22 June 2020.
Contributing factors
Water trapped in the left (pilot’s) side pitot system by a blocked pitot drain likely obstructed the airflow through the pitot lines during the flight. This resulted in inaccurate dynamic air pressure information being received by channel A of the air data attitude heading reference system.
Incorrect air pressure data received by channel A of the air data attitude heading reference system resulted in the calculation and display of false airspeed data on the left primary flight display. This triggered an airspeed miscompare, erroneous alerts and resulted in the pilot returning to Jandakot.
Other findings
The heading miscompare detected by the pilot was likely a result of the movement of the aircraft through moderate to severe turbulence.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
pilot of VH-OWI
Bureau of Meteorology
aircraft operator/maintainer and avionics manufacturer.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
pilot of VH-OWI
Bureau of Meteorology
aircraft operator/maintainer and avionics manufacturer.
Submissions were received from:
Bureau of Meteorology
avionics manufacturer.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 15 June 2020, wagon RKOX4055Y was unloaded at the BlueScope Steel Coopers Plains facility, south of Brisbane, Queensland. The forklift operator experienced difficulty unloading the welded beams and sought assistance from a second forklift operator. Footage from security cameras within the Coopers Plains facility showed the corner of wagon RKOX4055Y lifting during the unloading before dropping back down.
Following unloading, wagon RKOX4055Y was shunted and attached to other wagons to form train 2BW4. This train underwent a full train examination and departed Brisbane bound for Port Kembla, New South Wales.
At around 0430 on 16 June, station staff at Grafton found damage to the platform. Train 2BW4 was identified as passing through Grafton and the train crew were directed to inspect their train at Kempsey. The inspection did not identify any faults with wagon RKOX4055Y and the train continued.
At 1040, workers at Dungog noticed a wagon on train 2BW4 contact the platform. The train was directed to stop at Wallarobba. On inspection, the wagon body on RKOX4055Y was found to have dislodged and was resting on the bogie. Wagon contact damage was also found on, Coffs Harbour, Taree, Wingham and Dungog platforms. There were no injuries as a result of the occurrence.
What the ATSB found
During the unloading of wagon RKOX4055Y the wagon body was likely lifted off the centre pin and dislodged as the load became stuck. The forklift operators did not notice that the wagon body had lifted and continued unloading other wagons. The underframe of train 2BW4 was not inspected as required by Pacific National’s train examination procedure. The likely dislodged wagon body was not identified and train 2BW4 departed with a rolling stock irregularity.
During the journey to Port Kembla, further inspections occurred after reports of platform damage were made by station staff. The out of gauge wagon was detected when the train crew inspected the train at Wallarobba.
Additionally, the risk of a wagon lift off event had not been identified or controlled by BlueScope Steel or Pacific National.
What has been done as a result
Following the occurrence BlueScope Steel and Pacific National completed the following actions:
Communicated the details of the occurrence and contributing factors to the unloading and maintenance personnel.
Revised the unloading procedure to include the risk of lift off events and reinforced the requirement to unload welded beams from both sides.
Reviewed the safety interface agreement and risk assessments to ensure all risk controls were current and included the risks associated with lift off events.
Safety message
Procedures and practices for loading and unloading rolling stock must ensure risks are identified, controlled and that the practices do not affect the safe operation of rolling stock.
Maintenance inspection regimes must be completed in accordance with engineering practices to identify conditions that might contribute to accidents.
The investigation
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.
The occurrence
On 15 June 2020, a total of 14 loaded steel wagons were shunted into the BlueScope Steel (BSS) Coopers Plains facility,[1] south of Brisbane, Queensland.
At around 0600,[2] a forklift operator began unloading wagon RKOX4055Y which had a load of three stacks of welded beams.[3] The forklift operator had difficulty unloading the welded beams and made a number of attempts to move and lift the beams. The operator unloaded two of the three stacks and sought assistance from a second forklift operator as the last stack of beams had become stuck. The last stack was lifted from the wagon using both forklifts. Unloading then continued on other wagons.
Once unloaded, the wagons were shunted and attached to other wagons to form Pacific National (PN) train 2BW4. Train 2BW4 consisted of three locomotives and 53 wagons which underwent a full train examination without incident.
Train 2BW4 departed the Brisbane Freight Terminal (BFT) around 2145, bound for Port Kembla, New South Wales (NSW) (Figure 1). A roll-by inspection[4] was completed on departure with no abnormalities detected.
At 0222 on 16 June, train 2BW4 passed through Grafton station and Coffs Harbour station at 0343. NSW Trains station staff identified damage to Grafton station platform at around 0430. This was reported to the network controller and the train crew of 2BW4 was directed to inspect their train on arrival at Kempsey.
At around 0615 a roll-by inspection was performed by one of the train crew as train 2BW4 entered the loop line at Kempsey. The driver then walked along the opposite side to inspect the train. A couple of loose straps were found on some wagons which were rectified and 2WB4 departed Kempsey.
A crew change was performed south of Taree station with the outgoing train crew performing a roll-by inspection. Following this the train continued the journey.
As train 2BW4 passed through Dungog platform at 1040, nearby workers noticed that a wagon on 2BW4 made contact with the platform. Network control was advised and train 2BW4 was diverted into the loop at Wallarobba for inspection.
The train crew inspected the train and identified that the wagon body on the 35th wagon (RKOX4055Y) was detached and resting on the bogie bolster at the A-end of the wagon. The bogie had shifted towards the middle of the wagon with the centre bearing sitting forward of the centre plate (Figure 2). It was the trailing bogie on the wagon. Two huck bolts[5] from the centre bearing mount were sitting within centre plate, limiting further movement of the bogie.
Arrangements were made to remove wagon RKOX4055Y from the consist and the wagon was recovered the following day.
Minor damage was found on Grafton, Coffs Harbour, Taree, Wingham and Dungog platforms believed to be a result of contact with the detached wagon RKOX4055Y. Closed-circuit television (CCTV) footage from Coffs Harbour, Taree and Dungog showed this wagon contact the platforms with dust, smoke and sparks visible (Figure 1).
Figure 1: Train path 2BW4 and platform footage of wagon RKOX4055Y
Map showing the path of train 2BW4 and platform locations. Footage from Taree and Dungog platforms inset showing wagon RKOX4055Y contacting the platforms.
Source: Geoscience Australia and Sydney Trains, modified and annotated by OTSI
Figure 2: RKOX4055Y A-end bogie detached
Image showing the bogie as found with inset image showing the centre bearing from the opposite side.
Source: Pacific National, modified and annotated by OTSI
Context
Wagon and bogies
Wagon RKOX4055Y was a bulk steel wagon with tare mass of 27 t and a maximum capacity of 50 t. The wagon body had three openings along the side walls to allow access for loading and unloading (Figure 1 – Taree platform footage). Timber dunnage[6] (blocks) was positioned horizontally (side wall to side wall) along the base of the wagon to support loaded material. If there are gaps between the dunnage and side wall loads can become stuck.
Each end of the wagon rested on a bogie with the centre bearing, centre plate and centre pin permitting bogie rotation. Seated correctly the bogie maintains the gauge of the rolling stock within the kinematic outline.[7] The mass of the wagon body retains the bogie in position.
The design of the wagon body and bogie interface makes them susceptible to lifting if a load becomes stuck and can lift off the centre pin. Lift off events do occur periodically.
Loading
BSS Port Kembla (NSW) loaded wagon RKOX4055Y on 13 June 2020 with three stacks of welded beams totalling 48 t.
PN required loading to be completed in accordance their freight loading manual (Fabricated Steel (Welded Beam) Sections – Web Horizontal, FLM 05-19_09). This specified the minimum requirements for loading including:
welded beams are loaded with the web[8] horizontal
inspection of dunnage, including gaps between dunnage and wagon side wall
load is distributed evenly as possible (horizontally and longitudinal).
Welded beams are not required to have restraints securing the load due to their length and mass.
Unloading
BSS unloading procedure (Rail SOP Rail Wagon Discharge, QLD-PR-T-008) required welded beams to be unloaded from both sides to maintain weight distribution (prevent leaning or tipping of the wagon). If both sides could not be accessed the rail coordinator was to be notified to allow for appropriate arrangements to be organised.
It was common practice to unload welded beams from one side in the same manner as other wagons. On the morning of the occurrence, there were wagons positioned on the adjacent road preventing access to both sides of wagon RKOX4055Y and this wagon was unloaded from one side only.
The unloading was conducted pre-dawn under artificial lighting within the BSS facility and the forklifts had additional lighting to assist with visibility during loading or unloading.
Both forklift operators had approximately 20 years’ experience unloading rail wagons. The forklift operators reported that welded beams could be difficult to unload if the welded beams were placed close together, touching or if the beams fell between the dunnage and side wall.
Train examination
Prior to departure PN required trains to undergo a full train examination in accordance with Train Inspection Manual’s (TIM 01-01_03 and TIM 01-02_04). These manuals specified the inspection requirement for the mechanical integrity (including underframe and bogie centre pin interface), load security and brake system and brake testing.
The full train examination was performed by two terminal operator personnel who held the required qualifications. One had 16 years’ experience and the other 27 years’ experience.
Interface agreement
PN and BSS had a safety interface agreement (SIA) as required by the rail safety national law (RSNL). The purpose of interface agreement was to:[9]
identify and assess risks that may arise from operations at the interface
determine measures to manage those risks
establish the processes for the evaluation, testing and where necessary, revision of those measures
identify how each party will monitor compliance with its obligations under the agreement
define the roles and responsibilities of each party to the SIA
establish a process for keeping the SIA under review.
Safety analysis
Wagon RKOX4055Y was unloaded from one side and the forklift operator had difficulty unloading the beams. The BSS unloading procedure did not address loads that became stuck. The operators attempted to free the load using two forklifts, as the last stack of beams (approximately 15 t) became stuck between the dunnage and the side wall of the wagon. While attempting to lift the beams, the A-end of the wagon was likely lifted off the centre pin (Figure 3). Footage from the BSS Coopers Plains facility showed the corner of wagon RKOX4055Y lift before being placed down again. Neither forklift operator identified the likely lift off event and dislodged wagon body.
Figure 3: Unloading wagon RKOX4055Y
The upper diagram shows the unloading of wagon RKOX4055Y with the welded beams stuck between the dunnage (blue) and the wagon side walls. The lower diagram shows the wagon body and centre bearing lift off the centre pin (green) during attempts to lift the beams. Screenshots from CCTV footage showing the corner of RKOX4055Y lifted before being placed down.
Source: Pacific National footage, diagrams and annotation by OTSI
Unloading welded beams from one side likely increased the risk of a wagon lift off event, in particular, if the last stack of beams become stuck. At that point, the mass of the load is at the lightest and the capacity of a single forklift (35 t) could lift the wagon body and load.
Following the unloading, wagon RKOX4055Y was shunted to form train 2BW4. The train underwent a full train examination by PN two terminal operators. The personnel conducting this inspection did not inspect the underframe of the wagons on 2BW4. The deviation from the train examination procedure had not been identified through PNs compliance monitoring prior to the occurrence. It is likely that the dislodged wagon body on RKOX4055Y would have been identified if the underframe was inspected as required.
A roll-by inspection was completed as train 2BW4 departed the BFT. There were two additional roll-by inspections during the journey. These inspections did not identify the likely dislodged wagon body on RKOX4055Y. The manner in which the wagon body rested on the bogie would make it difficult to identify there was a rolling stock irregularity. Additionally, there were only minor scrape marks on the A-end of wagon RKOX4055Y which could be missed when inspecting three locomotives and 53 wagons (1099 m long).
The inspection of 2BW4 at Kempsey following reports of platform damage at Grafton was conducted pre-dawn. The inspection identified loose strapping which was corrected but found no faults with wagon RKOX4055Y.
The risk of a lift off event had not been identified or controlled within the SIA or within the BSS unloading procedure. The monitoring associated with the SIA and BSS unloading practices had not identified that wagons were being unloaded from one side only.
The risk controls preventing rolling stock entering service after a lift off event were:
unloading personnel detecting the lift off event and reporting it.
Terminal operators or maintenance personnel identifying the rolling stock irregularity prior to departure.
roll-by inspections on departure and during the journey.
The two forklift operators reported that neither had experienced a lift off event prior to the occurrence and unaware what to look for. The PN terminal operator personnel did not inspect the underframe of 2BW4 as required and the roll-by inspections were ineffective at detecting the rolling stock irregularity.
In this instance, the wagon body was partially restrained by the huck bolts resting within the centre plate. The A-end of wagon RKOX4055Y travelled intermittently out of gauge for approximately 739 km in a trailing direction, likely reducing the consequences of this occurrence. On each occasion the wagon body contacted an obstruction such as a platform, the wagon body glanced rather than catching the obstruction.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the out of gauge wagon on freight train 2BW4 on 16 June 2020.
Contributing factors
The body on wagon RKOX4055Y was likely lifted and dislodged during unloading of the wagon as the welded beams had become stuck. The dislodged wagon body was not identified at the time of unloading, during subsequent inspections prior to departing as 2BW4 or during the journey.
The underframe of train 2BW4 was not inspected prior to departing the Brisbane Freight Terminal as required by Pacific National's train examination procedure.
The risk of a wagon lift off event and potential consequences had not been identified or controlled in the Pacific National and BlueScope Steel safety interface agreement or within BlueScope Steels unloading procedure.
Other factors that increased risk
Wagon RKOX4055Y was unloaded from one side contrary to the requirements of the unloading procedure, likely increasing the risk of a lift off event.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
BlueScope Steel
BlueScope Steel advised that the following safety actions was taken:
The requirement to unload welded beams from both sides was reinforced with terminal personnel.
Unloading procedure (SOP QLD-PR-T-008) was reviewed to ensure appropriate controls are in place and to highlight the risk of a wagon lift off event.
Lift off events were included into BlueScope Steels incident management system as a reportable incident.
Pacific National
Pacific National advised that the following safety action was taken:
Communicated the occurrence and contributing factors to the BFT terminal operators and maintenance personnel and reinforced the requirement for underframe inspections prior to trains departing the terminal.
Required BFT terminal operators and shunting personnel to undertake an underframe inspection on each wagon before shunting from the BlueScope Steel Coopers Plains facility.
Reviewed the safety engagement schedule to include engagements relating to full train examinations at BFT.
Reviewed the verification of competency (VOC) assessments at BFT for full train examinations by driver trainers and train crew including inspection of the wagon body and bogie interface.
Pacific National also advised that an engineering review is currently underway to review the design of the RKOX wagons to prevent welded beams becoming stuck between the dunnage and wagon side wall.
Pacific National and BlueScope Steel
In addition to the above, the following combined actions were undertaken:
Reviewed the Wagon Corrective Action Report (WCAR) process to include wagon lift off events as a defect requiring attention.
Reviewed the safety interface agreement and risk assessments to ensure all risk controls are current and include risks associated with lift off events.
Routine combined audits to be established to assess the effectiveness of the risk controls as per the safety interface agreement.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
BlueScope Steel
BlueScope Steel Coopers Plains forklift operator
Office of the National Rail Safety Regulator
Pacific National
Transport for NSW
Submissions were received from:
Office of the National Rail Safety Regulator
Pacific National.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 16 March 2020 a Bombardier DHC-8-402 registered VH-QOE, departed Jacksons International Airport, Port Moresby, Papua New Guinea. Shortly after take-off, the flight crew detected fumes in the cockpit. Passing FL 100 on climb, the fumes became stronger and the cabin crew also reported detecting a fume smell in the cabin.
The flight crew donned oxygen masks and levelled off at FL 180. The first officer then made a PAN call and requested a return to Port Moresby. After switching off the number one bleed air, as per the quick reference handbook for smoke and fumes, the flight crew observed smoke emanating from the air vents. The crew switched off the number 2 bleed air and depressurised the cabin once the aircraft had descended below FL 100, and the smoke dissipated.
The Papua New Guinea Accident Investigation Commission (AIC) investigated the incident and requested assistance from the Australian Transport Safety Bureau (ATSB).
To facilitate this work the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.
The ATSB has now concluded its involvement in the investigation.
The AIC is responsible for and will administer the release of the final investigation report into this incident.
This investigation was conducted under the Transport Safety Investigation Act 2003 (Commonwealth) by the Office of Transport Safety Investigations (NSW) on behalf of the ATSB in accordance with the Collaboration Agreement. Released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Safety summary
What happened
On the evening of 3 June 2020, two Aurizon banking locomotives assisted a loaded coal train, WH512, up the Ardglen bank in the Hunter Region of New South Wales (NSW). On completion of the banking assist at Ardglen yard, the train crew prepared the lead locomotive 5031 to become the trailing locomotive, then transferred to locomotive 5034.
The two banking locomotives started to move while the train crew were walking from 5031 to 5034. The train crew boarded 5034 and attempted to take control of the locomotives without success. As the locomotives rolled back down the Ardglen bank, the train crew attempted to stop the locomotives with a series of brake applications. The locomotives reached speeds of up to 114 km/h before derailing and overturning on their side and coming to rest 13 m apart.
The train crew sustained minor injuries in the crash and were able to exit the cabin. The locomotives were significantly damaged and approximately 100 m of rail track was also damaged.
What the ATSB found
During the process of changing ends, the driver likely depressed the Independent Brake Handle accidently, at the same time as placing locomotive 5031 into Trail Cut-out mode. This released the automatic air brake application on both locomotives.
The park brakes were ineffective in holding the locomotives on the grade at Ardglen and the banking locomotives started to roll away after the train crew left the cab of locomotive 5031. The train crew were then unable to establish control once the locomotives started rolling and the banking locomotives rolled approximately 3 km before derailing at 366.529 km near Kankool.
Aurizon did not ensure that the train crew had a consistent understanding of how to safely change ends on banking locomotives. Further, the train crew had not been trained to use the forced lead function which would have likely allowed the train crew to regain control of the locomotives.
Aurizon had not fully considered emergency egress from a locomotive overturned on its side. This increased the risk of further injury to the train crew and could also have prevented emergency services accessing personnel within the locomotive in a timely manner.
What has been done as a result
Aurizon completed their internal investigation and advised the following actions were commenced and completed to prevent recurrence:
Completed modifications on the locomotive classes involved in the derailment to improve alignment in the braking system, resulting in improved park brake force.
Modified the procedure clarifying steps for changing ends and when to use forced lead function and monitoring the correct application of the procedure through regular analysis of locomotive downloads.
Developed training resources to enable more effective training in emergency situations.
Safety message
Rail transport operators should ensure, parking brake systems on locomotives are effective, regularly inspected and maintained. Their safety management systems should contain operational work instructions with sufficient detail on how to carry out safety critical tasks, such as forced lead function. Additionally, rail transport operators’ competency management systems should assess all safety critical competencies, including emergency operational instructions and emergency egress and ensure train crew are trained and assessed.
The occurrence
Preparation of locomotives and banking operation
At approximately 1750[1] on 3 June 2020, the two-person train crew (driver A and driver B) arrived at Chilcotts Creek siding and commenced preparing the banking locomotives[2] (5031 and 5034) for the planned assist of train WH512 up the bank between Chilcotts Creek and Ardglen in the Hunter Region of NSW.
Driver A prepared locomotive 5031 and driver B prepared locomotive 5034. Driver B joined driver A on locomotive 5031 after preparing locomotive 5034. Driver A then attempted to move the locomotives under power and noticed they were not moving as easily as they should have.
Driver B then got back down from the cab and checked the brakes on locomotive 5034. Driver B found the park brake on 5034 number 2 bogie was not releasing. The train crew cycled through applying and releasing the park brake in an attempt to make it release.
Driver B contacted the Rollingstock Defect Coordinator (RDC) to help resolve the sticking park brake. Driver B and the RDC worked through the problem and resolved the issue by manually releasing the park brake. Driver B then returned to locomotive 5031 and updated the locomotive 5034 logbook writing down the park brake issues experienced on number 2 bogie.
At approximately 1910, train WH512 arrived at Chilcotts Creek and stopped in the loop at signal CC12L. After receiving confirmation of the train being stopped, Network Control (NC) authorised the banking locomotives to depart Chilcotts Creek engine siding.
Driver A moved the banking locomotives to the rear of WH512. The train crew undertook a test attach/detach of the banking locomotives to the rear of train WH512 and conducted an independent brake test on locomotive 5034 to confirm it was operational. Both attach/detach and the independent brake were verified as working.
Between 1918 and 1945, WH512 was assisted up Ardglen bank by banking locomotives 5031 and 5034. The banking locomotives stopped prior to signal 09-12M on the main line at Ardglen and WH512 continued its trip in the Up[3] direction towards Newcastle.
Driver A recalled reducing the power on the banking locomotives from notch 8 to notch 4 to allow the banking locomotives to come away from the rear of the train WH512.
At 1946 driver A applied the independent brake on locomotive 5031 to bring the locomotives to a stop.
Changing ends of banking locomotives
Driver B told driver A that locomotive 5031’s park brakes were on and driver A said that they turned to see the lights indicating the park brakes were on. Driver A then started the process of changing 5031 from the Lead locomotive to the Trail locomotive.[4]
Driver A firstly moved the throttle/dynamic brake handle to idle and the reverser handle to neutral. They then moved the automatic brake handle to the Handle Off (HO) position which activated the Electronic Brake Valve (EBV) to release the air pressure in the train brake line to zero.
When the air pressure had dropped to zero, driver A turned the locomotive headlights off and released the independent brakes. Driver A then used the locomotive Smart Display Interface Screens (SDIS) to place locomotive 5031 into Trail Cut-out mode which electronically isolated the EBV and the independent brake. After completing this task Driver A stepped off locomotive 5031 and started to walk towards locomotive 5034. Earlier, Driver B had exited the cabin and made their way towards the hut to activate the level crossing.
Runaway and derailment
At 1948, with both drivers outside the locomotive and in the process of changing ends, the banking locomotives began to slowly roll in the Down direction back towards Chilcotts Creek. Driver A had just reached locomotive 5034 when they noticed the locomotives slowly moving. Driver A called out to driver B, and driver A then boarded the moving locomotive and got into the driver’s seat. Driver B boarded locomotive 5034 shortly after.
Figure 1: Runaway
This figure shows the path of the runaway and the speed of the locomotives as they progressed from Ardglen towards Kankool.
Source: SIX maps and ARTC trip report, modified by OTSI
Driver A attempted to activate locomotive 5034 as the Lead locomotive using the SDIS but the screen did not respond. Driver A pressed the vigilance reset button and turned the locomotive headlights on.
Driver A then moved the automatic brake handle from the HO position into the service zone, which had no effect in stopping the locomotives. The locomotives had increased speed to approximately 6 km/h. Driver B also attempted to activate locomotive 5034 as the Lead locomotive on the SDIS screen but could not get the system to acknowledge commands.
Driver B told driver A to apply the emergency brake, then driver B leaned across driver A and placed the automatic brake handle into emergency but this had no effect in stopping the locomotives. Driver B sounded the horn as the locomotives passed the level crossing, one minute and 45 seconds had elapsed from when the locomotives started to move and they were travelling at approximately 29 km/h.
At 1950, Driver B made an emergency call to Network Control and reported that they were a runaway train. The Upper Hunter Network Control Officer (NCO) asked for clarification of their situation. Driver B remained in communication with the NCO over the next 2 minutes.
Driver A moved the automatic brake handle to the release position, the locomotives were travelling at approximately 73 km/h. Driver A moved the automatic brake handle to the emergency position again but there was no effective application of the brakes. Driver B was still on the radio with the NCO and reported they had no effective brakes and were travelling at 87-88 km/h. The NCO confirmed that the track ahead was clear through to Chilcotts Creek.
About four minutes had elapsed and the locomotives were travelling at approximately 114 km/h when the data logger on locomotive 5031 stopped recording at 1952. At the same time, Network Control observed the locomotives disappear from the Phoenix display[5]. The locomotives had derailed.
The NCO attempted to contact the train crew two times unsuccessfully. On a third attempt, the train crew responded advising the NCO that the banking locomotives had tipped over on their side and come to rest.
Driver B reported that they were okay and were trying to get out of the locomotive cabin. They also made a call to Aurizon Control to inform them of their situation.
The locomotives had derailed at 366.529 km by overturning to their left side and parting in the process, sliding along the ballast, before coming to rest approximately 13 m apart at 366.619 km.
Post derailment and recovery
Driver A attempted to push the front windscreen of the locomotive open but was unsuccessful. As the locomotive was lying on its left side, the designated emergency escape was through the open side window on the right side of the cabin, which was now approximately 1.2 m above head height. Driver B managed to climb up and out of the cabin and driver A followed shortly after.
When driver B exited the cabin, they made another phone call to the NCO to advise them they were out of the locomotive cabin and was informed by the NCO that NSW ambulance and Fire and Rescue NSW personnel were on their way.
Driver A heard fluid leaking and smelt diesel fuel and found it was coming out of locomotive 5031. Driver A was able to locate a rag and stem the flow of the fuel until emergency services could arrive.
At approximately 2030 emergency services arrived. The train crew were treated for their injuries which included bruising to the left elbow and a cut to the head of driver A and injury to the right ear and other cuts and abrasions to driver B.
Both locomotives sustained significant damage and approximately 100 m of rail track was damaged as a result of the derailment.
Kankool is a locality in the Hunter Region of NSW approximately 200 km north-east of Newcastle. The banking locomotives derailed and came to rest approximately 2 km from Kankool.
Figure 3: Location map
Source: Geoscience Australia, modified by OTSI
Ardglen bank
The section between Chilcotts Creek and Ardglen is where WH512 required assistance from the banking locomotives. This section of track is more commonly referred to as the Ardglen bank and freight services generally require banking locomotives to assist them up the hill towards Ardglen.
The ruling grade[6] on the Ardglen bank between Ardglen and Kankool is 1:40, between Chilcotts Creek and Kankool the ruling grade is 1:38 (Figure 4).
Figure 4: Ardglen bank
This figure shows the gradient between Chilcotts Creek and Ardglen. Figure is not to scale.
Source: ARTC NSW Curve and Gradient Diagrams: Section 1 – North and Hunter Valley, modified by the OTSI
Organisations
Australian Rail Track Corporation
The Australian Rail Track Corporation (ARTC) was the rail infrastructure manager. ARTC was an accredited operator[7] and since September 2004 held a 60-year lease of the interstate and Hunter Valley rail lines of NSW.
Aurizon
Aurizon was the rollingstock operator responsible for WH512 and the banking locomotives that assisted WH512 up Ardglen bank. Aurizon (previously known as QR National) was also an accredited operator and has had above rail operations in the Hunter Valley since 2005. QR National was rebranded Aurizon in December 2012.
Environmental information
Weather observations from Murrurundi Gap Station (approximately 6 km south-east from Kankool) recorded the temperature at 3 pm at 11.5 °C. There had been no recorded rain on the day and 1.2 mm was recorded the day before.
The first light at Ardglen was at 0623 and the last light was at 1727. The incident occurred at 1750, in darkness.
The Ardglen Yard is open with good visibility. The ARTC curve and gradient diagram (Figure 4) indicates the rail line is on a 1:147 grade prior to the Ardglen tunnel entry. The diagram also indicates the rail line through the yard is on a 1:107 grade and transitions to a 1:44 grade.
Train crew
The train crew both worked from the Quirindi depot.
Driver A
Driver A had been a train driver with Aurizon since September 2012 working in Central Queensland and NSW. Driver A joined the Quirindi depot in February 2017. Driver A had acquired the Aurizon competency as a main line driver prior to joining Quirindi depot and qualified for the relevant Aurizon accreditation to undertake banking operations on 26 August 2017.[8]
The roster for driver A in the week prior to the incident is shown in Table 1.
Driver B had transferred to Quirindi depot from Antiene in September 2019. Driver B was the co-driver or second qualified driver on the locomotives. Driver B had acquired the Aurizon competency as a main line driver in May 2019 and qualified for the relevant Aurizon accreditation to undertake banking operations on 12 May 2020.
The roster for driver B in the week prior to the incident is shown in Table 2.
Table 2 Actual duty times for driver B
Date
Duty start
Duty end
Duty time
Time off
28 May 2020
2045
0600
9:15 hours
15:00 hours
29 May 2020
2100
0755
10:55 hours
30 May 2020
Break (from day shift to night shift)
16:05 hours
31 May 2020
0000
0620
6:20 hours
27:40 hours
1 June 2020
1000
1715
7:15 hours
18:00 hours
2 June 2020
1115
1620
5:05 hours
20:10 hours
3 June 2020
1230
Incident occurred at 1948
Based on the duty times worked by the train crew and the time the incident occurred, fatigue was not considered a contributing factor.
Rollingstock information
Locomotives
Both locomotives (5031 and 5034) involved in the incident were 5020 class locomotives (Standard Gauge, 180 tonne, 3184 kW tractive power, model C44acHi). The locomotives were built in 2010 by United Group Limited (Rail) at Chullora NSW.
The locomotives were set up to run as an end-to-end configuration which allowed the locomotives to be operated from the front cabin of whichever locomotive was in the Lead for the direction of travel (Figure 5).
Figure 5: Banking locomotives
This figure shows the end-to-end setup of the banking locomotives. Locomotive 5034 faced the Up direction.
Source: C44acHi Locomotive Vol.1 Rev 00 Operator’s Manual, modified by the OTSI
The Air Brake System
FastBrake® Electronic Air Brake is a microcomputer based electro-pneumatic braking system developed by Wabtec Corporation. It is the braking system used on the 5020 class locomotives.
The system consists of two major components, the Electronic Brake Valve (EBV) and the Pneumatic Operating Unit (POU).
Electronic Brake Valve
The EBV consists of two handles that are used to operate the locomotive and train air brake system. The handles are the Automatic Brake and Independent Brake.
Figure 6: Electronic Brake Valve
This figure shows the EBV, with the Automatic Brake Handle in HO position and the Independent Brake Handle in REL position. This is the positioning the handles should be in when a locomotive is set up as a Trail unit
Source: OTSI
Automatic Brake Handle
The Automatic Brake handle is used to apply brakes to a consist that is being hauled by the locomotive. The Automatic Brake handle operates through six control positions:
1. Release (REL) 2. Minimum reduction (MIN) 3. Full service (FS) 4. Suppression (SUP) 5. Handle off (HO) or Continuous service (CS) 6. Emergency (EMER).
The service zone is between MIN and FS. A brake application in the service zone will reduce brake pipe pressure by 43 kPa with a MIN application and up to 193 kPa with a FS application.
As stipulated in the Operator’s Manual[10] the Automatic Brake handle should be moved to HO position when the locomotive is a Trail unit in a multiple-unit configuration or is being towed as an unpowered unit.
Independent Brake Handle
The Independent Brake handle is used to apply brakes to the locomotive only.
It has two positions:
1. Release (REL) 2. Apply (FULL).
When the handle is in the REL position the brakes are released. As the handle is moved towards the FULL position, the brake application is gradually increased.
The Operator’s Manual stated that, the independent brake handle should always be in the REL position when set up as a Trail unit in a multiple-unit configuration or when it is being towed as an unpowered unit (Dead).
Pneumatic Operating Unit
The POU responds to the electrical signals from the EBV to control (apply/release) the train air brakes. There are four major components:
1. Brake Pipe control 2. Brake Cylinder control 3. Independent application and release 4. Power supply.
The train driver sends commands to the braking system through the EBV. When the automatic brake handle is moved to a position other than REL, the Brake Pipe pressure will reduce and result in the application of the automatic train brake including the locomotives.
When an automatic brake application has been made, the independent brake handle can be used to make an independent release of the automatic brake application on the locomotives (bail-off). This is to minimise the effect of hauled rollingstock bunching into the rear of the locomotives.
Bail-off is achieved by pushing the independent brake handle down towards the floor of the locomotive. The spring action in the handle returns the handle to its original position when released and stops the bail-off. The brakes return to the service application level a few seconds after the handle is released.
When the independent brake is applied, positive air pressure is placed in the No.3 Control Pipe and brakes apply. When the independent brake is released, positive air pressure is placed in the No.4 Independent Release Pipe and brakes release. Figure 7 shows the end air pipe connections at the rear of locomotive 5031 which were connected to the rear of locomotive 5034. With these pipes connected, commands to the braking system from the Lead locomotive pneumatically triggered the same braking control functions in the Trail locomotive.
Figure 7: Air pipe connections
This figure shows the end air pipe connections of locomotive 5031
Source: OTSI
Spring Applied Park Brake System
The locomotives had spring applied, air pressure released, park brakes mounted on each bogie. Each park brake cylinder unit operated two brake shoes to actuate braking on two axles of each bogie.
The park brakes were applied and released using push buttons situated on a panel located behind the driver’s seat (Figure 10). When a park brake button was pressed on, an electrical signal was sent to apply all park brakes in the locomotive consist.
When the park brakes were sticking on locomotive 5034, driver B manually released the park brake. The worm screw spindle located on the rear of the park brake cylinder was wound in an anticlockwise direction to release the park brake.
If required, the spring park brake could be manually applied by rotating the worm screw spindle in a clockwise direction.
Figure 8: Park brake system
This figure shows the park brake mechanism which is located on one of the bogies of a 5020 class locomotive.
Source: OTSI
To reset and reapply the spring park brake, air pressure must be reapplied to the park brake; this releases the park brake and resets the manual override feature. An application of the park brake can then be made using the push buttons, which vents air pressure from the park brake.
The braking system also contained an anti-compounding air brake circuit which prevented simultaneous application of the service brake and the spring park brake. The combined force of the spring park brake and the service brake is additive and would be excessive without the anti-compounding brake circuit.
Smart Display Interface Screens
There are three Smart Display Interface Screens (SDIS) that allow the train crew to set up, control, and monitor locomotive operation. The SDIS receives touch screen input from the train crew and displays the operating conditions of the locomotive. Two screens are located at driver A’s control position and another is located at driver B’s position.
The SDIS could only be used when the locomotives were stationary. Screen parameters could not be changed when the locomotive was moving faster than 0.8 km/h.
Figure 9: Locomotive cabin
This figure shows the SDIS screens and train crew positions. Two images were merged to display full cab layout.
Source: OTSI
Master Controller
The Master Controller comprised of two handles: the Reverser handle and the Throttle/Dynamic brake handle. These interlocked handles are used by the driver to set direction, regulate locomotive speed, and apply dynamic braking.
The Reverser handle
The Reverser handle is a removable handle that when removed, disables the Master Controller.
When the Reverser handle is inserted, it can be used to set the direction of travel of the locomotive. The handle can be set to forward mode by moving the handle forward, neutral by centring the handle or reverse by moving the handle rearwards.
A mechanical interlock with the Throttle/Dynamic brake handle prevents the Reverser handle from being moved from the neutral position unless the Throttle/Dynamic Brake handle is set to notch 0.
The Throttle/Dynamic Brake handle
The Throttle/Dynamic Brake handle is used to control locomotive speed and dynamic braking.
As a dual-purpose handle, it is spring loaded to maintain separation between throttle and dynamic brake operations. The default position is in throttle operations.
To operate as a throttle handle, the Reverser handle has to firstly be placed in either forward or reverse and then the throttle handle can be moved between the nine throttle notch positions (0 to 8).
To use Dynamic Brake operations the handle must be pushed to the right against the spring, through a mechanical interlock, and forward to the Dynamic Brake setup position.
Once the Dynamic Brake handle is in the setup position, the Dynamic Brake handle can be moved forward to increase braking, and rearward to decrease braking.
Figure 10: Driver’s controls
This figure shows the layout of the driver’s controls Source: OTSI
Other controls situated next to the Master Controller are the Horn control switch and the Vigilance reset push-button. The Horn control switch initiates the operation of the town and country horns. The Vigilance reset button was the interactive point of the random non-predictive-type vigilance control system fitted to the locomotive.
Banking operations
Aurizon conducted its banking operations utilising the train crew from the Quirindi depot. Up to four trains could be bank assisted between Chilcotts Creek and Ardglen in a 24-hour period.
A local work instruction for the Quirindi depot detailed the procedure for bank working between Chilcotts Creek and Ardglen.[11] Specifically, requirements when departing from Chilcotts Creek Siding, attaching and detaching with the train to be assisted, the banking operation, the change of operating cabins and the return of the locomotives to the Chilcotts Creek Siding.
Banking operations were conducted with two train crew members. Both crew members travelled in the cabin of the Lead locomotive in the direction of travel.
According to the procedure, banking operations commenced once the train to be banked had stopped in the siding and made a full-service automatic brake application. The driver of the banking locomotives was required to request permission from the driver of the train to be banked to attach to the rear of the train. Once attached, a test was conducted to ensure the anti-coupling device operated correctly by remaining released.[12]
The driver of the train being banked notified the banking locomotive train crew of the signal to proceed and banking commenced. Communication of signal indications was provided by the driver of the train being banked and had to be acknowledged by the banking locomotive train crew. At Ardglen, the banking locomotive driver reduced throttle power to allow the train to detach and continue its journey while the banking locomotives came to a stand prior to the Up home starting signal (09-12M) at Ardglen.
Once the banking locomotives stopped at Ardglen the train crew on the banking locomotives completed the process of changing ends.
Figure 11: Phoenix display
This figure shows the separation of banked train (WH512) from the banking locomotives (AZBK) prior to reaching the Up home starting signal (09-12M) at Ardglen.
Source: ARTC, modified by OTSI
Changing ends
The banking locomotives were operated as a multiple-unit configuration. In this configuration one locomotive is deemed the Lead and the other locomotive/s are set to Trail or un-powered (Dead). This allows the train crew to operate the consist from the cabin of the Lead locomotive only, with commands passing to the Trail locomotive through the MU cable[13] and the connected pneumatic hoses.
To change ends so control can be passed from the cab of one locomotive to the cab of the other locomotive, the C44acHi Locomotive Volume 1 Operator’s Manual provided instructions on how to set up the locomotive as Lead, Single, Trail or Dead.
Locomotive setup as Lead
According to the manual the following procedure sets the locomotive as the Lead:[14]
Set all applicable circuit breakers on the Engine Control (EC) panel ON or OFF for Lead or Trail. All circuit breakers should be ON for Lead operation.
Verify the Master Controller handles are in the following positions in the Lead locomotive:
Dynamic Brake handle is in OFF position.
Throttle handle is in IDLE.
Reverser is in the centre position.
Verify the Electronic Air Brake (EAB) system is properly set up for Lead operation.
Ensure that the Electrically Controlled Pneumatic (ECP) Brake system is set up for operation.
SDIS ELECTRONIC AIR BRAKE, in this publication for additional information.
Set the appropriate headlight switches ON or OFF for short hood (No. 1 end) Lead or long hood (No. 2 end) Lead.
The EOT [End of Train] devices (if used) must have an identification code and be armed to function.
The Lead locomotive is identified on the SDIS for EAB operation. Set up all Trail locomotives in the consist before identifying and setting up the Lead locomotive.
Set the Engine Run circuit breaker, Generator Field circuit breaker, Control circuit breaker, and the Dynamic Braking control circuit breaker to ON in the Lead locomotive. Start all locomotive engines in the consist and ensure the MU lines [cables] are connected before setting the circuit breakers to OFF in the Trail units.
Locomotive setup as Trail
According to the manual the following procedure sets the locomotive as a Trail locomotive:[15]
Set all applicable circuit breakers on the Engine Control (EC) panel ON or OFF for Lead or Trail. In a Trail configuration, follow the labels or all Railroad Operating Procedures for proper settings.
Move the Reverser handle to the centre position and remove the handle. The Throttle handle is in IDLE.
Verify the Electronic Air Brake (EAB) system is properly set up for Trail operation.
Move the EBV Automatic Brake handle in the HANDLE OFF (HO) position and Independent handle in the RELEASE (REL) position for Trail operation.
Set the appropriate Headlight switches ON or OFF. Follow all Railroad Operating Procedures.
The EOT devices (if used) must have an identification code and be armed to function.
The Lead locomotive is identified on the SDIS for EAB operation. Set up all Trail locomotives in the consist before identifying the Lead locomotive in SDIS.
Set the Engine Run circuit breaker, Generator Field circuit breaker, Control circuit breaker, and the Dynamic Braking Control circuit breaker to OFF in the Trail locomotives. Start all locomotive engines in the consist and ensure the MU lines [cables] are connected before setting the circuit breakers to OFF in the Trail units.
Competency for banking operations
Train crew deemed competent to operate banking operations were required to have successfully completed training.[16] The knowledge and practical assessment for bank engine working was conducted on train crew that have successfully completed ‘Engine and Air’ school as a pre-requisite.
The questions contained in the assessment document[17] asked of the person being tested to either demonstrate or explain parts of the procedure.
There were 11 questions in the assessment document, but none specifically asked the person being tested to demonstrate or explain the process for changing ends.
The assessment was completed on the job. The assessor was required to only sign off a person as competent, if they were confident the person had a thorough understanding of the location and operation of the various items of locomotive equipment. The ‘on job’ assessment was used to assess banking operations in various locations across the network.
Driver A was assessed on a route from Ardglen to Murrurundi and return on 29 August 2017. This route included the Ardglen Bank. Driver B was assessed on a route from Werris Creek to Drayton Junction and on a route from Murrulla to Werris Creek on 20 May 2020.These routes included the Ardglen bank. Both driver A and driver B were assessed as competent.
Inspections and maintenance of locomotives
Prior to operation, train crew were required to undertake a series of inspections of the locomotives. These included a ground inspection, inspection after boarding and inspection after engine start up. These were conducted by driver A and driver B of locomotives 5031 and 5034 respectively.
The train crew encountered a problem with the park brake on 5034 not releasing which was rectified with the aid of the RDC. The locomotives were certified okay to operate as per Aurizon’s pre-start locomotive checks and inspections work instruction[18].
A review of the locomotive maintenance records over the previous two years indicated both locomotives had been serviced regularly and consistent with the requirements of the maintenance schedule. The locomotives were required to be inspected at 122, 366 and 732-day cycles.
Brake functionality tests were required during each inspection. Additionally, brake functionality tests were conducted when a locomotive required additional out of sequence inspection and maintenance.
A review of the planned work for the previous two years revealed one park brake problem on locomotive 5031. The park brake was reported as intermittently not applying and was scheduled for inspection on 6 December 2019. During the inspection, testing of the park brake cylinder found it was functioning correctly and the fault could not be replicated, and the locomotive was cleared to return to service.
Inadvertent depression of the Independent Brake Handle
The location of the independent brake handle leaves it susceptible to possible depression by the driver when the driver is interacting with the SDIS. The independent brake handle sits approximately below the driver’s elbow. A review of the activities undertaken by the train crew, as recalled from interviews and from the event recorder log, suggests that this was the most likely scenario to have occurred.
Driver A was interacting with the SDIS to change the locomotive from Lead to Trail. As they leant forward to do this, driver A likely inadvertently depressed the independent brake handle (Figure 12) causing the brake cylinder to vent air to atmosphere. At 1947:45, when driver A placed locomotive 5031 into Trail Cut-out mode, they were unaware brake cylinder air had also started to vent and continued until the brake cylinder pressure reached 0kPa.
Figure 12: Independent brake handle and SDIS
Source: OTSI
Post-incident testing to re-create a continuous air pressure release from the brake cylinder was conducted.
Continual air pressure release from the brake cylinder could only be achieved when the independent brake handle was depressed towards the floor (bail-off) at the same time the locomotive was set to Trail. These combined actions instructed the locomotive to maintain the release of air from the brake cylinder after downwards pressure is released from the independent brake handle and return springs move it to its regular position. Continual air pressure release from the brake cylinder could also be interrupted by venting the No.4 pipe. This results in the system resetting and re-applying the air brake.
Ineffective park brakes
Post-incident testing and stripping of the locomotive park brake cylinders was conducted by the operator in the presence of the Office of the National Rail Safety Regulator (ONRSR). This process verified the cylinders were operational and working to standard.
The standard for braking systems for locomotive rollingstock AS7510.1:2014 states:
A park brake shall hold the locomotive stationary on a 1:30 gradient under all conditions of loading of the uncoupled locomotive.
However, further investigation into the performance of the park brake system found previously undetected misalignment of the brake rigging on the vertical and horizontal planes and friction levels were contributing to a significant decrease in effective park brake force (Figure 13 and Figure 14).
Figure 13: Brake cylinder connection to top lever
This figure shows the misalignment of the top lever with the brake cylinder.
Source: Aurizon
The misalignment and friction in the brake rigging likely resulted in a reduced efficiency transfer of brake cylinder force, approximately 55 to 65 per cent efficiency. This resulted in a reduced force being applied at the interface of the brake pad and the wheel (brake shoe force).
The investigation into the performance of the park brake system found the locomotive park brake hold force was not effective on gradients steeper than 1:40.
Figure 14: Pivot plate and shackle
This figure shows points of friction and horizontal misalignment.
Source: Aurizon
Gradient of track at Ardglen
The gradient of the track at Ardglen was stated in the ARTC Curve and Gradient Diagrams as 1:107. However, further consultation with ARTC confirmed the gradient of the track at Ardglen was between 1:39.4 and 1:43.1 at the location the locomotives were stationary during the change of ends.
While the gradient of the track was steeper than the published gradient of 1:107, it was not as steep as the specified 1:30 gradient that applied park brakes were required to hold locomotives stationary.
In the context of the locomotives running away, the gradient of the track was between 1:39.4 to 1:43.1 and the locomotive park brake hold force was not effective on gradients steeper than 1:40.
It is likely the locomotives started to move when the release of air from the brake cylinder decreased the brake shoe force.
Anti-compounding air brake mechanism
Operator testing after the incident showed that the brake shoe force dips below the applied park brake force when the independent brakes are released (Figure 15).
Figure 15: Brake shoe force over time
This figure shows the brake shoe force over time with a transition of independent brake to the park brake.
Source: Aurizon
It is likely this dip in brake force was caused by the arrangement and components used in the anti-compounding air brake mechanism. This acts to prevent excessive or compounded pressure being applied at the brake shoe and wheel interface. The brake force from the independent brake and the park brake applied together was greater (92.44kN) than when the park brake was applied alone. Additionally, when the independent brake was released, the resulting brake force dipped briefly before the park brake force settled at 65kN. It is most likely the locomotives started to roll when the resultant brake shoe force decreased during the brake force dip.
Change of ends process
Work Instruction
Aurizon had a work instruction for bank locomotive working between Chilcotts Creek and Ardglen[19] that specified the process for changing ends. The detail in the work instruction for changing ends was brief with the primary instructions including, the park brake must be applied before cutting out the Lead locomotive and changing of ends should happen in Ardglen Yard.
Work instructions in quality management systems[20] explain ‘how’ things need to be done. They are the step-by-step guide to implementing what an organisation expects and provides focus for those who are doing the actual work.
The work instruction lacked specific detail about how to safely change ends. This information was included in the Operator’s Manual and also detailed in the Training documentation.
Without the step-by-step information being detailed in the work instruction, Aurizon’s system did not provide a clear ‘how to’ for safely changing ends. Rather it provided what needed to be done which was then left to the train crew to conduct as they could recall from their training.
Training documentation
Aurizon had a training and assessment program that included instructions on how to change driving positions in multiple-unit configurations[21]. Comparisons between the steps in the training documentation and those in the work instruction revealed that there was no step in the training documentation to apply the park brake.
The steps taken by the driver on the day of the incident were consistent with the steps required in the training documentation.
Training and competency assessment
The training and assessment program also included an ‘on job’ assessment for banking operations.[22] This was the bank engine working knowledge and assessment undertaken by driver A and driver B. As mentioned in ‘Competency for banking operations’ (p16), there was no question specifically requesting the person being assessed to demonstrate how to change ends.
While it is probable the assessor may observe this in the course of an assessment, there was nowhere for the assessor to record this on the documentation. Without a record of the assessment there was no way of assuring that the competency of safely changing ends had been assessed for all train crew.
With inconsistencies between the work instruction and the training documentation and no method of assuring assessment of the change of ends competency had been completed, Aurizon’s system for safely changing ends in Ardglen Yard did not ensure train crew had a consistent understanding of the process.
Banking locomotives derailed
Control of the locomotives
The train crew had moved from the cabin of locomotive 5031 into 5034 with both locomotives in Trail Cut-out mode and the last instruction to the locomotives was to release air from the brake cylinder (bail-off).
With equalising reservoir pressure exhausted, brake pipe pressure zero and cut out, and all air released from the brake cylinders, the air brake system was rendered ineffective.
Shortly after sitting down in the driver’s seat, driver A attempted a brake application by moving the automatic brake handle to full service. This had no effect in stopping the locomotives as the locomotive was still in Trail Cut-out mode.
A few seconds later the automatic brake handle was placed into emergency, also to no effect in stopping the locomotives as the locomotive was still in Trail Cut-out mode. This application appears to have released a slight build-up of air in the brake pipe (see blue line in Figure 16). The cause of the slight build-up of air in the brake pipe (to 34 kPa) could not be determined. The brake pipe pressure did not increase again from 0 kPa after this first emergency application.
Figure 16: Analysed event recorder log
This figure provides an explanation of activities coinciding with recorded data on locomotive 5034.
Source: Aurizon
As the locomotives approached a speed over 70 km/h, driver A moved the automatic brake handle to the release position and then attempted another emergency application. There was no effective application of the brakes due to the locomotive already being in emergency braking status with brake line pressure at 0 kPa.
At an increasing speed, the locomotives approached a series of left- and right-hand bends with a signposted track speed of 55 km/h. The locomotives remained upright travelling at approximately 93.5 km/h through a left hand 360 m curve radius bend. They managed to continue upright into the start of a right hand 220 m curve radius bend as they accelerated towards 114 km/h. As the locomotives reached the exit transition of this 220 m right-hand curve, centrifugal force lifted the right hand wheels and overturned the locomotives to the left side of the track. The locomotives separated and slid approximately 100 m before coming to rest 13 m apart.
The brake cylinder pressure remained at 0 kPa until the locomotives derailed and separated. When this happened, the brake cylinder pressure recovered as a result of No.4 air pipe being separated between the locomotives and air releasing from this pipe. This was evidenced by the brakes re-applying on the locomotives when they came to rest (purple line in Figure 16).
In the train crew’s attempts to gain control of the locomotives, the SDIS interface did not allow the train crew to change locomotive 5034 to Lead as the locomotives were already moving faster than 0.8 km/h. The inability to change locomotive status through the SDIS was a mechanism to prevent conflict once locomotives were moving.
At this point in time, there was only one way the train crew could have re-established control of the locomotives. However, the train crew were not aware of the forced lead function which would have allowed them to take control of the locomotives.
Forced lead function
This was a known method of placing locomotives into Lead status. In Lead status the driver has operational control of the locomotive and any other locomotive when in a multiple-unit configuration. The forced lead function could be applied by placing the generator field switch to on and moving the reverser handle in any direction. The instructions on how to do this were in some of Aurizon’s procedures however, the train crew were not aware of it.
The forced lead function was not included in the bank working instruction, however it was contained in Aurizon’s locomotive training material for 5020 class locomotives, specifically, Aurizon’s C40aci Locomotive Module 3, Section 2 Participant’s Handbook (v1.0).
While it was contained in the training material, there was no written or practical assessment that ensured the train crew would be tested on it.
It is likely that had the train crew had knowledge of and been trained in the forced lead function, it would have prevented the runaway from escalating. The train crew could likely have regained control of the locomotives shortly after the start of the runaway. As a control mechanism to allow the train driver to regain control of the locomotive, it would be reasonable to have this function taught to train crew as an emergency response mechanism.
The ONRSR released a safety message: Wabtec Air Brake System – advice to Rail Transport Operators on 18 February 2021. It required Rail Transport Operators to ensure their crew were aware the Wabtec Air Brake System installed on locomotives did not allow the cab setup to change from Trail to Lead once the locomotive is moving. Also that this feature could be overridden using the forced lead function.
Emergency egress
The Operators’ Manual for 5020 class locomotives provides a section on emergency egress which states:
Emergency egress from the Operator’s cab is by sliding open either of the side windows of the cab. This means of escape should only be used in an emergency where safe exit via the vestibule cab and the platform side doors is not available.
When the locomotives derailed, they tipped to their left side, and came to rest.
The egress options available to the train crew at this time were via the vestibule cab and platform side doors or via the right-side window which was now directly overhead. The train crew attempted to break open the front windscreen to exit the cabin but were unable to do so. The windscreens of the 5020 class locomotive were a high impact resistance tinted glass.
There was a similar scenario in the Derailment of freight train near Julia Creek, Qld on 27 December 2015. A 2800 class locomotive tipped on the right side. The train crew attempted to exit through the front windscreen but were unable to break it open with an emergency hammer. The crew decided to exit the cab through the side window. The emergency hammer was not intended for breaking the front windscreen, it was to break the side windows in the event they did not slide open.
The option to exit through the vestibule cab and platform side doors was not used at the time. Driver B exited through the side window as it was the most direct path out.
At interview, driver A expressed the desire to get out of the cab after it had tipped. After repeated unsuccessful attempts to break the front windscreen with the heel of their boot, driver A chose to follow the path out the side window that driver B had taken earlier.
With the locomotive on its side, exit via the vestibule and by the side window required the train crew to climb up using internal structures. Exiting via the vestibule also required passing through doors, which to open, likely added further complexity and risk to the escape route.
In an emergency, when a person has a heightened level of stress, activities that require complex thought or action only increases stress. Leaving the cab after an accident should be as easy as possible.[23] The most direct and simple path is likely the path the person will choose to escape.
With the width of a 5020-class locomotive at 2.94 m, the train crew climbed upwards and out through the side window. This increased their risk of injury of fall both while climbing out of the cab and then coming down from the side of the locomotive to the ground.
Had the train crew been seriously injured and unable to egress the cab without assistance, emergency services would also have had difficulty accessing the cab. In situations where a critically injured person requires attention in a timely manner, the access/egress provisions to the locomotive cab while on its side were not suitable.
The Rail Industry Safety and Standards Board (RISSB)[24] developed rollingstock standard AS 7522 Access and egress. It was first released on 23 August 2012 with the latest edition published on 23 March 2021. The standard provides the following information with regarding emergency evacuation from locomotive rollingstock:
‘Enclosed cabs of rollingstock shall be fitted with sufficient emergency exits to provide escape paths to the vehicle exterior when the vehicle is upright and when overturned on the side.’
The 5020-class locomotive was built prior to these standards being released when consideration of emergency egress when the locomotive is overturned on the side was not an Australian Standard. However, the risks to the train crew attempting to exit a cab that has overturned on its side warrants a review of the emergency egress provisions.
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the Uncontrolled runaway and derailment of banking locomotives near Kankool on 3 June 2020
Contributing factors
During process of changing ends, the driver likely inadvertently depressed the Independent Brake Handle, at the same time as placing locomotive 5031 into Trail Cut-out mode. This released the automatic air brake application on both locomotives
The park brakes were ineffective in holding the locomotives on the grade in Ardglen Yard (Safety issue)
The banking locomotives started to roll away after the train crew left the cab of locomotive 5031. The train crew were then unable to establish control once the locomotives started rolling and the banking locomotives rolled approximately 3 kms before derailing at 366.529 km near Kankool
Aurizon did not ensure train crews had a consistent understanding of how to safely change ends on banking locomotives (Safety issue)
The train crew had not been trained to use forced lead function which would likely have allowed the train crew to regain control of the locomotives (Safety issue)
Other factors that increased risk
Aurizon had not fully considered emergency egress from a locomotive overturned on its side. This increased the risk of further injury and could also have prevented emergency services from accessing personnel within the locomotive in a timely manner
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The train crew had not been trained to use forced lead function which would likely have allowed the train crew to regain control of the locomotives
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Train crew on board incident locomotives
Aurizon
Australian Rail Track Corporation
Wabtec
Office of the National Rail Safety Regulator
References
Australian Standard 2014, AS7510.1:2014 Braking Systems Part 1 Locomotive Rollingstock.
Australian Standard 2021, AS7522:2021 Access and egress.
General Electric Company 2010, GEJ-7045 Operating Manual C44-ACi Locomotive for Queensland Rail National Coal
Rail Industry Safety and Standards Board 2021, Glossary of Terms. Accessed at: www.rissb.com.au/glossary
US Department of Transportation Federal Railroad Administration 1998, Human Factors Guidelines for Locomotive Cabs DOT-VNTSC-FRA-98-8
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Aurizon
Australian Rail Track Corporation
Transport for NSW
Office of the National Rail Safety Regulator.
Any submissions from those parties will be reviewed and, where considered appropriate, the text of the draft report will be amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On Saturday 30 May 2020, V/Line train 8185 was operating as the 2216 evening service from Melbourne’s Southern Cross Station to Wendouree in suburban Ballarat. The train was a three-car VLocity Diesel Multiple Unit (DMU).
The service was scheduled to stop at Ballarat Railway Station in central Ballarat before proceeding to its destination at Wendouree. The station was located a short distance before the Lydiard Street North level crossing that was fitted with heritage swing gates.
Approaching Ballarat Railway Station, the train did not respond to the driver’s braking demands and could not be stopped. At about 2336, the train passed through the station and impacted the level crossing gates that were closed to rail traffic. The train was estimated to be travelling at between 93 and 97 km/h at the time of the collision.
The impact destroyed the pair of southern gates, damaged the front and side of the train, and resulted in gate debris being scattered into the surrounding area. There were no injuries to members of the public from this debris.
The driver subsequently brought the train to a stand approximately 640 m beyond the station. One of the two passengers on board required hospitalisation, and the train driver and conductor sustained minor injuries.
What the ATSB found
It was found that slippery rail conditions existed for at least the final 2.5 km of the approach to Ballarat Railway Station and probably the final 5 km. It was concluded that moisture from light rain was the primary environmental factor influencing the formation of very low levels of adhesion[1] at the contact between the train’s wheels and the rail head. This substantially reduced the braking performance of train 8185.
It was found that the sanding system installed on train 8185 to improve adhesion in slippery conditions was ineffective at improving braking performance during this event. It was concluded that several factors potentially adversely influenced the effectiveness of the sanders.
The design configuration of the sanding system, and specifically the locating of the sanding nozzles behind wheels, was not consistent with the current design practice of locating sanding nozzles ahead of the wheel-rail interface being targeted.
It was also found that there were missed opportunities to identify weaknesses in the sander design configuration. Operator acceptance of the three-car VLocity braking system did not include assessment of sander performance against defined criteria for improving adhesion. In addition, V/Line investigation of previous rail safety occurrences that involved poor wheel-rail adhesion did not examine sander effectiveness.
Other factors that increased the risk of diminished sander performance included vegetation contamination in sander mechanisms that reduced sand flow, and the depletion of sand in one sand box. These factors were associated with sander maintenance and train preparation processes. It was also noted that the strong crosswinds present that evening may have adversely influenced sand distribution.
Loss of adhesion leading to increased stopping distance was not recognised as a risk source for collision in V/Line’s risk registers. It was concluded that there were insufficient risk controls in place to mitigate against a train arriving at Ballarat Railway Station travelling at excessive speed and being unable to stop before impacting the Lydiard Street North level crossing gates.
The configuration of the crossing protection that used swing gates introduced additional hazards compared to boom barrier style crossing protection and risk controls were not in place to manage the unique risks that existed at the crossing.
What has been done as a result
V/Line has advised the ATSB of the following safety actions that address five of the identified safety issues:
Sanders have been installed on the intermediate cars of VLocity three-car sets. The added units discharge sand in front of the wheel-rail contact point (in the direction of travel) and are operational on all VLocity trains.
A sand flow test has been added to the VLocity servicing schedule to monitor through-life sander discharge performance.
The work instruction for checking sand boxes has been reviewed and will be updated to include enhanced guidance on required sand levels.
A number of additional risk assessments have been undertaken in relation to loss of adhesion leading to increased stopping distance.
To enhance risk controls associated with the Lydiard Street level crossing, V/Line has reduced the permitted train speed on the approaches to Ballarat Railway Station from 160 to 80 km/h. Boom barrier level crossing protection has been installed at the Lydiard Street North level crossing and speed monitoring has been installed at the Humffray Street level crossing to initiate activation of the Lydiard Street North level crossing protection in the case of a train travelling above the design threshold.
On the remaining safety issue, the Australian Transport Safety Bureau recommends that V/Line takes safety action to ensure the performance of sanders on the VLocity three-car set is assessed against defined acceptance criteria for improved braking performance in low adhesion conditions.
Safety message
This occurrence has highlighted the importance of passenger rail operators having risk controls in place to prevent collisions because of slippery rail conditions. Controls include effective train-borne equipment such as wheel slip/slide protection systems and sanders, and targeted risk controls at locations vulnerable to risks associated with train overrun.
The occurrence
Journey before incident
On Saturday 30 May 2020, V/Line[1] train 8185 departed Melbourne’s Southern Cross Station at its scheduled time of 2216[2] travelling to Wendouree in suburban Ballarat. The train stopped at several stations en-route to Ballarat, including Ballan about 36 km to the east. At about 2318 on the approach to Ballan, train 8185 experienced wheel slide[3] during braking but was able to stop at the station. The driver observed light rain and gusty winds at this time.
Figure 1: Rail route from Melbourne to Ballarat and Wendouree
Source: Google Maps. Annotated by Chief Investigator, Transport Safety (CITS)
Departing Ballan, the driver experienced wheel slip[4] events during the next 12 km when powering and, as the journey progressed, instances of wheel slide during braking. The train’s event recorder detected that the wheel slip/slide protection (WSP) system was active for about 75 per cent of the time in the first 5 km after departing Ballan. The WSP train system is activated automatically to assist management of wheel slip and slide in slippery conditions.
The incident
The driver reported that they commenced braking slightly earlier than they normally would on the approach to Ballarat due to the wet and windy weather conditions. The train’s event recorder detected braking being initiated at 23:33:44, approximately 5.1 km from the intended stopping point at Ballarat Railway Station. Train logger information indicated that the train was travelling at just over 160 km/h.
Over about 650 m, the brake was applied, then released and then reapplied. During these early brake applications, the train’s WSP system detected wheel slide, which was followed by activation of the sanding system. The brake was again released at 23:34:04, with the train about 4.3 km from the intended stopping point and estimated to be travelling at between 150 and 155 km/h.[5]
The train then coasted for 22 s, after which the driver made a further brake application. At this point, the train was approximately 3.4 km from its intended stopping point at Ballarat Railway Station and travelling at approximately 160 km/h. Four seconds later, the train’s WSP and sanding systems were activated by the braking system.[6]
When about 2.6 km from the train’s intended stopping point, the driver increased braking to a full-service brake application. The full-service braking was then maintained except for a short reduction in brake demand for between 3 and 4 s when the train was about 1.5 km from the station. Under full-service braking, the speed of the train was reducing at an average rate of about 0.2 m/s2 compared to the design rate of 0.95 m/s2 in dry conditions.
About 730 m from the intended stop at Ballarat Railway Station, the train passed over Humffray Street North level crossing and estimated to be travelling at between 120 and 125 km/h. The flashing lights, bells and boom barriers were all operating when the train passed through the crossing but with reduced warning time.[7] Seven seconds after passing over the crossing, and probably travelling at between 110 and 119 km/h, the train passed through a set of facing points (number 39 points) and associated turnout that were speed limited to 40 km/h, and onto the southern track that led to platform 1 at Ballarat Railway Station.
At 23:35:49, and now about 300 m from the intended stopping point, the driver moved the brake controller from a full-service to an emergency brake application. The train entered the station travelling at about 100 km/h.
The train passed its intended stopping point at the western end of Ballarat Railway Station at 23:35:59, travelled through departure signal 20 that was at stop, and entered the Lydiard Street North level crossing at a speed estimated to be between 93 and 97 km/h (Figure 2).
Figure 2: Train 8185 having impacted the first gate and about to strike the second.
CCTV snapshot of train having entered the level crossing traveling from right to left. Source: V/Line Corporation
About a second before the train passed through the crossing, the road traffic lights changed from green to flashing amber as the train occupied a track circuit[8] for the crossing. However, the gates were still across the railway track rather than protecting the crossing from road traffic and were struck by the train. CCTV had recorded a group of three pedestrians walking across the level crossing approximately 49 s before the train passed across Lydiard Street North.
The train continued westwards, through a set of trailing points that were also speed limited to 40 km/h. It then passed over the Doveton Street North level crossing that was about 400 m after its intended stopping point. The flashing lights, bells and boom barriers were operating when the train passed through the crossing, but with reduced warning time. The train came to a stand about 640 m beyond its intended stop.
Following the incident
After stopping, the driver communicated with the V/Line regional train control centre (Centrol) to report the incident and arrange for an emergency response. The conductor, who had been in the rear driver’s cab, moved forward along the train and checked on the two passengers in the front carriage before checking on the driver.
The passengers and crew had been subjected to lateral forces (rough ride) as the train negotiated the series of turnouts. One passenger had been standing near an exit door as the train approached the station. This person sustained head, back, and leg injuries and was taken to hospital by emergency services. The other passenger had been seated and indicated to the conductor that they were uninjured.
Once the passengers were detrained, the conductor was also taken to hospital for assessment before being discharged. The driver of the train sustained minor injuries.
Collision damage to train 8185
The front of the lead car (1270) was significantly damaged as a result of impact with the heritage gates. The driver’s cab survival space was maintained and the windscreen was not penetrated.[9] Impact marks on train front were consistent with portions of the gate support (Figure 3).
Figure 3: Impact damage to the front of train 8185, car 1270
Source: CITS
Part of the gates impacted the left side of the leading car, penetrating the side window surface (Figure 4).[10] The internal fittings remained intact.
Figure 4: VLocity car 1270 impact damage to passenger (left) side leading window
Source: CITS
Level crossing gate damage from collision
Train 8185 was travelling on the southern-most track when it passed through the Lydiard Street North level crossing with the gates closed to rail traffic. The train struck and destroyed the southern-side pair of gates (Figure 5). Parts of the gates were reported to have impacted adjacent buildings. The gates on the northern side of the crossing remained attached to their support posts.
Figure 5: Remnants of the damaged gates on the southern side of the crossing
Source: V/Line
Context
Location
The incident occurred in Ballarat, a Victorian regional city located about 100 km west of Melbourne. Ballarat Railway Station is the main station within Ballarat, and is located adjacent to Lydiard Street North (Figure 6).
Figure 6: Ballarat Railway Station locality and level crossings
Source: Google Maps. Annotated by CITS
Environmental conditions
The Bureau of Meteorology (BoM) weather monitoring station was located at Ballarat Aerodrome, about 8 km from Ballarat Railway Station. The BoM station recorded an air temperature of 9.0 °C and a relative humidity of 90 per cent at 2330 on the 30 May 2020.
Light rain was recorded between 2300 and 2330 on the evening of the incident, registering a total fall of 0.2 mm. The previous recorded rain fall was at around 0300 in the early hours of that day, when 0.2 mm precipitation was also recorded at the BoM station. After the incident, there was no further rain recorded prior to the departure of the first train the following morning.
At 2330, wind was recorded by the BoM as being from the north at 33 km/h, gusting to 42 km/h. The potential for the presence of airborne particulates was considered. The nearest Environmental Protection Agency (EPA) testing station that was recording on the day of the incident was in suburban Melbourne, about 95 km from Ballarat. Data recorded by the EPA showed no significant increase in PM10 particles[11] in Victoria on the day of the incident.
Track information
Track and associated infrastructure were owned by the Victorian Rail Track Corporation (VicTrack) and managed by V/Line Corporation (V/Line). V/Line was responsible for track maintenance.
Track construction and corridor environment
Ballarat is linked to Melbourne and other regional centres by the regional rail network. The track from Deer Park Junction in western suburban Melbourne to around 2 km from Ballarat Railway Station was Class 1 (allowing a maximum speed of 160 km/h) and constructed on concrete sleepers. This track was upgraded as part of Victoria’s Regional Fast Rail (RFR) project that was completed in 2006. The gauge of the RFR upgraded track approaching Ballarat was, on average, about 7 mm narrower than the nominal 1600 mm broad gauge.[12] About 2 km from Ballarat Railway Station the line speed reduced from 160 km/h to 130 km/h. Track construction from this point was a mixture of concrete and wooden sleepers.
Between 6 km to 1 km from the station, the rail corridor was predominantly contained within a shallow cutting. There was a mix of trees, shrubs, and grass in the rail corridor in this area.
Track gradient
From about 6.5 km, the track approaching Ballarat Railway Station was on an approximate 1:52 downgrade. The gradient eased to approximately 1:100 downgrade between 1 km and 2 km from the station, then changed in the vicinity of Humffray Street North to a slightly uphill grade of 1:737. Approximately level track immediately preceded the station, with a slight rising grade of 1:383 recorded along the platform. On leaving Ballarat Railway Station, there was an uphill gradient of approximately 1:71 in the vicinity of Doveton Street.
Signalling Information
V/Line was responsible for the operation and maintenance of the signalling system.
The signalling at Ballarat was operated from the Centrol train control facility in Melbourne. Centrol interfaced with signal interlocking at Ballarat to provide remote monitoring and control. The area was equipped with three aspect colour light signalling.
Signals 52 and 40 on the approach to Ballarat were equipped with Train Protection and Warning System (TPWS) Train Stop Sensors (TSS)[13] that would have applied the train’s brakes if either of these signals had been passed at stop. In this instance, both signals were at proceed and therefore the TSS was not triggered. The TPWS at this location was not fitted with an overspeed sensor (OSS) that initiates a train emergency brake application if a train is detected as being overspeed.
Signal 40 at Ballarat was located before facing points[14] (39 points) that were set to direct the train to platform 1. The speed limit across these points and turnout was 40 km/h.
Train route and signal status recording
Centrol train control had set the route for train 8185 to Ballarat Railway Station. From signal 52, located about 1 km from the station, the route was set to take the train into platform 1 up to signal 20 (Figure 7). Signal 52 displayed a yellow over green aspect, requiring the train to reduce to medium speed (40 km/h) for signal 40, that was located approximately 500 m from the station.
Figure 7: The route set for and taken by train 8185 at Ballarat
The green line indicates that the route had been set and cleared for train 8185 through to signal 20. Source: V/Line, annotated by CITS
Lydiard Street North level crossing
The level crossing over Lydiard Street North was immediately adjacent to the west end of the Ballarat Railway Station platforms and located at a chainage of 113.923 rail km from Melbourne (Figure 8).
Figure 8: Aerial view of Lydiard Street North level crossing
Source: Google Maps. Annotated by CITS
A set of swing gates were installed on either side of the rail corridor (Figure 9). The gates were first installed in 1885, and were a heritage-listed element of the preserved station precinct.
Figure 9: Level crossing gates at Lydiard Street North, approaching from the south
Source: Pass Assets - Department of Transport (Vic)
The mechanism to operate the gates was replaced by a motorised system in 2001.[15] When required to permit the passage of rail traffic, the gates were motored closed to road traffic. Further modification was made in 2017 when the pedestrian crossing gates were upgraded to include emergency gate control locks. Road traffic lights also protected the rail crossing. The road manager was the City of Ballarat.
Control of gates
The Lydiard Street level crossing gates were controlled from a signal box at Ballarat until 2016, when control was transferred to the Centrol train control facility in Melbourne. The crossing was equipped with CCTV to assist with this remote operation.
When the level crossing was closed to rail traffic (normal position), departure signals at the station for westbound traffic were set to stop (red aspect over a red aspect). Signal 20, the departure signal for platform 1, was one of three down[16] departure signals located at the west end of Ballarat Railway Station that were similarly interlocked with the gates.
To operate the gates so that they opened for rail traffic, the train controller (at Centrol) moved an on-screen icon from ‘normal’ to ‘reverse’ in the display of the train control system. This resulted in the road traffic lights on either side of the crossing changing to red, stopping road traffic. The train controller was then able to close the gates to road traffic by remote control of the motorised system.
With the gates confirmed closed to road traffic, the train controller would then set the relevant departure signal to a proceed indication, permitting the train to depart towards Wendouree.
Train crew and passengers
The driver
The driver of train 8185 had more than 46 years driving experience. They had been driving VLocity DMU since they were introduced into service in 2005.
In the four months leading up to the incident, the driver worked 23 shifts,11 of which were VLocity runs from Southern Cross Station to either Ballarat or Wendouree. Of these 11 trips, five were with three-car sets and six with six-car sets.
The driver’s last annual Train Driver Safety Audit was conducted in September 2019 with no detected non-conformances, and their most recent periodical medical was completed in February 2020, from which they were assessed as fit for duty.
The driver suffered minor injuries as a result of this incident.
Driver roster and fatigue
The previous 14 days rostering would not have contributed to a fatigue condition. The driver did not work for 10 of the 14 days preceding the incident. That last work day was 29 May 2020 where they worked an 8 hour shift to 2309.
There was no evidence to suggest that the driver’s shift on the day of the incident had led to fatigue being a factor in this incident. On that day, the driver commenced duty at 1700 and first ran a VLocity service from Ballarat to Melbourne, experiencing no operational issues. Arriving at Southern Cross Station, they changed platforms to access train 8185 for the return trip to Wendouree.
There were no other indicators or conditions identified that suggested driver fatigue was a factor in this incident.
The conductor
The conductor signed on for duty at 1406 on the day of the incident and was completing their fourth and final run of the day when the incident occurred. The conductor was travelling in the rear cab of the train as it approached Ballarat. After the incident, they moved to the front of the train to assist the passengers and driver. The conductor received minor injuries and attended hospital for assessment.
Passengers
There were two passengers on board at the time of the incident. The train had fewer passengers than would otherwise be expected owing to movement restrictions associated with the Covid-19 pandemic. One of the passengers was taken to hospital for treatment following the incident.
Train 8185
Car-set 3VL70
Train 8185 comprised the three-car VLocity Diesel Multiple Unit (DMU) set 3VL70. In the direction of travel towards Ballarat, the set consisted of car DM1270 (a powered car with driving cab), TM1370 (a powered intermediate car), and DM(D)1170 (a powered car with driving cab).
Car-set 3VL70 was purchased as a three-car unit and entered service in 2017. The VLocity type train was designed, manufactured, and maintained by Bombardier Australia.[17] VLocity trains were originally introduced to the Victorian broad gauge network as two-car sets in 2005. In 2006, three-car units were ordered and additional intermediate (TM) cars procured to insert into the existing two-car units. VLocity trains were subsequently operated as three-car and six-car sets.
The three-car VLocity operated to a maximum speed of 160 km/h. Traction power was provided by a diesel engine under each vehicle, driving the cab-end bogie of the DM and DM(D) cars, and the rear bogie of the intermediate TM car, in the direction of travel for train set 3VL70 travelling from Melbourne to Ballarat. Tractive force was delivered from the engine via a hydrodynamic transmission.
Train 8185 on day of incident
On the morning of 30 May, train set 3VL70 received its primary preparation at Geelong.[18] The preparation was recorded on a Vehicle Preparation Form and no train faults were detected during the preparation. The primary preparation included checking sand boxes that supplied sand for braking in slippery conditions. The process did not include objective criteria for the assessment of adequate sand level, and there was no checklist of individual items completed by the preparation driver as part of this task.
Coupled for six-car operation with another three-car set, 3VL70 then operated on western sectors of the V/Line network, before operating as a three-car set on the Ararat to Melbourne (Southern Cross) service (8166), and the Melbourne to Ballarat service (8185).
The driver of train 8185 joined the train at Southern Cross Station. The driver reported that on joining the train, they were not aware of any faults with the train. There was no opportunity nor responsibility on the driver to check sand levels at this point in the day.
Event recorder information
Train 8185
The VLocity was equipped with a Faiveley Transport VM-40 event recorder that logged 40 digital inputs with an additional four internal state digital signals, 11 analogue inputs and eight other channels from the VLocity subsystems and equipment. The logger recorded key information including driver power and brake controller demand, braking system activity and train location and time from an on-board GPS receiver.
Information on train speed
Two values of speed were logged by car 1270, pulse speed and BCU speed:
Pulse speed was calculated from the rotating speed of the third axle from the leading end of car 1270 and was also the input to the speedometer display. If this wheelset was sliding during braking, the pulse speed was an underestimate of the speed of the train.
Brake Control Unit (BCU) speed was calculated (when in braking) from the rotating speed of the fastest rotating axle on car 1270. During a slide event, it was more accurate than pulse speed because it was using information from the wheelset with the least slide (fastest rotating). None-the-less, it could also be an underestimate of the train’s speed during wheel slide.
Both the pulse and BCU speeds underestimated actual train speed during periods when wheels were sliding. Graphed pulse and BCU speeds tended to be saw-tooth in shape (Appendix E, Figure 34), with wheelsets slowing sharply during brake application with slide, and then returning towards actual speed when braking was automatically released to reduce the sliding.
Driver braking and train speed on the approach to Ballarat
The event recorder showed that the driver of train 8185 engaged in three distinct periods of brake application on approach to Ballarat Railway Station (Figure 10 and Table 1).
Figure 10: Locations of brake applications of train 8185 on Ballarat approach
Source: V/Line, Google Maps, annotated by CITS
Table 1: Brake application points, with recorded speeds and an estimated speed
Time
Event
Pulse speed
(km/h)
BCU speed
(km/h)
Estimated train speed [1]
(km/h)
23:33;21
Power and braking off, train coasting
158
158
156 – 158
23:33:44
Position 1 Braking commenced
163
164
161 – 164
23:33:56
Position 2 Braking released for 1s
162
163
160 – 163
23:33:57
Position 3 Braking reapplied
161
163
160 – 163
23:34:04
Position 4 Braking released for 22 s
132
140
150 – 158
23:34:26
Position 5 Braking reapplied
161
162
160 – 162
23:34:43
Position 6 Full-service brake application
155
158
155 – 159
23:35:09
Brake demand reduced to 30% for 3-4 s
98
127
134 – 136
23:35:12
Return to full-service brake application
110
135
133 - 136
23:35:35
Train passes over Humffray St crossing
97
117
120 - 125
23:35:42
Train passes through 39 points
94
107
110 – 119
23:35:49
Position 7 Emergency brake application
78
99
108 – 113
23:35:59
Position 8 passes intended stop
98
99
96 – 100
23:36:01
Train enters level crossing
75
93
93 - 97
23:36:37
Train comes to stand
0
0
0
[1] Given the potential underestimate of the recorded pulse and BCU speeds during wheel slide, an estimate of the speed range in which the actual train’s speed would probably lie was made using the logger GPS data. The GPS data was not sufficiently accurate to give instantaneous speeds and estimates were limited to an average over a period. All speeds are therefore estimates only. Source: Pulse and BCU speeds from train data logger. Speed estimate by CITS, using available logger data including GPS.
A graphical representation of the brake demand shows the first two braking periods, followed by the 22 s period of no braking, and then the continuous braking through to the collision (Figure 11). The term ‘brake demand’ refers to the total (load compensated) braking request transmitted from the brake control unit that is converted to a brake cylinder pressure. The range of brake demand was between 0 and 64 kN.[19]
Figure 11: BCU speed[20] and brake demands from the intended stopping point
This graph is drawn from train data logger records. There is some inaccuracy in logged distance information during the sliding event, in addition to the known limitations of the BCU speed. Source: CITS, from VLocity event recorder data
First period of brake application (from position 1 to 2)
At around 6 km from Ballarat Railway Station, the driver shut off power and commenced coasting. When approximately 5.1 km[21] from the station (position 1), the driver-initiated brake demand of 13 per cent of a full-service application.[22] This brake application was held for 13 s, during which the train travelled about 530 m. At the point of brake release (position 2), the train was approximately 4.6 km from the station.
Second period of brake application (from position 3 to 4)
Following about a second of brake release, a brake demand of about 70 per cent of full-service was commenced (position 3), before being eased to about 47 per cent. This second period of brake application lasted for 6 s, with a maximum brake cylinder pressure of 174 kPa[23] being recorded for the power bogie on car 1270. The driver released the brakes (position 4) when the train was approximately 4.3 km from the intended stopping point.
Third period of brake application (from position 5 to collision)[24]
After coasting for approximately 22 s, a third period of brake application commenced (position 5). The train was about 3.4 km from the intended stopping point. The initial brake demand was about 13 per cent of full-service. Then, with the train about 2.6 km from the station stop (position 6), the brake application was increased to full-service (100 per cent), that produced an average brake cylinder pressure of around 297 kPa over the next 66 s. At one point, the brake demand was briefly reduced (for about 3 s) to 30 per cent before being increased back to full-service when the train was about 1.5 km from the station.
With the train approximately 300 m from its intended stopping point, the driver moved from full-service to an emergency brake application (position 7).[25] The emergency braking was maintained as the train passed its intended stopping point at Ballarat Railway Station (position 8), collided with the crossing gates and subsequently came to a stop.
Wheel slip/slide protection (WSP) and sanding activity
The train was fitted with wheel slip/slide protection (WSP) and sanding systems to manage traction and braking in slippery rail conditions (refer braking system description). During all three described periods of braking on the approach to Ballarat, the WSP and sander systems automatically activated (Figure 12).[26]
Figure 12: Graph of event recorder information from car 1270 of train 8185
The figure shows WSP and sanding activity through each phase of braking. It also shows the saw-tooth behaviour of the BCU speed in the periods of heavier braking, and in particular during the full-service application from 23:34:43. Source: CITS, from train 8185 car 1270 event recorder data
Trains operating before and after the occurrence
Data logger records were also examined for the trains operating prior to train 8185, and the first train departing Ballarat the next morning.
Train arriving at Ballarat before train 8185
The previous train to enter Ballarat left Southern Cross Station at 2052 and arrived at Ballarat Railway Station at 2214 (train 8181). This train did not experience any wheel slip or slide events on this journey. The event recorder did detect wheel slip and sanding as power was applied after the trip at about 2331, on the entrance to Ballarat East depot. This event was shortly before the arrival of train 8185 and after the light drizzle had commenced.
Train departing Ballarat prior to train 8185
Train 8174 left Ballarat Railway Station for Southern Cross Station at 2119 on the evening of the incident. The event recorder of this train detected 4 s of WSP activation on the approach to Ballan Station at 2134. The train was braking from 145 km/h when the WSP was recorded. The train stopped safely at Ballan Station.
Train departing Ballarat after train 8185
The first train departing Ballarat after train 8185 was on the following morning (train 8104). The train departed at 0615 and there had been no rain recorded since that on the evening of the incident. The event recorder detected a number of slip and slide events between Ballarat and Ballan, including WSP and sander activity. This suggested that conditions remained slippery the next morning, with moisture probably remaining on the rail head.
Post-incident wheel and rail inspections
Train wheels
Post-incident inspection of train 8185 wheels identified some markings. The wheels of the leading car (1270) exhibited some minor marks approximately 25 mm long around the flange root of the wheels (Figure 13). It could not be determined whether these were caused by the slide incident or a previous event.
Figure 13: Markings on the wheels of car 1270
Source: CITS
Profile measurements of wheels on incident train 8185 were compared to the MP2[27] profile specified by V/Line. An assessment of the wheel profiles indicated that wheelset condition was consistent across the train and had no significant asymmetric wear, flange wear or tread wear. Analysis of wheel hollowing[28] provided by V/Line showed that measurements were within specification.
Track inspection and measurement
Monash Institute of Railway Technology (IRT) was engaged by V/Line to inspect the track during the day following the incident (IRT 2020). Inspections and measurements were at five sites, with three of those sites located on the approach side of Ballarat Railway Station (Figure 14). Site 1 was at the 110.243 km mark, site 2 at the 110.772 km mark, and site 3 at the 112.850 km mark.[29]
Figure 14: IRT measurement sites east of Ballarat Railway Station
Source: Department of Transport (Vic) Pass Assets, CITS
Geometry
Track at sites 1 and 2 consisted of 60 kg rail on concrete sleepers, installed as part of the RFR project. There was also a track cant of approximately 75 mm[30] at these sites, consistent with the shallow radius left-hand curve of 2400 m radius. IRT concluded that rails at sites 1 and 2 were not significantly worn.
Site 3 was at the location of the older 94 lb/ft rail. The down rail showed significantly more wear than the up rail,[31] however transverse rail profiles were found to be close to the specified template.[32]
Rail head contamination inspection and assessment
IRT reported that the surface condition at sites 1 and 2 showed relatively typical levels of contamination, consistent with the presence of normal oxides and dust/dirt. More significant contamination was observed at site 3, with what appeared to be dirt/dust on the surface of the rails (Figure 15). The particulates on the rail head were not tested for composition.
Figure 15: Rail surface condition at 112.850 km chainage, about 1.1 km from station stop
The figure shows some surface dust/dirt on the rail head and grease on the gauge corner of the down rail, the left rail looking towards Ballarat. The source of the dust/dirt is not known. Source: IRT (2020)
Grease was also observed on the gauge corner of the down rail at site 3, which was likely to have been carried from the wayside lubricator located approximately 150 m from this site in the direction of Ballarat Railway Station. The lubricant had not migrated onto the top of the rail where wheel contact was likely to have occurred.
Friction measurements
Measurement of the friction coefficient at the rail surface was undertaken by IRT the day after the incident using a push tribometer within the main wheel-rail contact band. Both dry and simulated wet conditions were measured, with wet conditions simulated by applying water to the rail surface using a conventional watering spray following the dry measurements.
Results showed that on the approach to Ballarat Railway Station between sites 1 and 3, friction conditions were relatively consistent. Dry rails recorded values between 0.42 and 0.47 (average 0.44). This figure reduced once water was applied, with results ranging between 0.28 to 0.33 (average 0.29).
IRT advised that adhesion levels decreased with increasing speed, and maximum friction levels for rolling stock travelling at 160 km/h might be expected to be 39 per cent less than that measured with the tribometer.[33] Based on this IRT reported figure of a 39 per cent reduction, the average measured wet coefficient of 0.29 would reduce to 0.18 at a train speed of 160 km/h.
Geometric analysis of wheel and rail contact
The effective management of the contact between wheels and rails is an important element of railway operations. ATSB undertook a geometric analysis[34] of the likely wheel rail contact conditions present for train 8185 at sites 1-3. A track gauge of 1593 mm was used for site 1 and 2, reflecting the narrower gauge on the RFR section, and 1600 mm was used for site 3. The leading wheelset (wheel 1 and wheel 8)[35] from the first powered bogie of car 1270, and leading wheelset (wheel 3 and wheel 6)[36] of the first unpowered bogie on that car were used for the analysis.
Sites 1 and 2 wheel-rail interfaces
Sites 1 and 2 were both on a section of mild, left-curving track and, because the sites were of similar geometry, the results of site 1 are presented (Figure 16).
On the high rail of the curve, a narrow band of contact was likely present for typical wheel positions,[37] localised on the gauge shoulder only. Narrow contact in this location was not ideal for promoting good adhesion conditions between wheel and rail. This was also away from the area of the rail targeted by sanding (the central crown) and toward a region of the wheel and rail that was more likely to be affected by any contaminant such as grease that could migrate from the wheel flange.
On the low rail of the curve, wheels were expected to have maintained a relatively broad, central contact that should have been able to utilise any sanding that occurred and should not have been susceptible to grease contamination.
As the low and high rail wheels are rigidly connected, the net available adhesion is the sum of the two. Therefore, while a reduction in available adhesion in braking could be expected on this curve, it is unlikely to have been significant.
Site 3 wheel-rail interface
On the straighter section at site 3, more centralised contact on both rails was predicted for both the leading axle of the car, and the leading axle of the first unpowered bogie (Figure 17).
Figure 16: Site 1 profile overlays showing likely contact scenarios for the leading axle
The figure shows the predicted wheel rail contact of the leading axle during curving at site 1 Three scenarios are shown; a 1mm offset, 2 mm offset and 3 mm offset from flange contact condition . Source: ATSB
Figure 17: Site 3 profile overlays showing likely contact scenarios for two axles
The figure shows the predicted wheel rail contact of the leading axle and third axle of car 1270 at site 3, assuming centralised running. Source: ATSB
Potential contribution of wheel-rail contact geometry to event
The braking response of the train at geometrically different locations consistently indicated low wheel-rail adhesion. This suggests that wheel-rail contact conditions, while not optimal, were probably not substantially contributory to the prevailing low adhesion condition experienced in this occurrence.
Train 8185 braking system
System description
The VLocity braking system automatically blended a combination of hydrodynamic[38] and friction brakes.[39] Brake Control Units (BCUs) were fitted to each car to control the braking and interfaced with the Vehicle Control Unit (VCU). The BCU determined the blend of hydrodynamic and friction braking to ensure the braking effort satisfied required brake demand.
The braking demand request was by the movement of the power/brake controller (PBC) (Figure 18). The PBC operated in power mode when pulled back from the centre ‘off’ position and in the brake mode when pushed forward from the centre position. There were six power notches that dictated the tractive effort. In brake mode, the controller moved seamlessly between minimum and full-service braking. When pushed fully forward, emergency braking was applied.[40]
Figure 18: Power/brake controller, WSP and sanding indicator
Source: CITS
Wheel slip/slide protection
Control systems to manage low adhesion
The term ‘adhesion’ is commonly used in the rail industry to describe the level of friction available to transfer forces between the wheel and the rail.
The VLocity was equipped with a wheel slip/slide protection (WSP) system to optimise traction and braking and prevent damage to wheels and track in instances of reduced adhesion conditions. The technical description of the VLocity braking system (Bombardier 2017) stated that:
When a sliding axle is detected and the pneumatic brake is active, the corresponding dump valve is energised by the BCU, so that the brake cylinders are vented which reduces the brake force until the wheels speed up again. An independent monitoring function is provided, which ensures that the friction brake is reapplied, if the dump valves are continuously energised for a certain time period.
When WSP was activated owing to wheel slide, hydrodynamic braking was automatically terminated, and all braking was supplied by the friction disc brakes. Once the wheel slide had been corrected, the system reinstated braking effort according to the train driver’s brake control setting. The system on the VLocity was designed to avoid wheels locking and did not allow for maintaining slide in certain circumstances.[41]
In the event of wheel slip being detected (such as when the train was attempting to depart from a station where the tracks were slippery, and powered axles were rotating faster than non-powered axles), engine speed and tractive effort were automatically reduced. Upon correction of the wheel slip condition, the system re-applied tractive power according to the train driver’s power control setting.
Activation of the WSP was evident to the train driver from a warning light on the control panel (Figure 18). The WSP warning light extinguished when adhesion was regained. Sanding was also automatically applied under such circumstances, and activation indicated by a separate warning light.
Physical removal of materials from wheel tread
The configuration of the train braking system can affect adhesion levels at the wheel-rail interface. Tread brakes or abrasive brake blocks that act to directly remove materials from the wheel tread can strongly influence the adhesion levels between wheel and rail. This was not a feature on the VLocity train that was equipped with disc brakes, and therefore did not have the benefit from having the wheels cleaned during brake application. RSSB (2014) found that tread brakes appeared to be less susceptible to moist rail head than trains with disc brakes.
Post-incident brake testing
Post-incident brake testing indicated that all three cars were compliant with the braking system routine test procedure (Bombardier 2014), and sufficient brake force was available to decelerate train 8185 had there been sufficient adhesion at the wheel-rail interface.
Testing also showed the BCU on all three cars met requirements in relation to WSP activation and the operation of dump valves to reduce brake cylinder pressure on detection of wheel slide.[42]
Sanding system
Layout
VLocity DMUs were fitted with a sanding system to apply sand to the rail head to improve the friction between the wheels and rails. Sand could be applied automatically by the WSP system or manually by the driver using a foot pedal. Sanders were located on the front and rear cars of the three-car set. The TM cars were not equipped for sanding.
The sander operation depended on whether the train was powering, or under braking (Figure 19). If the train was under power and wheel slip was detected, sand was applied behind the second axle of the first car and in front of the third axle of the rear car of the train. If the train was braking, sand was applied (only) behind the second axle at the front of the train.
Figure 19: VLocity DMU sanding arrangement pertinent to the direction of travel.
Source: CITS
This arrangement for sand application was the same as for the VLocity two-car set (with DM and DMD cars only) introduced into passenger service in 2005.
Position of sanding nozzle relative to wheel
The nozzles of the sanders that operated in braking were positioned behind the second wheelset, facing toward the direction of train travel (Figure 20).
Measurement of discharge nozzles on car 1270 found that the end of the sand discharge pipes were about 150 mm above the rail head and about 440 mm from the wheel centreline. Bombardier drawing titled ‘Body to bogie motor bogie attachment’ (BTA 2006) specified the nozzle to be 120 mm above the rail head and 412 mm from the centreline of the wheel. The nozzles were therefore located about 30 mm higher than the specified height in the drawing.
The angle of the nozzles was approximately 20 degrees to the rail surface and was in the plane of the rail. The nozzles were midway between the inner and outer surfaces of the wheel.
Figure 20: Location of sand nozzle relative to the wheel
Source: CITS
Sand boxes and metering units
Two sand boxes were fitted at the cab-end bogies of each of the DM and DM(D) cars and incorporated sand metering units (Figure 21).
Figure 21: A car 1270 sand box and sand metering unit removed (right-hand side image).
Source: CITS
When sanding was required, solenoid valves were energised which supplied pressurised air from the main reservoir into the sanding system through a sintered metal plate. Within the sand box, supply air was used to agitate the sand and meter the desired sand flow rate through the sanding discharge pipe and discharge nozzle (Appendix A).
Sand specification
V/Line used sand sourced from a local supplier, either bagged or in bulk, depending on the depot being supplied. The product was silica sand, sourced from local sand quarries and screened to a specified grain size. The sand grain size profile was finer than specified by RISSB guidelines for braking applications (Appendix B).
Routine maintenance of sanding system
V/Line Work Instruction VEWI-79 (V/Line 2019) detailed the VLocity servicing schedule. This required:
sand boxes to be checked and filled every 21 days.
checking the sand box assemblies and that the sanding units operated every 31,000 km.
checking the sand box lid every 93,000 km.
checking the sanding magnet valve every 186,000 km.
checking the sanding brackets and hoses every 186,000 km.
checking the sanding system pressure reducing valve and isolating cock every 372,000 km.
The maintenance processes did not require sand flow rates to be monitored over time, against defined criteria.
V/Line did not have a process in place for nozzle position or alignment relative to the wheel to be checked or adjusted during maintenance. The group standard in Great Britain for sanding equipment (RSSB 2021) stated that maintaining sand discharge nozzle alignment was necessary to maintain performance of the sanding equipment.
Post-incident inspection and testing of sanding system
Condition of sand boxes following the occurrence
The condition of the sand boxes in car 1270 were checked following the stabling of train 8185 after the incident (Figure 22).
Figure 22: Sand boxes on car 1270 at Ballarat East depot, after the incident.
Source: CITS
The sand box on side A (left side in direction of travel) contained approximately 21.6 kg of sand compared to the nominal capacity of 25 kg. The sand box on side B contained approximately 3.9 kg when measured and was effectively depleted.[43]
Flow rate measurements prior to disassembly and cleaning
Following the incident, 3VL70 was tested by Bombardier at Ballarat East depot to assess the function of the train’s sanders. These tests were witnessed by V/Line and the Chief Investigator Transport Safety (CITS). The expected and desired sand delivery rate was advised to be between 1.5 and 2 kg/min.
Sand output was measured from side A and B sanders on cars 1270 and 1170 (Table 2). The first set of tests (1-3) were conducted without any addition of sand to the sand box from the time of the incident. The remaining tests (4-6) were additional tests conducted on car 1270 boxes only, with the sand boxes emptied and then half-filled with sand that was supplied to Ballarat East depot.[44] The desired rate of 1.5-2 kg/min was only achieved in one test; test 5 on sand box B of car 1270 after it was refilled.
Table 2: Sander performance tests
Car 1270 sand flow (kg/min)
Car 1170 sand flow (kg/min) [1]
Side A
Side B
Side A
Side B
Test 1
0.829
0.104
0.05
0.711
Test 2
0.654
0.014
0.434
0.622
Test 3
0.595
0.008
0.089
0.756
Test 4
0.371
0.987
[2]
[2]
Test 5
0.553
1.627
[2]
[2]
Test 6
0.452
1.472
[2]
[2]
Average
0.6 (tests 1-6)
1.4 (tests 4-6)
0.2 (tests 1-3)
0.7 (tests 1-3)
[1] The sanders on the rear car (1170) were not designed to dispense sand during braking into Ballarat. [2] No data recorded Source: Bombardier with averages by CITS
Sander inspections
Following the initial flow tests, the sand was drained from all the sand boxes and the sanding units disassembled for inspection. Dry vegetation was found in the sand domes of all metering units.
For the units from car 1270, there was significant vegetation in both units, and more in the unit from side A (Figure 23).
Figure 23: Vegetation in metering unit sand domes of car 1270
Source: CITS
Vegetation was also found in the sand domes of the metering units of car 1170 (Figure 24).
Figure 24: Vegetation in metering unit sand domes of car 1170.
Note the sand discharge connector pipe is not shown in this figure. Source: CITS and Bombardier.
Sander flow rate measurements following cleaning
Vegetation was removed and the sanding units were reassembled. Flow tests were repeated and sand delivery rates consistently matched the expected flow rate Table 3).
Table 3: Sander performance tests following cleaning of units
Car 1270 sand flow (kg/min)
Car 1170 sand flow (kg/min)
Side A
Side B
Side A
Side B
Test 1
1.855
2.050
1.985
1.875
Test 2
1.835
1.865
1.965
1.855
Test 3
1.805
1.915
[1]
[1]
Average
1.8
1.9
2.0
1.9
[1] No data recorded. Source: Bombardier
Sander rate comparison of VLocity trains that had experienced overruns
In July 2020, V/Line undertook retrospective testing of sanders on VLocity trains, including nine involved in low adhesion overrun incidents between 2010 and 2020. The four sanders on each of the nine trains were tested, giving a total of 36 tests. Testing found that 15 of the 36 sanders tested did not meet the desired sand delivery output of 1.5-2 kg/min (Appendix C).
There was a wide distribution of flow rates between 0 and 2 kg/min (Figure 25).
Figure 25: Sand flow rates for a sample of 36 sanding units on VLocity trains
The bar chart shows the distribution of flow rates across the 36 sanders tested. The sanders were those fitted to nine trains involved in overruns between April 2010 and June 2020. The tests were conducted July 2020. Source: CITS, based on Bombardier test data
Type testing of VLocity braking in low adhesion conditions
Type testing
Prior to delivery, type testing of the train’s equipment was undertaken to verify that the equipment met the specification (Bombardier n.d.). Pre-acceptance slip/slide type tests were performed on the VLocity three car set in 2008. A test procedure (Bombardier 2008) was developed with the objective of verifying correct operation of the slip/slide equipment. There was no type testing to specifically verify sander performance against defined criteria.
Testing was conducted on a closed section of track with the train at both tare[45] and gross loaded mass. For low adhesion tests, the train was equipped with a watering system that supplied a water/detergent mix to the leading wheelset of the train.[46]
Type testing outcomes
The test report (BTA 2008b) concluded: ‘… the slip/slide equipment responded correctly both to skid and spin situations and provided an effective protection of the wheels from wheel flats’.
Low adhesion tests (in braking) were conducted with the train set to brake in blended (fiction and hydrodynamic), friction only and emergency conditions and braking (stopping) distance recorded (Figure 26 and Figure 27). The tests were conducted for a range of initial speeds, and for each speed, there were 3 tests without sand (relying on the WSP system only), and one test with sanding activated. No statistically significant difference in the braking distance with or without sanding applied was observed.
Figure 26: Slip/slide braking test results for a tare loaded three-car set, for normal braking, friction only braking (F) and emergency braking (E), and range of initial speeds.
Source: Bombardier, CITS
Figure 27: Slip/slide braking test results for a gross loaded three-car set, for normal braking, friction only braking (F) and emergency braking (E), and range of initial speeds.
Source: Bombardier, CITS
As would be expected, braking (stopping) distances during the low adhesion type tests exceeded stopping distances for braking on dry track (Figure 28). The longest recorded stopping distance from 160 km/h for the loaded, friction only braking test scenario was about 1400 m. This equates to a retardation rate of 0.71 m/s2 or about 75 per cent of the dry retardation rate.
Figure 28: VLocity slip/slide type test results from 2008, friction braking scenario
This graph shows the outcome of individual tests for the gross (loaded) and friction (only) brakes scenario. For each starting speed, there were 3 tests without sand (relying on the WSP system only), and one test with sanding activated. Source: Bombardier test data
Driver training and actions taken by the driver of train 8185
Instructions for drivers regarding low wheel-rail adhesion
The V/Line Professional Driving Booklet contained information describing low adhesion conditions at locations where high levels of trackside vegetation existed (with cuttings presenting a particular problem), and during light drizzle and immediately following stormy conditions (V/Line n.d.). The booklet also warned against errors leading to low adhesion incidents. These included not considering environmental indicators of possible low levels of rail adhesion, and incorrect braking techniques (these being unspecified) for low adhesion conditions.
Further guidance in the form of an information notice (V/Line 2013) was distributed to drivers in 2013 (Appendix D). The notice included advice on driving techniques in low adhesion conditions, automatic and manual sanding, the WSP system, and extended stopping distances. The guidance indicated that the shortest stopping distance (on a VLocity) would be achieved by allowing the WSP system to control braking effort.
V/Line used simulator training for its drivers. However, drivers did not receive ongoing driving simulator instruction in handling low adhesion conditions as part of continuation training.
Actions taken by the driver of train 8185
The driver reported experiencing some wheel slip on departing Ballan and applying manual sanding. The driver reported and train data confirmed that the train subsequently experienced intermittent wheel slip (in power) and wheel slide (during braking) from Ballan onwards.
The driver reported having applied braking earlier than would be usual on the approach to Ballarat due to the conditions of wheel slip experienced earlier in the trip. Shortly after the initial application, they released the brake on encountering wheel slide, reapplied and then released. During this phase in the approach, the driver’s intention was to attempt to manage the braking in the low adhesion conditions through release and reapplication of braking demand.
The driver subsequently made a full-service brake application when about 2.6 km from the intended stopping point, and the management of braking effort was then with the train’s WSP system. For the train to stop in this distance, a retardation of about 0.4 m/s2 was required. In dry conditions, a retardation rate of 0.95 m/s2 would be expected.
The driver moved the controller from a full-service braking application to emergency when the train was about 300 m from the intended stop. The driver reported that they chose not to make an emergency brake application earlier, concerned that there would be a time delay to regain braking control if they were to move back to service braking.
Risk register references to loss of adhesion
V/Line risk register
Loss of adhesion (specifically listed as wheel to rail interface failure) was recorded in V/Line’s Train to Vehicle risk register as a risk source for the risk event of a road user being presented with inadequate warning time at a level crossing. Despite V/Line having commenced work on improving sander design at the time of the collision, no other risk register references to loss of adhesion were provided. The risk controls for the risk event relating to loss of adhesion were listed as the construction and maintenance of level crossings.
Work undertaken by V/Line on improving sander design
Despite there being no V/Line risk register entry for loss of adhesion resulting in a collision, V/Line had commenced a review of the sanding system in 2016, and in 2019 commenced a program to modify all VLocity trains to include an additional sanding arrangement on the intermediate cars. These sanding systems were activated in 2022.
RISSB hazard register
RISSB had developed a hazard register (RISSB n.d.), primarily to support the development of RISSB standards. This register had been refined in a programme of work drawing on industry expertise and it was a resource made available to its members. Within this register, inadequate adhesion was listed as a factor in the collision and derailment precursor,[47] for which the source of the hazard was ‘brakes being inadequate when moving’.
Other similar occurrences involving V/Line VLocity
Ten VLocity overrun events that occurred between April 2010 and June 2020 were identified for closer review. These events were either greater than 100 m in length, or events that were on the same day (Table 4).
Table 4: Significant VLocity overrun events selected for further analysis
Approximate overrun length
1000 m
500 m
100 m
Not stated, but more than one event on same day
Number of events
2
2
2
4
Source: V/Line
Of the two events that recorded overruns of 1000 m or greater, both occurred at Macedon. The first of these events occurred in August 2010, with the driver reporting wet and slippery conditions. The second occurred in February 2018, with the driver reporting no wheel-rail adhesion. Of the overruns that were reported to be approximately 500 m, one occurred at Rochester in 2014, and the other at Drouin in 2016. Slippery rail conditions were reported for both these incidents.
While inspections were made of the track in some of these instances, there was no record of examination of the train sanding system or assessment of sander performance and its potential contribution to an overrun event.
Safety analysis
Wheel-rail adhesion
Estimated level of wheel-rail adhesion
The wheel slip/slide protection (WSP) system was active during braking on the approach to Ballarat Railway Station indicating that the level of adhesion between wheel and rail was insufficient to support the level of braking demanded. The response of the train’s braking system during the event provided an estimate of the wheel-rail adhesion for train 8185.
Commencing about 2.6 km before the intended stopping point at the station, there was a near continuous full-service brake application for 66 s.[48] During this period of braking, a train retardation of about 0.2 m/s2was achieved compared to a full-service braking rate in dry conditions of 0.95 m/s2. Available adhesion experienced by train 8185 was therefore likely to have been between 0.02 and 0.03 on this section (Appendix E).[49] This reflects very low to extremely low levels of available adhesion.
Sources of low adhesion conditions at Ballarat
The level of adhesion achieved between wheel and rail can be strongly influenced by rail surface contamination. There are a range of contaminants that may occur including leaf matter, oils and greases, dry contaminants such as iron oxides and dust, and small amounts of moisture.[50]
Post-incident site measurements[51] found an average friction coefficient on wet rail of 0.29 (at walking pace), that may reduce by around 39 per cent for a train travelling at 160 km/h (IRT 2020). Based on this reduction figure, the measurements would equate to a level of adhesion of about 0.18 for a train speed of 160 km/h. These levels are not unusually low for wet rail and did not indicate the presence of a lubricating agent. Post-incident track inspections also did not identify significant leaf, oil or grease contamination on the approach to Ballarat Railway Station.
In the absence of any apparent matter contamination, the most significant environmental condition present at the time of the occurrence was a small amount of moisture. Work commissioned by RSSB (2014) reviewed research and data gathered from service experience and found that there was evidence for low adhesion being caused by slightly wet rails. The report defined the wet rail phenomenon as:
Poor adhesion conditions caused when low levels of moisture are present at the wheel-rail interface. These conditions are associated with dew on the rail head, very light rain, misty conditions and the transition between dry and wet rails at the onset of rain. They are not necessarily associated with the additional presence of other (non-water) rail head contaminants. These conditions are not associated with continuous rain.
Weather recordings indicated that between 2300 and 2330 on the night of the event, light rain started to fall in the Ballarat area. Rain was also observed on CCTV footage of Ballarat Railway Station and Humffray Street crossing at the time train 8185 passed. It is probable that this small amount of rail head moisture was the primary environmental factor in the development of low adhesion conditions at the wheel-rail interface of train 8185. The train that arrived into Ballarat prior to train 8185 and prior to the light rain did not experience wheel slip or slide events.
Noting the mostly dry conditions and prevailing winds in the lead up to light rain that evening, the possibility that particulates had mixed with moisture to form an unusual interfacial layer was considered. An investigation of recurring low adhesion events in Melbourne (OCI n.d.) found that (in those instances):
The majority of overrun events have occurred with rail head moisture resulting from light rain or dew. The investigation concluded that moisture combined in particular proportion with rail head contaminants such as iron oxides and mineral clay produces a liquid suspension sufficient to result in low coefficient of friction conditions including instances of low shear strength within the interfacial layer.
However, there was insufficient evidence in this instance to conclude if any other contaminant had influenced the available adhesion at the wheel-rail interface.
Sanding system design and performance
Performance of train 8185 sanding in this event
For many trains, sanders are used to modify conditions between wheel and rail in slippery conditions. The entrainment of sand into the wheel–rail contact has been shown to be an effective way of improving friction levels between the wheel and rail in conditions of low adhesion (RAIB 2005). Train 8185 was fitted with sanders for that purpose.
The event recorder for train 8185 showed that sanding was automatically requested on the detection of low wheel-rail adhesion by the train, and was active for a long period on the approach to Ballarat Railway Station. However, available adhesion between wheels and rails remained very low indicating that the sanders were ineffective at raising the friction between wheel and rail surfaces.
Positioning of sanding nozzles
Location of sanders relative to wheels
The VLocity three-car set was fitted with sanding devices on its lead and trailing cars. During braking, by design only the sanders on the leading car operated to dispense sand (Figure 29). The nozzles on these sanders were located behind the leading bogie of the lead vehicle, with the outlet facing toward the rear wheels of the leading bogie.
Figure 29: Train 8185 sanders activation during braking
Source: CITS
The RISSB standard for Braking Systems on Multiple Unit Passenger Rolling Stock (RISSB 2014), introduced in 2014, stated that sanding systems should, in general, conform to the requirements of GM/RT2461. Standard GM/RT2461 was developed as a Railway Group Standard in Great Britain (Railway Safety 2001) and mandated that new multiple unit trains in Great Britain be fitted with a sanding system. The standard also specified requirements for any systems that were installed on existing trains.
The version of GM/RT2461 that existed at the time of VLocity design specified that in braking mode:
...sand shall be delivered to the railhead by the leading vehicle only for all train formations (including multiple formations), at a location forward of the third axle and after the second axle, in the direction of travel.
The 2016 update of GM/RT2461 was more specific in relation to the position of sand delivery forward of the third wheelset in the direction of travel. The later version of the standard specified the necessary criteria for sand application under braking and contained a good practice design guide for sanding equipment. This guide stated that sanding equipment would be more effective in reducing the risk from low adhesion if the discharged sand was effectively focused ‘just in front of the wheel-rail contact point’ and delivered at a rate within the design and maintenance parameters of the equipment. The practice of sand being delivered in front of the wheel-rail contact point for braking, rather than behind it, was a consistent design feature sighted on rolling stock studied by this investigation.
On a VLocity three-car set, the location of the sanding nozzles (for braking) behind the wheels of the lead bogie was inconsistent with these design practices and likely to be a significant recurring factor in the diminished performance of the sanding system in improving adhesion.
Response from Alstom in relation to location of the sanding nozzles
Alstom provided background on the design development leading to the locating of the sanding nozzles behind the wheels of the lead bogie, and advised that the initial design was considered consistent with the GM/RT2461 standard that existed at that time. Alstom also advised that stakeholders[52] involved at the time of the procurement of the initial two-car VLocity prioritised train detection (track circuits) over maximising the effectiveness of the sanding system. Alstom advised that effective application of wheel slip/slide protection system was considered the primary method of optimising the brake application to prevent the formation of wheel flats, and to improve braking performance in low adhesion conditions.
An unwanted side effect of low adhesion remedial treatments such as sand was a failure of the train to activate a track circuit, with subsequent safety implications related to signalling and level crossing operation. Alstom advised that DMUs were considered to have a higher train detection risk over an Electric Multiple Unit (EMU) as there was no return current in the rail to ‘burn off’ railhead contamination. Any build-up of sand deposit on the rail was considered to increase the risk (of lack of train detection).
Height and distance of nozzle from wheel-rail contact point
Experiments have been conducted into the effect of the height and longitudinal position of the sanding nozzle on the proportion of sand reaching the rail (Lewis et al. 2018). In the test conditions used, it was found that the further the nozzle was from the contact point, generally the lower the proportion of dispensed sand being deposited on the rail (Appendix F).
The results of these experiments cannot be directly related to train 8185 given the difference between the test arrangements and the configuration of train 8185. However, for comparative purposes, the height and longitudinal offset of the sanding nozzles on car 1270 were plotted against the test samples. It was found that the nozzles on car 1270 were higher and more longitudinally distant from the wheel-rail contact point than the tested samples.
Sand availability
The amount of sand remaining in each sand box on car 1270 after the incident differed significantly. Post-incident inspection found 21.6 kg remaining in the sand box on side A (left side in direction of travel). Based on the average measured (post-incident) flow rate from this unit (0.6 kg/min) and the time activated during the journey, the sand box on side A was probably near full at the time train 8185 departed from Southern Cross Station.[53]
In contrast, only about 3.9 kg of sand remained in the sand box on side B (right side) of car 1270.[54] When tested with the remaining sand, only a small amount of sand was dispensed and the sand box was therefore functionally empty. It was not possible to ascertain at which point the sand box on side B was effectively exhausted. It is possible this occurred on the final approach or earlier in the journey. Assuming the sand was exhausted as the train came to a stop in Ballarat, the box would have been no more than half full at the start of the journey from Southern Cross Station.[55]
A process for preparing the train at Geelong on the morning of the incident included a checking of the sand levels in the sand boxes. However, this process did not include any quantitative criterion on the volume of sand required to be in the box at that inspection, nor was there a separate check-off for this item of the inspection. The sand boxes did not contain a mark or trigger point for the topping up of sand.
Sanding flow rates
Post-incident disassembly of sanders on train 8185 found that all units were contaminated with vegetation. Comparative testing conducted before and after cleaning of units found significant improvement in flow rates after cleaning (Table 5). All cleaned units met the desired flow rate of 1.5-2 kg/min.[56]
Table 5: Mean sand flow rates from train 8185 sanders, before and after cleaning
Car
Side
Before cleaning
After cleaning
1270
A
0.6 kg/min
1.8 kg/min
1270
B
1.4 kg/min
1.9 kg/min
1170
A
0.2 kg/min
2.0 kg/min
1170
B
0.7 kg/min
1.9 kg/min
Source: CITS analysis and summary of V/Line test data
Based on the test results, it is probable that in service, including on the day of the incident, the amount of sand dispensed from the car 1270 sanders (during braking) was less than the desired rate of 1.5-2 kg/min. Research has found that small changes in flow rate can lead to reductions in the amount of sand delivered to the wheel-rail contact (Lewis et al. 2018).
Testing of sanding systems by Rail Safety Standards Board (RSSB)
In 2009, the RSSB published research that evaluated the performance of sanders on multiple units in Great Britain (RSSB 2009). The research found that there was considerable variability in the performance of sanding systems with many operating well below the 2 kg/min discharge rate recommended (Appendix G).[57] The RSSB research material was compared with V/Line testing conducted of VLocity vehicles involved in overrun incidents. Similar variation in discharge rates across the fleet were observed in the RSSB and VLocity tests (Appendix G).
The RSSB report identified the lack of regular maintenance and ineffective design as causes for sanding systems not dispensing the required amount of sand, and that performance may deteriorate over time. The research also recommended that acceptable discharge rates in the maintenance manuals should be close to the design criteria for the system.
Maintenance of the VLocity units did not include testing of sander discharge flow rates. Without measurement of flow rates or some other assurance process, deficiencies could not be identified and addressed.
Influence of crosswinds
Around the time of the occurrence, recorded winds were 33 km/h gusting to 42 km/h from the north, and so orientated across the direction of travel of train 8185 on its approach into Ballarat. Experiments conducted on sanding equipment have shown that even moderate crosswinds can adversely influence the amount of sand reaching the rail (Lewis et al. 2018). It is possible that the crosswinds at the time of the event influenced the distribution of sand towards the rails, particularly when present in combination with the location of sander nozzles (for braking) behind the wheel-rail contact point, and the height of the sanding nozzles above rails.
Missed opportunities to identify sanding system weakness
Type testing of VLocity three-car set
Braking system type testing of the VLocity three-car set was conducted in 2008 against a performance requirement for braking on dry rail. Additional type testing was conducted with a water-detergent mix to simulate low adhesion conditions, with the aim to demonstrate WSP operation. Data from this whole-of-train WSP testing in reduced adhesion conditions showed stopping distances with and without sand being applied. However, the results of these tests did not demonstrate any consistent reduction in stopping distances when the sanders were activated.
While not mandatory in Australia and noting its release was after the 2008 type testing, the European standard for wheel slide protection (CEN 2018) stated that testing should include assessment of the impact of the sanding on the low adhesion braking performance achieved. The type testing of the VLocity three-car set in 2008 did not include demonstration of performance of the sanding system against specified criteria. This was a missed opportunity for weaknesses in the sander design configuration (for braking) to be identified and remedial action taken.
Other investigations have identified gaps in processes for defining and proving rolling stock performance in low adhesion conditions. An investigation of recurring low adhesion events in Melbourne (OCI n.d.) found that (in that instance):
…performance requirements for braking in low-adhesion conditions were not adequately defined within the procurement documentation for the train.
and,
… acceptance testing did not fully verify the braking performance … for some conditions that were later to be experienced in service.
V/Line response to previous low adhesion events
Significant events associated with low adhesion conditions and involving VLocity rolling stock were experienced on previous occasions on the V/line network. While inspections of the track were made that resulted in treatments such as vegetation removal and scrubbing of the track, there was no record of examination of the train sanding system or assessment of sander performance and its potential contribution to the overrun events.
Risk of collision owing to low adhesion
Despite previous low adhesion events, the loss of adhesion leading to increased stopping distance was not recognised as a risk source for a train overrun collision in V/Line’s risk registers. The risk of a collision, either with a level crossing gate, terminal infrastructure, or another train, was not documented. The only risk event reference to loss of adhesion was for a road user being presented with inadequate warning time at a level crossing. Controls to treat the risk of collision associated with low adhesion were also not documented in V/Line’s risk registers.
The risk of collision events associated with low adhesion had been identified by other standards and investigative agencies. RISSB, the industry body, had identified inadequate adhesion as a factor for collision and derailment owing to brakes being inadequate when moving, and documented this in their hazard register (RISSB n.d.). Also, in 2013 ATSB published its investigation report into a collision of a passenger train into a station buffer stop at Cleveland, Queensland (ATSB 2013). In relation to the management of risk, one of the findings made in that report was that:
Despite numerous occurrences of slip/slide events in the years leading up to the accident at Cleveland, Queensland Rail’s risk management processes did not precipitate a broad, cross-divisional, consideration of solutions to the issue including an investigation of the factors relating to poor wheel-rail adhesion.
The ATSB advised that this finding affected all owners and operators of rolling stock fitted with electro-pneumatic disc actuated braking systems incorporating wheel slip/slide protection control.
Lydiard Street gates
Proximity of gates to departure signal
The Lydiard Street North crossing gates were closed to rail traffic (and open to road traffic) except when required to be opened for the passage of trains. For train 8185, the level crossing and gates were protected by departure signal 20 being at stop. Signal 20 would remain at stop until the gates were closed to road traffic and made open for the passage of train 8185. That operation, to open the gates to rail, had not yet commenced when train 8185 arrived.
The level crossing was located 17 m beyond signal 20 and this proximity provided only a small margin in the event of signal 20 at stop being overrun by a train (Figure 30).
Figure 30: Departure signal 20 and the Lydiard Street North level crossing
This photograph was taken after the event. The gates on the northern side of the crossing are shown closed to road traffic. The departure signal 20 is shown at stop, as it was when passed by train 8185. Source: CITS
Standards existing prior to the event, and another published following the event, identified the risks associated with short distances between protective signals and level crossings, and potential mitigating actions (Appendix H). Possible mitigating actions cited include increasing the safety zone between signals and level crossings, particularly for new crossings, and train protection systems or other predictive systems to detect train overspeed in sufficient time to take remedial action.
In the case of the Lydiard Street North level crossing and gate configuration, neither the train controller located in Melbourne, nor the signalling system had the means of detecting that train 8185 was traveling at a speed that made it likely it would pass signal 20 at stop and enter the Lydiard Street crossing while it was closed to rail traffic. There were no effective safety controls in place to specifically mitigate against a train arriving at Ballarat Railway Station travelling at excessive speed and being unable to stop before colliding with the crossing gates closed against rail traffic.
About a second before the train passed through the crossing, the road traffic lights changed from showing a green indication to a flashing amber as the train occupied a track circuit[58] at the crossing. This was the only warning provided to road traffic.
Unique hazards associated with Lydiard Street North level crossing gates
The configuration of the crossing protection at Lydiard Street North level crossing, that used swing gates, introduced unique hazards when compared to boom barrier style crossing protection. Train 8185 was estimated to be travelling between 93 and 97 km/h when it struck the gates. The collision resulted in several events including impact with the driving cabin, side impact of the passenger compartment, and the projection of gate debris into surrounding public spaces.
Owing to the time of the collision and the movement restrictions associated with the Covid-19 pandemic, there were few pedestrians or road vehicles in the area, and there were none affected by the overrun or collision with the gates. The outcome to public outside the train may have been different in other circumstances.
The potential for impact with the gates was not documented in risk registers and risk controls were not in place to manage the unique risks associated with the gates at the Lydiard Street North level crossing.
Speed across 39 points
Train 8185 passed over 39 points on the approach to Ballarat Railway Station at a speed estimated to be in the range of 110 – 119 km/h. The turnout was rated for 40 km/h operations and routed trains to platform 1 at Ballarat Railway Station (Figure 31). The train crew recounted being thrown around when the train passed over the points.
Work undertaken for the Regional Fast Rail project by Transportation Technology Center, Inc (TTCI) for the Department of Infrastructure, Victoria (DOI 2006) calculated that the overturning speed for a VLocity train at an uncanted[59] 1:8.7 turnout, as installed at 39 points, was 117 km/h. This overturning speed assumed no crosswind and a loaded train. Train 8185 passed through this turnout at an estimated speed of over 110 km/h therefore having a significantly reduced margin to overturning and derailment.
The Australian standard for signalling principles (RISSB 2018), recognised the risk of rail traffic derailing owing to overspeed at points. The standard offered guidance for mitigating the risk, which included enforcement systems, such as Train Protection Warning System (TPWS). Train 8185, was equipped with on-board TPWS, as were all VLocity trains. However, the trackside TPWS components to enforce the speed restriction across 39 points were not installed.
In this instance, train 8185 was already in full-service braking from about 2.6 km before the intended stopping point, and at least 2 km before 39 points. Overspeed enforcement within this distance, and in the circumstances of very low adhesion conditions, may therefore not have reduced the train speed at the turnout.
Figure 31: Route taken by train 8185 via 39 points towards platform 1
Source: Pass Assets (DoT, Vic), annotated by CITS
Driver expectations and response
Expectation
Adhesion conditions
The driver of train 8185 was familiar with the route into Ballarat Railway Station and had last driven it four days prior to the incident. The driver was also an experienced driver of the VLocity DMU and had experienced wheel slide conditions requiring WSP activations on previous occasions. However, the driver had not previously experienced extremely low levels of adhesion where the train’s speed could not be controlled by the braking, WSP and sanding systems. The driver of train 8185 had no reasonable means of knowing the extent of the extremely low adhesion conditions, nor that the sanding system would be ineffective at improving adhesion.
The braking records of train 8185 and train 8181, that preceded train 8185, were compared. The evaluation found that train 8185 was not able to achieve the retardation of train 8181 even though the brake application on train 8185 was significantly greater. With moderate brake application in the 2 km between 2.8 km and 800 m from the station, train 8181 achieved an average retardation of about 0.4 m/s2, with a peak retardation of about 0.6 m/s2 (Appendix I).
Sander performance
The driver was familiar with the sanding system on train 8185 and understood that it delivered sand to the rail to improve friction when either the WSP system triggered the sanding system to activate, or when sand was demanded manually by the driver using the foot pedal.
On the evening of the incident, the train provided the driver with an indication that the sanding system was delivering sand. However, the data recordings indicated that the adhesion remained extremely low and train deceleration under full-service brake application was between 20 and 30 per cent of expectation. The driver was presented with information that the sanders were operating and had no reasonable means of knowing that sander performance may have been affected by other factors, and was not improving adhesion conditions.
Information and driver training for low adhesion conditions
The Professional Driving Booklet provided some guidance on driving in low adhesion conditions, and an information notice on Braking in Slippery Track Conditions had been issued to VLocity drivers in 2013. The guidance on low adhesion conditions advised on allowing the WSP system to control the brake activation and not to release and reapply braking. Initially, the driver attempted to manage braking by release and reapplication as one might on a train not fitted with a WSP system. However, from approximately 2.6 km from the station stop, the driver afforded the WSP system the opportunity to manage the adhesion conditions.
The driver’s considerable experience and training did not prepare them for the extremely low adhesion conditions that existed at Ballarat at the time of the incident. While simulator training for the VLocity was provided by V/line, drivers did not receive driving simulator instruction in handling very low adhesion conditions as part of continuation training. It was technically feasible for the V/Line VLocity simulator to model low adhesion conditions.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the collision of passenger train 8185 with level crossing gates at Ballarat, Victoria, on 30 May 2020.
Contributing factors
Very low levels of adhesion existed between the wheels of train 8185 and the rail head on the approach to Ballarat Railway Station. A small amount of rail head moisture was probably the primary environmental factor in the development of low adhesion conditions.
The sanding system on train 8185 did not effectively improve wheel-rail adhesion during braking of the train on its approach to Ballarat Railway Station.
Safety controls were ineffective in mitigating against a train arriving at Ballarat Railway Station travelling at excessive speed and being unable to stop before colliding with the crossing gates closed against rail traffic. [Safety issue]
Other factors that increased risk
The location of sanding nozzles (for braking) behind the wheels of the lead bogie was inconsistent with design practice existing at the time of the collision and was probably a recurring factor in diminished sander effectiveness on VLocity trains. [Safety issue]
Neither V/Line nor Bombardier identified during type testing of the three-car VLocity in 2008 that the sanding system may not reduce stopping distances in low adhesion conditions. The results of type testing did not show any statistically significant difference in the stopping distance with or without the sanding system operational.
There was no suitable assessment of the performance of sanders on the VLocity three-car set against defined acceptance criteria for improved braking performance in low adhesion conditions. [Safety Issue]
V/Line investigation of previous rail safety occurrences that involved poor wheel-rail adhesion did not include examination of the train sanding system or assessment of sander performance and its potential contribution to the overrun events.
The sanding mechanism of all sanders on train 8185 was partially blocked by vegetation. Testing showed that flow rates were affected by the vegetation, and that suitable rates were achieved when vegetation was removed.
Maintenance of the VLocity sander units did not include testing of sand discharge flow rates (or some other process) to confirm performance. Without performance checks over time, deficiencies could not be identified and addressed. [Safety Issue]
The car 1270 side B sand box of train 8185 was probably no more than half full on leaving Southern Cross Station and functionally empty on arrival at Ballarat.
The processes involved in train preparation did not ensure a required minimum amount of sand in sand boxes. [Safety Issue]
Loss of adhesion leading to increased stopping distance was not recognised as a risk source for any type of collision in V/Line’s risk registers. [Safety issue]
Train 8185 passed through 39 points and the associated turnout at a speed estimated to be greater than 110 km/h. This reduced its margin for navigating this turnout safely, and without overturning or derailment.
Other findings
Comparison with experiments conducted on sander nozzle discharge position found that the nozzles on car 1270 were higher and more longitudinally offset from the wheel-rail contact point than all tested samples. Research indicates that the height and offset of the sander nozzle outlet relative to the wheel-rail contact point influences the proportion of sand deposited on the rail.
Winds at the time of the event were strong and orientated across the direction of travel of train 8185 as it approached Ballarat Railway Station. Research indicates that even moderate crosswinds can influence the amount of sand reaching the rail.
The driver did not have information on the severity of the very low wheel-rail adhesion that would exist on the approach to Ballarat, limiting their ability to take informed action.
The driver did not have information about the ineffective sander performance, limiting their ability to take informed action.
V/Line drivers did not receive ongoing driving simulator instruction in handling very low adhesion conditions.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
V/Line
V/Line personnel
Event recorders from train 8185 and other V/Line trains
Bombardier sanding test results
Monash Institute of Railway Technology (IRT) track inspection and measurements
Bureau of Meteorology
Environmental Protection Agency (Vic)
CCTV footage from Ballarat Railway Station
Photographs taken on the day after the incident
References
ATSB rail occurrence investigation RO-2013-005 Collision of passenger train T842 with station platform, Cleveland, Queensland, 31 January 2013, Australia.
DOI (Department of Infrastructure, Victoria) (2006). Regional Fast Rail Project: Turnout Safety Analysis, prepared by TCCI (Transportation Technology Center, Inc), U.S.A
FRA (Federal Railroad Administration) (1980), Standard 49 CFR 223 Safety Glazing Standards - Locomotives, Passenger Cars and Cabooses. Department of Transportation, U.S.A.
FRA (Federal Railroad Administration) (2017), A survey of wheel/rail friction, Department of Transportation, U.S.A.
IRT (Monash Institute of Railway Technology) (2020), Ballarat rail measurements for V/Line Pty Ltd, Report No: Monash/RT/2020/1521, Australia.
Lewis SR, Riley S, Fletcher DI and Lewis R (2018) ‘Optimisation of a railway sanding system for optimal grain entrainment into the wheel–rail contact’. Proc IMechE Part F: J Rail and Rapid Transit 2018, Vol. 232(1) 43–62.
OCI (Office of the Chief Investigator, Transport Safety) (n.d.) Platform overruns Siemens Nexas EMU Connex / Metro Trains Melbourne, Rail Safety Investigation, Report No 2009/05.
Olofsson U, Zhu Y, Abbasi S, Lewis R and Lewis S (2013). Tribology of the wheel−rail contact – aspects of wear, particle emission and adhesion. Vehicle System Dynamics. 51. 1091-1120.
ONRSR (Office of the National Rail Safety Regulator) (2019) Reporting requirements for notifiable occurrences, Australia.
RAIB (Rail Accident Investigation Branch) (2005) Autumn Adhesion Investigation Part 3: Review of adhesion-related incidents, U.K.
Railway Safety (2001) Sanding Equipment Fitted to Multiple Units and On-Track MachinesRailway Group Standard GMRT2461, Issue 1, U.K.
RISSB (Rail Industry Safety and Standards Board) (n.d.) Hazard register, RISSB website, accessed 8 March 2022.
RISSB (Rail Industry Safety and Standards Board) (2014), AS 7510.3:2014 Braking Systems on Multiple Unit Passenger Rolling Stock, Queensland.
RISSB (Rail Industry Safety and Standards Board) (2018), AS 7711:2018 Signalling Principles, Rail Industry Safety and Standards Board, Queensland.
RISSB (Rail Industry Safety and Standards Board) (2020) AS 7658:2020Level crossings – rail industry requirements, Queensland.
RSSB (Rail Safety and Standards Board) (2009)Understanding the current use of sanders on multiple units, Research Report T796’, U.K.
RSSB (Rail Safety and Standards Board) (2014) Investigation into the effect of moisture on rail adhesion, Research Report T1042’, U.K.
RSSB (Rail Safety and Standards Board) (2018) Trial of sander configurations and sand laying rates, Research Report T1107’, U.K.
RSSB (Rail Safety and Standards Board) (2021)Sanding EquipmentRailway Group Standard GMRT2461 Issue 3.1, U.K.
Standards Australia (1995), Safety glass for land vehicles, AS 2080, Standards Australia, NSW.
Transit Cooperative Research Program (TCRP) (1997) ‘Improved Methods for Increasing Wheel/Rail Adhesion in the Presence of Natural Contaminants’, Research Results Digest 17.
Veerbeck H (1973) ‘Present knowledge of adhesion and its utilization’, Rail International, No 6.
VRIOG (Victorian Rail Industry Operators Group Standards) (2010)12.0.1 Signalling Principles – Overlaps, Victoria.
V/Line (n.d.) Professional Driving Booklet MSR01345
V/Line (2013) VLocity Information Notice V38: Braking in Slippery Track Conditions.
V/Line (2017) Rail and Wheel Profiles,. NIST-2621, Revision 1.
V/Line (2019) Work Instruction VEWI-79 VLocity servicing schedule, revision 5.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
V/Line
The crew of train 8185
Alstom (Bombardier were acquired by Alstom)
ONRSR
RISSB
City of Ballarat
Department of Transport (Vic)
Monash Institute of Railway Technology
Submissions were received from the driver of train 8185 and all consulted organisations. Submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Sand box configuration and operation
The sander fitted to the VLocity used compressed air to agitate the sand in the sand box and discharge the sand at a metered rate through the discharge nozzle (Figure 33).
Figure 33: Air and sand flow controlled by sand box metering unit
Source: CITS, adapted from diagram by Knorr-Bremse (not to scale)
When operating, pressurised air was supplied from the main reservoir into the sand box through a sintered plate. Inside the sand box, the air supply stream divided into two streams, the exhaust air stream (1), and the metering air stream (2). The exhaust air stream agitated the sand in the sand box to make it flow more readily and was returned to the manifold through the exhaust cap and hose. The metering air stream flowed through the sand dome and conveyed the sand through the sanding discharge pipe at the base of the sanding unit.
Appendix B – Sand used and comparison with guidelines
Sand specification
The sand used in VLocity sanders was silica sand, sourced from local sand quarries and screened to a specified grain size. The sand was specified as 16/30 and was sized according to a sieve analysis (Table 6). The sand was also specified to have a maximum uniformity coefficient of 1.6.[1]
Table 6: Size specification for sand used on VLocity
Sieve size (mm)
1.700
1.400
1.180
1.000
0.850
0.600
0.425
Per cent passing (by weight)
100
99.9
98.2
88.5
70.3
12.3
2.1
Source: V/Line
Comparison with sand standards for braking applications
The Rail Industry Safety and Standards Board (RISSB) standard for braking systems on multiple unit passenger rolling stock (RISSB 2014), stated that:
Sanding systems should, in general, conform to the requirements of GM/RT2461.
Standard GM/RT2461 (RSSB 2021) was developed as a Railway Group Standard in Great Britain and specified requirements for sand types to be used in both braking and traction sanders. The standard advised that coarse/medium grain size sand was more suitable for use in braking sanders owing to the grain size tending to be larger than the rail contaminant layer and providing a mechanical link between the wheels and rails.
The standard stated that the sand for braking sanders should have a uniformity coefficient less than 1.5, and that the maximum proportion of grains with a diameter of less than 0.71 mm should not exceed 5 per cent by weight. A sieve analysis conducted by the supplier of sand for the VLocity trains found that approximately 45 per cent of the sand had a diameter of less than 0.71 mm. The sand used for the VLocity trains was therefore finer than that specified by GM/RT2461 (RSSB 2021). Research and standards suggest the sand used was probably better suited to addressing wheel spin rather than wheel slide.
Appendix C – Measurement of sander flow rates on other VLocity
Other overrun events examined
An examination was made of sanders fitted to nine VLocity trains involved in 10 overrun events between April 2010 and June 2020. There were 66 reported overrun events involving VLocity trains during this period. The 10 incidents selected for further analysis involved trains that experienced overruns of greater than 100 m, or events that were on the same day.[2] Several of the overrun events were in the Macedon (Ranges), and the others distributed (Table 7).
Table 7: Significant VLocity overshoot events selected for further analysis, by location
Location
Macedon
Trafalgar
Drouin
Rochester
Riddles Ck
Number of events
5
2
1
1
1
Source: V/Line
Results of sander flow tests
The sand flow rates from the four sanders fitted on each of the nine trains selected were measured in testing conducted in July 2020 (Table 8). The flow rates were first measured without unit maintenance (36 tests). Fifteen of the 36 units tested did not meet the desired sand delivery output of between 1.5 to 2 kg/min on their initial flow tests. For those units where the desired flow rate was not achieved (in italics in Table), the sanding system was subjected to maintenance[3] until a desired sand flow rate was achieved. Where the flow rate of between 1.5 and 2 kg/min was achieved on initial testing, the system was generally not tested a second time.
Table 8: Sand flow measurements of nine VLocity sets involved in overruns
First sand flow measurements (kg/min), conducted July 2020
Second sand flow measurements, after maintenance (kg/min)
Unit No.
DM(D) Side A
DM(D) Side B
DM Side A
DM Side B
DM(D) Side A
DM(D) Side B
DM Side A
DM Side B
VL23
1.95
1.65
1.75
1.75
[1]
[1]
[1]
[1]
VL12
0.94
1.635
1.8
1.5
1.63
1.625
[1]
[1]
VL64
1.69
1.16
0.83
0.02
1.9
1.97
1.99
1.92
VL66
0.98
1.12
0.66
0.13
2.14
2
1.92
2.25
VL15
1.05
0.95
0.25
1.05
1.75
1.55
1.85
1.65
VL01
2.08
1.89
1.74
1.95
[1]
[1]
[1]
[1]
VL03
1.95
1.95
1.9
2
[1]
[1]
[1]
[1]
VL26
1.61
0.07
1.5
1.65
1.6
1.6
[1]
[1]
VL50
0.11
1.64
2.08
0.78
2.06
1.78
2.15
2.03
[1] No data recorded as expected sand flow rate was met in the first test. Source: V/Line, Bombardier.
Appendix D – Information on driving in low adhesion conditions
Appendix E – Retardation during full-service brake application
The period of consistent full-service braking has been used to estimate the average retardation of train 8185 achieved during this period.[4]
For this period, a train retardation of about 0.2 m/s2 (represented by the slope of the blue dashed line) was achieved compared to a full-service braking rate in dry conditions of 0.95 m/s2 (Figure 34).
Figure 34: BCU, pulse and speed estimated from GPS, from 2.5 km to 450 m from intended stopping point at Ballarat Railway Station.
The figure shows a comparison of the BCU speed with pulse speed and the speed estimated from GPS recordings. The pulse speed is the speed recorded by one of the third axle on car 1270, whereas the BCU speed represents the speed of the fastest rotating axle on that car. The dashed line represents an estimate of the average reduction in speed over the period.
Source: CITS, based on train 8185 event recorder and GPS data
The level of adhesion has been estimated as the ratio of the longitudinal force and normal force (weight). Considering grade, available adhesion experienced by train 8185 was estimated to probably be between 0.02 and 0.03 on the approach of train 8185 to Ballarat Railway Station. This reflects very low to extremely low levels of friction and compares to a required adhesion at the wheel-rail interface for full-service braking retardation of at least 0.1.
Appendix F – Test data on implications of nozzle position
Experiments were identified that measured the amount of sand delivered to the rail head for different nozzle positions (Lewis et al. 2018). Tests were conducted with a 25 mm diameter hose fitted with a nozzle and the nozzle at various positions relative to nip and rail. Tests were conducted under dry conditions, with the discharge nozzle in front of wheel at a 15-degree angle to the rail, and a 48 km/h longitudinal wind.
The height and distance of the nozzle from the wheel-rail contact point was found to influence the proportion of the sand reaching the interface (Figure 35).
Figure 35: Mass of sand deposited on rail for different nozzle positions
Source: Lewis et al (2018). adapted by CITS
The specified position for the VLocity discharge nozzle and the actual position of the nozzles on car 1270 of train 8185 were plotted alongside the test results for reference. Direct qualitative comparison with the test results was not possible given the difference between test conditions and the sander orientation on car 1270.
Appendix G – Performance testing on sanders in Great Britain
Testing of sanding systems by Rail Safety Standards Board (RSSB)
In 2009, the RSSB published research that evaluated the performance of sanders on multiple units in Great Britain (RSSB 2009). The findings showed that there was considerable variability in performance of sanding systems with many operating well below the 2 kg/min discharge rate recommended by guidance in issue 1 of GM/RT2461 (Railway Safety 2001). The large variation in discharge rates reported by RSSB was thought to be due to several factors, including discharge hose length, hose bore diameter, nozzles fitted to the end of discharge hoses, dampness of sand, and design of sand storage hoppers. The report specified the lack of regular maintenance and ineffective design as causes for sanding systems not dispensing the required amount of sand. The testing also suggested that performance may deteriorate over time.
Comparison between RSSB data and VLocity measurements
The RSSB test result distribution was compared with the 36 tests conducted by Bombardier in July 2020 on nine VLocity sets (Figure 36). The mean discharge rate from 330 RSSB tests was 1.148 kg/min, that was similar to the VLocity mean of 1.236 kg/min. Figure 36 shows the distrution of sanding rates for SDN14 units which are equivalent to those installed on VLocity trains.
Figure 36: Comparison of sanding rates - RSSB (2009) and Bombardier tests on VLocity
Source: CITS, Bombardier, RSSB
Appendix H – Risk mitigation for rail overruns of level crossings
Australian level crossing standard
Noting that the version cited was not published at the time of the incident, the Australian level crossing standard[5] stated the requirement that rail traffic shall have priority over road and pedestrian traffic at level crossings. For the hazard associated with a train passing a signal displaying a stop indication (SPAD), the standard stated the following possible mitigation:
New level crossings should be located beyond a signals safety zone (overlap).[6] Existing signals may be relocated to meet the necessary safety zone (overlap). Train protection systems may also be a mitigation.
The Ballarat Railway Station precinct dates to the nineteenth century and the crossing gates at Lydiard Street North were not located beyond the safety zone of signal 20. The standard identified train protection systems as also a possible mitigation.
Australian standard for signalling principles
The Australian standard for signalling principles, AS 7711:2018 (RISSB 2018), also considered the risk of a signal near a crossing and stated:
Where the position of a signal presents the risk of a significantly reduced crossing warning time in the event of the overrun of a signal additional controls should be considered to mitigate the risk.
AS 7711:2018 also advised that:
…predictive systems can be used to activate the crossing where overspeeding is detected on the approach to the stop signal.
Appendix I – Comparison of braking on trains 8185 and 8181
Graphical presentation of braking profiles
The approach of train 8185 into Ballarat was compared with the previous train that evening, train 8181 (Figure 37). Both trains were three-car VLocity trains and braking on both was initiated about 5 km from the intended stopping point, and when the trains were travelling at around 160 km/h.
Figure 37: Speed (BCU)[7] and braking profile comparison of trains 8185 and 8181
Source: CITS (from data provided by V/Line)
Comparison of braking profiles
The approach of train 8181 and its arrival at the station were unremarkable and no activation of either the WSP system or of sanding was observed. The train speed was reduced in increments as the train approached the 40 km/h-limited crossover that directed the train onto the track for the № 1 platform. Between 2.8 km and 800 m from the station stop, brake applications were between 70 per cent and 20 per cent of a full-service application, except for a short application at about 80 per cent.[8] During this period, the average retardation of train 8181 was about 0.4 m/s2, with a peak retardation of about 0.6 m/s2. The train coasted to the platform for a normal stop.
From approximately 2.6 km before the intended stopping point, the driver of train 8185 made a full-service brake application. However, average retardation achieved was only about 0.2 m/s2 and insufficient to slow the train for the intended stop. This compares to the 0.4 m/s2 retardation of train 8181 with significantly less brake demand.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
[1] A numerical expression of the variety in particle sizes, defined as the ratio of the sieve size through which 60 per cent (by weight) of the material passes to the sieve size that allows 10 per cent of the material to pass. It is unity for a material whose particles are all of the same size, and it increases with variety in size
[2] Events with overruns of greater than 100 m and events that were on the same day were selected based on the assumption that these would have a greater probability of being low-adhesion events rather than another type of error.
[3] Maintenance involved addressing any air leaks and removing air flow restrictions.
[4] There was a period of about 4 s during the 66 s period when braking was reduced below full-service braking.
[5]Rail Industry Safety and Standards Board (2020), AS 7658:2020 Level crossings – rail industry requirements. This standard was published after the Ballarat incident.
[6] The Victorian Rail Industry Operators Group standard for overlaps (VRIOG 2010), stated the minimum overlap length is the longest of the emergency braking distances of the train types being considered, from the authorised speed at the warning aspect to the target speed at the end of overlap, plus a 10 per cent distance safety margin. The standard also stated the minimum mainline overlap length shall be 100 m for line speeds up to and including 40 km/h
[7] The speed graphed is that of the fastest rotating axle on car 1270 (the BCU speed). For train 8185, this speed did not represent the actual train speed at the points when all axles were sliding.
[8] Based on recorded brake demand, expressed as a percentage of the maximum 64 kN.
[5] During wheel slide activity, train recorded speeds are unreliable. GPS data has been used to assist speed estimation.
[6] From this point, the WSP system remained activated until the train came to a stop after the collision.
[7] The lights would have been flashing for approximately 22 s, compared to a minimum warning time at the crossing of 26 s under normal conditions
[8] An electric circuit where current is carried through the rails and used to detect the presence of trains. Track circuits are used in the operation and control of points and signalling equipment.
[9] The front windscreen was equipped with glass fabricated to comply with the requirements of BR 566 – ‘Specification for High Impact Windscreens’ type 2.
[10] All side facing glazing were single glazed, and of a single laminated construction in compliance with AS 2080 Appendix K (Standards Australia 1995). The glass was also specified to comply with the impact performance requirements of FRA Standard 49 CFR 223 Type II (FRA 1980).
[11] PM10 are very small particles found in dust and smoke. They have a diameter of 10 micrometres (0.01 mm) or smaller.
[12] Broad gauge on the V/Line network is nominally 1600 mm. The RFR track on the approach to Ballarat was measured, on average, at about 1593 mm. The tight gauge was associated with sleeper manufacture.
[13] If a train passed a signal at danger (stop) without authority, TPWS TSS would initiate an emergency brake demand on those trains fitted with the compatible train-borne equipment. VLocity trains are fitted with such equipment.
[14] Facing points are points with the switch blades facing approaching rail traffic.
[15] The mechanical system to operate the gates was retained in the Ballarat B signal box for emergency use.
[17] In 2021, Alstom announced the completion of the acquisition of Bombardier Transportation, which included Bombardier Australia.
[18] Items addressed in the preparation process were listed in the Operator’s Manual (V/Line 2016). When making rollingstock ready for service, the preparation driver was required to sign a pro-forma signifying fulfillment of this process. This record was then archived. There was no checklist of individual items completed by the preparation driver as part of this task.
[19] A brake demand at the full-service level of 64 kN was not the brake force actually applied (due to WSP activation, see wheel slip/slide protection description) but was rather the driver brake control setting.
[20] The speed graphed is the BCU speed, based on the fastest rotating axle on car 1270. The regular sudden drop in BCU speed represent axles being in wheel slide during the systems attempts to apply braking force at the wheels. These sudden dips in the BCU speed do not represent an actual reduction in train speed.
[21] Distances are estimated from logged train GPS location data
[22] The brake demand is described here as a percentage of the maximum value of 64 kN.
[23] The full-service brake cylinder pressure on a VLocity car is approximately 300 kPa. ‘Full-service’ is the term for a maximum brake application under normal (non-emergency) running conditions.
[24] The train horn was sounded a number of times through this phase of the approach into Ballarat.
[25] Emergency braking is designed to disable dynamic brake and exhaust the brake pipe, increasing the deceleration from nominally 0.95 m/s2 to 1.1 m/s2 on dry, level, tangent track.
[26] The reasons for a short period of recorded sander inactivity from about 23:35:44 (as logged) was not determined.
[27] The MP2 wheel profile was originally developed for use on the disc braked passenger rolling stock which operate on the Metropolitan Melbourne network.
[28] Wheel hollowing is where the wheel surface in contact with the rail is gradually worn to form a hollow shape. The wheel tread is worn below the level of the end of the thread.
[29] Site locations measured from Melbourne. Lydiard Street North level crossing was located at a chainage of 113.923 km.
[31] The down rail is the left side rail when travelling from Melbourne to Ballarat. The up rail is the left side rail when travelling from Ballarat to Melbourne.
[32] The rail profile specified for this section was RTG2000 (V/Line 2017).
[33] Push tribometer instruments were generally known to provide higher friction measurements than full scale wheel-rail tests, primarily due to differences in contact geometry, creep behaviour and speed. IRT guidance of around a 39 per cent reduction for a train travelling at 160 km/h referenced Veerbeck (1973). Other research also notes that adhesion was governed by the characteristics of the interfacial layer and the amount of moisture present, and the effect of speed on the interfacial layer was not clear (Federal Railroad Administration 2017).
[34] The geometric analysis did not consider effects of vehicle dynamics, load imbalance, track geometry irregularity or wheelset angle of attack. While these may have had an effect, it would not be expected to be as significant as the geometric conditions.
[35] Wheel 1 is the front right wheel in the direction of travel. Wheel 8 is the front left wheel.
[36] Wheel 3 is the third right wheel of the car in the direction of travel. Wheel 6 is the third left wheel of the car.
[37] Three likely contact scenarios were considered, referenced as 1mm offset, 2 mm offset and 3 mm offset from flange contact condition.
[38] Braking equipment that enables a train driver to apply variable retardation by the utilisation of the transmission system of a train fitted with a hydraulic power transmission system (RISSB 2014).
[39] Hydrodynamic braking on the VLocity is only available above 40 km/h. Below this speed, the braking is by friction braking.
[40] Emergency braking could be applied through the power/brake controller, an emergency push button located in the cab at either end of the train, a secondary brake controller, the emergency brake cock, or (if triggered) via other systems such as TPWS or the train’s vigilance control.
[41] The European standard for wheel slide protection (CEN 2018) stated that if the adhesion remained at an extremely low level, alternative strategies of WSP control may be adopted. For example, controlling the axles at different levels of slide or allowing the wheelsets to lock.
[42] The routine test procedure did not specify a test for the independent monitoring function, as described in the technical description of the VLocity braking system (Bombardier 2017).
[43] 3.9 kg is approximately the sand minimum level to dispense sand from the sand box. A small amount of sand was dispensed during a functional test prior to this measurement, and the box may therefore have contained slightly more sand than this measured value.
[44] The same sand was supplied for tests as that used for filling sand boxes on VLocity trains during maintenance.
[45] Vehicle load condition based on the design mass in working order in accordance with European Committee for Standardization standard EN 15663 (CEN 2009).
[46] The testing specification did not require a specific level of wheel-rail adhesion to be achieved by the mix.
[47] The terminology of precursor and source of hazard is consistent with that used in the RISSB hazard register.
[48] The braking was briefly reduced for about 3 s during this 66 s period of full-service brake application.
[49] The level of adhesion has been estimated as the ratio of the longitudinal force and normal force (weight).
[50] Moisture, even in small amounts, on the rail surface is the single most important contaminant responsible for loss of adhesion (TRCP 1997).
[51] Conducted on the day following the overrun incident.
[52] The two-car VLocity trains were acquired as part of an operator franchise commitment. The operator at the time of the initial technical specification for the two-car VLocity was National Express Group Australia (V/Line Passenger) Pty Ltd.
[53] A full sand box contains about 25 kg of sand.
[54] The actual amount of sand in the sand boxes was slightly more than that recorded, due to a small amount of sand being lost during a functional test after the event and before the measurement of the amount of sand remaining.
[55] Based on a maximum potential flow rate of 2 kg/min, it was estimated that the sanding mechanism on side B could have dispensed up to 9 kg on this journey.
[57] Discharge rate of 2 kg/min contained in guidance in issue 1 of GM/RT2461 (Railway Safety 2001)
[58] An electric circuit where current is carried through the rails and used to detect the presence of trains. Track circuits are used in the operation and control of points and signalling equipment.
[59] Cant is the intended height difference in the rails (i.e. where the track is inclined in a curve).
[1] The term ‘adhesion’ is commonly used in the rail industry to describe the level of friction available to transfer forces between the wheel and the rail. This term is used throughout this report.
Preliminary report
Report release date: 06/10/2020
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
The occurrence
On Saturday 30 May 2020, V/Line train 8185 was a scheduled service from Melbourne’s Southern Cross Station to Wendouree in suburban Ballarat. The train departed at its scheduled time of 2216[1] and stopped at several stations en-route, including Ballan. On the approach to Ballan, the train experienced a minor degree of wheel slide[2] during braking, but was able to stop normally. The driver reported light rain and gusty winds at this time.
Figure 1: Rail route from Melbourne to Ballarat and Wendouree
Source: Google Maps. Annotated by Chief Investigator, Transport Safety
Departing Ballan, the driver began to experience wheel slip[3] events during powering and as the journey progressed, instances of wheel slide during braking. The train’s event recorder detected that the Wheel Slip/Slide Protection system (WSP)[4] was active for about 75 per cent of the time in the first 5 km after departing Ballan.
On the approach to Ballarat, the driver reported having commenced braking slightly earlier than would normally be the case due to the wet and windy weather conditions. The train’s event recorder detected braking being initiated at 23:33:44, with the train 4.9 km from Ballarat Station and the train travelling at approximately 160 km/h[5]. After 6 s of braking, the train’s WSP system detected wheel slide. Two seconds later, operation of the train’s sanding valve for a period of 3 s was detected. At 23:33:56, the driver released the brake and then re-applied it 1 s later. The brake was again released at 23:34:04, with the train travelling at 141 km/h. Shortly before the brake was released, operation of the sanding valve for a further 5 s was recorded.
The train then coasted for 23 s at which point the driver again made a further brake application. At this point, the train was 3.1 km from Ballarat Station and travelling at approximately 160 km/h, its speed having increased on the downgrade. Four seconds later the train’s WSP detected wheel slide and the WSP remained in this state for the rest of the approach into Ballarat. Two seconds later, the sanding valve was again activated and remained operating for a period of 71 s.
At 23:35:35, and approximately 650 m from the intended stop at Ballarat Station, the train passed over Humffray St level crossing at about 117 km/h. It is likely that the flashing lights, bells and boom barriers were all operating when the train passed through the crossing but with reduced warning time. Fourteen seconds later, at 23:35:49, the driver applied the Emergency brake, with the train recorded as travelling at 99 km/h and 235 m from the intended stopping point. At approximately the same time, the train passed across a set of facing points, which were speed limited to 40 km/h,[6] and onto the southern track that lead to platform 1. The train passed through Ballarat Station at about 100 km/h.
Figure 2: Ballarat railway station locality and level crossings
Source: Google Maps. Annotated by Chief Investigator, Transport Safety
The train passed its intended stopping point at the western end of Ballarat station at 23:35:59, travelling through the Departure signal at Stop, and continued through Lydiard St railway crossing around 2 s later at a speed of 93 km/h. One second before the train passed through the crossing, the road traffic lights changed from showing a green indication to a flashing amber. However, the gates were still across the railway track rather than protecting the crossing from road traffic and were struck by the train (Figure 3). Approximately 49 s before the train passed through Lydiard St, CCTV recorded a group of three pedestrians passing over the crossing.
The train continued westwards, through a set of trailing points with a speed limit of 40 km/h and onto the main line, passing over Doveton St North level crossing at 23:36:18, 377 metres from its intended stopping point, and travelling at 73 km/h. It is likely that the flashing lights, bells and boom barriers were operating when the train passed through the crossing, but with reduced warning time. The train came to a stop approximately 600 metres west of its intended stopping point at 23:36:38.
Figure 3: VLocity 3VL70 having impacted the first gate and about to strike the second. Train is running from right-to-left
Source: V/Line Corporation
The driver at this point communicated with Centrol[7] to report the incident and arrange for an emergency response. The conductor who was in the rear driver’s cab moved forward along the train and then checked on the two passengers in the front carriage before checking on the driver.
Passengers and crew had been subjected to high lateral forces as the train negotiated the points. One passenger had been seated as the train arrived into Ballarat Station. This person indicated to the conductor that they were uninjured. The other passenger had been standing near an exit door as the train approached Ballarat Station. This person sustained head, back, and leg injuries and was taken off the train by emergency services and admitted to hospital.
Once the passengers were detrained, the conductor was also admitted to hospital for assessment and later discharged.
Context
Track and gradient
The track between Melbourne and Wendouree is Class 1 (160 km/h) constructed on concrete sleepers, and was upgraded between Deer Park West Junction and Ballarat as part of Victoria’s Regional Fast Rail (RFR) project completed in 2006.
From about 6.5 km out, the track approaching Ballarat Railway Station is on an approximate 1-in-52 downgrade. This continues for around 4 km, then eases over a further 1.4 km to be slightly uphill (1:737) briefly, then at 1:383 (also up) along the station platform.
Lydiard St level crossing
The level crossing over Lydiard Street North is immediately adjacent to the west end of the Ballarat Railway Station platforms. A set of swing gates (Figure 4) that protected the crossing are a heritage-listed unique Victorian historical artefact, approximately a century old, and an element of the preserved station precinct. When required, they swing through 90 degrees across the road to permit the passage of rail traffic. They were interlocked with signalling and controlled from the Centrol train control facility in Melbourne.
Source: Pass Assets - Department of Transport (Vic)
Damage to level crossing
VLocity 3VL70 impacted the gates at a speed of approximately 93 km/h (Figure 3) destroying the two gates forming the southern crossing barrier (Figure 5). Parts of the gate assembly were later found lodged in adjacent buildings.[8]
Figure 5: Remnants of damaged gate – southern side
Source: V/Line Corporation
Train information
V/Line service 8185 on the 30 May 2020 comprised 3VL70, a 3-car VLocity Diesel Multiple Unit (DMU) set consisting of, in the direction of travel, DM1270 (a powered car with driving cab), TM1370 (a powered intermediate car), and DM(D)1170 (a powered car with driving cab and toilet facilities with Disabled Access). The vehicles were designed, manufactured, and are maintained under contract, by Bombardier Australia. They operate at a maximum service speed of 160 km/h.
Figure 6: VLocity Diesel Multiple Unit
Source: V/Line Corporation
Traction power is provided by a turbo-charged, 559 kW, 6-cylinder diesel engine under each vehicle, driving both axles of the cab-end bogie of DM and DM(D) cars as well as the № 1-end bogie of the intermediate TM car (refer to Figure 7, powered bogies being shown in brown).
This tractive force is delivered from the engine via an automatic hydrodynamic transmission comprising a torque converter (low speed) and two hydraulic couplings for higher speed.[9] The hydrodynamic transmission delivers power through cardan shafts to a final drive unit on each of the two axles of the power bogies. During train braking, the transmission is used as a retarder to provide hydrodynamic braking, which is ‘blended’ with friction braking provided by electro-pneumatic (EP) disc brakes on each axle.
VLocity DMUs are equipped with a Wheel Slip/Slide protection system (WSP) to optimise traction and braking levels and prevent damage to wheels and track in cases of reduced adhesion conditions. The WSP system functions such that:
In the event of wheel slip being detected (powered axles are rotating faster than non-powered axles), engine speed and tractive effort are automatically reduced. Upon correction of the wheel slip, the system will re-apply tractive power according to the train driver’s power control (throttle) setting. Any such reduced engine output on an affected vehicle will be evident to the train driver from engine tachometer indications and a wheel slip warning light on the control panel. The wheel slip warning light will extinguish when adhesion is regained. Sanding may be automatically applied, and if so, a separate warning light will be displayed.
In the event of wheel slide being detected in braking, brake cylinder pressure will be reduced (and hydrodynamic braking terminated) to regain optimum braking effort for the available adhesion. Sand may be automatically applied to the rail. Once the wheel slide has been corrected, the system will reinstate braking effort according to the train driver’s brake control setting.
Sanding System
VLocity DMUs are fitted with a sanding system to apply sand to the rail head to improve the friction between the wheels and rail in low adhesion conditions. Sand can be applied automatically by the WSP system or manually by the driver using a foot pedal. Sanders are located at the front and rear of the set, and the TM cars are not equipped for sanding (Figure 7).
Figure 7: VLocity DMU traction and sanding arrangement
Source: Chief Investigator, Transport Safety
If the train is under power, sand is applied to the rear of the lead bogie of the DM car and in front of the last bogie at the rear of the train (DMD car in this case). Under braking, sand is applied behind the trailing axle of the lead bogie at the front of the train (DM car in this case).
Event recorder
The train was equipped with a Faiveley Transport VM-40 Event Recorder that logs 48 digital and 20 analogue parameters from the VLocity subsystems and equipment. Parameters of interest include:
driver power and brake controller demand
brake cylinder pressure
axle velocity
calculated train velocity
sanding
Wheel Slip/Slide protection system activation
train location and time from an on-board GPS[10] receiver.
VLocity damage
The front of the lead carriage (1270) was significantly damaged, particularly the windscreen (Figure 8) and the passengers’ window where parts of the gate impacted the left side of the carriage (Figure 9).
Figure 8: VLocity car 1270 –impact damage to front of train
Source: Chief Investigator, Transport Safety
Figure 9: VLocity car 1270 damage to passenger side window from impact of gate debris
Source: Chief Investigator, Transport Safety
Weather
The Bureau of Meteorology station at Ballarat Aerodrome recorded an air temperature of 9.0 °C and a relative humidity of 90 per cent at 2330 on 30 May 2020. Wind was from the north at 33km/h, gusting to 42 km/h and a light drizzle fell between 2300 and 2330 (0.2mm).
Safety action
As a result of testing, performance issues with the sanding system on VLocity 3VL70 were identified and Bombardier has subsequently undertaken fleet-wide testing of VLocity sanders and performed remedial action where required.
Further investigation
To date, the ATSB has:
carried out inspections of rollingstock and testing of the brake and sander operation
carried out analysis of event recorder data
conducted interviews with train crew
examined evidence around track geometry and rail head condition.
The investigation is continuing and will include the review and examination of:
operation and maintenance of the VLocity sanders
evidence in relation to rail condition and wheel/rail interface
dynamic performance of the braking system
train operation and performance.
Should a critical safety issue be identified during the course of the investigation, the ATSB will immediately notify relevant parties so appropriate and timely safety action can be taken.
A final report will be released at the conclusion of the investigation.
Acknowledgements
The ATSB acknowledges the cooperation received from V/Line Corporation and Bombardier during the initial investigation.
This preliminary report details factual information established in the investigation’s early evidence collection phase, and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 24 May 2020, APL England was making way down the east coast of New South Wales, with a cargo of containers, bound for Melbourne, Victoria. Early that morning, in adverse weather, the ship underwent a series of heavy rolls that resulted in the loss of 50 containers overboard and shutdown of the main engine.
What the ATSB found
The ATSB found that APL England’s fixed container securing arrangements on deck were in a poor state of repair and the strength of many securing fixtures was severely reduced by corrosion. In the seas encountered, the fittings failed, and containers were lost overboard. The investigation also found that this condition would have taken several years of poor maintenance to develop. This showed that the ship had not received the scrutiny from crewmembers, shore management or other agencies that a ship of its age or condition required. This presented an increased risk to the continued safe operation of the vessel, security of the cargo carried, and safety of crew members working around the containers.
In addition, the investigation found that procedures for adverse weather were not followed. Had these procedures and associated assessment tools been used, navigational and operational decisions could have been made, which would have better prepared the ship for the conditions encountered.
What has been done as a result
In addition to the repairs conducted on APL England, the ATSB has been advised that the deck and container fittings in all other vessels in the APL fleet were inspected and repaired as required. The company also implemented improved vessel inspections and associated reporting requirements for both ship and shore staff. APL assessed the safe stowage and carriage of high cube containers and conducted an internal safety assessment of the practice. As a result, limits were placed on the numbers of high cube containers that could be loaded into bays fitted with cell guides, which limited the extent to which containers protruded above the cell guides. Cargo securing manuals were reviewed and updated to include the revised stowage arrangements for high cube containers.
Additionally, APL implemented additional safety action regarding passage planning and navigation in heavy weather. They also advised that the wider CMA CGM Group and subsidiary entity fleets were made aware of these issues and the safety actions taken in response to this investigation.
Finally, in July 2022 the classification society, DNV, updated Class Guideline DNV-CG-0182 to include a new section which provided requirements and guidance on the allowable wear and tear of container supporting structures and container securing equipment.
Safety message
This investigation highlights the importance of regular maintenance of vessel fixtures to ensure the security and stability of the ship and its cargo, as well as crew safety.
Ships’ officers and crew are also reminded of the importance of adhering to the cargo securing manual and of following specific procedures and guidance material to assist preparations for, and decision making during, adverse weather conditions.
The occurrence
Passage to Australia
On 11 May 2020, the 5,780 TEU[1] fully-cellular container ship APL England (Figure 1) departed Ningbo, China, bound for Sydney, New South Wales. The ship was loaded with 3,161 containers (5,048 TEU), with a forward draught of 11.44 m, an aft draught of 13.32 m, and a GM[2] of 1.69 m. The Singapore-flagged ship was technically managed by the CMA CGM International Shipping Company Pte. Ltd (CCISC).
The vessel’s load computer results based upon ship conditions on departure from Ningbo showed 9 lashing force exceedances, from 102–107% of the maximum force (see the section titled Load computer). The master and chief mate accepted these values in the knowledge that changing ship conditions (ballast and fuel) would bring these forces within the acceptable range as the voyage progressed.
On 13 May the master was informed of a change in destination from Sydney to Melbourne, Victoria.
On 22 May, the master received weather advice from the CMA CGM group Fleet Navigation and Support Centre (FNSC) regarding a low pressure system and high swells (5–6 m) developing off the New South Wales coast. The master monitored the weather forecasts via updates from the commercial weather guidance provider ship performance optimization system (SPOS) service.
Figure 1: APL England arriving into Brisbane
Source: ATSB
On 23 May, at 0800 Eastern Standard Time,[3] the ship was 20 NM north-east of Port Macquarie, making good a speed of 14 knots, in north-westerly winds to force 5[4] (17–21 knots) with 2 m seas on a 2.5 m swell. Over the following hours, the weather deteriorated as the winds moved round to the south and the seas increased. The ship’s pitching and rolling motion also increased. The master ordered the ship’s speed reduced to about 7 knots as the ship was ahead of schedule into Melbourne, and advised the officer of the watch (OOW) to use hand steering as required to reduce the motion. The bridge log recorded that all lashings were checked during the afternoon (log entry time 1630).
The master rested from 2030 to 2300 and then returned to the bridge. At midnight, the OOW recorded in the bridge log south-westerly winds to force 9 (41–47 knots), high seas (sea state 7, 6–9 m wave height) on a southerly 4.5 m swell. At about 0100, with intermittent use of hand steering, the master felt the rolling was acceptable and returned to the accommodation to sleep.
The duty engineer completed the evening inspection of the engine room and at 2130 responded to an engine room alarm. The alarm reset when accepted by the duty engineer, who then returned to the accommodation at about 2200 and went to sleep. At 2326, and again at 2347, the engineer responded to alarms sounding, silencing them on each occasion. The engineer found no faults and attributed the alarms to the motion of the ship.
At 0215 on 24 May, when about 40 NM east of Sydney, the ship underwent a series of heavy rolls. Crew members, including the master and the duty engineer were woken by the heavy rolling, and unsecured items moved and fell to the deck. The master went to the bridge where the OOW (second mate) had re‑engaged hand steering in response to the significant movement.
Just after being woken, the duty engineer received a telephone request from the OOW to stand by in the engine room. At about that time, an engine room alarm sounded, and the engineer went to the engine room to attend to it. The alarm reset upon accepting.
The heavy rolling dissipated while the ship continued to pitch noticeably. At about 0230, the master changed course more southerly to 195°, and maintained a ship speed of about 7 knots in 40–45 knot winds from ahead (south-westerly). This reduced the ship’s motion and the master retired again at about 0300. The duty engineer remained on standby in the engine room and kept watch from the engine control room.
At 0400, the third mate took the navigation watch (OOW), and at about 0420, the master again awoke and returned to the bridge. The ship’s course was altered to 185°, and hand steering used as necessary. The master remained on the bridge, and the duty engineer remained in the engine room.
The incident
Just after 0600, the ship was on hand steering and maintaining its southerly course at about 7 knots (Figure 2). Conditions remained unchanged with the ship pitching and periodically rolling more noticeably in high seas and gale force winds.
At 0610, 46 NM south-east of Sydney, the ship underwent a series of very heavy rolls, to about 25° either side of upright. Again, many items moved and fell to the deck, including those which were previously secure, and personnel held on to maintain their footing.
The movement also resulted in activation of a steering system alarm, followed by an engine room alarm at 0610:28. The duty engineer was seated at the engine control console (near the alarm acknowledge push button) when the heavy roll and alarm occurred. The engineer had to hold on for security and answered the engine alarm 6 seconds after it sounded.
Figure 2: APL England track and incident location
Source: Australian Hydrographic Office, Google Earth, annotated by the ATSB
The ship continued to roll heavily. At 0610:53, 25 seconds after the initial alarm, the main engine shut down due to loss of engine lubricating oil pressure.
The OOW noted the loss of power and slowing of the ship. They alerted the master to the loss of propulsion and, following standard procedure, moved the engine telegraph to ‘stop’.
At 0611:50, the duty engineer informed the OOW that, with the engine telegraph set to ‘stop’, the engine could be started again once the alarms had cleared and the main engine shutdown lockouts had reset. The main engine was subsequently restarted, dead slow ahead.
The events had woken the chief engineer and the chief mate who both went to the bridge. Upon seeing that the main engine had shut down the chief engineer went to the engine room, while the chief mate took control of navigation to recover the ship.
Incident recovery
The ship was turned easterly and then southerly, into the weather. The response was slow and the main engine speed was increased to half ahead. The ship gathered speed and, by 0617, passed 2 knots and continued turning to starboard and south. At 0622 the ship’s speed was 6 knots on a steady 165° heading. The master and chief mate discussed options. It was decided to head north, with the weather, while the situation was assessed further.
The turn to starboard was commenced at 0627 and the ship was steady on a northerly course (about 015°) and with a speed of about 12 knots at 0700. At this time, the ship was 44 NM south‑east of Sydney. The chief mate contacted Sydney vessel traffic services (VTS) and was informed that the weather was not expected to improve and that Sydney and Port Botany were closed.[5]
As the skies lightened (sunrise was at 0647), the chief mate noticed fallen stacks of containers aft, from bay 62 (Figure 3 right). The master notified the company of the incident. Upon returning to the bridge about 10 minutes later, the master was further notified by the chief mate of the damage and loss of containers forward at bay 30 (Figure 3 left).
Figure 3: Looking forward and aft from navigation bridge at about 0700
Source: APL, annotated by the ATSB
On the northerly heading, though the weather remained unabated from the south-south-west, the ship’s movement improved and no further loss of containers occurred. The winds eased to force 7 (28–33 knots) into the afternoon and, at 1600, the ship was passing Newcastle.
Due to the closure of Sydney and nearby ports due to the weather, the decision was made to continue passage to Brisbane, Queensland, the next closest, suitable place of refuge and about 400 NM further north. The weather eased as the ship travelled north. By noon on 25 May, off Byron Bay with 120 NM to travel, winds were force 5 (17–21 knots) from the south-west with sea state 5 (2.5–4 m waves) on a 3 m south-south-easterly swell.
Brisbane arrival
At about 2136 on 25 May, APL England anchored 7 NM off Point Cartwright and the entrance to the Port of Brisbane. Prior to being allowed entry into port, several inspections and assessments by surveyors and maritime authorities were carried out. Maritime Safety Queensland (MSQ) formulated a recovery plan and risk assessment for the operation. Additional piloting, towage, pollution prevention and on-water guidance measures were put in place.
Two days after arriving off the port, at 0600 on 27 May, APL England weighed anchor and proceeded into Brisbane. At 1342 the ship was all fast alongside.
Over the following days personnel representing several different stakeholders attended the ship, including investigators from the ATSB, the Australian Maritime Safety Authority (AMSA) and MSQ.
On 29 May, the first damaged container was removed from the ship. In all, 50 containers were lost (16 from bay 62 and 34 from bay 30), and 79 were damaged but remained on board. One container lost overboard contained hazardous goods in the form of dry powder fire extinguishers. AMSA identified a search area of about 1,000 km2 stretching between the Illawarra and Sydney’s southern suburbs in water depths of up to 200 m.
By 19 June all remaining containers had been discharged and AMSA released APL England to sail from Australia to Zhoushan, China, to undertake repairs. On 4 July, APL England arrived at the shipyard in Zhoushan.
Post-incident inspections identified that more than 550 single and double lashing plates required replacement, along with significant amounts of deck steelwork and structures. This included lashing plates and structures supporting and securing containers lost overboard. APL England underwent repairs and departed the shipyard on 2 August to continue operating. DNV GL placed a condition of class on the ship noting that numerous corroded or thinned bracket/stiffener plates on the exposed weather deck and cross decks remained to be repaired.
Soon thereafter the ship was sold and it changed name, owners, managers, operators, flag, classification society, Protection and Indemnity (P&I) insurers and area of operations.
Context
APL England
At the time of the incident, APL England was owned by CMB Ocean 13 Leasing Company and technically managed by CMA CGM International Shipping Company, both of Singapore. It was chartered by ANL Singapore Pte. Ltd from APL Co Pte. Ltd (APL).[6]
During March 2020, APL changed APL England’s voyage plan from the China–India service to the China–Australia service. APL England completed the China–India service in Manila and in early April proceeded to Shanghai to load for the Australia service.
The change of service prompted increased attention to the ship’s condition (deck and engine room), including deck condition, cargo lashing equipment, access hatches and deck structures as well as other machinery and equipment such as lifeboats, winches and windlasses. Two additional fitters joined the ship to assist with deck repairs and maintenance. Direction was received from, and regular reports were made to, fleet management. A three-day period at anchor to effect repairs and prepare for the change of service was conducted at Shanghai, prior to loading cargo for Australia.
The ship was classed with DNV GL[7] and had completed its most recent annual survey during April 2020.
Crew
APL England had a multi-national crew of 25 including two third mates, two cadets and two supernumerary fitters on deck. The master was from Malaysia and the chief engineer from Singapore. Other deck and engineering officers were from China, the cadets from Malaysia and Singapore, the fitters were from Ukraine and remaining crewmembers were from Myanmar. All were suitably qualified, and Singapore endorsed, for the positions they held.
The deck department consisted of the master plus four deck officers (chief mate, second mate and two third mates) and a deck cadet. There was a boatswain (bosun) and three able seafarers, an ordinary seaman and the two additional fitters for deck maintenance. The able seafarers usually maintained bridge watches overnight and assisted the chief mate and bosun on deck during day watches when available. The two fitters had been recently added to the ship’s complement to assist with deck maintenance under the direction of the chief mate.
The engineering complement consisted of the chief engineer plus three engineers, an electrical trades officer, a refrigeration engineer, and an engineer cadet plus two oilers and a fitter. The second, third and fourth engineers kept a rotating duty routine in which each engineer was responsible for the engine room operations and alarm monitoring for a 24-hour period every third day, from 0800 to 0800.
APLEngland’s master had worked at sea since 1996 and progressed through the ranks to obtain a Master Mariner’s (Class 1) certificate in 2008. The master served in container ships of various size as chief mate from 2007 to 2018 at which time they were promoted to master. This voyage was their second contract in APL England and third as master. The master had been on board for 11 weeks.
The chief mate held a Chief Mate certificate of competency obtained in 2016 after first going to sea as cadet in 2008. They had wide experience on container ships up to 8,000 TEU and had been on board for almost 20 weeks having joined APL England for the first time in January 2020. The chief mate did not keep a navigation watch.
The third mate was the officer of the watch at the time of the incident. They held a Third Mate certificate of competency obtained in 2018 and had joined APL England in December 2019. The third mate’s first trip to sea was in 2016 as cadet and all their experience had been in container ships.
The able seafarer on watch and performing helm duties held a certificate of proficiency for rating as an able seafarer—deck, issued in 2016. They first went to sea in 2001 and had joined APL England in July 2019. Normal routine was to keep watch during the night (4 to 8 watch) and work on deck during the day watch.
The chief engineer held a marine engineer officer Class 1 (Motorship) certificate obtained in 2016. They had joined the APL fleet as a fourth engineer in 2012 and had since progressed to this, their first, ship as chief engineer. The chief engineer joined APL England in March 2020 and had been on board for 11 weeks.
The third engineer was duty engineer at the time of the incident and had first gone to sea in 2010 within the APL fleet. They held a third engineer’s certificate of competency obtained in 2016 with all their experience being in container ships with low-speed main engines. The third engineer joined APL England in January 2020 and had been on board for 19 weeks.
Carriage of containers
APL England was designed exclusively for the carriage of containers as cargo. Containers were carried in athwartship spaces called ‘bays’, both on deck and in cargo holds. The ship’s bays were numbered from bay 01 forward to bay 62 aft, with bay numbers 45 to 62 located aft of the accommodation.
Containers are stowed and secured with suitable securing arrangements to withstand the forces imposed on them while being transported by sea. The motions of a ship in a seaway give rise to accelerations and forces, the magnitude of which depend upon the dimensions of the ship, its stability conditions and the wind and sea conditions being experienced. A ship’s cargo stowage arrangement and securing system is designed to ensure that the forces generated at sea remain within defined, allowable limits and that the container stow remains intact. The ship’s cargo securing manual (CSM) provided details of these limits, stowage arrangements and container securing systems, including lashing patterns and details of lashing gear.
On board APL England, the equipment used to secure containers on deck included twistlocks, lashing bars and turnbuckles. Twistlocks were used to secure containers stowed on deck to the hatch cover or deck, and to secure containers to one another vertically in a stack. Turnbuckles were anchored to lashing eyes on the ship’s deck, hatch coaming or lashing bridge, depending on the location on board. The lashing bars secured containers to the ship and were tensioned via the turnbuckles.
Cargo…carried on or under deck shall be so loaded, stowed and secured as to prevent as far as is practicable, throughout the voyage, damage or hazard to the ship and the persons on board, and loss of cargo overboard.
All cargoes…shall be loaded, stowed and secured throughout the voyage in accordance with the Cargo Securing Manual approved by the Administration. The Cargo Securing Manual shall be drawn up to a standard at least equivalent to relevant guidelines[9] developed by the Organization (IMO).
The ‘relevant guidelines’ required that the CSM covered all necessary aspects of cargo stowage and securing and had uniform layout and content. Consistent with this guidance, APL England’s CSM included the following general information, that:
the CSM specified the arrangements and cargo securing devices provided on board the ship for the correct application to and the securing of…containers…based on transverse, longitudinal and vertical forces which may arise during adverse weather and sea conditions
it is imperative to the safety of the ship and the protection of the cargo and personnel that the securing of the cargo is carried out properly and that only appropriate securing points or fittings should be used for cargo securing
information on the strength, and instructions for the use and maintenance, of each specific type of cargo securing device, is provided in this manual
cargo securing devices should be maintained in a satisfactory condition (and) items worn or damaged to such an extent that their quality is impaired should be replaced.
In accordance with requirements, APL England’s cargo securing manual was compiled by Kunshan Lucky Sea Industrial and first approved in 2001. The CSM in force at the time was approved, with amendments, by Class (DNV GL) on behalf of the Republic of Singapore Flag Administration on 15 May 2017.
Fixed container securing devices
Chapter 2 of the CSM provided details on the fixed securing devices used on deck which included 1,500 lashing plates—686 single, 686 double and 128 swivel. Each lashing plate had a safe working load of 250 kN and a breaking load of 500 kN. The single and double lashing plates were welded to the ship’s structure and were made from 25 mm thick steel plate (Figure 4).
Figure 4: Lashing plates (eyes), spare and as recently fitted to APL England
Source: ATSB
Maintenance of securing equipment
Sound engineering practice, prudent seamanship and multiple industry and business guides, circulars and directives dictate that it is important that shipboard equipment, such as cargo securing devices, meet acceptable functional and strength criteria applicable to the ship and its cargo. Additionally, (as detailed above in the CSM) such devices should be maintained in a satisfactory condition and items worn or damaged to such an extent that their quality is impaired should be replaced.
Chapter 2.3 of APL England’s CSM described the inspection and maintenance requirements for the fixed and portable securing equipment. This section included the following information:
Inspection and maintenance of both fixed and portable securing gear should be carried out under the responsibility of the master…at intervals not exceeding six months…and…should be documented in an appropriate record book, which should be kept with the Cargo Securing Manual.
Damage to fixed cargo securing devices must be repaired by an authorized workshop and reported at the next suitable survey of the classification society.
During the voyage…inspection and adjustment of securing arrangements…is limited to moderately retensioning turnbuckles of lashings. This is particularly important when heavy weather or swell is being expected.
Additional remarks included:
…where there is any doubt over the capability of existing fixed securing arrangements including supporting structure, the fixed fitting should be proof tested at loads equal to the maximum specified securing load + 25%. The proof loading is to be applied at both the mean and extreme angles of operation.
DNV GL advised that, at the time of the occurrence, there were no class rules specifically for the wear and tear and corrosion of fixed lashing devices. Rather, assessment of acceptable wastage was based on class standards for lifting appliances.[10] That allowed for 10% reduction in plate thickness due to wear and tear and general corrosion, and 30% in the case of isolated pitting.
Appendix VII of the CSM contained the ‘Record of cargo securing devices inspection and maintenance’. This included third party service reports and a section listing on board inspections. An ATSB review of these records identified that they were intermittent and inconsistent, particularly after 2014. The latest entries were from monthly inspections January to April 2020. All lashing gear was considered in ‘satisfactory’ condition with limited comments which included ‘Lashing eye found corrosive (sic)’. Prior to 2020, the preceding record was from October 2016.
No planned maintenance system or other digital or other record of fixed and portable lashing equipment inspection and maintenance was provided to the ATSB by the master or APL.
Container forces
The CSM in addressing stowage and securing and the forces acting on containers remarked:
The stowage and securing system as described in [this manual] is designed under the condition of GM ≤1.5 m.[11] If, for any reason, the ship is to be operated with larger GM values, the expected acceleration will increase accordingly.
If a GM value greater than 1.5 m cannot be avoided a reduction of stack masses or stack heights…or a shifting of masses to lower tiers in the stack should be effected.
APL England’s container stowage and securing arrangement was designed so that forces remained within the maximum allowable limits. The preparation and approval of the container securing arrangement plan and the lashing computer system was based upon DNV GL 2017 rules which were in turn based upon and similar to the Germanischer Lloyd (GL) ‘Guidelines for Loading Computer Systems 2013’ (GL2013) rules.
DNV GL documents relating to container ships and stowage and lashing of containers outlined the forces calculations and the static and dynamic variables used. These variables included:
dynamic, inertial forces generated by accelerations due to roll, pitch and heave motions of the ship—the calculations took into consideration ship’s speed, stability condition (GM) and trading route, combined with statistical wave data according to IACS recommendations[12]
wind forces
wave impact forces from seas
forces imposed by the securing arrangements
strength of the container and of the lashing equipment including ship’s structure.
The DNV GL method used roll, pitch and sway to determine a roll motion (transverse) acceleration for each loading condition. A minimum heeling angle of 16° and maximum of 21.4° were used to calculate the maximum transverse acceleration. The maximum expected heeling angle for the load condition (taking into consideration vessel speed, stability condition and route) was then calculated.
All calculations were based upon lashing equipment in new condition with a factor of safety of 2 (failure strength 2 times the design load) to allow for corrosion and wear and tear.
Non-standard height (high cube) containers
The CSM provided guidance on securing of all containers approved for use on board. To this end the CSM made specific reference to the various size containers the ship could carry, and which type of container could be carried in which location on the ship. Therefore, multiple references were made throughout section ‘4.3 Container stowage and securing plans’ to the size (length and height) of container to which each plan applied. The summary page of the plans listed 20 ft and 40 ft containers as being International Organization for Standardization (ISO) standard 8 ft 6 in high units. Taller containers (high cube)[13] were limited to the longer (45 ft, 48 ft and 53 ft) containers.
The plans for 40 ft container stowage on deck each noted a height of 8 ft 6 in for 40 ft containers. The CSM only allowed for 40 ft containers to be loaded into bay 62 and did not allow for these to be high cube containers.
The CSM further stated:
The mass distribution within bays and stacks as stated in this manual presents an optimum under the given circumstances. Any alteration of this distribution will have an effect to the magnitude and distribution of forces in containers and securing devices.
In deciding on another vertical distribution of masses in a stack the relevant distribution as given in this manual should be taken as a reference (and in that case) the following principles should be used (including):
When stacking 9' 6” containers a reduction of top masses or a shifting of masses from top to bottom should be carried out in order to compensate for the higher center of gravity and the higher windage area of that stack.
Cell guides
APL England was fitted with cell guides[14] for on deck stowage of containers into the aftmost bay (bay 62). According to DNV GL rules, containers stowed within cell guides on deck were considered as though they were stowed in cell guides below deck and needed to comply with those rules. The rules allowed for athwartships clearance of 25 mm and fore-aft clearance of 38 mm.
The support provided by cell guides was not allowed for in DNV GL (GL2013) forces calculations (see the section titled Load computer) for container securing.
Manufacturers of the MACS3 loading computer advised that the program assumed all containers with the bottom within the cell guides did not have twistlocks fitted and those above the guides did. The program assumed all containers loaded into bay 62 were standard 40 ft (8 ft 6 in high) with twistlocks fitted between tiers 5 and 6 and above. Furthermore, program forces calculations assumed that all containers with their base within the cell guides were completely covered (supported) by the cell guides.
Contrary to the CSM requirements, APL England was loaded with exclusively high cube containers into bay 62. The top of tier 4 was therefore 1.2 m higher than if standard height containers had been loaded (Figure 5). This reduced the amount of the tier 5 containers held within the cell guides although the loading computer program considered them to be completely within.
Figure 5: Bay 62 container stowage versus cell guide arrangement
Source: ATSB
Container securing arrangement document
The CSM was supported by a Class approved (DNV GL 15 May 2018) ‘Container securing arrangement’ (CSA) document which outlined the stowage and securing arrangements for the vessel for each location and for each size of container carried. The information in this document was similar to that contained in Chapter 4.3 (Container stowage and securing plan) of the CSM. However, there were notable differences between the information provided in the CSM2017 and CSA2018, especially regarding numbers of tiers, container and stack weights and lashing of forward bays. It was not apparent which of these two documents was the definitive one upon which the cargo loading and securing plan was based, or upon which the settings for the load computer were based.
This document agreed with the CSM in defining 40 ft containers to be standard height, with no reference to 40 ft containers of different heights for loading throughout the ship, including bay 62.
Load computer
The CSM, in addressing stowage and securing and the forces acting on containers remarked:
In the light of the complexity of the problem of proper stowage and securing of containers with varying gross masses under the usual condition of time pressure in port it is strongly recommended to ship owners or ship operators to provide appropriate computer software in order to enable ship's staff to keep the securing of individual loading situations under control.
APL England had a capacity of 5,780 TEU. With limited durations in port for cargo operations, a means to easily and quickly ascertain that the forces acting on the ship would not exceed specified limits was required. Therefore, in addition to the CSM, the ship was fitted with a Seacos MACS3 (v NET1.1) loading computer system developed by Interschalt Maritime Systems. Among other applications, this system also incorporated a container or cargo loading module and a lashing calculation program. The system met the requirements of the GL2013 rules.
A loading computer alone does not meet the SOLAS requirements for a CSM approved by the Administration. Consequently, DNV GL rules stated that
An approved loading computer system is not a substitute for the approved loading manual, (or) the approved stability booklet…It is used as a supplement to these approved documents to facilitate strength and stability calculations.
System functions
The MACS3 system utilized a wide range of hydrostatic, stability and strength calculations to assist the safe loading and unloading of the ship. The system was also capable of assessments of stability and stress conditions throughout a voyage.
Among other features, the MACS3 program included the Sealash cargo securing module. This module checked and analysed lashing forces. It was also capable of inventory management for the securing materials.
The software combined details of the ship’s structure, securing arrangements (equipment and securing methods), container weights and distribution (sourced from load condition files delivered to the ship prior to loading), and ship condition in calculations. Many of these details were unable to be changed by the user and were based on classification society requirements.
However, some parameters which influenced the lashing forces calculation results, were able to be changed by the user. This included GM, draught and speed.
The load computer generated a coded bay plan for each bay which displayed relevant container details including position (bay, row and tier numbers), container serial number, size, weight, class of dangerous goods (if relevant), load and discharge port. All information was also available in tabular format.
The graphical plan also showed the lashing arrangement. Each page of the plan included tabulated figures on stack weight and forces calculated for each stack. Exceedances were highlighted in red.
Non-standard cargo containers—high cube
High cube containers were indicated in bay plans by a dark triangle on the upper right corner of the software’s graphical image. The difference in height between standard and high cube containers was visible, as the container representation was also higher. Further, the overall stack height would appear higher on the bay plan graphic.
Loading of high cube containers into bay 62 was in contravention of the CSM. However, no error messages were displayed on board APL England for this loading condition.
The APL cargo operations manual included a procedure for ‘Lashing system—loading restriction’. This procedure highlighted height restrictions for full stacks of high cube containers below the lashing level (as per bay 62). This procedure described that, upon starting the MACS3 software, a pop-up warning window would display directing the user to refer to the CSM and that ‘when loading containers on deck…it is compulsory to stow particular amount of standard or high cube containers on tiers 80 to 86 (tiers 1 to 4 on deck) as per the Cargo Securing Manual’. This document was dated 6 April 2020, however the required warning was not displayed on the APL England loading system software.
No explanation was provided in relation to how the high cube containers were permitted to be loaded into bay 62 or why the MACS3 software allowed this breach of the CSM.
Machinery
APL England’s main engine was a Samsung B&W 12K90MC, delivering 55,659 kW at 94 revolutions per minute (RPM) through a direct drive six-bladed propeller. At 94 RPM the main engine consumed 210 tonnes of fuel per day at a ship speed of 25 knots. Economical speed was 60 RPM, consuming 67.7 tonnes of fuel per day at 16.3 knots.
The main engine lubricating oil system included two vertical centrifugal pumps with 400 mm delivery bore and 1,200 m³/hour capacity at 0.45 MPa pressure. The pumps were mounted into the lubricating oil sump tank at the forward end of the main engine. Minimum oil level in the sump tank was 480 mm maintaining the pump suction submersed by 350 mm. Records of sump level showed that the engine was being operated with oil levels within recommended parameters.
In accord with DNV GL rules, the system was designed to operate in dynamic conditions to up to 22.5° roll and 7.5° pitch angles.
The main engine lubricating oil system pressure monitoring consisted of two pressure sensing circuits. The first was a pressure transducer which provided real-time pressure values to the engine room alarm and monitoring computer system. The monitoring system provided a display of oil pressure in the machinery control room. Normal inlet pressure to the engine was 0.27 MPa. Software alarm and shutdown triggers were based upon readings from this transducer. A separate pressure switch was also fitted as an independent low-low pressure main engine shutdown. The software low pressure alarm was set at 0.17 MPa with zero-time delay, and both low-low pressure shutdowns were set to 0.15 MPa with zero-time delay.
Recorded data
Voyage data recordings
APL England was fitted with a simplified voyage data recorder (S-VDR)[15] designed to collect and store data from various shipboard systems in compliance with SOLAS requirements. This included parametric data, bridge and communication audio, and radar images. Roll and pitch data were not recorded on board, nor was there any requirement to do so.
APLEngland’s system was designed to capture 12 hours of data, written concurrently to a Compact Flash (CF) card and the protective capsule. This system required crew interaction to ensure the data was saved following an incident where power was not lost. The oldest data was continually overwritten and to preserve data, it was saved to the CF card and the card removed. This procedure was followed on this occasion and the recorded data was provided to the ATSB. The downloaded data was successfully converted into a usable format in accordance with the manufacturer’s procedures.
APL England was also fitted with a Panasonic video recording system, which captured 8 video feeds from cargo areas and the bridge, and contained about 1 month of data. The video recordings were viewed as part of the investigation but did not capture the loss of containers overboard.
Machinery alarm log
APL England’s machinery control, monitoring and alarm system provided a record of alarm activations. This system was independent of the VDR and analysis showed the alarm time stamp to be 2 minutes and 43 seconds ahead of the times recorded on the VDR. Times were captured for alarm activation, acknowledgement and clearance.
Recorded data
Data from the time of the heavy rolling and loss of containers are shown in Table 1 and Figure 6.
Table 1: Recorded data times and events from the time of the container loss overboard
Time (Local, VDR time)
Event
0609
Rolling begins to increase, ship speed about 7 knots
0610:28
Steering system alarm
0610:28
First machinery alarm since 0218—piston cooling oil inlet low pressure[1]
0610:37
Roll 1—audio of objects within the bridge sliding and falling to the deck[2]
0610:50
Roll 1 return—sliding and banging audio of objects within the bridge
0610:53
Main engine shutdown alarm
0610:59
Roll 2—audio
0611:04
OOW and master note that the main engine had stopped. Ship speed slowed to about 5 knots
0611:08
Roll 2 return—audio
0611:18
Roll 3—heavy sustained roll audio. Period of maximum rolling
0611:29
Roll 3 return—sustained audio
0611:41
Roll 4
0611:55
Roll 4 return
0612:06
Roll 5. Ship speed to 3.5 knots
0612:14
Main engine shutdown interlocks reset
0612:18
Roll 5 return
0612:30
Roll 6
0612:39
Roll 6 return, no further sliding or falling object audio
0612:46
Public address warning
0613
Ship speed to less than 2 knots
0613:07
Main engine slowdown alarm indicating the engine was running
0614 to 0615
Slowest speeds of about 0.5 knots recorded
0615:24
Master confirmed main engine was running
0615:41
Speed of 1 knot audibly confirmed
0617
Speed increases through 2 knots
The duty engineer had changed the machinery alarm duty call system to ‘Attended’ and alarms were not sounding on the bridge or recorded by VDR audio
References in this table to audio are to objects within the bridge sliding and falling to the deck. No audio of containers falling was recorded
Figure 6: APLEngland's track from 0609 with times and events marked
Track waviness is related to the port-starboard motion of the GPS sensor (mounted about 25 m above the waterline) as the ship rolled. Annotation 0610:37 falling objects refers to audio of objects within the bridge falling to the deck, not external audio of containers falling. Source: Google Earth, with APL data, annotated by ATSB
The data showed that the rolling preceded the main engine shutdown and reached maximum as, or just after, the main engine stopped. The rolling then quickly diminished as the ship slowed and propulsion was re-established. No audio, or other recording, captured the moment the containers fell overboard.
Ship inspection
General guidance in SOLAS (Chapter 1 Regulation 11) stated:
The condition of the ship and its equipment shall be maintained to conform with the provisions of the present regulations to ensure that the ship in all respects will remain fit to proceed to sea without danger to the ship or persons on board.
Additional references and IMO circulars[16] supported and expanded on this principle.
Multiple organisations and agencies have an interest in the condition of ships within their sphere of influence. These entities thus have roles, responsibilities and obligations when it comes to ensuring that the ship is safe to operate and is fit for service. Typically, the list of interested parties includes the:
shipping company
flag administration
classification society
protection and indemnity insurance (P&I Club)
coastal and port States within the area of operation of the ship.
Shipping company and shipboard (APL)
The ISM Code[17] (Part A, paragraph 10) makes it clear that the ship operator (the shipping company) is responsible for ensuring the safe and pollution-free operation of the ship. In particular, the shipping company is required to ensure that the ship is maintained and operated in accordance with applicable rules and regulations and any additional requirements that may be established by the company.
Maintenance for control of corrosion of deck fittings is difficult and is heavily reliant upon good inspection regimes. APL had a planned maintenance system, and survey and inspection cycle in operation throughout its fleet. Part of this regime included regular vessel visits and inspections by shore management and technical staff along with routine vessel management contact and practices.
Records of these visits and inspections included:
a vessel maintenance planning spreadsheet (referred to as the Fleet 077 document). The latest spreadsheet prior to the incident (updated 24 May) contained 229 jobs, 53 of which remained outstanding. While this list contained many jobs related to repair of corroded deck fittings (including lashing bridges), no jobs existed for repair of cargo securing arrangements such as lashing eyes or container foundations.
chief mate handover notes (from 11 January 2020) providing an exchange of information between departing and boarding crewmembers regarding job relevant information including deck maintenance. This document referred the reader to the Fleet 077 list and made particular mention of renewal of container foundations by the deck fitters.
chief mate’s deck maintenance prior to arrival in Australia list compiled as part of routine duties—undated, unsigned. This list contained mention of 50 lashing eyes and 200 container foundations requiring replacement and said to be included in the dry dock list. In addition to this list, correspondence from the previous chief mate to shore management reported a total of 270 container foundations requiring replacement.
an undated dry dock list provided details of shipboard maintenance which could only be, or would be more appropriately, completed when the ship was out of service and/or out of the water. The dry dock list included 276 lashing eyes and 270 container foundations along with lashing bridge structures requiring repair or replacement. APL England’s next scheduled dry docking was due by early 2021.
the cargo securing manual contained a sporadic manual record of cargo securing gear maintenance. The records contained therein included monthly entries for 2020. These entries included comments that lashing eyes were found corroded and damaged container foundations had been repaired.
APL did not provide detail of the history of shore management inspections of APL England.
Change of service preparations
Prior to loading cargo for the change of service to Australia, APL England proceeded to anchorage for 3 days and undertook repairs. This repair time was to address items related to the recent detention of another company vessel in Australia, however it did not include any inspection or maintenance of cargo securing equipment.
Flag administration (Singapore)
Responsibility for the safety of a ship and compliance to relevant international instruments rests with the flag State, as provided under Article 94 of the United Nations Convention on the Law of the Sea (UNCLOS).
As part of the discharge of its obligations and to ensure compliance with flag requirements, the Maritime and Port Authority (MPA) of Singapore conducts flag state control (FSC) monitoring and inspection on all Singapore-registered ships. The MPA advised the ATSB that APL England was generally inspected every 4-5 months with the last inspection carried out on 18 March 2019. The advice went on to say, that apart from some common deficiencies, the vessel was generally well-maintained with no deficiencies related to cargo securing devices.
Port state inspections
International conventions and the UNCLOS give nations responsibilities to check and control ships in coastal waters so that they do not pose threats to ship and crew safety or to the marine environment. These countries utilise port state control (PSC) as a method to ensure shipowners and flag states comply with their responsibilities for the safety and operation of a ship.
APL England first entered service in 2001. From then, until this incident, the ship had been subjected to at least 50 separate port state inspections. No detentions were recorded and while deficiencies were regularly recorded from 2013 onwards, only one deficiency (in 2016) related to lashing material.
The last PSC inspection was completed in December 2019, with one minor deficiency recorded.
As part of the PSC operations, port states and collectives of port states (under various geographical memoranda of understanding) periodically conduct inspection campaigns targeted (or focused) at particular areas of concern. Several of these campaigns have been directed toward cargo securing including container ships and container securing. The results from campaigns conducted world-wide since 2016, including by MOUs in APL England’s areas of operation,[18] did not highlight fixed cargo securing arrangements as an area of concern.
Australian Maritime Safety Authority port state control inspections
In Australia, the Australian Maritime Safety Authority (AMSA) conducts PSC inspections. AMSA figures for 2020 showed:
26,179 ship arrivals into Australian ports (5,981 individual ships), 3,694 container ship visits
3,021 PSC inspections,
6,377 deficiencies—2.1 per ship inspection
178 ships detained
263 inspections of container ships (8.7% of total)
879 container ship deficiencies, 3.3 per inspection, 436 deficiencies were structural/equipment related
17 container ships detained
295 Singapore flagged ships were inspected with 13 being detained
AMSA Marine Notice 03/2018 Proper stowage of cargo containers
Australia expects cargo to be carried in full compliance with a vessel’s CSM and in accordance with the requirements of the SOLAS Convention. In 2018 AMSA published Marine Notice 03/2018 ‘Proper stowage of cargo containers’.[19] This notice reminded vessel owners, operators and masters of the need to stow and secure cargo containers in accordance with approved arrangements.
The notice revealed that AMSA was aware of recent incidents in which the stowage of cargoes did not comply with the approved arrangements, including that fixed and portable securing equipment were not maintained appropriately.
AMSA focused inspection campaigns
In 2010, AMSA conducted a focused inspection campaign (FIC)[20] into securing arrangements of cargo containers. That campaign found that, of 111 vessels inspected, 8% of the vessels inspected had container lashings and fittings that were in a condition which was a cause of concern. Further, 10% of the vessels recorded deficiencies in relation to containers not lashed in accordance with the vessel’s CSM.
In 2020, following this occurrence, AMSA conducted a FIC on proper stowage and securing of cargo containers. This was to verify that containerised cargo was stowed and secured in accordance with SOLAS. Over a 3-month period, AMSA conducted a total of 208 FIC inspections. Results from the campaign included that ‘fixed cargo securing equipment (was) in good condition’. Two ships were detained as a direct result of the FIC, neither for condition of fixed securing devices nor deck condition.
The FIC web report included the observation that:
Since the campaign, AMSA has continued to observe failures of fixed physical securing arrangements onboard ships visiting Australia.
In May 2021, AMSA detained the container ship Sealand Michigan for, among other items, the deficiency ‘Fixed cargo securing devices corroded and defective.’ This ship was of similar age and size to APL England.
AMSA maritime safety awareness bulletin
In March 2021, AMSA published marine safety awareness bulletin number 13: ‘Preventing container loss’.[21] This bulletin focused on the risk of losing shipping containers at sea, the impact on safety and the environment, and what measures should be considered to prevent it from happening. Points raised in the bulletin included:
The ship’s crew must be familiar with, and containers must be stowed and secured in accordance with, the approved cargo securing manual
Cargo securing arrangements should be regularly inspected and maintained and be sufficient to withstand severe weather conditions
Preparations, including weather routing and adding lashings, should be made to ensure containers are secured for the most severe weather expected on the voyage.
Port of Rotterdam, Netherlands
In 2019, in response to the loss of 342 containers from MSC Zoe, the Netherland authorities and Port of Rotterdam conducted a concentrated inspection campaign into ‘Lashing of containers on board seagoing vessels’. The campaign involved random inspections of seagoing vessels in the Port of Rotterdam to determine whether the loading and securing of containers complied with international laws and regulations.
A total of 69 ships were inspected. A significant proportion of the vessels (36%) did not secure containers according to their CSM, including heavy containers stowed over lighter ones.
The campaign included inspection for ‘damaged portable/fixed lashing devices’, and 11 vessels were found not to comply to international regulations in this area. No further detail was given and no specific mention of the damage or condition of fixed securing devices was made in the report. No vessels were detained as part of the campaign.
Classification society—DNV GL
At the time of the incident, APL England was classified with DNV GL, was up to date with surveys, in class and had completed the most recent Annual survey during April 2020.
DNV GL advised that annual survey is a general survey of the hull and equipment, machinery and systems to confirm that the ship complies with the relevant rule requirements and is in satisfactorily maintained condition. The thoroughness and stringency of the survey should depend upon the condition of the ship and its equipment.
Annual surveys were to include inspection of hull and equipment and machinery systems. DNV GL also advised that
Hull and Equipment survey shall cover examination of as far as applicable…fittings and hull supporting structures…for stowage, securing and supporting of...containers (and) condition and origin/identity of loose lashing/securing elements, against documentation on board (approved container stowage plan).
DNV GL rules require that parts of the container stowage and lashing system fixed to the ship are subject to classification in accordance with Class construction rules. Loose lashing elements (lashing rods, turnbuckles, twistlocks etc) are to be examined within the approval of the entire stowage and lashing system in accordance with Class rules and recorded in the CSM.
The annual survey from April 2020 made no observations regarding cargo securing devices. This survey identified, among other items, heavy corrosion, wastage and cracking around a small number of cargo hatch coamings.
Protection and indemnity club insurance—Steamship Mutual
A protection and indemnity (P&I) club is an independent, not-for-profit mutual insurance association, providing cover for its shipowner and charterer members against third party liabilities arising out of the use and operation of ships.
At the time of the incident, APL England’s P&I Club was Steamship Mutual. Steamship Mutual state[22] that
…it is extremely important for the Club to manage the quality of entered tonnage in order to ensure that undue risk is not presented to the Membership as a whole by any particular entry.
To manage this, the Club conducted surveys of vessels prior to entry (if over 12 years old for container ships), as a result of a detention, a casualty or similar or as part of a programme of planned vessel surveys.
The purpose of these condition surveys was to examine risk, not only from the perspective of the physical condition of the vessel, but also with reference to shipboard operation and management. Club guidance for condition surveys of container ships included advice for surveyors to pay particular attention to, among others:
Condition of cell guides
Type, condition and sufficiency of container lashing equipment
Condition of securing points on vessel
Condition of shoes and twist locks
Approved stowage plans, securing & lashing arrangement drawings as per CSM.
No evidence was made available to the ATSB by Steamship Mutual, or their representatives, to show that APL England had been inspected by the club during membership. Further, details of any inspections completed after the incident were not provided to the ATSB.
Condition of securing arrangements
The ATSB examined securing arrangements and lashing equipment in use on APL England. The portable lashing equipment appeared in generally good condition. However, many of the ship fittings (fixed securing devices including lashing eyes, lashing bridges and deck structures) were in poor condition. Figure 7 (bay 30) and Figure 8 (bay 62) show examples of the condition of container lashing eyes and ship’s structure from where containers were lost.
ATSB inspection showed this deterioration was apparent throughout the ship.
Corrosion
The ATSB sought expert assistance regarding corrosion of marine and shipboard structures to understand the phenomenon occurring on board APL England and the resultant condition as illustrated above.
Advice received was that the environmental conditions of a ship’s deck equipment and structures are complex and difficult to replicate for research purposes. Control over the conditions is difficult and research directly comparable to life-cycle conditions for container ship deck fittings is scant. That said, the advice was that corrosion of 25 mm steel plate to the state shown in Figure 7 and Figure 8 was high and was unlikely to have occurred in the 5 years between dry dockings. This was supported by corrosion research texts which suggested that corrosion rates of 1 mm per year were high.
Figure 7: Typical, thinned, heavily wasted and failed double (left) and single (right) lashing eyes from bay 30
Source: ATSB
Figure 8: Thinned, heavily wasted and failed lashing eyes (top) and wasted and failed container support structure (bottom) from bay 62
Source: ATSB
Weather
As APL England travelled down the east coast of Australia, the master received weather information regarding a complex low pressure system developing off the south-east of the country. This included regular forecasts and warnings (including gale warnings) issued by the Bureau of Meteorology (BoM) through the automated Marine Safety Information (MSI) Enhanced Group Call (EGC) system, along with reports and guidance provided by the CMA CGM fleet navigation and support centre (FNSC) and through commercial weather guidance service providers (ship performance optimization system—SPOS).
Enhanced Group Call (EGC) communications
APL England received and automatically printed the MSI broadcasts into the bridge as required. This included navigational and meteorological warnings, meteorological forecasts, and other urgent safety-related messages.
The printed messages were then filed on the ship’s bridge. Ship’s officers stated that in day-to-day operations they gave preference to consulting the weather and routing information regularly received from the FNSC and SPOS.
Bureau of Meteorology
BoM provides marine weather services covering 78 coastal water zones around the coast of Australia. Additionally, forecasts and warnings to ships are provided via VHF and HF radio services, and the EGC MSI service through global satellite communications services. Services are also accessible via the internet.[23] BoM advised that forecasters ensure the most accurate information is provided in MSI bulletins by using multiple models and guidance sources.
On 20 May, as APL England entered the Coral Sea, the BoM was issuing storm force wind warnings (48–55 knots) for the south-eastern seas off Australia.
On 22 May, APL England was off the southern Queensland coast and received weather advice from the FNSC of a low pressure system off south-eastern Australia. The BoM issued storm force wind warnings throughout 22 May and into 23 May. At 1008 on 23 May the warning was reduced to a gale warning (34–40 knots). The gale warning remained into 25 May, well after APL England had lost the containers.
BoM also provided wind and wave forecast maps (to 7 days in advance) for the area. Daily copies of the wave maps and mean sea level pressure prognoses, from 11 May onwards, were sent to the master of APL England by the FNSC. These included forecast of 5–7 m waves on 23–24 May.
Ship performance optimization system (SPOS)
APL England was fitted with the DTN[24] ship performance optimization system (SPOS) weather routing software, with Seakeeping module. This module combined weather forecasts with hydrodynamic modelling and operational data from the ship for motion forecasting and risk assessment, based upon the IMO MSC.1/Circ.1228 guidance. This was to assist the master in optimising the ship’s route. The service provided a data file sent to the ship via email which was accessed via on board software. Each file contained 9-day forecasting and could be received 1, 2 or 4 times per day.
On board APL England, the master stated that the latest SPOS data file was regularly downloaded and that they did so on 23 May. Figure 9 shows the update forecast map from 0400 on 24 May, used by the master to assess conditions. The ship weather inset graphic displayed the local weather conditions forecast for the ship at the time. The Spot weather inset listed the conditions at a point determined by the computer mouse pointer (in Figure 9, the mouse pointer was over the ship’s position at 0220 hrs on 24 May).
The master stated that through experience they had come to rely more heavily on the information provided through the SPOS system than other means.
Figure 9: Weather map from SPOS data as used by the master prior to the incident
The figure is displaying APL England’s position with projected route down the NSW coast. Displayed weather features include wind barbs, with coloured wind contours (clear to burned orange—user adjustable) and lines overlaying a grid of pressure readings. Insets show a list of spot (computer mouse position) weather conditions and the ship’s weather graphic. The left hand side of the window shows the map elements available and those on display (checked). Note that times in the figure are in UTC. Source: APL, annotated by ATSB
Fleet navigation and support centre (FNSC)
In 2017, CMA CGM opened a navigation and port operations centre in Singapore to provide 24‑hour support to vessels operating in the Asia-Pacific region. The facility used the latest navigation assistance tools and technologies to track and examine wide-ranging nautical, meteorological, and geographic information in real-time and provided this support to the fleet’s ships.
The FNSC advised, that for vessels trading between Asia and Australia, route planning was delegated to the ship’s master using the on board SPOS software. That said, the FNSC also provided the ship with a daily weather forecast email covering the Australia-Oceania area. This email included the:
Australian BoM mean sea level pressure prognosis charts for 12-hourly forecasts for that day and the following 3 days
BoM Auswave Global total wave height and direction forecast charts for that day and the next
Stormgeo[25] wind and wave forecast maps covering the Oceania region for that day and the next.
During the voyage to Australia, the FNSC monitored the progress of APL England. A route optimisation plan was sent to the ship after departure from Ningbo, to provide the master with guidance for improved fuel savings when transiting the Australian coast. On the master’s request, the FNSC would also provide heavy weather avoidance advice in accordance with company procedures. No evidence of a request or any specific heavy weather advice from the FNSC was provided to the ATSB during the investigation.
Information sent by the FNSC, from 21 May onwards, forecast the high seas and heavy weather system developing in APL England’s path, off the south-east coast of Australia.
Navigation in adverse weather
Possible causes of rolling
IMO circular MSC.1/Circ.1228[26] provided masters with assistance for making ship handling decisions in adverse weather and sea conditions. The circular described adverse weather conditions that may cause heavy rolling with a risk of damage or capsize.
Dangerous phenomena detailed in the circular were:
Phenomena occurring in following and quartering seas—not apparent in this case
Synchronous rolling motion—when the ship’s roll period[27] coincides with the wave encounter period.[28] Ships are more prone to such rolling when the seas are abeam.
Parametric roll motions—large and dangerous roll amplitudes due to the variation of ship stability between the position on the wave crest and the position in the wave trough.
Combination of various dangerous phenomena—extremely dangerous situations arising from combination of the above phenomena, with ship motion affected by waves and water on deck, cargo movement, and so on.
Operational guidance was provided to assist the master in avoiding dangerous situations when navigating in bad weather.
The circular cautioned that:
A ship could be unsafe even outside the dangerous zones defined in this guidance if the stability of the ship is insufficient.
The bridge procedure ‘Navigation in adverse weather’ described adverse weather as ‘unfavorable (sic) weather conditions which can lead to endanger the crew, the vessel and the cargo’. The procedure provided direction to the OOW and master for such conditions. Among other directions, the master was to inform the FNSC if support was required, and to report to the FNSC if the passage plan was to be amended.
The OOW was to monitor and assess the situation and use available information sources (including local observations and sources as outlined above) to minimise consequences of the adverse weather. The OOW was to advise the master of any significant happenings including changes in speed or course etc.
The procedure directed that at least once per watch, the master or OOW were to assess the weather using the ‘Dangerous motion criteria’ tool (described in the following section). Further, the ‘Navigation in adverse weather check list’ and the engine procedure ‘Engine safety measures for adverse weather’ were to be followed.
The procedure then included information on dangerous phenomena similar to that outlined in the IMO circular MSC.1/Circ.1228. This included synchronous rolling and parametric rolling. The advice and procedures were supported by the dangerous motions calculation tool.
The adverse weather procedures were not enacted during the voyage and deteriorating conditions. Further, as the weather worsened, the master did not direct the chief engineer or the duty engineer(s) to complete the engine room safety measures. Among other things, this procedure called for:
the engine room to be continually attended
main and generator engine sump levels to be adjusted to avoid loss of pump suction
an additional steering pump to be running.
Dangerous motion criteria calculation tool
The dangerous motion criteria calculation tool determined the encounter period based upon values of the ship’s speed, wave period and the angle between the ship’s course and the wave direction. The tool then indicated if the master should be called due to the presence of one, or more, of the dangerous conditions (see Appendix: Dangerous motions criteria tool).
Using the formulae from the calculation tool and the conditions present at the time of the loss of containers, the ATSB constructed a map of encounter angle versus ship’s speed for various values of the ship’s roll period (TR) over the encounter period (TE) (TR/TE). The map (Figure 10) was used to highlight the conditions in which a danger of parametric or synchronous rolling existed. Also shown on the figure are the approximate speed and encounter angle existing at about 0610.
This representation indicated that, based on APL’s criteria, APL England was operating in the region of susceptibility to parametric rolling. Of note, the criteria used to determine the ship’s susceptibility to parametric rolling are independent of the state of the weather conditions. That is, these criteria do not vary with the size of the sea or waves or with deterioration in the state of the sea or weather, although the severity of the resulting rolling does.
The ATSB analysis showed that a significant alteration in a ship’s course and / or speed would have been required to change the conditions such that the ship was not susceptible to parametric rolling.
Figure 10: ATSB analysis map of dangerous rolling conditions for APLEngland based upon the dangerous motion criteria tool calculations
Source: ATSB
APL England motion preceding the occurrence event
During the hours preceding the loss of containers, as APL England pushed into the heavy weather, the ship went through intermittent periods of increased rolling. These events involved increases in the roll amplitude for several rolls after which the motion abated and more comfortable conditions returned.
One such event occurred at about 0215 on the morning before the loss of containers. At that time the ship was steering 200° and had a speed of about 7 knots, with winds from the south-west at force 8 (gale force 34–40 knots), sea state 7 (high seas 6–9 m) and a 4 m swell. The ship was proceeding comfortably when the amplitude of rolling increased for several rolls before reducing.
The rolling was sufficient to wake many crewmembers. It also moved furniture and unsecured items, and made standing difficult. The master went to the bridge to assist, and a machinery alarm called the duty engineer to the engine room. The alarm cleared on acceptance, but the duty engineer remained in the engine room and stayed there until about 0800.
These roll events precipitated a number of course changes and hand steering to attempt to reduce the amount of rolling and pitching. Several bouts of rolling, albeit not as severe, were experienced between 0215 and 0610, however the magnitude of the rolling at 0610 exceeded that encountered at 0215.
Related occurrences
334-MO-2018-002 YM Efficiency, 1 June 2018
At about 0035 on 1 June 2018, YM Efficiency was steaming slowly into strong gale force winds and very rough seas off Newcastle, en route to Sydney, when it suddenly rolled heavily, causing container stacks to collapse and topple. As a result, 81 containers were lost overboard and a further 62 were damaged. The ship sustained structural damage to its lashing bridges, superstructure, and accommodation ladder. Substantial debris from the lost containers subsequently washed ashore on the New South Wales coast.
The ATSB investigation[29] determined that the forces generated during the sudden, heavy rolling placed excessive stresses on containers stowed aft of the ship’s accommodation. This resulted in the structural failure of containers and components of the lashing system, leading to the loss of containers overboard. Potential causes for the sudden rolling were investigated, but there was insufficient evidence to establish a definitive reason.
Further, the condition of the ship’s lashing equipment was considered not to have contributed to the loss of containers. However, the investigation found that the weights and distribution of containers in the affected bays were such that calculated forces exceeded those allowable as defined in the ship’s cargo securing manual.
APL England, 18 August 2016
At about 1500 Western Standard Time[30] on 18 August 2016, while transiting the Great Australian Bight, APL England lost 37 containers overboard in rough seas. At the time of the occurrence, the ship was on an easterly heading (095°) at a speed of 17.9 knots in south-westerly winds of force 7/8 (34–47 knots) with a 4–5 m south-westerly swell on 6 m seas.
The master reported that the ship was rolling easily/moderately to a beam and quarterly swell but at around 1445–1500 the vessel encountered a sudden heavy roll to port (about 25°) coinciding with the loss of containers.
While the ATSB did not investigate this occurrence, AMSA conducted an investigation and concluded that:
the vessel had a high GM which may have contributed to generation of excessive dynamic forces leading to failure of container base sockets and collapse of the stow
the topmost container tier in all rows of the collapsed bay was over the recommended weight although the stack weight in each row was not exceeded
the master was well prepared for heavy weather and had complied with safety management system requirements on departure from Fremantle
the weather experienced was as expected in the Great Australian Bight during the winter season
the ship conditions (draft, loading, stability) were within criteria which may have led to parametric rolling.
The condition of fixed securing equipment on deck was not mentioned as a factor in this incident. APL England was subsequently inspected by AMSA in early 2017 and then departed the Australian coast and did not return to Australia until the current incident.
Safety analysis
Introduction
On 24 May 2020, APL England was making way down the east coast of New South Wales, with a cargo of containers, bound for Melbourne, Victoria. Early that morning, the ship underwent a series of heavy rolls in adverse weather, leading to failure of the container securing arrangements and the loss of 50 containers overboard.
Evidence indicated that the rolling, and resulting forces, exceeded the design limits for the securing system. However, APL England’s container securing arrangements on deck were in a poor state of repair and at risk of failing in a seaway below those limits.
The evidence also showed that the degree of rolling exceeded the design dynamic operating limits for the main engine and machinery. Consequently, the main engine lubricating oil pump momentarily lost suction causing the system pressure to fall below the low-low pressure main engine shutdown setting. The main engine shutdown and propulsion was temporarily lost.
Heavy weather preparations
As early as 21 May, APL England received Bureau of Meteorology (BoM) reports of high seas gale and storm force wind warnings, issued through the enhanced group call automated communications system. At about the same time, the master received similar information regarding a low pressure system and high seas developing along the south-east coast of Australia, from supporting company and commercial weather services. The warnings continued over the following days.
In response, the master and crew undertook the following heavy weather preparations:
container lashings were checked during the afternoon of 23 May
the master spent increased time on the bridge with the navigating officers
the master directed course changes and the use of hand steering to reduce the degree and effects of rolling and pitching.
However, the required adverse weather procedures and checklist were not followed and the dangerous motion criteria tool was not used.
The investigation was unable to state with certainty that compliance with the heavy weather procedures would have prevented this incident. However, not following procedures meant that opportunities to have been better prepared for the conditions encountered were missed.
Had procedures been followed, the master would have informed the fleet navigation support centre (FNSC) of local observations, navigation changes and ship conditions. The FNSC would then have been in a position to provide explicit, targeted, advice and support for avoidance of the heavy weather.
Furthermore, had the dangerous motions criteria tool been used, it would have indicated that the ship was in conditions conducive to parametric rolling and that greater changes to the ship’s heading and / or speed were required to avoid the dangerous conditions.
In addition, if the engineering department had been notified of the situation, and completed the engine adverse weather procedure, the volume of oil in main engine and generator engine sumps would have been checked and, if necessary, increased. This would have reduced the likelihood that the main engine lubricating oil pump would lose suction, triggering a shutdown.
Finally, completing the adverse weather checklist would have ensured that all crewmembers were prepared for the conditions, followed the procedures, and used the tools. The checklist would also have prompted navigation checks and alterations which would have reduced the likelihood of the ship encountering rolling events to the extremes it did. It would also have reminded crewmembers of the need for other machinery preparations such as running an additional steering motor.
Given the condition of the deck, not completing adverse weather preparations in accordance with the procedure, exposed the ship and crew to increased risk.
Vessel condition and maintenance
A well designed and effectively implemented maintenance management system not only helps a shipping company to meet the safety and pollution-prevention objectives, it is also an investment in the protection of a valuable asset.
Built in 2001, by 2020 APL England’s container securing arrangements on deck were in a poor state of repair and the strength of many securing fixtures, including in bays from which containers were lost, was severely compromised. For example, some of the lashing plates were reduced to less than 5 mm effective cross-sectional thickness from the original 25 mm plate (Figure 7 and Figure 8). The ATSB concluded that, in the seas encountered, the poor condition of these fittings contributed to the failure of many and the loss of containers overboard.
As the ship reportedly rolled beyond its design limit, the ATSB considered the possibility that the loss of containers was entirely due to forces associated with excessive rolling. However, as a factor of safety is applied to the securing fixtures, ultimate failure of these components should not occur close to the design limit if they are well maintained. On this occasion many of the fixtures securing the lost containers had been significantly reduced by corrosion, it was therefore considered likely that their poor condition also contributed to the incident.
It is also important to note that, in the sequence of events, it was not necessary for every single instance of lashing device failure to have been the result of corrosion. Any one failure of a lashing or, a combination of such failures could have imparted forces on adequately secured containers sufficient to dislodge them.
The severely corroded condition would have taken several years of poor maintenance to develop.
The investigation was unable to determine how the ship had come to be in this condition. Given the multiple inspection and maintenance arrangements in place, it was evident that APL England was not maintained to the standards expected by the industry and customers. Additionally, the ship had not received the scrutiny from shore management and agencies that a ship of its age or condition warranted. This presented an increased risk to the continued safe operation of the vessel and security of the cargo carried.
However, the evidence did not show that the condition of APL England was indicative of a wider problem with container ship condition. Container loss incident investigations and regulator inspection campaigns before and after this incident did not highlight poor condition of fixed securing devices as an issue.
Loading of high cube containers into bay 62
For APL England’s voyage to Australia, bay 62 was loaded with 7 tiers of high cube (9 ft 6 in) containers. On the day of the incident, all containers in bay 62 above tier 4 (42 in total) were dislodged, of which 16 containers were lost overboard.
APL England’s cargo securing manual (CSM) only allowed 40 ft containers of standard height (8 ft 6 in) to be loaded into bay 62. Stowage in accordance with the CSM would have ensured that the lower 4 tiers of containers were securely held within bay 62’s cell guide structure. It would also have ensured that about 1.5 m of the tier 5 containers were held within the cell guides, that is, over half of the tier 5 containers’ vertical extent would have been secured within the cell guides. The CSM’s lashing arrangements then called for the bottom of tier 6 to be secured to the top of tier 5 with twist locks and tier 7 to tier 6 similarly.[31] In addition, tiers 6 and 7 were to be secured by lashing rods and turnbuckles to lashing plates.
However, because the containers loaded in bay 62 were high cube (9 ft 6 in), loaded in contravention to the CSM and not detectable by the cargo computer software in use at time, the top of tier 4 was 1.2 m (4 ft) higher than if it the bay been loaded with standard height containers. Consequently, only about 0.3 m of the tier 5 containers were held within the tapered (fore-aft) lead-in section of the guides, which were themselves heavily corroded (Figure 5 and Figure 11). This left tier 5 containers with most of the container’s height (about 2.3 m) protruding above the cell guide, resulting in them being virtually unsecured. The high cube containers in tiers 6 and 7 were then secured to tier 5 in the pattern described in the CSM (albeit intended for standard height containers). However, this meant that tier 6 and tier 7 containers were in turn secured by twistlocks to the virtually unsecured tier 5 containers and by lashing bars and turnbuckles attached to heavily corroded lashing plates. The combined effect was that the securing of the containers in tiers 5, 6 and 7 was inadequate.
Further, while containers in bay 62 were lashed in the pattern described in CSM, tiers 5 to 7 were higher than allowed for in the manual by virtue of being high cube containers. Consequently, lashing bar extension pieces were used to get the bars to reach the tops of the tier 6 and tier 7 containers. However, the extension pieces were not listed in the CSM, not part of the ship’s lashing arrangements and therefore not approved for use on board APL England.
Figure 11: Bay 62 stack comparison between standard height and high cube containers
Source: ATSB
Cargo not stowed as per CSM
In addition to the factors discussed above, there were instances across the ship where container weights exceeded the maximum permissible weights allowed for in the CSM for that location. This included containers which were lost overboard.
In this incident, the weight discrepancies were not excessive (maximum being a 5.2 t container stowed in a location approved for 2.5 t) and the cargo computer calculated forces in these locations remained within limits. However, given the condition of the securing devices, any exceedance of the CSM recommended weight increased the risk of containers being lost.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individuals
From the evidence available, the following findings are made with respect to the loss of containers overboard involving APL England, 46 NM south-east of Sydney, NSW, on 24 May 2020.
Contributing factor
While making way in adverse weather, APL England took on a series of very heavy rolls, which exceeded the strength of badly corroded fixed container securing devices. This led to the loss overboard of 50 containers.
The insecure loading of high cube containers into bay 62 was contrary to the ship's cargo securing manual and not identifiable by the cargo computer software in use at the time. Consequently, forces generated during the heavy rolling resulted in dislodging of all containers above the cell guides and the loss of 16 overboard. (Safety issue)
A significant proportion of the fixed cargo securing devices on the deck of APL England were in poor condition. The heavy wastage of the devices significantly reduced their load carrying capacity and compromised the effective securing of cargo. (Safety issue)
On board routine inspection and maintenance of fixed cargo securing devices on APL England was ineffective. Over an extended period of time, the significant proportion of the devices that were unfit for purpose were not identified and made good. (Safety issue)
For an extended period of time, the inspection regimes of several external parties with an interest in the condition of APL England were ineffective in detecting the deteriorating condition of the ship's deck structure and fittings. The external parties included shore management, Class, Flag, Port State Control and Protection and Indemnity insurers.
Other factor that increased risk
The ship’s crew did not follow the company procedures for adverse weather. This removed opportunities to take measures which would have better prepared the ship for the conditions encountered.
The heavy rolling led to the main engine lubricating oil pump momentarily losing suction. This resulted in a loss of system pressure, and automatic shutdown of the main engine.
In several instances, cargo was not stowed in accordance with the cargo securing manual. This resulted in container weights exceeding the maximum permissible in several locations.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the marine industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description:The insecure loading of high cube containers into bay 62 was contrary to the ship's cargo securing manual and not identifiable by the cargo computer software in use at the time. Consequently, forces generated during the heavy rolling resulted in dislodging of all containers above the cell guides and the loss of 16 overboard.
Safety issue description: A significant proportion of the fixed cargo securing devices on the deck of APL England were in poor condition. The heavy wastage of the devices significantly reduced their load carrying capacity and compromised the effective securing of cargo.
Safety issue description: On board routine inspection and maintenance of fixed cargo securing devices on APL England was ineffective. Over an extended period of time, the significant proportion of the devices that were unfit for purpose were not identified and made good.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action taken by DNV GL
During this investigation, the ATSB was advised that, at the time of the occurrence, there were no classification society rules specifically for the wear and tear and corrosion of fixed lashing devices. DNV GL advised that criteria for such were being developing.
In July 2022 DNV Class Guideline DNV-CG-0182[32] was updated to include a new section relating to container securing equipment.
This section provided requirements and guidance on allowable wear and tear of container supporting structures and container securing equipment. In this section the allowable corrosion limit of lashing eye plates varied from 10‑20% of plate thickness depending upon the construction material.
Additional safety action taken by APL Co Pte Ltd
APL notified the ATSB of additional safety action taken in regard to passage planning and navigation in heavy weather. A Safety Security Alert (SSA) was issued which advised masters to seek increased consultation with the Fleet Navigation Support Centre, emphasised deck and engine room preparations, and included reminders to comply with load software limitations and to refer to the appropriate procedures.
Glossary
AMSA Australian Maritime Safety Authority
EGC Enhanced Group Call—a service used for the broadcast and reception of marine safety information (MSI) messages to a group of ships or to ships in a specified area via the Inmarsat satellites.
FNSC Fleet Navigation and Support Centre—part of CMA CGM’s Navigation and Port Operations Centre in Singapore. The facility provides 24-hour support to company vessels operating in the Asia-Pacific region.
FSC Flag State Control—the jurisdiction (flag State) under whose laws the vessel is registered or licensed has the authority and responsibility to enforce regulations over vessels registered under its flag, including those relating to inspection, certification, and issuance of safety and pollution prevention documents.
GM Refers to metacentric height, one of the measures used to determine a ship’s stability.
GMDSS Global Maritime Distress and Safety System—an internationally agreed-upon set of safety procedures, types of equipment, and communication protocols used to increase safety and make it easier to rescue distressed ships.
IACS International Association of Classification Societies— a not for profit membership organisation of classification societies that establish minimum technical standards and requirements that address maritime safety and environmental protection and ensures their consistent application.
ISM Code International Management Code for the Safe Operation of Ships and for Pollution Prevention.
ISO International Organization for Standardization
MPA Maritime Port Authority of Singapore
MSI Marine Safety Information—navigational and meteorological warnings, meteorological forecasts, and other urgent safety-related messages broadcast to ships. In Australia this is provided to vessels by AMSA and BOM as part of an internationally co-ordinated network of broadcasts.
MSQ Maritime Safety Queensland
PSC Port State Control—the inspection of foreign ships in national ports to verify that the condition of the ship and its equipment comply with the requirements of international regulations and that the ship is manned and operated in compliance with these rules.
SOLAS The International Convention for the Safety of Life at Sea, 1974, as amended.
SPOS Ship Performance Optimization System—commercial weather routing software for vessel route planning and updating.
TEU Twenty-foot equivalent unit—a standard shipping container. The nominal size of a container ship in TEU refers to the number of standard containers it can carry.
UNCLOS The United Nations Convention on the Law of the Sea—the regime of law and order in the world's oceans and seas establishing rules governing all uses of the oceans and their resources.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the master and involved crewmembers of APL England
APL
Australian Maritime Safety Authority
Maritime Safety Queensland
Maritime and Port Authority of Singapore
DNV GL
the Bureau of Meteorology
DTN
Navis
Port Authority of New South Wales
Inchcape Shipping Services
Transport Safety Investigation Bureau, Singapore
the University of Newcastle, Australia
Thynne Macartney
References
International Maritime Organization, 2007, MSC.1/Circ.1228—Revised guidance to the Master for avoiding dangerous situations in adverse weather and sea conditions, IMO, London.
International Maritime Organization, 2014, Code of Safe Practice for Cargo Stowage and Securing, IMO, London.
International Maritime Organization, 2014, MSC.1/Circ.1353/Rev.1—Revised guidelines for the preparation of the Cargo Securing Manual, IMO, London.
International Maritime Organization, 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the master, chief mate, third mate, chief engineer, third engineer and the able seafarer on the helm, of APL England
APL
Australian Maritime Safety Authority
Maritime Safety Queensland
The Maritime and Port Authority of Singapore
Submissions were received from:
the master, chief engineer, third engineer and the able seafarer on the helm, of APL England
APL
Australian Maritime Safety Authority
Maritime Safety Queensland
The Maritime and Port Authority of Singapore
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendix
Dangerous motions criteria tool
The CMA CGM bridge manual procedure ‘Navigation in adverse weather’ required that ‘The Master or OOW shall assess the weather condition, at least, once a watch by using the…Dangerous Motion Criteria’. This requirement was included as an item in the ‘Navigation in adverse weather checklist’. Output from the tool, including any action to take, was indicated in red and green boxes (Figure 12).
Figure 12: Dangerous motions criteria tool
Source: APL, annotated by ATSB
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
[1] TEU—twenty-foot equivalent unit—a standard shipping container. The nominal size of a container ship in TEU refers to the number of standard containers it can carry.
[2] GM—Refers to metacentric height, one of the measures used to determine a ship’s stability.
[3] All times in this report are east coast Australia local time, Eastern Standard Time (UTC + 10 hours) unless otherwise stated.
[4] The Beaufort scale of wind force, developed in 1805 by Admiral Sir Francis Beaufort, enables sailors to estimate wind speeds through visual observations of sea states.
[5] The ports of Port Kembla, Port Botany, Sydney and Newcastle had been closed to shipping from 22 May due to the weather. The next closest suitable port of refuge was Brisbane.
[6] APL and ANL Singapore are registered and headquartered in Singapore and are part of the CMA CGM Group.
[8] The International Convention for the Safety of Life at Sea, 1974, as amended.
[9] Refer to MSC.1/Circ.1353: Revised guidelines for the preparation of the cargo securing manual.
[10] DNV GL standard DNVGL-ST-0377 Shipboard lifting appliances
[11]APLEngland’s GM on departure Ningbo was 1.69 m and calculated at noon 23 May was 1.61 m.
[12] International Association of Classification Societies (IACS) recommendation No.34 Standard Wave Data
[13] High cube containers are ISO standard sized (length and width) containers with a height of 9 ft 6 in
[14] Cell guides are an arrangement in holds or on deck of fixed vertical guide rails for support of containers
[15] The voyage data recorder for a cargo ship larger than 3,000 gross tons, constructed before July 2002 may be an S‑VDR.
[16] See, for example, MSC/Circ.1070—Ship design, construction, repair and maintenance
[17] International Management Code for the Safe Operation of Ships and for Pollution Prevention.
[18] Tokyo MOU—21 member organisations in the Asia-Pacific region, including Australia Indian Ocean MOU—20 member countries in the Indian Ocean region, including Australia
[24] In 2019 DTN and MeteoGroup merged to form one private weather company trading as DTN. See www.dtn.com/
[25] Stormgeo (www.stormgeo.com) is a commercial weather information and advisory company. Its services to shipping include meteorological and data analysis and ship routing.
[26] MSC.1/Circ.1228 Revised guidance to the master for avoiding dangerous situations in adverse weather and sea conditions
[27] Roll period (TR) was defined as ‘The ship’s natural rolling period when observing in calm sea.’ This figure could be obtained from the load computer.
[28] Encounter period (TE) was defined as ‘The time interval in seconds between the passages of two successive wave crests relative to a ship borne observer.’
[29] ATSB investigation 344-MO-2018-002: Loss of containers overboard from YM Efficiency, 16 NM east-south-east of Newcastle, New South Wales, 1 June 2018.
[30] Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
[31] Containers within cell guides could not be secured together with twistlocks, nor was this required as the containers were considered secured within the cell guides.
[32] DNV GL documentation is available through the website www.dnv.com. On 1 March 2021 DNV GL became DNV.
Preliminary report
Report release date: 28/10/2020
The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the ongoing investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this Preliminary report. As such, no analysis or findings are included in this report.
The occurrence
Passage to Australia
On 11 May 2020, the 5,780 TEU[1] fully-cellular container ship APL England (Figure 1) departed Ningbo, China, bound for Sydney, New South Wales. The ship was loaded with 3,161 containers (5,048 TEU), with a forward draught of 11.44 m and an aft draught of 13.32 m. The Singapore-flagged ship was managed by the CMA CGM International Shipping Company.
On 13 May the master was informed of a change in destination from Sydney to Melbourne, Victoria. Australian entry requirements during the COVID-19 pandemic required the ship to have been at sea for at least 14 days since Ningbo. This requirement made little difference at this stage and the voyage progressed as planned.
On 22 May, the master received weather advice from the CMA CGM group Fleet Navigation Centre (FNC) regarding a low pressure system and high swells (5–6 m) developing off the New South Wales coast. The master monitored the weather forecasts via updates from the commercial Ship Performance Optimization System (SPOS) service, with which the ship was a registered user.
Figure 1: APL England arriving into Brisbane
Source: ATSB
On 23 May, the FNC (supported by SPOS reports) forecast reducing swell (4–5 m). At 0800 Eastern Standard Time,[2] the ship was 20 NM north-east of Port Macquarie, making good a speed of 14 knots, in north-westerly winds to force 5[3] (17–21 knots) with 2 m seas on a 2.5 m swell. Over the following hours, the weather deteriorated as the winds moved round to the south and the seas increased. The ship’s pitching and rolling motion also increased. The master ordered the ship’s speed reduced to about 7 knots and advised the officer of the watch (OOW) to use manual steering as required to reduce the motion.
The master rested from 2030 to 2300 and then returned to the bridge. At midnight, the OOW recorded in the bridge log south-westerly winds to force 9 (41–47 knots), high seas (sea state 7, 6–9 m wave height) on a southerly 4.5 m swell. At about 0100, with intermittent use of manual steering, the master felt the rolling was acceptable and returned to the accommodation and to sleep.
Meanwhile, the duty engineer completed the evening inspection of the engine room and at 2130 responded to an engine room alarm (main engine high oil mist detection), which cleared upon acceptance. The engineer returned to the accommodation at about 2200 and went to bed and to sleep. At 2326, the same alarm sounded, and the engineer went to the engine room and again the alarm cleared upon acceptance. A third alarm followed at 2347 (fuel oil overflow). The engineer found no faults and attributed these alarms to the motion of the ship. The engineer returned to the accommodation and to sleep.
At 0215 on 24 May, when about 40 NM east of Sydney, the ship underwent a series of heavy rolls. Crew members, including the master and the duty engineer, were woken and unsecured items, such as books, stationery, crockery and furniture, moved and fell to the deck. The master went to the bridge where the OOW (second mate) had engaged hand steering.
Just after being woken, the duty engineer received a telephone request from the OOW to stand by in the engine room. At about the same time, an engine room alarm sounded (main engine piston cooling oil low inlet pressure) and the engineer went to the engine room to attend to it. The alarm reset upon accepting.
The heavy rolling dissipated while the ship continued to pitch noticeably. At about 0230, the master changed course more southerly to 195° and maintained a ship speed of about 7 knots in 40–45 knots winds from ahead (south-westerly). This reduced the ship’s motion and the master retired again at about 0300. The duty engineer remained on standby in the engine room and kept watch from the engine control room.
At 0400 the third mate took the navigation watch (OOW). At about 0420, the master again awoke and returned to the bridge. Course was altered to 185° and hand steering used as necessary. The master remained on the bridge, and the duty engineer remained in the engine room.
The incident
Just after 0600, the ship was on hand steering and maintaining its southerly course at about 7 knots (Figure 2). Conditions remained unchanged with the ship pitching and periodically rolling more noticeably in high seas and gale force winds.
At 0610 the ship underwent a series of very heavy rolls, to about 25° either side of upright (position 34º 21.98' S, 151º 54.78' E). Again, many items moved and fell to the deck, including those which were previously secure such as the bridge document laminator, and personnel held on to maintain their footing.
A steering system alarm sounded, followed by an engine room alarm at 0610:28 (main engine piston cooling oil low inlet pressure). The duty engineer was seated at the engine control console (near the alarm acknowledge push button) when the heavy roll and alarm occurred. The engineer had to hold on for security and answered the alarm 6 seconds after it sounded.
Figure 2: APL England track and incident location
Source: Australian Hydrographic Office, Google Earth, annotated by the ATSB
The ship continued to roll heavily. At 0610:53, 25 seconds after the initial alarm, the main engine shut down due to loss of engine lubricating oil pressure.
The OOW noted the loss of power and slowing of the ship, alerted the master to the loss of the main engine and, following procedure, moved the engine telegraph to ‘stop’.
At 0611:50, the duty engineer informed the OOW that, with the engine telegraph set to ‘stop’, the engine could be started again once the alarms had cleared (and the main engine shutdown lockouts had reset).
The main engine was restarted, dead slow ahead. By this time the ship had turned to port, beam on to the seas, and continued to roll heavily.
The events had woken the chief engineer and the chief officer who both went to the bridge. Upon seeing that the main engine had shut down the chief engineer went to the engine room.
Incident recovery
The chief officer took control of navigation to recover the ship. The ship was turned easterly and then southerly, into the weather. The response was slow and the main engine speed was increased to half ahead. The ship gathered speed and, by 0617, passed 1 knot and continued turning to starboard and south. At 0622 the ship’s speed was 6 knots on steady 165° heading. The master and chief officer discussed options. It was decided to head north, with the weather, until a final decision was made.
The turn to starboard was commenced at 0627 and the ship was steady on a northerly course (about 015°) and with a speed of about 12 knots at 0700. At this time the ship was 44 NM south-east of Sydney. The chief officer contacted Sydney vessel traffic services (VTS) and was informed that the weather was not expected to improve.
As the skies lightened (sunrise was at 0647), the chief officer noticed fallen stacks of containers aft (bay 62) (Figure 3). The master notified the company of the incident. Upon returning to the bridge about 10 minutes later, the master was notified by the chief officer of the damage and loss of containers forward (bay 30).
Figure 3: Looking forward and aft from navigation bridge at about 0700
Source: CMA-CGM ANL
On the northerly heading, though the weather remained unabated from the south-south-west, the ship’s movement was improved and no further loss of containers occurred. The winds eased to force 7 (28–33 knots) into the afternoon and at 1600 the ship was passing Newcastle.
The decision was made to continue passage to Brisbane, Queensland, about 400 NM further north. The weather eased as the ship travelled north. By noon on 25 May, off Byron Bay with 120 NM to travel, winds were force 5 (17–21 knots) from the south-west with sea state 5 (2.5–4 m waves) on a 3 m south-south-easterly swell.
Brisbane
At about 2136 on 25 May, APL England anchored 7 NM off Point Cartwright, Queensland, and the entrance to the Port of Brisbane. Prior to being allowed entry into port, several inspections and assessments by surveyors and maritime authorities were carried out. Maritime Safety Queensland (MSQ) formulated a recovery plan and risk assessment for the operation. Additional piloting, towage, pollution prevention and on-water guidance measures were put in place.
Two days after arriving off the port, at 0600 on 27 May, APL England weighed anchor and proceeded into Brisbane. At 1342 the ship was all fast alongside.
Over the following days personnel representing several different stakeholders attended the ship, including investigators from the ATSB, the Australian Maritime Safety Authority (AMSA) and MSQ.
On 29 May, the first damaged container was removed from the ship. In all, 50 containers (including 26 empty) were lost, and 63 were damaged but remained on board. One container lost overboard contained hazardous goods in the form of dry powder fire extinguishers. AMSA identified a search area of about 1,000 km2 stretching between the Illawarra and Sydney’s southern suburbs in water depths of up to 200 m.
By 19 June all remaining containers had been discharged and AMSA released APL England to sail from Australia to Zhoushan (China) to undertake repairs. On 4 July, APL England arrived at the shipyard.
Context
APL England
At the time of the incident, APL England was owned by CMB Ocean 13 Leasing Company and managed by CMA CGM International Shipping Company, both of Singapore. It was time-chartered by ANL Singapore from APL.[4]
APL England had a multi-national crew of 25 from Malaysia, Singapore, China, Myanmar and Ukraine. There were four deck officers with the chief officer on daywork devoted to deck maintenance and cargo operations—the chief officer did not maintain a navigation watch.
During March 2020, CMA CGM changed APL England’s voyage plan from the China–India service to the China–Australia service. APL England completed the China–India service in Manila and in early April proceeded to Shanghai to load for the Australia service. The change of service prompted increased attention to the ship’s condition (deck and engine room), including deck condition, cargo lashing equipment, access hatches and deck structures as well as other machinery and equipment such as lifeboats, winches and windlasses. Two additional fitters joined the ship to assist with deck repairs and maintenance. Direction was received from, and regular reports were made to, fleet management.
The ship was classed with DNV GL and had completed the most recent annual survey during April 2020. This survey identified, amongst other items, heavy corrosion, wastage and cracking around a small number of cargo hatch coamings. No mention was made regarding findings related to the condition of cargo securing or deck fittings.
Machinery
APL England’s main engine was a Samsung B&W 12K90MC, delivering 55,659 kW at 94 revolutions per minute (RPM) through a direct drive six-bladed propeller. At 94 RPM the main engine consumed 210 tonnes of fuel per day at a ship speed of 25.0 knots. Economical speed was 60 RPM, consuming 67.7 tonnes of fuel per day at 16.3 knots.
The main engine lubricating oil system included two vertical centrifugal pumps with 400 mm delivery bore and 1,200 m³/hour capacity at 0.45 MPa pressure. The pumps were mounted into the lubricating oil sump tank at the forward end of the main engine. Minimum oil level in the sump tank was 480 mm maintaining the pump suction submersed by 350 mm. The system was designed to operate in conditions to 22.5° roll and 7.5° pitch angles.
The main engine lubricating oil system pressure monitoring consisted of two pressure sensing circuits. The first was a pressure transducer which provided real-time pressure values to the engine room alarm and monitoring computer system. The monitoring system provided a display of oil pressure in the machinery control room. Normal inlet pressure to the engine was 2.7 MPa. Software alarm and shutdown triggers were based upon readings from this transducer. A separate pressure switch was also fitted as an independent low-low pressure main engine shutdown. The software low pressure alarm was set at 1.7 MPa with zero time delay, and both low-low pressure shutdowns were set to 1.5 MPa with zero time delay.
Carriage of containers
APL England was designed exclusively for the carriage of containers as cargo. Containers were carried in athwartship spaces called ‘bays’, both on deck and in cargo holds. The ship’s bays were numbered from bay 01 forward to bay 62 aft, with bay numbers 46 to 62 located aft of the accommodation.
In accordance with SOLAS regulations, containers carried on board needed to be loaded, stowed and secured in accordance with a cargo securing manual (CSM) approved by the ship’s administration. APL England’s CSM was compiled by Kunshan Lucky Sea Industrial and first approved in 2001.
Containers are stowed and secured with suitable securing arrangements to withstand the forces imposed on them while being transported by sea. The motions of a ship in a seaway give rise to accelerations and forces, the magnitude of which depend upon the dimensions of the ship, its stability conditions and the wind and sea conditions being experienced. A ship’s cargo stowage arrangement and securing system is designed to ensure that the forces generated at sea remain within defined, allowable limits and that the container stow remains intact. The CSM provided details of these limits, stowage arrangements and container securing systems, including lashing patterns and details of lashing gear.
APL England had a capacity of 5,780 TEU. With limited durations in port for cargo operations, a means to easily and quickly ascertain that the forces acting on the ship would not exceed specified limits was required. To that end, in addition to the CSM, the ship was fitted with a Seacos MACS3 (v NET1.1) loading computer system developed by Interschalt maritime systems. Amongst other applications, this system also incorporated a container or cargo loading module and a lashing calculation program. The system met the requirements of Germanischer Lloyd (GL) Guidelines for Loading Computer Systems 2013 (GL2013).
On board APL England, the equipment used to secure containers on deck included twistlocks, lashing bars and turnbuckles. Twistlocks were used to secure containers stowed on deck to the hatch cover or deck, and to secure containers to one another vertically in a stack. Turnbuckles were anchored to lashing eyes on the ship’s deck, hatch coaming or lashing bridge, depending on the location on board. The lashing bars secured containers to the ship and were tensioned via the turnbuckles.
The load computer results based upon ship conditions on departure from Ningbo showed nine lashing lifting force exceedances, from 102 to 107 per cent of the maximum force. The master and chief officer accepted these values in the knowledge, confirmed by forces checks, that changing ship conditions (ballast and fuel) would bring these forces within the acceptable range as the voyage progressed.
Recorded data
APL England was fitted with a simplified voyage data recorder (S-VDR)[5] designed to collect and store data from various shipboard systems in compliance with SOLAS requirements. This included parametric data, bridge and communication audio, and radar images. Roll and pitch data were not recorded on board nor was there any requirement to record such data.
APLEngland’s system was designed to contain 12 hours of data, written concurrently to a Compact Flash (CF) card and the protective capsule. This system required crew interaction to ensure the data was saved following an incident where power was not lost. The oldest data is continually overwritten and to preserve data, it is saved to the CF card and the card removed. As per procedures, the data post-incident was saved by the crew to the CF card which was then provided to the ATSB. The downloaded data was successfully converted in accordance with the manufacturer’s procedures.
APL England was also fitted with a Panasonic video recording system, which captured 8 video feeds, and contained about 1 month of data.
Initial analysis of audio recordings revealed the falling objects banging and crashing noise which occurred on the bridge around 0610 was significantly more than during the earlier 0215 roll event. The review of the available recorded data is ongoing and will be included in the ATSB’s final investigation report.
Condition of securing arrangements
The ATSB onsite investigation examined securing arrangements and lashing equipment in use on the ship. The lashing equipment appeared in generally good condition. However, many of the ship fittings (lashing eyes, lashing bridges and deck structures) were not found in good condition, as evidenced by the examples shown in Figure 4.
Figure 4: Examples of condition of cargo securings and ship structure
Source: ATSB
The ATSB inspection of the bay 62 (aft) arrangement and damage revealed similar structural and securing conditions as shown in Figure 4. However, in addition to this, examination of the stowage arrangement showed that the security of the stow above the container cell guides used in bay 62 was affected by the use of high cube (2.9m (9’6”) high) as opposed to standard height (2.6 m (8’6”)) containers.
Containers loaded on deck into bay 62 were secured as per the CSM. The CSM allowed for 8 tiers of 40’ containers to be loaded with the lower 4 tiers held within the cell guide structure. Containers in these tiers were not secured to each other or the deck via twistlocks or other securing arrangement. Atop tier 4, the lower part of tier 5 containers were within the cell guides and, due to access reasons, not secured to tier 4 containers by twistlocks. Tier 5, 6, 7 and 8 containers were secured together by twistlocks and lashing rods secured these stacks to the ship as per the CSM—lashing rods connected from lashing eyes (mounted to the cell guide structure) to the lower foot of tier 5 containers.
In this arrangement, when loading standard height containers, the top of tier 4 was about 1,550 mm (5’1”) below the top of the cell guides. However, high cube containers are 300 mm (1’) higher than the standard height container. Therefore, when loading high cube containers into bay 62, the top of tier 4 was 1.2 m (4’) higher than when loading standard height containers. In these circumstances, the bottom of tier 5 containers would be about 300 mm below the top of the cell guides, and within the tapered (fore-aft) lead-in section of the guide (Figure 5).
For the voyage to Australia, bay 62 was loaded with predominantly high cube containers to 7 tiers. The loading computer lashing and forces checks did not show any conflicts for this arrangement.
Figure 5: Bay 62 container stowage versus cell guide arrangement
Source: ATSB
Weather—Australian east coast low pressure systems
As APL England travelled down the east coast of Australia, the master received weather information regarding a complex low pressure system developing off the south-east of the country. This included regular forecasts and warnings (including gale warnings) issued by the Bureau of Meteorology (BoM) along with reports and guidance provided by the FNC and through SPOS.
With regard to low pressure systems off the east coast of Australia, BoM noted that ‘some of Australia's worst maritime disasters are caused by the destructive winds, torrential rainfall and rough seas that accompany stronger East Coast Lows’.[6] ATSB incident investigations related to east coast lows include the loss of containers overboard from YM Efficiency in 2018, and the grounding of the bulk carrier Pasha Bulker in 2007.
BoM also stated:
…east coast lows are intense low pressure systems which occur, on average, several times each year off the eastern coast of Australia, in particular southern Queensland, NSW and eastern Victoria. Although they can occur at any time of the year, they are more common during autumn and winter with a maximum frequency in June. East Coast Lows will often intensify rapidly over a period of 12-24 hours making them one of the more dangerous weather systems to affect the eastern coast…
East coast lows can generate one or more of:
• Gale or storm force winds along the coast and adjacent waters
• Very rough seas and prolonged heavy swells over coastal and ocean waters which can cause damage to the coastline.
At about 0035 on 1 June 2018, YM Efficiency was steaming slowly into strong gale force winds and very rough seas off Newcastle, en route to Sydney, when it suddenly rolled heavily, causing container stacks to collapse and topple. As a result, 81 containers were lost overboard and a further 62 were damaged. The ship sustained structural damage to its lashing bridges, superstructure, and accommodation ladder. Substantial debris from the lost containers subsequently washed ashore on the New South Wales coast.
The ATSB investigation determined that the forces generated during the sudden, heavy rolling placed excessive stresses on containers stowed aft of the ship’s accommodation. This resulted in the structural failure of containers and components of the lashing system, leading to the loss of containers overboard. Potential causes for the sudden rolling were investigated, but there was insufficient evidence to establish a definitive reason.
Further, the condition of the ship’s lashing equipment was considered not to have contributed to the loss of containers. However, the investigation found that the weights and distribution of containers in the affected bays were such that calculated forces exceeded allowable force limits as defined in the ship’s cargo securing manual (CSM).
APL England, 18 August 2016
At about 1500 (local time UTC + 8 hours) on 18 August 2016, while transiting the Great Australian Bight, APL England lost 37 containers overboard in rough seas. At the time of the occurrence, the ship was on an easterly heading (095°) at a speed of 17.9 knots in south-westerly winds of force 7/8 (34–47 knots) with a 4–5 m south-westerly swell on 6 m seas.
The master reported that the ship was rolling easily/moderately to a beam and quarterly swell but at around 1445–1500 the vessel encountered a sudden heavy roll to port (about 25°) coinciding with the loss of containers.
The ATSB did not investigate the occurrence. AMSA conducted an investigation and concluded that:
the vessel had a high metacentric height (GM)[8] which may have contributed to generation of excessive dynamic forces leading to failure of container base sockets and collapse of the stow
the topmost container tier in all rows of the collapsed bay was over the recommended weight although the stack weight in each row was not exceeded
the master was well prepared for heavy weather and had complied with safety management system requirements on departure from Fremantle
the weather experienced was as expected in the Great Australian Bight during the winter season
the ship conditions (draft, loading, stability) were within criteria which may have led to parametric rolling.
Following this incident, APL England was removed from this service and did not return to Australia until the 24 May 2020 incident.
Further investigation
To date, the ATSB has completed site inspections and gathering of evidence including interviews, documentation, data records and the ship’s voyage data recorder. Evidence collection continues through requests directed to parties related to the incident including the shipping company, class, regulators, port authorities and weather organisations. Safety analysis of gathered evidence is on-going.
The investigation is continuing and will include review and analysis of the following:
the ship’s container stow and lashing arrangement
ship’s maintenance regimes (deck and engine room)
ship’s service history and associated inspections
relevant requirements for inspection of deck equipment for securing containers
ship’s stability condition
weather conditions and weather information provided to the crew at the time of the incident
available recorded data during the incident
actions of the ship’s officers and crew during the incident.
Should a critical safety issue be identified during the course of the investigation, the ATSB will immediately notify relevant parties so appropriate and timely safety action can be taken.
A final report will be released at the conclusion of the investigation.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On Saturday 9 May 2020, NSW TrainLink passenger service 283D, an 8-car H OSCar set, travelling from Newcastle to Sydney, encountered a rail worker on the Up Main track at approximately 130.500 km. The worker saw and heard the approaching train and removed themselves from the track and out of the danger zone.
The train stopped past the location where the worker was situated, and the driver spoke with the worker to understand what had happened. The driver learned that the worker was an outer handsignaller (OHS) for a Track Work Authority (TWA) worksite at Dora Creek bridge at 127.100 km.
The OHS had been instructed by the protection officer (PO) for the worksite to remove the railway track signals[1] (RTS) being used for protection for the TWA. This instruction was made in the knowledge there was a train approaching the OHS location, but no warning or other information was relayed to the worker in relation to the proximity of the train.
What the ATSB found
An unapproved practice occurred during the application of the approved method of protection of TWA. This practice involved the person managing the safeworking, the PO, instructing workers to remove the RTS used to protect the worksite while trains were closely approaching. This was for the purpose of improving train operations. This practice put the track worker involved at risk as there was no defined process or method for protecting this worker. This practice was not part of the recognised methodology of using a TWA as published by the Rail Infrastructure Manager, Sydney Trains.
What has been done as a result
Sydney Trains acknowledged an unapproved practice occurred during the TWA whereby workers were directed to remove RTS while the train was closely approaching its location. Sydney Trains have included this issue in their change request process for Network Rules. The amendment will reinforce the existing requirement in step 12 of NPR 702 as it relates to a TWA using an inner and outer handsignaller protection, in that both the inner and outer protection must be replaced immediately after the passage of each rail traffic movement.
Safety message
Network Rules and Procedures for safeworking on railways have been developed to give direction and instruction to workers in how to safely manage work on track. When practices develop that deviate from the established procedures, care needs to be exercised to ensure these practices do not introduce unintended risk. Rail safeworking practices should only be implemented as approved by the Rail Infrastructure Manager.
Sydney Trains Major Works Branch commissioned John Holland Group (JHG) to conduct repairs and maintenance to the Dora Creek rail bridge on the main north rail line between Sydney and Newcastle (Figure 1). JHG used a PO from within their own workforce to supervise the safeworking for the job. The method of protection chosen by the JHG PO was a TWA.
As the OHS approached the RTS to remove it from the rail line, they heard the sound of the train whistle of 283D and moved off the Up Main line to the safety of the Up Cess area. The train ran over the RTS and the driver applied the emergency brakes. The train came to a stand around 60 m past the OHS.
Figure 1: Location Map
Source: Geoscience Australia, annotated by the ATSB
Preparation activities for the work
JHG and Sydney Trains Major Works Branch engineers and workers collaborated about the preparatory activity for the bridge works at Dora Creek. This involved submission of various plans for engineering and safeworking activity.
The JHG PO was provided with a scope of information on Sunday 3 May 2020 about the upcoming work and was tasked with planning the worksite protection arrangements. The proposed worksite protection plan (WPP) for the work on the bridge was submitted to both a JHG safety advisor and Sydney Trains for review.
The plan included use of a TWA to protect work on the Up Main line, and the use of Lookout Working to protect work on the adjacent Down Main line[2] . This plan was approved by Sydney Trains Major Works Branch for use.
The work before the incident
The planned work for Dora Creek Bridge was due to start at 0700[3] on Saturday 9 May 2020. The JHG PO arrived on site at 0530 and commenced a review of the safeworking arrangements. The handsignallers for the TWA arrived on site at 0620 and were briefed by the PO on the safeworking arrangements, including the instruction that the preferred approach would be for the handsignallers to remove the RTS as trains approached. No one in the work group questioned or challenged this proposed method of working.
The handsignallers made their way to their designated locations and placed the protection in the form of RTS when requested by the PO. The TWA was authorised at 0650 and work commenced on the bridge. As per the approved safeworking arrangements, there was also Lookout Working in place for the adjacent Down Main line.
At 0945, a Sydney Trains Major Works Branch employee attended the site and asked for work to be stopped. The reason given was Sydney Trains Major Works Branch do not permit Lookout Working on their worksites unless specific approval is provided prior to the work commencing. The work was stopped, and the PO supervising the Lookout Working attempted to obtain an Absolute Signal Block (ASB) for the Down Main. The ASB could not be established due to the lack of a second person in the signal box at Wyong to conduct a peer review of the proposed working.
Given the unavailability of ASB, the next option chosen was for a Track Occupancy Authority (TOA) to be used, and a TOA was granted at 1130 for the Down Main, while the TWA continued to be used on the Up Main.
The TOA on the Down Main was fulfilled at 1209, while the TWA remained on the Up Main. The PO protecting the Down Main arranged for TWA protection to be provided for the Down Main, with inner and outer handsignallers only, that is, without the use of fixed signals. The work continued in this fashion for the remainder of the afternoon.
The incident
At around 1525, the OHS for the TWA on the Up Main was asked by the PO, via radio, to remove the RTS to allow the next train to run unimpeded through the worksite. At the time of this request, NSW TrainLink service 283D, the 1453 Newcastle to Sydney passenger service, was heading towards the location where the OHS was stationed.
The OHS accessed the Up Main track adjacent to the location of the RTS closest to the worksite at approximately 130.381 km, removed the RTS and proceeded to walk along the Up Main line towards the second RTS located 20 m away in the down direction. The OHS was at this point walking towards the approaching train 283D. As the OHS approached the second RTS, they heard the sound of the train whistle of 283D and immediately moved off the Up Main line to the safety of the Up Cess area. The train ran over the remaining RTS and the driver applied the emergency brakes and the train came to a stand around 60 m past the OHS.
The driver and the OHS briefly spoke to each other to understand what had occurred, and the driver reported the incident to the Network Control Officer at Broadmeadow signal box, who then reported the matter to the Rail Operations Centre (ROC). The Network Incident Manager in the ROC made enquiries and determined that work should cease and the incident be investigated. A Sydney Trains Incident Rail Commander was despatched to the site to commence investigations and drug and alcohol testing was organised.
The TWA on the Up Main was fulfilled at 1556 and all personnel requested to return to the site office for initial interview and commencement of the investigation.
The location, signalling system and infrastructure
Dora Creek is located on the main northern rail line from Sydney to Newcastle, with the Dora Creek bridge located at 126.900 to 127.100 km and Dora Creek station platforms located at 127.140 km.
The rail line consists of an Up and Down Main line, with the signalling system being double line unidirectional rail vehicle detection. Dora Creek station is located in the automatic signalling section between Morisset and Eraring.
The signalling system is overseen by the Network Control Officer at Broadmeadow signalbox. Morisset has a local signalbox on the station that can be switched in and out as required. Eraring Power Station siding is controlled by the NCO at Broadmeadow signalbox, and it also has a local control panel that may be switched in and out as required.
All the main line rail assets and infrastructure are managed by Sydney Trains, who is the Rail Infrastructure Manager (RIM) for this part of the NSW rail network. The area has a number of private sidings that branch off the main line, including Vales Point Colliery and the Eraring Power Station.
The train involved
Train 283D was an 8-car H (OSCar) outer suburban and intercity set, performing the route from Newcastle Interchange to Sydney Terminal. The timetable for the train was a 1453 departure, due for arrival in Sydney at 1729.
The train was operated by NSW TrainLink, the NSW Government transport agency for above rail operation for intercity and regional passenger trains. The train was crewed by a driver and guard. Sydney Trains is the maintainer of the rolling stock.
The train was being driven as per operational requirements, with the headlights and fog lights switched on. The train was within the required speed limits for the section of track, according to the data logger report provided by Sydney Trains Engineering and System Integrity Branch. The speed of the train when it encountered the OHS was recorded as travelling at 94 km/h; the maximum permitted track speed was 95 km/h.
No defects or abnormal operation of the train was noted by Sydney Trains, and the train responded to the inputs of the driver within the normal operational parameters and requirements. The operation of the train was not considered to be a factor in relation to this incident.
The people involved
The Protection Officer
The Protection Officer (PO) was employed by JHG.
The PO was rostered on for weekend track work on the Sydney Harbour Bridge on Sunday 3 May 1400 – 2400 hours, then the afternoon shift at Dora Creek from 1400 – 0200 each night, Monday to Thursday. Fatigue was not considered to be a factor in this incident.
The PO was qualified as a Protection Officer Level 4, and also as a Handsignaller level 2. The PO had 11 years of rail industry experience and held the PO4 qualification since 2013 and had been recertified in August 2018 by Transport for NSW. The PO was also qualified as a Handsignaller Level 2 and held that certification since May 2013, and was recertified by TfNSW in August 2018.
The Outer Hand signaller
The OHS was employed by Swetha International as a casual rail safety worker.
The OHS worked in a job outside the rail industry from Monday to Friday 1300 – 1800 on each of the two previous weeks prior to the incident. The shift at Dora Creek on Saturday 9 May was the only rail work performed in the previous two weeks. Fatigue was not considered to be a factor in this incident.
The OHS was qualified as a Handsignaller Class 2, and was certified in August 2018. The OHS had previously been employed in the rail industry as an infrastructure worker.
Network Rules and Procedures
Sydney Trains administer the RailSafe Network Rules and Procedures for work on the Sydney Trains network. These rules and procedures are published on the RailSafe website and are publicly available.
There are a range of Network Rules and Procedures that may apply to any particular worksite, The following Network Rules and Procedures were applicable in this incident.
NWT 300 Planning work in the rail corridor
This rule prescribes the rules for planning work within the rail corridor and assessing the work for safety. In general;
Work planned for the Rail Corridor must be assessed for safety and its potential to intrude on the Danger Zone. Work in the Danger Zone must: - be carried out in accordance with the Network Rules and Network Procedures - not begin until the required safety measures are in place. The level of safety must not be reduced: - to allow rail traffic movements, or - because of a lack of Qualified Workers.
The work at Dora Creek was required to be planned in accordance with this rule. As required by this rule, work in the danger zone may be carried out by using one of the permitted forms of work on track authorities. In this case, the work on track authority implemented was NWT 306 Track Work Authority.
NWT 306 Track Work Authority
This rule prescribes the rules for authorising, issuing and using a Track Work Authority (TWA). In general:
A TWA: - authorises occupancy of a defined portion of track between rail traffic movements - does not give exclusive occupancy of the defined portion of track - is requested by and issued to the Protection Officer - may include multiple worksites - allows work that breaks or obstructs the track or alters track geometry or structure. Drivers and Track Vehicle Operators must follow instructions given by Handsignallers and the Protection Officer.
The TWA entailed use of outer and inner handsignallers only, not using signals, in order to manage the approach of rail traffic to and through the worksite.
The role of handsignallers in TWA
The role of handsignallers during a TWA is to provide direction to drivers and track vehicle operators about the approach to, and transit through, the worksite. The PO for the work provides instructions to the handsignallers about when and how rail traffic can proceed, or not, through the worksite. The handsignallers then relay that information to rail traffic through a combination of handsignals, placement or removal of RTS, and other instructions.
TWA is a form of protection that has a number of possible combinations, depending on the available signalling infrastructure, the location of the worksite, what conditions exist and other factors.
In the case of the TWA in use at Dora Creek on this day, the PO had chosen to use the handsignallers only method, not placed at signals. The version of TWA contained specific instructions on how the OHS interacts with rail traffic.
NPR 702 Using a Track Work Authority
In this situation NPR 702, page 11, contained the following instructions:
‘Protecting Worksites using Handsignallers only
Protection Officer
1. Place an outer handsignaller and two railway track signals 2500 m from where the inner handsignaller will be positioned in the direction of approaching rail traffic
2.Tell the outer handsignaller to display a CAUTION handsignal to approaching rail traffic.'
NPR 702, page 18, also contained a further instruction about what an outer handsignaller must do when not at a signal.
‘Managing rail traffic transits through worksites
Protection Officer
10. If it is safe for rail traffic to pass the outer Handsignaller not at a signal, tell the Handsignaller to take the following actions:
Movement allowed
Outer handsignaller action
Rail traffic is to proceed at caution
(a) Signal PROCEED AT CAUTION to the Driver or Track Vehicle Operator
NGE 202 Handsignals
Network Rule NGE 202 Handsignals described a proceed at caution handsignal as (during daylight) a green flag waved slowly from side to side or (during darkness) a green light waved slowly from side to side or an outstretched arm waved slowly.
This was the only described and approved action for an OHS, not at a signal, working under a TWA in relation to rail traffic transit through the worksite.
The RailSafe Network Rules and Procedures did not provide permission or instructions for OHS to remove RTS during a TWA while a train is approaching. It was not an approved activity under a TWA.
NWT 308 Absolute Signal Blocking
Absolute Signal Blocking is used to exclude rail traffic from a defined portion of track for a specified period. Its effectiveness depends on the Protection Officer correctly nominating the worksite location and the Signaller correctly identifying all protecting signals and points to exclude rail traffic from the nominated worksite location.
Peer review of Absolute Signal Blocking
The peer review process came into effect in February 2020 and was implemented by Special Instruction No. 02/20 to signallers. The peer review was conducted in larger signalling locations such as the Rail Operations Centre and at Granville, Blacktown, Broadmeadow and Wollongong signal boxes. Smaller signalboxes were not permitted to issue ASB unless there is another person, qualified as a signaller, present to conduct the peer review.
This process effectively ruled out the use of ASB for a large part of the Sydney Trains network. This restriction was brought about in response to a series of incidents involving ASB in the Sydney Trains network.
The peer review process did not appear in any training or competence management material provided to POs. The Special Instruction was published on the Sydney Trains Intranet and was not available to workers not directly employed by Sydney Trains.
NGE 200 Walking in the Danger Zone
The two key requirements from NGE 200 that relate to this investigation are:
‘Walking in the Danger Zone is:
Doing no other work than placing or removing protection.
Placing or removing protection
If placing or removing protection, workers must stay alert for approaching rail traffic.’
A limited number of activities are permitted under NGE 200, and when placing or removing protection, workers are responsible for their own safety. Therefore the circumstances when an OHS is required to access the Danger Zone must be managed carefully.
NPR 709 Using Railway Track Signals
This procedure described the specific requirements necessary when placing or removing protection in the form of RTS. An OHS in this case needed to place two RTS on the right hand rail in the direction of travel 20 m apart.
The requirement to use the right hand rail places the RTS on the opposite side to where the driving station is in the cab on most rail traffic, where the driver is located on the left hand side.
This requirement was in place for many years, and was designed to reduce the noise impact of the explosion of the RTS on the driver.
The effect this requirement has on the worker placing the protection is that the worker is most often further away from a safe place, as the right hand rail in the direction of travel in a double track unidirectional environment is in the middle of the corridor. A worker bending down to place or remove RTS will be likely intruding into the Danger Zone of the adjacent track as well as the track on which the protection is required.
NWT 310 Lookout Working
This rule prescribes the rules for working in the Danger Zone without a work on track authority using Lookouts or an approved Automatic Track Warning System (ATWS) as the safety measure.
If the safety assessment shows that it is safe then some kinds of work may be done in the Danger Zone without a work on track authority.
NGE 204 Network Communication
This rule prescribes the rules for spoken and written communication in the Network. In principle;
Communication in the Network must be: - clear, brief and unambiguous - relevant to the task at hand - agreed to its meaning before being acted upon. Safeworking communication must use: - the 24-hour clock to give the time of day - the phonetic alphabet and spoken numbers to identify: - train numbers and track vehicle numbers - signal numbers Communication equipment used for rail traffic operation or work on track must be tested and checked for its intended operation.
NPR 721 Spoken and written communication
This procedure provides specifics on how the rail safety worker can be effective with their written, radio and telephone communications in the Network. How to pronounce spoken numbers, to use the phonetic alphabet to spell words, standard terms, open channel and emergency radio communication protocols and written communication abbreviations.
Worksite Protection Plan (WPP) review processes
The JHG PO prepared a draft WPP for the work on Dora Creek Bridge that was to occur on Saturday 9 May 2020. Planning work was a requirement of Sydney Trains that was mandated in the Network Rule NWT 300 Planning Work in the Rail Corridor. The PO records those details by completing a WPP which was a requirement contained in the form NRF 015 Worksite Protection Plan.
The WPP identified that the worksite on the Up Main would be protected by a TWA and adjacent line protection for the Down Main would be by the use of a lookout under Lookout Working.
Both forms of protection were suitable for the task and were available to be used based on the required considerations for each. Issues such as sighting distance on the Down Main were appropriate for Lookout Working, and the nature of the bridge work on the Up Main required that a level of protection above ASB was required. A TWA was therefore a suitable method of protection.
JHG and Sydney Trains both required that the PO submit the plan for review through various channels. There were four separate processes that needed to be undertaken before the work could commence using the proposed method of protection; none of these processes detected deficiencies with the plan.
Both organisations approved the plan and it was then put into practice in terms of organising labour and other supporting activities, ready to be implemented on the day.
The John Holland review process
The JHG review process involved an assessment of the WPP by an internal safety advisor. According to JHG, this person was part of their safety team and was in place to provide support and advice to project teams and workers. The review process did not extend to testing or validating the safety assessment made by the PO in relation to the suitability of the sites chosen for the handsignallers.
JHG were not aware of the Sydney Trains Major Works Branch pre-approval process for the use of Lookout Working.
The Sydney Trains Access Pre-Advice System process
The Sydney Trains Access Pre-Advice System (APS) review process is a planning tool rather than an endorsement or approval system. Sydney Trains implemented this new system on 1 May 2020.
APS was advertised as a resource planning system not as a safety system. This system did not endorse or approve the method of protection, it recorded and registered the presence of the workgroup.
If a PO wanted to use a TWA on the Sydney Trains Network, then the PO must submit a WPP no less than 4 days prior to the work commencing.
The Sydney Trains Major Works Branch review process
There was an additional review process that Sydney Trains Major Works Branch required for work that was undertaken either directly by its own staff or indirectly by contractors, as was the case for the works on Dora Creek Bridge.
This review process required a special pre-approval for the use of Lookout Working and was implemented in August 2018. It was a branch only process, and was not documented or recognised outside of the Major Works Branch of Sydney Trains.
The WPP was submitted by the PO as required for registration in the Sydney Trains APS. This included reference to the use of a lookout for the Down Main, however no one in Sydney Trains had apparently linked the Major Works Branch pre-approval process to this WPP, so it was approved for use.
The detection of the unapproved use of Lookout Working was made when a Sydney Trains Major Work Branch manager attended the site around 0945 and requested the work be stopped while another form of protection be implemented for the Down Main.
This incurred delays to the work and resulted in additional workload for the PO, who now had to organise a new form of protection for the Down Main line, whilst still supervising the TWA for the Up Main line.
The Sydney Trains Corridor Safety Centre
There was another review process employed by Sydney Trains to review and approve work on the network. The Corridor Safety Centre (CSC) was established to help identify any deficiencies with the WPP of POs. The PO for the Dora Creek work called the CSC prior to starting work and the operator at the CSC identified a deficiency with the WPP.
The CSC operator asks the PO a series of pre-determined questions, and there are a range of possible combinations of how the conversation will develop, depending on the answers given by the PO. The question sets are configured to try and capture essential information from the PO in order to determine if the safeworking arrangements are suitable.
While it is not feasible to address each and every factor or consideration in these question sets, there are some basic requirements that could be considered. In the case of the work at Dora Creek, the operator detected an error in the way the work location was classified.
The location of work was listed as between Dora Creek platform 1 and 78.8 signal. However the Network Rule NWT306 required the PO to identify the work as being between:
two signals, or
a signal and a set of points, or
a signal and the end of a terminal line, or
a set of points and the end of a terminal line.
The error was minor in nature but identified by the operator and noted to the PO, who did not realise the requirement. The CSC operator quoted the requirements of the rule to the PO, who then corrected this detail and noted the location of the work was between signals 88.0 and 78.8.
Correction of the work location was made and the worksite was approved and an approval number was issued.
The PO did not know who the Network Control Officer was for the work location in the Up direction. The PO asked the operator at the CSC who was the responsible signaller for the worksite in order to obtain the TWA. The CSC incorrectly identified Wyong as the controlling signalbox and the PO asked for and received the phone number for Wyong signalbox.
Safety analysis
Removing railway track signals during a TWA
Overview
In relation to TWA, the practices described in NWT 306 and NPR 702 were designed to deliver the safest possible outcomes for workers performing work on or around the track, and for train crew and passengers. In particular, the role of the OHS includes some inherent risks that require careful management given they often work alone when performing their duties.
The two main tasks performed by an OHS are:
Placing and replacing RTS
Displaying a caution handsignal to the drivers of approaching rail traffic.
Displaying the caution handsignal is performed from a safe place outside of the Danger Zone, most of time in the cess next to the track associated with the TWA. TWA as a method of protection was most widely used in the Sydney Trains Network in the dual track outer suburban and inter-city areas, as multiple track locations such as found in inner suburban areas provide limited safe places for handsignallers to operate.
The placement and replacement of RTS is therefore the task that involves the most risk for the OHS, as that task entails entering the Danger Zone alone, and bending down to affix the RTS to the head of the rail.
The permission to place and replace RTS was not in the rules and procedures for TWA. The permission for such activity is in rule NGE 200 Walking in the Danger Zone.
Placing or removing protection
The requirements for an OHS, not at a signal, to place or remove protection is not defined in the RailSafe Network Rules and Procedures. The established practice for an OHS to replace RTS after a train has run over them is to do so as soon as practicable after the train has passed.
The training material provided to handsignallers instructs them to:
‘Advise the inner handsignaller when the train or track vehicle has passed you.
Replace the Railway Track Signals.’
The rationale behind this is to permit the OHS access to the Danger Zone relatively soon after the train has passed. The proximity of the previous train prevents another train from closely approaching at track speed, because of the reduced proceed indications of the signalling system that will be displayed to any following rail traffic. This is therefore the safest time for a handsignaller, operating on their own, to be in the Danger Zone and replacing RTS protection.
Removing protection while a train is heading towards the OHS at track speed is not stated in the TWA Rule and Procedure but this practice occurred during this TWA, numerous times in the incident under investigation.
Placing and removing Railway Track Signals by the outer handsignaller
The practice of placing and removing RTS is approved under NGE 200 Walking in the Danger Zone which covers a range of work on track rules where placement or removal of RTS protection is required. Placing and removing protection are the only types of work approved under this rule. It also requires workers to stay alert for the approach of rail traffic under their own watchfulness.
There are no specified warning times applied to this type of work which is in contrast to Network Rule NWT 310 Lookout Working, where there is a defined formula for see time, move time and safe time to allow workers to move to a safe place and to be there for 10 seconds prior to the arrival of a train.
In a TWA, the approved practice for the OHS, not at a signal, is:
the OHS gives the driver a caution handsignal (which means the train slows down on the journey to the inner handsignaller)
the OHS replaces the RTS after the train has passed their location and exploded them.
This practice means that the worker is protected because a train has just passed and another train cannot enter the area as the signalling system holds the preceding signals to stop until the previous train has passed beyond the signalling system safety overlap. This is a deliberate and considered practice and is what the OHS is required to do during a TWA using handsignallers only. However, it was not applied in this instance.
The actions of the JHG PO in directing the OHS to retrieve the RTS before the arrival of train, with no indication of the train’s whereabouts, placed that worker in direct risk of being struck. It was also not an approved action under the Network Rules and Procedures for TWA.
The JHG PO indicated that it was common to adopt this practice during use of a TWA and had been done so many times before.
Sydney Trains have acknowledged that this was not an approved practice under the rules and procedures for TWA but that its use was known by the Safety Division of the organisation at the time of the incident.
Removal of railway track signal protection during a Track Work Authority
The JHG PO said that it was his clear intention to ask the handsignallers on the Up Main to remove their RTS to allow rail traffic to pass through the worksite unimpeded. This intention was conveyed to both handsignallers at their pre-work briefing at the site shed at Dora Creek station prior to them leaving for their designated locations.
For the OHS, this meant they were being asked to enter the Danger Zone, while a train was on its way towards them at track speed, in order to retrieve the RTS.
Evidence provided from the OHS log indicates that of the 14 trains that travelled through the section since the TWA was granted at 0650 until the near hit incident at 1526, 11 of those trains were allowed to ‘run free’, that is, the protection was removed prior to the arrival of the train.
This practice places the OHS in danger, as the worker is being asked to enter the Danger Zone alone with no other specified form or method of protection to remove the RTS while a train is moving towards them at track speed.
The OHS said that as he reported the near hit to the PO, he heard the PO say over the radio he should have informed the OHS that there was a train closely approaching”. However this could not be verified as these radio transmissions were not recorded.
Evidence provided by Sydney Trains Network Rules Unit for this investigation indicated that the practice of removing the protection while the TWA was in force, was not an approved activity under the RailSafe Network Rules and Procedures. The practice of removing the protection effectively fulfils the TWA each and every time it occurs. If protection is removed to allow trains to run unimpeded, then effectively there is no TWA in place.
Sydney Trains Network Rules Unit indicate they were aware of the non-conforming practice at the time and have since provided instruction to the portion of its workforce where this type of protection is used more commonly that it is not an approved practice. Sydney Trains also undertook to revise the Network Rules and Procedures to make it clear that this practice is not acceptable.
Making a safety assessment
The common rule for all work on track is NWT 300 Planning Work in the Rail Corridor. That rule says, among other things, that work in the rail corridor must be planned and a safety assessment made by the PO. The manner of recording information about the safety assessment and the way the assessment is conducted is not described in the rules.
One of the factors involved in the use of a TWA is the placement of the handsignallers. NWT 300 states in part:
‘When making a safety assessment, Protection Officers must consider, amongst other factors, if:
Easily-reached safe places will be available for workers…’
The PO for this work made their safety assessment from the site office next to Dora Creek station. No attempt was made to visit the site to understand if there was an easily reached safe place for the OHS or if the location provided suitable visibility for the OHS to see, and be seen by, approaching rail traffic
Evidence provided for this investigation revealed that the PO for this work was on site from Monday 4 May to Thursday 7 May 2020, working afternoon shift 1600 – 0200, and that there were opportunities to visit the site to establish that it was suitable for the task.
There was no overt instruction provided by JHG to the PO for this purpose. During the review by the JHG internal safeworking advisor, there was no indication that the adequacy of the safety assessment was checked or validated.
The location of the outer handsignaller
While NWT 300 does not mandate that a site visit is required by a PO when undertaking the safety assessment, the PO was not able to confirm how he verified that the safety assessment for the site chosen for the OHS was suitable. NPR 702 is quite specific in terms of the placement of handsignallers when using handsignallers only. It states:
‘Protecting Worksites using handsignallers only
Protection Officer
Choose locations where handsignaller, Drivers and Track Vehicle Operators can see each other clearly…’
Evidence provided from the OHS was that at approximately 0900 he relocated himself approximately 50 - 100 m closer to the worksite, that is in a southerly direction, in order to establish better sighting distance with rail traffic on the Up Main. The reason for the relocation was a train standing at signal E1 on the Down Main line awaiting authority to proceed.
A train in this position on the Down Main obscures rail traffic approaching in the Up direction as the stationary train impedes visibility around the left hand curve. Figure 2 below shows the location where the OHS was stationed and the impact of a train standing at signal E1.
The location of the OHS was noted on the WPP as at 130.500 km, however the position the OHS adopted after relocation at 0900 was closer to 130.380 km.
The OHS decision to relocate was made without consultation or knowledge of the PO and placed the OHS slightly within the required 2500 m distance to the inner handsignaller, who was located at 128.000 km. This is a technical breach of NPR 702, however there is no evidence to suggest it had an adverse effect on the worksite protection.
Figure 2: View from the outer handsignaller’s original location
Source: John Holland
Communications between the Protection Officer and handsignallers
The OHS described some of the radio communications between the PO and the various handsignallers as confusing and ineffective. The OHS described having to clarify the arrangements with the inner handsignaller for the Up Main TWA in order to confirm who instructions were being given to at particular points in time.
The OHS reported that formal open channel radio protocols as described in the RailSafe Network Rules and Procedures NGE 204 and NPR 721 were not being used, and that the communication was casual and unclear. It was not possible to validate this assertion with certainty as these open channel radio transmissions were not recorded.
Competency of workers at CSC
The CSC question set did not test whether the placement of the handsignallers met the requirements of the Network Rules and Procedures in terms of visibility between the handsignaller and drivers of approaching rail traffic.
Operators at the Sydney Trains CSC are required to possess safeworking qualifications. The required qualification at a minimum is PO2. To implement a TWA as a method of protection requires a PO3 or above qualification. Of the 12 CSC operators, 9 were (as at July 2020) PO2 level only. The CSC operator who took the call from the PO at Dora Creek was a PO2 at the time of the incident.
The operators at the Sydney Trains CSC were, in some cases, providing advice and support to POs about methods of protection they could not implement given their current level of qualification (PO2).
Knowledge and awareness of the various review and approval processes
A common factor across Sydney Trains review processes that form part of the approval for worksite protection examined through this investigation, was that they did not appear in the training materials and courseware for PO training which raised questions as to how POs and contract POs in particular are made aware of review process requirements.
The courseware for Sydney Trains PO 4 training did not reference the APS system or the Major Works review process for the use of Lookout Working, nor the ASB peer review process. There was one reference to the CSC, and that was in relation to being able to seek support through a rail safety coach. There was no reference to requirements to submit WPP details for review by the CSC.
The applicable review processes for worksite protection approval, require POs to do a range of things in relation to the planning and delivery of their proposed worksite protection arrangements, but they were not routinely provided with any training or support material to make them aware of and competent to do these tasks.
The applicable review processes do exist in various forms outside of the Network Rules and Procedures, including in memos, newsletters, and internal Sydney Trains procedures. However, given they are outside of the Network Rules and Procedures then if changes are made to them, there is no assurance that changes would be notified to people that need to know and understand them, like a contract PO.
Changes to Sydney Trains Network Rules and Procedures are communicated to employees through defined and comprehensive change and communication processes which are distributed more broadly through a subscriber mailing list. However not all contractors are on this distribution list.
The rail industry, like many industries, relies upon an extended supply chain rather than purely in-house resources. As a result, many POs are contractors and do not have ready access to internal information resources like an employee would.
Changes to auxiliary processes that support worksite protection rules and procedures, like the ones made for review processes involving the CSC and APS in this incident, were not communicated to the JHG contract PO and as a result, there is little assurance that JHG or other contractors who need to know this information received it.
Without ready access to information and training about Sydney Trains review processes that sit out side of the Network Rules and Procedures, there is an increased risk of errors and mistakes occurring in the planning, preparation and delivery of worksite protection services. An integrated set of training materials and processes to communicate changes to contractors are essential to ensure all workers, employees and contractors alike, are aware of and competent to provide worksite protection services on the network.
Prohibitions in the Network Rules
The RailSafe Network Rules provided instruction about the required responses during the use of the various work on track rules. The rules are predicated on the basis of instructing people what they must do in order to deliver the desired safe outcome and are not based, for the most part, on informing people what they cannot or should not do, as it is not possible to identify each and every undesired practice for the application of the rule or procedure.
But, there are exceptions to this in some rules, for example in Lookout Working NWT 310, contains a specific prohibition on the use of radios and telephones.
‘Lookouts must:
Not use radios or telephones to warn workers….’
This prohibition was included in the rule because it is a known practice that compromises the safe outcomes intended by the rules and there is a desired need to specifically tell people about the prohibition. Other rules are silent on prohibited or undesired practices and rely on the description of the approved practices to deliver the desired safe outcome.
Workload
The interruptions to the work because of the cancellation of Lookout Working and the need to implement a new type of protection on the Down Main, incurred delays to the work and caused an increase in the workload for the PO. At interview, the PO acknowledged the workload increase, but did not report that it was beyond his capability to manage and did not believe it contributed to the incident involving the OHS later in the afternoon. The investigation determined that it was unlikely that the workload level of the PO contributed to the incident.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the safeworking occurrence involving NSW Trains 283D and an OHS near Dora Creek NSW, 9 May 2020.
Contributing factors
There was an unapproved practice occurring during Track Work Authority of asking the Outer Handsignaller to remove Railway Track Signals from the track as a train was closely approaching in order to let it run free, which placed the Outer Handsignaller at risk of being struck by the train. (Safety issue)
The Outer Handsignaller, under direction from the Protection Officer, removed the Track Work Authority Railway Track Signals while a train was heading towards their location.
Other findings
Sydney Trains Protection Officer training and competence assessment did not address a number of important operational safety processes, such as the Corridor Safety Centre, making sure these workers get the information they need.
The various processes used to register, review and approve the Worksite Protection Plan did not detect some basic deficiencies that impacted its effectiveness such as a site visit to determine safe place location.
The operators at the Sydney Trains Corridor Safety Centre were, in some cases, providing advice and support to Protection Officers about methods of protection they were not certified to implement.
NPR 709 requires placement of Railway Track Signals on the right hand rail in the direction of travel of rail traffic, often placing the worker in the Danger Zone of the adjacent line.
The workload of the Protection Officer increased signifcantly during the day because of the cancellation of the pre-arranged Lookout Working by Sydney Trains Major Works and the Sydney Trains Absolute Signal Blocking Peer review process, meaning Absolute Signal Blocking was not available because of the lack of a peer review person.
The Sydney Trains Absolute Signal Blocking peer review process effectively prevented use of this method in certain parts of the network unless an additional person was provided and present to conduct the review.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions will be provided separately on the ATSB website on release of the final investigation report, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website after the release of the final report as further information about safety action comes to hand.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Unapproved practice during TWA
Safety issue number: RO-2020-006-SI-01 Safety issue description: There was an unapproved practice occurring during Track Work Authority of asking the Outer Handsignaller to remove Railway Track Signals from the track as a train was closely approaching in order to let it run free, which placed the Outer Handsignaller at risk of being struck by the train.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Sydney Trains recorded audio
Sydney Trains data logger report
Sydney Trains Incident Information Management System (IIMS) reports
Sydney Trains RailSafe Network Rules and Procedures
John Holland 5 Whys investigation report and statements
Swetha International Investigation report and statements
TfNSW training material for Protection Officers and Handsignallers
Interview with the Protection Officer
Interview with the Outer handsignaller.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Sydney Trains
John Holland Pty Ltd
NSW Trains
Swetha International Pty Ltd
Transport for NSW
Office of the National Rail Safety Regulator
Submissions were received from all of these parties. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Table of abbreviations
Table of abbreviations
APS
Access Pre-Advice System
ASB
Absolute Signal Blocking
ATWS
Automatic Track Warning System
CSC
Corridor Safety Centre
JHG
John Holland Group
NCO
Network Control Officer
NGE
Network Rule General
NPR
Network Procedure
NWT
Network Rule Work on Track
OHS
Outer Hand Signaller
PO
Protection Officer
RIM
Rail Infrastructure Manager
ROC
Rail Operations Centre
RTS
Railway Track Signals
TOA
Track Occupancy Authority
TWA
Track Work Authority
WPP
Worksite Protection Plan
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Mid-morning on 17 May 2020 an experimental amateur-built Osprey 2 amphibious aircraft, registered VH-WID (WID), took off from Maitland Airport, New South Wales, for a local private flight. The pilot was the sole occupant and was conducting the aircraft’s second test flight.
During the climb, passing 2,400 ft, the pilot was advised, via radio, of white smoke coming from the aircraft and noted that the engine was not running smoothly. In response, the pilot broadcast that they were returning to land on runway 23. However, during the descent they turned to join the reciprocal runway 05. As the aircraft was turned on to the base leg of the circuit the engine failed, and the pilot attempted to conduct a forced landing on to the closer runway 08. During the final stage of the glide approach, the aircraft was observed to abruptly roll, pitch down and collide with terrain.
What the ATSB found
The ATSB found that the use of a damaged engine oil cooler fitting, which was not compatible with the fitted oil hose, most likely resulted in the hose disconnecting from the oil cooler during the climb, and the loss of oil from the engine.
During the return to the airport, the airborne duration and engine power required to maintain height were both increased when the pilot decided to change runways. This resulted in the engine failing due to oil starvation as the aircraft was turning on to the base leg of the circuit. During the subsequent forced landing, control of the aircraft was lost due to an aerodynamic stall at a height too low for recovery.
It was also identified that neither the required, nor the majority of the recommended stage build inspections of the aircraft were conducted. This was not detected prior to the issuance of a certificate of airworthiness that permitted the aircraft to be flown. While these inspections would probably not have detected the damaged fitting, they may have identified that the oil supply hose was in poor condition. They would also have been an opportunity to identify and improve the overall build quality of the aircraft.
The ATSB also identified a number of other deficiencies relating to the inspection and flight testing of amateur‑built aircraft, including the risk assessment of the proposed test pilot.
What has been done as a result
As a result of this investigation, the Sport Aircraft Association of Australia (SAAA) amended the Authorised Person’s Manual of Procedures and submitted it to the Civil Aviation Safety Authority (CASA) for approval. The revisions to the manual:
stated that if the authorised person considered that an aircraft was unsafe, they were not required to issue a certificate of airworthiness and could refer the matter to CASA
clarified that the Risk Radar Aviation report must be endorsed in writing by both the technical counsellor (TC) and the builder
required that the authorised person (AP) receive 3 technical counsellor reports
required the AP to name the pilot who would be conducting the initial test flying of the aircraft in the limitations
required that any changes made to the aircraft after the certificate of airworthiness was issued be notified to the AP
clarified that a TC or AP cannot inspect their own aircraft.
The SAAA also updated their other manuals to reflect these changes.
In addition, the SAAA have written to CASA to request an urgent 1-day refresher training course for all authorised persons and annual refresher training courses be made available. They have also amended their procedures to mandate that 3 stage inspections, inclusive of the final inspection, are conducted by a technical advisor (or equivalent) on the aircraft during the build. The SAAA have also requested that CASA provide them with a summary of the audits conducted on authorised persons to ensure they are aware of issues which may arise.
Safety message
As stated in the ATSB publication, Avoidable Accidents No. 3 - Managing partial power loss after take-off in single-engine aircraft, managing a partial engine failure is often a more complex scenario than a complete engine failure. The course of action chosen can be strongly influenced by the engine producing some power. Pilots are advised that as the engine could stop at any stage, the aircraft should be landed at the earliest opportunity and consideration should be given to forced landing options along the flight path.
This accident also highlights the importance of adhering to the design specifications and good engineering practices when building an amateur-built experimental aircraft. Attention should be given to the component manufacturer’s specifications, installation instructions and limitations to ensure the component, and consequently the aircraft, will perform as intended.
Consideration should also be given to having independent inspections during the build process. Independent inspections conducted during the early stages of the build, and prior to closing components such as the wings and fuselage, will assist in ensuring the builder has used accepted practices and reduce the likelihood of inadvertent construction errors.
Finally, while most amateur-built aircraft are built to a high standard consideration should be given to the use of a professionally‑trained test pilot for the initial test flying. Use of the Sport Aircraft Association of Australia’s risk assessment tool, and consultation with their Flight Safety Advisors, can significantly assist the test flying stage.
The occurrence
On 17 May 2020, at around 0800 Eastern Standard Time,[1] a pilot arrived at Maitland Airport, New South Wales, to prepare for a private flight in an experimental amateur-built[2] Osprey 2 amphibious[3] aircraft, registered VH-WID (WID). The pilot was conducting their second test flight in the aircraft and was to be the sole occupant for the flight.
Immediately prior to the test flight, the pilot conducted a flight in a Piper Aircraft Inc. PA-28 Archer (PA-28) aircraft, reportedly to practice forced landings. This flight took about 35 minutes.
While the pilot was flying the PA-28, the owner/builder (builder) of WID conducted the aircraft’s pre-flight inspection and ran the engine on the ground for about 5 minutes. The builder then signed the maintenance release to confirm that the inspection had been completed.
It was reported that the pilot also conducted a pre-flight inspection, however this did not include checks of the fuel for contamination or the oil level in the engine. The pilot consulted the checklist to start the engine and spent around 15 minutes on the ground taxiing and conducting further checks, including a high-speed taxi.
At 1002, the aircraft departed from runway 23[4] and turned left. During the subsequent climb, the pilot made a broadcast on the common traffic advisory frequency (CTAF),[5] advising they[6] were on climb to 3,000 ft to operate overhead the airport (Number 1 in Figure 1). At 1007, the pilot of a second aircraft made a radio transmission stating they were entering runway 05 (the reciprocal runway) for a departure to the west.
Shortly after, as WID passed approximately 2,400 ft above ground level (AGL), a witness on the ground contacted the pilot of WID, on the CTAF, to advise that white smoke could be seen ‘coming back from the aircraft’. The pilot responded that they had also detected ‘some rough running’ and consequently they were returning to join the crosswind leg of the circuit for runway 23. The pilot of the second aircraft taxied back to the airport apron to ensure WID had access to all runways, however, they did not broadcast this on the CTAF.
Figure 1: Accident flight track and key events
Source: Google Earth with OzRunways data, annotated by the ATSB
The pilot of WID commenced a descending left orbit to the north of the airport. However, instead of continuing the descent to land on the previously‑advised runway 23, they stopped the descent at about 1,000 ft AGL and conducted a turn in the opposite direction. They then turned to join the circuit for runway 05, advising on the CTAF they were joining downwind (Number 4 in Figure 1). The pilot subsequently increased the engine power and climbed to maintain between 1,100 and 1,200 ft AGL on a widening downwind leg.
As the aircraft turned base for runway 05, (about 5 minutes after the pilot was advised of smoke from the aircraft) the engine stopped. The pilot made a broadcast to advise they had a ‘complete engine failure’ and they were conducting a glide approach to runway 05, which they quickly changed to runway 08 (Numbers 5 and 6 in Figure 1).
Several witnesses reported that as the aircraft was on final approach to runway 08 with the wings level it suddenly rolled to the left and the nose dropped. The aircraft subsequently collided with terrain in an inverted position. The pilot was fatally injured, and the aircraft was destroyed.
The pilot held a valid Private Pilot Licence (Aeroplane) issued in June 2010. They also held a single engine aeroplane class rating with manual pitch propeller control and retractable undercarriage design feature endorsements. In addition, the pilot had spin and aerobatic endorsements, issued in July 2012.
The pilot commenced flying in the United Kingdom (UK) however, they had not attained a UK pilot licence. They had recorded approximately 60 flight hours to the end of 2003. After attending the Empire Test Pilot’s School[7] as a flight test engineer[8] in 2003, they had worked as a professional flight test engineer in both the UK and Australia.
The pilot commenced flying in Australia in 2007. A review of their logbook indicated they had accumulated approximately 189 hours of flying in Australia, of which approximately 103 hours were as pilot in command. Prior to the day of the accident, they had flown twice in 2020, with the last recorded flight on 29 March 2020. In 2019, they had flown 10.4 hours, including an aeroplane flight review, which covered stall recognition with recovery and forced landings.
The pilot conducted a high-speed taxi test and their first flight test in WID in December 2019. As far as the ATSB could ascertain, the pilot had not flown as a test pilot in any other aircraft prior to the first test flight.
Medical information
The pilot’s Class 2 medical certificate expired on the 16 May 2020. However, due to the COVID‑19 pandemic, the Civil Aviation Safety Authority (CASA) issued an automatic exemption to all medical certificates valid on 31 March 2020. This exemption authorised licence holders to fly without a current medical certificate for a period of 6 months beyond the certificate’s expiry date. The pilot’s medical certificate noted one restriction requiring distance vision correction to be worn during flight.
The post-mortem and toxicological examinations did not reveal any medical issues that may have contributed to the accident. In addition, there was no indication that the pilot was experiencing a level of fatigue known to affect performance.
Aircraft information
Overview
The Osprey 2 amateur-built aircraft was designed in the United States in 1972, to be built from a set of plans. It was a mid-wing, cantilever monoplane with a flying boat hull and a strut mounted engine, driving a wooden pusher style propeller (Figure 2). The aircraft was manufactured primarily from wood, with wooden formers and frames, and skinned with plywood. The conventional flight control surfaces (ailerons, elevator, and rudder) were covered with fabric and no flaps were fitted. It was equipped with retractable tricycle undercarriage.
Figure 2: VH-WID
Source: Aircraft owner/builder
Aircraft build
The aircraft build was started in 1977 in Australia, and the original builder had manufactured and built the:
fuselage
spars
empennage
wing ribs (which were not assembled)
fuel tank
landing gear
engine mount.
The plans and the manufactured parts were then sold a number of times before being bought by the last builder in 2014. The aircraft was placed on the Australian register on 18 August 2014, with the aircraft build then completed over several years.
In 2016, the builder purchased a Lycoming O-320-E2A[9] engine, which had previously sustained a propeller strike. The engine was sent to a CASA-approved engine repair shop for a sudden stoppage inspection. After the inspection, the engine was test run, then inhibited to prevent corrosion and all entry points were covered. The builder received the engine, with a new engine driven fuel pump and oil filter, in August 2016.
Maintenance
The aircraft was being maintained in accordance with the CASA maintenance schedule, which required an inspection every 12 months or 100 hours, whichever came first. It had a valid maintenance release, issued by the builder[10] on 3 December 2019.
Wreckage and accident site information
Site and wreckage information
The accident site was located on the extended centreline, approximately 740 m west of the threshold for runway 08 (Figure 1). The on-site examination identified that the aircraft struck terrain in an inverted position with the left wing likely striking first, followed by the aircraft nose, engine pod and right wing (Figure 3). The ground impressions formed by the leading edge of the wings were of a curved nature and likely indicative of the aircraft rotating to the left as it impacted the ground.
The distance from the first impact point to the last item of wreckage was about 27 m, with the engine and fuselage coming to rest about 11 m from the initial impact point. This, along with the angle at which the impact occurred, suggested a low forward speed. There was no post‑impact fire.
Figure 3: Accident site
Source: ATSB
All the major aircraft components were accounted for at the site. The inspection also identified that:
the flight control system was intact, with no defects identified that may have contributed to the accident
while the main landing gear was found retracted, video evidence indicated that the gear was extended for the duration of the flight, as such retraction likely occurred during the accident sequence
one of the propeller blades was significantly fragmented while the other remained intact
the oil supply line from the engine to the oil cooler was disconnected (Figure 4)
the engine cowl, rear fuselage, and empennage were heavily coated with engine oil, with streams forming as the oil migrated on the surfaces (Figure 5)
there was no oil in the engine
the oil gauge/filler tube was broken at the base where it attached to the engine lower crankcase assembly (Figure 4)
the crankcase below the no. 1 cylinder was perforated (see the section titled Engine inspection).
Figure 4: Oil cooler supply hose disconnected
Source: ATSB
Figure 5: Empennage with oil residue
Source: ATSB
Engine inspection
The engine was inspected at an independent CASA-approved engine overhaul facility. The inspection found signs of internal damage indicative of an engine that had been starved of lubricating oil. The inspection also found that:
the connecting rod in the no. 1 cylinder had separated at the big-end (Figure 6), most likely resulting in the observed hole in the crankcase (Figure 6 and Figure 7)
the crankshaft journals[11] exhibited various levels of heat damage (Figure 7)
within the no. 3 cylinder, corrosion was observed on the bolts on the connecting rod and the bearings were heavily distressed with copper discolouration and deformed on one side
within the no. 4 cylinder, while oil was observed in the connecting rod bearing, it was discoloured black
all oil galleries were clear of obstructions.
Figure 6: Number one cylinder damage
Source: ATSB
Figure 7: Crankcase hole and heat damage to crankshaft journals
Source: ATSB
Engine manufacturer analysis
The ATSB subsequently transported engine parts to the engine manufacturer for additional inspection. They confirmed that the engine had most likely failed through oil starvation with the connecting rods and bearings showing obvious signs of oil starvation. They also advised that if a hose had disconnected from the oil cooler, that was the most likely cause of the oil loss.
Oil cooling system
An oil cooler removes surplus heat from an internal combustion engine. The oil pump transfers the oil from the sump through a supply hose to the oil cooler. The return hose passes the oil through an oil filter and then on to lubricate and cool the engine. The supply hose to the oil cooler was found disconnected at the accident site (Figure 8).
Figure 8: Oil cooling system
Source: ATSB
The builder advised they had reused an automotive oil cooler from a previous project. They also advised that a length of oil hose and fittings were purchased new from an automotive supplier, a few years before the hose was cut to length, assembled with the fittings and installed on the aircraft.
Figure 9: Oil hose assemblies
The hose assembly at the top of the image is the oil cooler supply hose which was found disconnected at the accident site. The lower hose is the oil cooler return hose. The lighting in this photo resulted in the silver-coloured fittings appearing brass coloured.
Source: ATSB
Hose examination
The two hose assemblies were similar in construction but of different lengths. It was reported that the hoses were most likely cut from the same length of hose (Figure 9) however, they were different shades of blue. The hoses had a polyester textile outer braid with an internal textile reinforcement. They were designed to be used in low pressure, high temperature applications to carry petroleum-based products including lubricating fluids, hydraulic and transmission oils. Crazing was found on the outer surface of both hoses but was more significant on the detached oil cooler supply hose (Figure 10).
Figure 10: Crazing on oil cooler supply hose
Source: ATSB
Fitting examination
Both hose assemblies had push-on type fittings that do not require external clamping (Figure 11). The integrity of the connection relied on the hose expanding over a series of barbs[12] on the fitting. The internal liner material conformed to the barbs under the pressure of the internal textile reinforcement and outer braid of the hose.
Figure 11: Hose and fittings
Source: ATSB
On each hose assembly, the end connected to the engine had a straight, silver colour plated mild‑steel fitting, with three barbs and a yellow collar. The end connected to the oil cooler had a 90° curved, red and blue aluminium alloy fitting, with two barbs (Figure 11–Figure 13). Table 1 lists the differences between the two fittings.
Table 1: Differences between fittings
Silver coloured fitting (engine end)
Red-blue coloured fitting (oil cooler end)
Three-barbs:
mild-steel construction
equal height and spacing
outside diameter of barbs 18.11 mm
Two-barbs:
aluminium alloy construction
barbs of different heights
outside diameter of barbs 17.83 mm and 18.28 mm
shorter overall length than barbs on silver fitting
inside diameter slightly smaller than silver coloured fitting
Oil had migrated between first and second barb and the valley between the second and third barb was clear of oil
Oil had migrated between first and second barb on fitting which did not separate
The two-barb fitting from the detached oil cooler supply hose, showed signs of mechanical damage consistent with tooling marks which could not have been sustained during the accident sequence (Figure 12).
Figure 12: Damage to two barbed fitting of the detached oil cooler supply hose
Source: ATSB
The two-barb fitting on the oil cooler return hose, which did not detach, also had some mechanical damage, though this was less severe, with no significant damage to the barb (Figure 13). This connection also showed signs of the hose migrating off the fitting. However, as there was impact damage on the fitting collar, it could not be established if the migration of the hose occurred prior to, or during, the accident sequence.
Figure 13: Images of two-barb fitting from the oil cooler return hose
The image on the left shows mechanical damage to the fitting, the image on the right shows damage to the fitting and migration of hose from fitting.
Source: ATSB
Hose supplier advice
The ATSB discussed the aspects of hose design and push-on fittings with the Australian supplier of the hose. They advised that:
the hose was compatible with the type of engine oil that was in use
the hose was rated for the operating temperature and pressure it would sustain in use on the aircraft engine
external crazing indicated that the hose was at the end of its in‑service life and would have lost its pliability due to age
with external crazing, the inner braid reinforcement layer would likely also have deteriorated affecting the ability of the hose to grip the barbs of the fitting
a fitting could be re-used provided it was undamaged
they recommended a three-barb fitting be used with the hose
they could not comment on the use of a two-barbed fitting, as no testing had been conducted on the fitting in combination with the type of hose used
they had not conducted testing of the product to certify its use in an aviation setting.
Aircraft build
During the inspection of the aircraft wreckage, non-standard practices and parts, different to those specified in the build drawings, were identified. Examples of these are listed in Table 2.
There was no requirement to follow aviation‑specific standards when building an amateur-built aircraft, for which an experimental, special certificate of airworthiness applied. However, CASA advisory circular (AC) 21.4(2) Amateur-built experimental aircraft – certification referenced ACs containing information and guidance on acceptable fabrication and assembly. Section 7.2 stated:
…it is strongly recommended that approved components and established aircraft quality material be used, especially in fabricating parts constituting the primary structure, such as wing spars, critical attachment fittings, and fuselage structural members.
Table 2: practices identified
Part or system
Practices or parts different to design drawing
Oil cooler hoses
end-fitting type not used on engines fitted to certified aircraft, normally a ‘screw together’ or ‘detachable-re-useable’ fitting would be used
Aircraft fuel system
electric fuel pump was mounted with commercial hardware, no locking devices (nuts or locking washers) fitted
electrical earth lead terminal was connected to a painted surface
hoses and fittings different to design drawing
Flight controls
use of a non-castellated nylon lock nut in combination with a split pin in the elevator control rod
use of stainless-steel shackle and thumb pin (not locked) at aileron outer-wing bellcrank
Engine induction system
no engine intake system air filter
Engine exhaust system
no heat muff for carburettor heat incorporated - carburettor heat was taken from the engine cowl area
Electrical system
electrical circuits, fuse array was retained with plastic cable ties
Weather
The weather observations recorded by the Bureau of Meteorology for Maitland Airport showed that at 1000 the wind was from the south-east at 4 kt reducing to 3 kt at 1030. Visibility was greater than 10 km with no cloud detected. This was consistent with both witness statements and video imagery recorded from inside the aircraft.
Recorded data
The aircraft was not equipped with a flight data recorder or cockpit voice recorder, nor was it required to be.
The aircraft was fitted with a Garmin AERA 500 GPS unit that was reported to be operating on the accident flight. The ATSB examined this unit and determined that the ‘track record mode’ was set to OFF, therefore the accident flight was not recorded.
A damaged iPad was recovered from the accident site. The pilot utilised the iPad to run an electronic navigation program (OzRunways), however the damage to the device precluded any on-device data download. However, the software provider supplied remotely stored data (Figure 1).
In addition, the aircraft was fitted with a Drift Innovation HD170 portable video recorder mounted inside the cockpit, behind the pilot, facing forwards. While the camera sustained significant damage during the accident sequence, audio and video imagery from the accident flight and the pilot’s first test flight were recovered. The recorded audio was not in sync with the video, so was not used in the analysis of the accident flight.
Recording of the accident flight
The video of the accident flight ended prior to the accident when the aircraft was approximately 200 ft above the ground.
Most of the cockpit instrumentation was visible in the video, although at times the footage was affected by sun glare. The oil pressure and temperature gauges were difficult to see on the video however, it showed that about 30 seconds after the pilot gave their departure call, the engine oil pressure was in the normal range. Due to the sun glare, the gauge was not visible again until about 1 minute 50 seconds later, where it showed low oil pressure. This was after the pilot had advised the engine was running rough. The engine RPM gauge was not visible in the video. There was no evidence on the video of smoke entering the cockpit.
The video also recorded that as the aircraft was turning on to the base leg for runway 05, the shadow of the propeller became stationary and there was a change in vibrations, consistent with the engine stopping. As the pilot continued the turn onto final for runway 08, the airspeed displayed on the aircraft instruments decreased to between 60–65 kt and the rate of descent almost immediately increased from level flight to approximately 1,700 ft per minute.
Amateur-built experimental aircraft
CASA permitted an amateur builder to construct an aircraft solely for educational or recreational purposes.[13] There were no prescribed design standards, and the aircraft could be constructed from any materials, using any engine and propeller combination. In addition, CASA approval was not required before construction commenced and CASA did not conduct any inspections of the aircraft.
Before an amateur-built aircraft could be flown, it was required to be registered with CASA and have a valid certificate of airworthiness (CoA). According to Advisory Circular (AC) 21.1(1)
aircraft certification is the whole process of assessing an aircraft type against its type design and the aircraft’s condition for safe operation, which culminates in issue of a Certificate of Airworthiness (CoA) for an individual aircraft.
As amateur-built aircraft did not have a type design, there was no aircraft type‑specific standard to assess the aircraft against. To allow these aircraft to operate, they are issued a specific special CoA.
An authorised person (AP)[14] or CASA was able to issue an experimental CoA.[15] To obtain a CoA a builder could:
approach CASA directly
approach an industry member who was a CASA‑appointed AP
become a member of the Sport Aircraft Association of Australia (SAAA – see the following section) and approach a SAAA member who was a CASA‑appointed AP.
AC 21.4(2) Amateur-built experimental aircraft - certification, last updated in September 2000, provided guidance and information to applicants applying for a special certificate of airworthiness for an amateur-built aircraft in Australia. This stated that:
Amateur builders should[16] call upon persons having experience with aircraft construction techniques, such as the SAAA technical counsellors [see the section titled Technical counsellor] …. to inspect particular components eg. wing assemblies, fuselages etc. prior to closure and to conduct other inspections as necessary. This practice is an effective means of monitoring construction integrity.
The AC went on to describe that although CASA had previously inspected aircraft at several stages though the build, overseas experience had shown that only one final inspection was required. The purpose of this inspection was
to allow the inspector [AP] to make a subjective assessment of the workshop methods, techniques and practices used in the construction of the aircraft solely for the purpose of prescribing appropriate conditions and operating limitations necessary to protect other airspace users and persons on the ground or water, ie. to protect persons and property not involved in the activity.
It also stated that:
the person carrying out the inspection is not responsible for the integrity of the design or construction of the amateur-built experimental aircraft, nor for the identification of any structural design or construction deficiencies – responsibility for the design, construction and integrity of the aircraft rests with the amateur builder.
In addition, in seeking a CoA the AC advised that the applicant should be prepared to supply
evidence of inspections, such as logbook entries signed by the amateur builder, describing all inspections conducted during construction of the aircraft in addition to photographic documentation of construction details. This will substantiate that the construction has been accomplished in accordance with acceptable workshop methods, techniques, and practices.
CASA recommended that amateur builders contacted an approved organisation before commencing a project to seek advice. One of the ways of doing this was to contact the SAAA.
Sport Aircraft Association of Australia
The SAAA is a voluntary ‘…group of aviation enthusiasts, assisting each other to build, maintain and operate sport aircraft’. There was no regulatory requirement for members to follow the SAAA procedures or advice, nor did the SAAA have any powers granted by CASA to direct and enforce members to perform any activity in relation to building, certification and test flying the aircraft. To receive a CoA through the SAAA system, the builder was required to be a member when they applied for the CoA, but there was no requirement for them to be a member at the commencement of or throughout a build project.
The organisation had two functions, which were overseen by CASA. These included management of CASA‑appointed APs and management and delivery of a CASA‑approved maintenance procedures course for SAAA members. As the accident aircraft was in the flight‑testing phase, the ATSB did not review the maintenance procedures course.
One of the main functions of the SAAA was to support people building their own aircraft, including assisting them to gain a CoA. They did this by providing:
a risk assessment tool (see the section titled Risk Radar Aviation)
a group of advisors to provide advice on building the aircraft (see the section titled Technical counsellor)
access to APs to certify the aircraft
advice on technical and regulatory matters.
They also provided advice on flight safety, including test flying, through flight safety advisors, and assistance with the flight testing of the aircraft once the aircraft had received a CoA. The builder stated that when they contacted the SAAA in relation to the flight testing, they were told that none of the advisors had experience in the aircraft type.
Risk Radar Aviation
According to the SAAA, the Risk Radar (RRAv) report was a whole of life measuring and awareness system developed by the SAAA that covers every aspect from choosing an aircraft to building/modifying that aircraft through to testing and routine flight operations and maintenance.
It was a self-assessment tool designed to alert the user to areas of high risk to allow appropriate mitigations to be considered, rather than to stop a project. It relied on the builder and when requested, a technical counsellor (TC), objectively answering relevant questions about the project.
The RRAv report covered four areas:
planning (assessed whether the design of aircraft was suitable for the experience of the owner)
build/modify (assessed the quality of the aircraft build)
flight testing (assessed experience levels of test pilot and the suitability of the test area)
post-build (assessed experience level of the owner/builder to continue flying the aircraft after the CoA was attained).
Build/modify section
The build/modify section had separated the assessment criteria into nine areas, including one on the engine group. This in turn had more specific questions, including for example, questions on the oil cooler (see Table 3). A user was required to select the rating which best described the aircraft from a drop-down list, and the tool would automatically alert if this was considered a concern. The RRAv instructions advised that a user should discuss and close out the concern with their TC and/or flight safety advisor and a TC should document in the RRAv tool detail of any concerns that had been waived.
Table 3: Example of questions raised within the oil cooler section showing all available options, ratings and alerts
Engine group
Rating selections available to the builder in a drop-down list
Rating
Automatic alert if appropriate
Oil cooler – secure mount, condition including fins for damage or blocking, lines for leaks and/or chafing and vibration, oil lines of approved types
Well-constructed to standards within AC43
10
Well-constructed to standards within AC43 with minor rectifiable issues
5
Concern
Poorly constructed / assembled
0
Concern
Poor quality materials
0
Concern
Non-aviation grade materials in critical areas
0
Concern
TC has concerns re design
0
Concern
Outside design limits
2
Concern
Meet design limits
10
Checked OK
10
Good condition
10
Poor condition / needs attention
5
Concern
Flight-testing section
The flight-testing section had an area relating to the proposed test pilot, including a space to name the test pilot and where their flying experience and currency was rated. Again, the various responses were automatically assessed and a caution was raised to alert the user to areas where additional risk mitigations may be required.
Technical counsellor
A TC was a member of the SAAA who was:
willing to assist others, inspecting their work, guiding them through construction phases and finally, perhaps most importantly, guiding them through the lead up to the aircraft certification process.
To become a TC, an applicant had to have a reasonable amount of experience with building and maintaining amateur-built experimental aircraft. They were nominated by another TC or the president of the local area group. The TC was not responsible for the design or construction of an aircraft. They could provide suggestions to a builder, however the builder was under no obligation to accept their advice. However, where there was a difference of opinion on the design or construction technique being applied, it was recommended that the TC highlight this in a visit report and their copy of the RRAv report and provide that to the SAAA.
The TC’s handbook, current at the time of the build but not available to a builder, stated in the list of duties that TCs were required to:
assist the builder to prepare for Final Inspection day … this must also include a “Plan-Build-Test” RRAv Report (prepared by the Builder and signed off by both Owner/Builder and TC) that presents the project, the pilot and test flying programme plans for consideration by an Authorised Person (AP).
In the section titled Stage inspections, it stated that a:
thorough nuts and bolts inspection must occur prior to the on-site visit carried out by the authorised person (AP). The builder is responsible for this, with assistance from their TC and other experienced builders [emphasis added by ATSB].
The handbook did not detail that a TC who was building their own aircraft was required to have an independent TC conduct the ‘nuts and bolts’ inspection of the aircraft.
Builder’s assist program
The SAAA ran a voluntary program, called the Builder’s Assist Program (BAP), where a builder and a TC worked together on a project. The program included a minimum of three inspections of an aircraft to be conducted at major milestones during the build.
Inspections of an aircraft during the build process
Regardless of whether a builder had signed up to the BAP, the SAAA recommended that they organise at least three formal TC visits, including:
on completion of the first component
during the fuselage/wing assembly
engine installation.
The RRAv tool had a checklist section to document the inspection and it was recommended that a TC submit a report to the SAAA after each inspection. However, there was no regulatory requirement to organise stage inspections or inspections prior to the closure of any components.
Final assembly (nuts and bolts) inspection
To attain a CoA, the AP Manual of Procedures required that a
duly completed and executed RRAv report pertaining to the planning, build and test phases of the applicant’s project has been received.
This required that a builder organise a ‘nuts and bolts’ inspection to be completed with a TC, irrespective of whether they had liaised with a TC during the build. This inspection was to be completed prior to organising an inspection for the certificate of airworthiness.
The SAAA technical counsellor handbook advised that before conducting a ‘nuts and bolts’ inspection, the TC should use the RRAv report as a guide to create a checklist of what to inspect. The handbook also detailed that a report, signed by the builder of an aircraft, and endorsed by a TC, should be submitted to the SAAA after the ‘nuts and bolts’ inspection was completed.
While the ‘nuts and bolts’ inspection was required by the SAAA, the SAAA had no process to check that this inspection had been completed, or if any of the recommended TC visits for a project were completed or a report was submitted.
Information provided to members on inspection requirements
The SAAA made a number of information booklets available to members that contained advice on how to complete a project through the SAAA process. The ATSB reviewed the information available to a builder to determine if there was consistent advice that a TC was required to conduct the nuts and bolts inspection or endorse the RRAv report prior to it being submitted to the AP. A review of these booklets can be found in Appendix A.
In summary, while some documents advised that both the owner of the aircraft and the principal advisor (TC) must cause a RRAv report to be executed, none of the documents included any mandatory inspections, although they detailed that the TC was available to assist the builder to complete the ‘nuts and bolts’ inspection.
The information paper on the process for how to apply for the CoA listed the documents required to be submitted when applying for the certificate of airworthiness. It stated the RRAv report must be supplied, and that the TC was the ‘first point of contact for any assistance required’. However, it did not specify that the TC was required to conduct the ‘nuts and bolts’ inspection nor that they were required to endorse the RRAv report.
Authorised Persons using SAAA processes
The SAAA nominated experienced members to CASA to become APs. These members were assessed by CASA and then completed a CASA‑run training course, which provided training on the legal requirements to issue a CoA. There was no requirement for an AP to be a licenced aircraft maintenance engineer (LAME) or to have other engineering qualifications.[17]
According to the conditions of their instrument of appointment, the AP must issue the CoA in accordance with:
the Sport Aircraft Association of Australia SAAA ‘Authorised Person’ manual of procedures Special certificate of airworthiness – Experimental (Amateur-built) … and
for amateur-built experimental aircraft – CASA Advisory Circular AC 21-4
The SAAA AP Manual of procedures special certificate of airworthiness – experimental (amateur‑built) (manual) was written by the SAAA and approved by CASA. The manual did not identify that a TC was required to conduct a nuts and bolts inspection prior to the request for a CoA. It stated that before an AP could attend an aircraft, they were required to receive a
duly completed and executed RRAv [Risk Radar (see the section titled Risk Radar Aviation)] report pertaining to the planning, build and test phases of the applicant’s project...
and
As a minimum, the owner of an aircraft must cause a RRAv report to be executed by both him/herself and the principal advisor (Technical counsellor) [see the section titled Technical counsellor] which presents the project, the pilot and test flying programme plans prior to consideration by an Authorised Person (AP) for issuance of a CoA.
A checklist itemised the documents the AP must receive before a CoA could be issued. It included a RRAv report, however it did not specify that the RRAv report was required to be endorsed by a TC.
Since this accident, the SAAA have clarified in a Special Bulletin to all APs that the requirement that the RRAv report must be ‘executed’ indicated it was required to be ‘signed with the proper formalities’ by the final assisting TC.
The checklist also listed the items on the aircraft the AP was required to inspect, including ensuring the aircraft markings and passenger warning placarding met the regulations. The AP was also required to do a general inspection of the aircraft to check the:
engine and flight controls and pilot/static system operated correctly
seatbelts met the minimum standards
cockpit did not have protrusions
carburettor heat system (where installed)
firewall was adequate (where required).
The manual went on to state that after the AP’s inspection of the aircraft was complete, the AP should consider any conditions and limitations to apply to the aircraft, which should be listed on the CoA. These limitations are designed ‘in the interests of the safety of other airspace users and persons on the ground or water’. In determining whether any limitations were necessary, the AP was required to use the RRAv report to assess the:
aircraft
operating airfield
area it was to be flown
proposed test pilot’s experience and flight test schedule.
The manual listed examples of limitations, which were based on a list of examples contained within AC 21‑4(2) Attachment 3. While these lists included the airfield to be used and the area the aircraft could be flown, neither specified the name of the pilot who was to conduct the testing or the flight test schedule to be used. AC 21-10 v 4.2 Experimental certificates, which also listed example limitations to apply to aircraft with an experimental certificate, similarly did not list the pilot’s name in the examples.
The AP manual of procedures stated one of the reasons to revise the certificate of airworthiness was a change of nominated pilot, however, this was not stated in other publications.
After the CoA was issued, the AP was required to submit all the paperwork to CASA using the delegate notification management system (DNMS).
Interviews with authorised persons
The ATSB interviewed a number of SAAA APs to establish if consistent procedures were being followed when issuing a certificate of airworthiness. The APs were selected from a range of backgrounds (both LAME and non-technical) and included both those recently appointed and others who had held their authorisations for many years.
All APs advised that most of the aircraft they assessed were well built.
They also all advised that, as it was on the checklist, they ensured they received a copy of the builder’s RRAv report. However, all but one advised that they had not been checking to ensure the RRAv report was endorsed by a TC. Some APs advised that they used the summary section of the RRAv report but did not assess the build section as builders mostly rated their aircraft construction highly, which was not always the case. They also did not routinely request a copy of TC inspection reports due to an assessment that they often just detailed that the TC had attended and did not add value to the process.
The interviewed APs also stated that, until they received the Special Bulletin from the SAAA on the 12 May 2021, they had been issuing CoAs to builders who had no TC involvement with the build. Consequently, CoAs had been issued in circumstances where TC inspections, including the ‘nuts and bolts’ inspection (see the section titled Final assembly (nuts and bolts) inspection), had not been conducted.
However, all but one AP advised, they themselves conducted a thorough inspection of the aircraft to ensure, as far as they could establish, the integrity of the build. This was done by having the aircraft presented with all access panels opened and cowls removed. They would often identify areas where the builder could make improvements and, in most cases, the builder would correct the issues.
In the case of the one AP who did not conduct an inspection of this nature, they had knowledge of the build from the start, with all builds having TC involvement and regular inspections of the aircraft.
One AP advised that where a builder used non-aviation components, they required that the builder justify the safety and reliability of the part. The AP would also do their own research on the component and applied limitations on the aircraft to suit.
All APs stated that they considered the suitability of the flight-testing pilot who was named on the RRAv report and would often contact that pilot, especially if they were not known to them. However, only half the APs advised that they named the test pilot in the limitations on the certificate.
They all advised that the CASA surveillance of them as an AP was thorough in checking the paperwork against the regulations and would identify missing dates or areas where more detail should be added. However, they also stated that CASA did not assess the RRAv report to ensure they were received and endorsed or check if any inspections of the aircraft had been conducted during the build process.
CASA surveillance of SAAA authorised persons
The ATSB interviewed relevant personnel at CASA in relation to the surveillance conducted on the SAAA APs. The Sport Aviation section advised that they conducted regular surveillance events to ensure the APs were issuing the certificates in accordance with their instrument of appointment. The frequency of these surveillance events was determined by:
the national surveillance scheme, generally each of the APs was surveilled every 2 years.
response‑based surveillance, which was based on intelligence from industry inspections and engagements
campaign surveillance where any emerging risk across a particular sector was the focus of the surveillance.
The surveillance event consisted of randomly selecting and assessing work packages from the DNMS for the AP under surveillance. To ensure the AP met the requirements of their instrument of appointment, the audit assessed the paperwork to ensure it met the regulatory requirements and the process was conducted in accordance with the SAAA AP manual of procedures. They advised that even though all the SAAA APs used the same manual of procedures, CASA personnel did not have a checklist to ensure all events surveilled the same items.
The Sport Aviation section advised that as AC 21.4 was a condition of the instrument of appointment, it was mandatory that it be considered when issuing certificates. They also advised that although the SAAA Manual of procedures required that a RRAv report be submitted, CASA as part of a surveillance event, did not assess it, or ensure it was endorsed, as this was a SAAA requirement which was above the minimum mandatory requirements.
They advised that, regardless of CASR 21.195A stating that the AP was required to give the builder a certificate if they were entitled to one, the AP was required to inspect the aircraft to ensure it is safe to fly. CASA also stated that the AP should apply limitations appropriate to the aircraft being considered.
CASA’s views were sought on the actions that an AP should take if they considered that the aircraft was unsafe but the builder was entitled to a certificate in accordance with CASR 21.195A. CASA advised the AP could request additional information relating to the deficient area/s and, if they requested something which could not be supplied, then:
refuse to issue the certificate because they are not satisfied with the supplied information
apply very stringent limitations on where and when the aircraft could be flown.
They also advised that if they refused to issue a certificate, this should be notified to CASA through the DNMS, which would prevent the builder from then going to another AP to have the certificate issued.[19]
CASA advised that they did not check if a test pilot had been named in the limitations as the minimum experience required to test an amateur-built aircraft was a private pilot licence and the appropriate aircraft‑related endorsements, nor was it a requirement to name a test pilot.
However, in a separate interview, the CASA surveillance management team advised that they would expect the pilot of a certified aircraft operating under an experimental certificate conducting test flying to be named in the limitations on the certificate of airworthiness.
Comparable international amateur built aircraft regulatory systems
A review of the regulatory system for the construction of amateur‑built aircraft systems internationally found that a number of countries had regulations which allowed amateur-built aircraft to be constructed under a similar system to that in Australia. These countries had based their legislation on the United States Federal Aviation Administration (FAA) legislation. These systems had a requirement that evidence of independent inspections during the build process be provided to the person conducting the assessment to issue the CoA. This was to ensure that the integrity of the aircraft build had been maintained. A review of these systems can be found in Appendix B
Other countries, such as the United Kingdom, required the design and construction to be approved by a licenced engineer. The European Aviation Safety Authority did not regulate amateur-built aircraft, leaving that to individual states to register the aircraft.
Build process for VH-WID
The builder was a member of, and TC with, the SAAA and had elected to use their processes to obtain a CoA for the aircraft and had signed up for the builder’s assist program.
Risk radar aviation report for VH-WID
The builder submitted an RRAv report to the AP prior to the CoA inspection. On the form the builder documented that two TCs had been involved in the project and that more than two inspections had been completed.[20] However, a TC had not endorsed the form.
Of the two TCs named, one had inspected the aircraft in 2014, when the project was first started and had submitted a TC visit report and a RRAv report. The second named TC advised that while they had seen the aircraft at the start of the project, they were not involved in the project and had not inspected the aircraft nor written a TC report. The builder later advised they had not engaged an independent TC as there were not many TCs who had experience with wood and fabric construction.[21]
The builder also advised that a ‘nuts and bolts’ inspection with an independent TC had not been completed nor was it required, and they did not involve an independent TC with the completion of the RRAv report. However, the builder noted that they themselves were a technical counsellor. With regard to performing these dual roles, the SAAA advised that it was ‘counterintuitive for a builder to do their own inspection, irrespective of whether they are TCs or not’.
Build section of RRAv report
The builder had selected ‘well constructed to standards within AC43’ for most questions in the build/modify area of the RRAv report, including the engine build/modify section. There was no indication on the RRAv report that the builder had used non-aviation parts in the aircraft, apart from the engine ignition system.
Flight test section of RRAv report
The builder advised that when they entered their own flying experience in the RRAv report, the tool flagged concerns. Consequently, they decided to contract a pilot to do the test flying, however they had not engaged a pilot when they organised the certificate of airworthiness inspection.
In the test phase section of the RRAv report, the builder had not named a pilot to conduct the test flying, although they had filled in the section with a specific, experienced test pilot in mind. As such, they had entered extensive experience against all criteria (Figure 14). This was not representative of the experience of the accident pilot (Figure 15).
Figure 14: Risk Radar Aviation section for test pilot as submitted by builder of VH-WID
Source: supplied
Figure 15: Risk Radar Aviation section with the accident pilot’s experience
Source: SAAA with changes by ATSB
Certificate of airworthiness on-site inspection for VH-WID
The builder applied for a CoA for WID in November 2017. The AP did not request a TC ‘nuts and bolts’ inspection report or evidence of previous inspections.
The AP conducted an on-site visit on the 16 March 2018, during which a number of issues were identified with the aircraft. These included:
aft wing attach bolts not installed safely
right wing attach bolts loose
twisted flight control cables
loose nuts in flight control connections
wear on the aileron cable
skin on the inboard section of both wings not bonded to the ribs
loose engine mount
sharp edges around items in the cockpit
installed ‘experimental’ signage on the aircraft of the incorrect size.
Consequently, the AP cancelled the inspection to allow for defect rectification.
After a second on-site visit, organised after the listed items had been corrected, the CoA (valid for 12 months) was issued on 21 August 2018. The AP recorded that the quality of the build was ‘fair’. The certificate was subsequently re‑issued on 10 October 2019, due to the time taken to complete the test flying. The following limitations, among others, were included on both certificates:
the AP was to be notified of any major changes to the aircraft or the aircraft sustaining major damage
at least 25 hours flight testing was required within the stated test area
the aircraft was not to be operated over built up areas
no passengers were permitted
all flights from Maitland were to be from/to runways 05/23 with no flight permitted over built up areas of Windella or Rutherford. Circuit operations at Maitland were to be left hand from runway 05, remaining clear of Windella.
The AP advised they discussed a specific pilot to do the test flying with the builder and had also discussed this with the proposed test pilot, however they did not name the pilot in the limitations. The builder advised that the nominated test pilot was subsequently too busy to do the test flying. The AP also stated that their expertise was not in assessing if a pilot was suitable to conduct the flight testing and that they encouraged all builders to talk to the SAAA flight advisors before conducting the first flight.
Aircraft changes after the certificate of airworthiness was issued
After the CoA was received, a registered operator (builder) was required to advise the AP when a ‘major change’ to the aircraft was made, before flying the aircraft again. In 2017, a major change was defined among other things as having an effect on ‘the operational characteristics of the aircraft’. As such, the builder was required to assess if a major change had been made and if it would have a significant effect on the aircraft.
The builder made the following changes to the aircraft after the CoA was issued:
after a circuit by a different pilot,[22] the wings were removed and the rear mounts for the wing were redrilled to change the angle of incidence on both wings
a trim tab was fitted to the rudder
vortex generators were installed on the underside of the horizontal stabiliser and the top of the cabin.
These changes were recorded in the aircraft logbook, however the AP was not advised.
The builder advised that between the accident pilot’s first and second test flight, the aileron movement had also been adjusted. The design instructions for the aircraft stated that to eliminate adverse yaw, the ailerons should be set such that the up moving aileron moved 80 per cent further than the opposite side moved down. The owner advised that initially they had set the ailerons to move in a 1:1 ratio. After the pilot’s first test flight, this had been adjusted so the up moving aileron moved 70 per cent further than the down moving aileron. The accident pilot had been made aware of these changes.
Test pilot requirements for amateur-built aircraft
The minimum qualification required to conduct initial flight testing in an amateur-built experimental aircraft was a private pilot licence with the appropriate aircraft‑related endorsements. There were no minimum experience requirements however, CASA advised it was ‘unwise’ for the initial flight test to be carried out by someone other than a pilot with specific test flying qualifications or knowledge.[23]
In addition, CASA AC 21.47 Flight test safety stated that personnel involved in flight testing should be ‘appropriately qualified, experienced and current’. It also advised:
A formal experimental test flying certificate does not, in itself, necessarily mean that the holder is the best person to employ for a specific flight test project. For example, a qualified TP [test pilot], who graduated from Test Pilot School over thirty years ago and who has only operated military fast jets or transport category airliners since that date, may not be the ideal pilot to choose for the developmental test flying of a Light Sport Aircraft with a tail-wheel landing gear configuration.
The CASA AC also urged ‘most strongly’ that builders made detailed reference to the FAA AC 90–89 Amateur-built aircraft and ultralight flight testing handbook. This FAA AC stated that the test pilot should be ‘rated, current, and competent in the same category and class as the aircraft being tested’. The minimum flying experience suggested for an aircraft built from a ‘time-proven set of plans’ was 100 hours in command, and a minimum of 1 hour training in recovery from unusual attitudes within the 45 days prior to the first flight test.
Information provided by the accident pilot to the builder
Just before the CoA was re‑issued in 2019, the builder was put in contact with the accident pilot. The pilot sent information about their experience, advising they had ‘been in testing for a long time for both the UK and Oz [Australian] militaries, plus flown GA [general aviation] and gliders for years’. They advised that they were a flight test engineer and had attended the Empire Test Pilot’s School (ETPS), however, they did not specify that their attendance at ETPS was as a flight test engineer rather than as a test pilot.
They stated that they had a private licence and did not provide their total number of flying hours. In discussing their recent flying experience, they advised that
Just of late, I fly the robin[24] out of WLM [Williamtown] for aerobatics, plus the archer and occasionally the lance[25] out of MND [Maitland] for touring.
They also advised that they had an aerobatic, retractable landing gear and constant speed endorsement. The builder did not request further information.
Aircraft testing
Taxi test
The pilot had written a report on the initial taxi test conducted on the 13 December 2019, which identified that:
the airspeed indicator was overreading by about 10–12 knots compared to the onboard GPS unit (with no headwind or tailwind present)
there was considerable slack in the nose wheel steering control cables
the braking system was not effective.
In response to these observations, the builder conducted work on the nose wheel and rudder tracking to correct the issues.
The builder advised that the airspeed indicator overread was not corrected prior to the test pilot flying the aircraft as the pilot and builder were unsure if the discrepancy was the result of the aircraft’s attitude during taxi. They had planned to test the airspeed indicator at a later stage in the flight testing. However, the builder advised the pilot had intended to use the speed indicated on their iPad rather than the airspeed indicator in the aircraft, during the initial flights, as the wind conditions were light.
Accident pilot’s first flight test
While no report could be found relating to the accident pilot’s first flight test, conducted on the 30 December 2019, the video recorder was operational during the flight. The video showed the aircraft was controllable, although the yaw and roll characteristics of the aircraft were poor. In an email to the builder, the pilot advised that all turns were done using rudder almost exclusively and stated if you use the stick at all the adverse yaw is so strong it has the nose off in the opposite direction … the only issue is near the ground when you may wish to pick up a wing. Getting it to roll with your feet has some delay, which isn’t ideal near the ground.
Stall
A note in the pilot’s test sheet for the accident flight, indicated that the pilot had assessed the stall speed as 65 kt on the airspeed indicator in the aircraft, during the first test flight. They had also assessed that they should not fly below 75 kt on the airspeed indicator during the approach.
The information in the pilot operating manual, written by the builder, stated that the stall speed was 56 kt with the landing gear extended.[26] In the ‘Operating suggestions’ section of this document, it stated that ‘the aircraft is very docile approaching the stall and does not exhibit any bad characteristics’. This document suggested that 70 kt be used in the circuit, however, it also stated in the downwind check that 78 kt be maintained on final.
The ATSB discussed the aircraft’s flight characteristics with another pilot who had built and owned an Osprey 2 in the early 1980’s. They advised that their aircraft stalled at 52 kt with the landing gear retracted and there were no inherent indications of an approaching stall. They also advised that during the stall, while the wing did drop, it was not violent, and the aircraft required 100–200 ft to recover. As these aircraft were built from plans by different builders, the stall characteristics may have differed.
Finally, this pilot stated that during the process to get a certificate of airworthiness for their aircraft, the Department of Civil Aviation[27] had required that a stall warning system be installed.
VH‑WID did not have a stall warning system installed.[28]
Passing 2,400 ft on climb after taking off from Maitland Airport, the pilot was advised, via radio, of white smoke coming from the aircraft and noted that the engine was not running smoothly. In response, the pilot broadcast that they were returning to land on runway 23, however, during the descent, they turned to join the reciprocal runway 05. As the aircraft was turned on to the base leg of the circuit, the engine failed, and the pilot attempted to conduct a forced landing on to the closer runway 08. During the final stage of the approach, the aircraft was observed to abruptly roll, pitch down and collide with terrain.
This analysis will discuss the reason for the engine power loss and the pilot’s response. It will also examine the aircraft build and approval process, including the involvement of the Civil Aviation Safety Authority (CASA) and the Sport Aircraft Association of Australia (SAAA).
Development of the accident
Examination of the engine identified a number of significant deficiencies with the oil supply hose and fitting connected to the oil cooler. Firstly, a damaged fitting was used to connect the oil supply hose to the oil cooler. This damage would likely have allowed oil to leak past the fitting’s barbs. Secondly, the external condition of the supply hose indicated that it had reached the end of its effective lifespan. Its aged condition probably reduced the ability of the hose to mechanically grip the barbs and ensure the integrity of the connection.
Finally, the fitting was not approved for use in combination with the hose by the hose manufacturer and had slightly different dimensions, and one less barb, compared to the hose manufacturer’s approved fitting on the other end of the assembly. The combination of these three factors likely resulted in the pressurised hose separating from the oil cooler fitting (either partially or completely), allowing the oil to be lost overboard.
This disconnection and oil loss most likely occurred while the aircraft was on climb, as white smoke was observed by witnesses on the ground and the pilot reported rough running of the engine. Given that the engine was above and behind the pilot’s position in the aircraft, this would not have been visually obvious to the pilot.
The pilot initially advised that they were returning to runway 23, which would have allowed the aircraft to land as soon as possible. However, the pilot then turned to join the reciprocal runway 05, possibly due to a pilot of another aircraft reporting they were departing from this runway. The pilot also flew a widening circuit, which was in accordance with one of the limitations on the certificate of airworthiness (CoA) to avoid a built-up area. However, this extended the time the aircraft was airborne and increased the power required from the engine to maintain height. The combination of these factors resulted in the engine failing in flight due to oil starvation.
The engine failed as the aircraft commenced the turn to base. Due to its relatively poor glide performance, from that position it was likely unable to reach any runway. There were opportunities for a forced landing to be conducted off the airport. However, it is possible that, as the pilot had just practiced forced landings in an aircraft (PA‑28) that was probably capable of reaching the airport environment from that position, they overestimated the Osprey’s glide performance.
During the forced landing, video imagery recorded the speed decreasing to between 60–65 kt on the aircraft’s airspeed indicator, which was below the speed the pilot had previously identified as the stall speed. There was no stall warning system installed, and no known aircraft indications to increase the pilot’s awareness of the approaching stall.
Examination of the accident site confirmed that the aircraft contacted the ground with low forward airspeed while rolling to the left, consistent with an aerodynamic stall. The height at which the stall occurred was too low to permit recovery.
Amateur-built aircraft system
The amateur-built aircraft system was designed to allow people the freedom to design and build their own aircraft. Responsibility for ensuring that such aircraft were built to a safe standard rested with the builder and methods of ensuring safety and reliability included:
following build instructions and plans
using accepted construction techniques/practices and aviation‑compatible parts.
Assistance in this regard was available from the SAAA, specifically the technical advice from their Technical Councillors (TCs).
Build inspections
Independent inspections at milestone points during the construction are an effective method of ensuring the builder is following accepted practices and that no inadvertent errors have been made. CASA stated that to meet their safety objectives, amateur builders should have independent inspections of the aircraft and these inspections should be documented in the builder’s log. However, this was not mandated and so while the SAAA recommended that at least three inspections with a technical counsellor (TC) occurred during the course of the build, compliance was optional.
Despite this, the SAAA had written a clause into the Authorised Person’s (AP’s) manual of procedures requiring that an AP receive a TC‑endorsed risk radar aviation (RRAv) report. This clause did not clearly articulate that a TC was required to conduct a ‘nuts and bolts’ inspection of the aircraft. In addition, the checklist of the required documentation to be supplied to an AP, which included the RRAv report, did not clarify that it was required to be endorsed by a TC. This resulted in some APs accepting RRAv reports which had not been endorsed. This allowed aircraft to be presented for the Certificate of Airworthiness (CoA) assessment without having an independent ‘nuts and bolts’ inspection. However, most of the APs interviewed by the ATSB were conducting their own inspection of the aircraft, which mitigated some of the risk.
On this occasion the builder had supplied an RRAv report to the AP, however it had not been endorsed by an independent TC, nor had any independent stage or closure inspections of the aircraft been conducted during the builder’s project. While it was considered unlikely a TC would have detected the damaged barb on the fitting, as the oil hose assembly would most likely have been assembled prior to an inspection, they may have identified the visibly aged condition of the oil supply hose.
Additionally, had these inspections been conducted, it is likely several other building practices not normally used in aviation would have been detected. These had the potential to increase risk but were not considered contributary to the accident.
The SAAA information booklets were written to ensure that builders understood that they were responsible for the integrity of the construction of the aircraft. The booklets, available to a builder at the time of the project, did not clearly articulate that a TC was required to conduct an independent ‘nuts and bolts’ inspection of the aircraft before it was presented to the AP for inspection.
They also did not state that a builder, who was also a TC, was required to have an independent TC conduct a ‘nuts and bolts’ inspection. The builder of VH‑WID was a TC with the SAAA. Recognising that this was the only TC‑built aircraft examined by the ATSB, the issues found in the techniques used in the construction of the aircraft, raised questions as to the efficacy of the method of appointing TCs by the SAAA.[29]
At the time of the accident, the SAAA also did not have a system in place to ensure inspections, including the ‘nuts and bolts’ inspections, were being completed on aircraft which were built using the SAAA processes. The TCs were supposed to complete reports to document their visits and inspections of the aircraft, but this was not formally monitored by the SAAA.
Regulatory oversight of Authorised Persons
The purpose of CASA surveillance was to ensure APs were issuing certificates in accordance with their instrument of approval. Their instrument of approval required that they issue certificates in accordance with the CASA Advisory Circular AC 21-4 and the SAAA AP Manual of procedures special certificate of airworthiness – experimental (amateur‑built) (manual), which was approved by CASA.
CASA inspectors were conducting regular surveillance on the APs. However, during these events, they were ensuring the APs were meeting the regulatory requirements but not ensuring that the requirements in the manual were being met. As such, they were not ensuring APs were receiving endorsed copies of the RRAv report. While the RRAV report was above the minimum requirements of the legislation, it was a requirement of the AP’s manual of procedures which in turn was a requirement of their instrument of approval.
The use of an Advisory Circular (AC) as a mandatory item in the instrument of approval introduced an element of uncertainty in the process. AC 21.4, in particular, was written for a number of different audiences and created uncertainty around which inspections were required and which were recommended.
Other countries with similar systems to Australia for the certification of amateur‑built aircraft had a requirement that evidence of independent inspections of the aircraft during the build process, be provided to the person conducting the assessment to issue the CoA. This was to ensure the integrity of the aircraft build had been maintained. The Australian system did not have this requirement.
Test pilot suitability
The AP advised that, while they did not name a specific pilot to conduct the flight test program in the limitations on the CoA, they had discussed a specific highly experienced test pilot with the builder and had this pilot in mind when they considered the limitations. That pilot was later unavailable to conduct the flight test program, so the builder engaged a new test pilot.
The accident pilot met the minimum requirements to test fly the aircraft. However, while they were a professional flight test engineer, they had significantly less pilot in command experience than the originally suggested test pilot, having accrued approximately 100 hours flying as pilot in command over 13 years.
When the builder arranged for the pilot to do the testing, they did not assess the pilot’s experience using the RRAv report. Use of the RRAV report would have provided an objective assessment of the pilot’s experience levels. Furthermore, the RRAv report would most likely have raised ‘concerns’ due to the pilot's recent flying and overall flying experience.
In addition, if the pilot had been named in the limitations on the CoA, the builder would have been required to advise the AP of the change. This would have provided the AP an opportunity to consider the pilot’s experience and discuss the test flying program with the pilot. They would also have had the opportunity to reassess the RRAV report and consequently whether they needed to reassess the limitations on the CoA.
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the collision with terrain involving an Osprey 2 Amphibian aircraft, registered VH-WID, near Maitland Airport, New South Wales on 17 May 2020.
Contributing factors
The use of a damaged fitting, which was not compatible with the installed, aged hose, most likely resulted in the hose disconnecting from the oil cooler during the climb and the loss of oil from the engine.
During the descent to runway 23, the pilot elected to approach the reciprocal runway 05. This necessitated increased power from a damaged engine to maintain height and extended the time airborne.
As the aircraft turned on to the base leg of the circuit for runway 05, the engine failed due to oil starvation.
While attempting a forced landing, control of the aircraft was lost due to an aerodynamic stall at a height insufficient for recovery.
Other factors that increased risk
Neither the recommended stage nor the final ‘nuts and bolts’ inspections were conducted. Additionally, the technical counsellor had not endorsed the risk radar aviation report and the authorised person did not detect that these inspections were not completed before the certificate of airworthiness certificate was issued, resulting in missed opportunities to improve the aircraft’s build quality.
While the intention by Sport Aircraft Association of Australia was that an independent ‘nuts and bolts’ inspection with a technical counsellor was required, this was not clearly stated in the procedures applicable to the builder, and the authorised person.
The Civil Aviation Safety Authority (CASA) had approved the system to allow the Sport Aircraft Association of Australia authorised person to issue a special certificate of airworthiness - experimental (amateur-built). This system required the authorised person to receive an endorsed risk assessment prior to the authorised person’s inspection. However, during surveillance activities, CASA inspectors did not assess that these risk assessments were complete.
The builder did not use the Sport Aircraft Association of Australia 'risk radar aviation' (RRAv) assessment report to establish the risk for the accident pilot to conduct the test flying. Use of the RRAv report would most likely have raised ‘concerns’ due to the pilot's recent, and overall, flying experience.
The Sport Aircraft Association of Australia's Manual of Procedures for the authorised person (approved by CASA) required, and Advisory Circular 21.4 recommended, that the proposed test pilot's experience be assessed when considering limitations placed on a certificate of airworthiness. However, the pilot was not required to be named and therefore there was no means of ensuring the test pilot would be re-assessed if they were changed after the certificate was issued.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Proactive safety action Sport Aircraft Association of Australia
The SAAA have:
written to CASA to request an urgent 1-day refresher training course for all authorised persons (AP)
requested that CASA provide annual refresher training and require that an AP must attend at least once every 3 years
advised APs that they are not required to issue a CoA if they are of the opinion that operation of the aircraft would present an unacceptable risk
amended their procedures to require 3 stage inspections be completed during an aircraft build (this is inclusive of the final ‘nuts and bolts’ inspection). They have amended the Technical Counsellor Handbook – now TC manual, including that the TC must submit reports to the SAAA and use the risk radar checklist to conduct the inspection
submitted a revised Authorised Person Manual of Procedures to CASA. This reinforces that RRAv form must be ‘completed and executed’ which means signed with comments from both builder and an independent TC. It also required:
that the AP receive 3 TC visit reports – one of which may be the final TC ‘nuts and bolts’ inspection – if these are not available the AP must request an independent inspection by a licenced aircraft maintenance engineer or equivalent
the test pilot be named in the limitations contained within the certificate of airworthiness and if the pilot is changed, the authorised person needs to be informed
any structural change or damage repair to the aircraft during the ‘phase 1’ testing are to be notified to the AP and written authorisation is required before flying can continue
if the AP considers it is not safe to issue a certificate they can refer the matter to CASA.
specified that a technical counsellor or an authorised person are not permitted to inspect their own aircraft
updated the Risk radar aviation report signature blocks
written a new booklet ‘Construction of Amateur-built experimental aircraft’ to include information on the risk radar aviation report (this clarifies that the RRAv is required however it does not state it must be endorsed by a TC)
updated the Member’s Handbook to explain how to use the risk radar and require its use to create checklists
requested that CASA provide summaries of the audits conducted by authorised persons to ensure they are made aware of developing issues
SAAA intend to:
further review and update the SAAA Member handbook to ensure any matters referred to unequivocally describe the steps and processes an owner / builder of an aircraft should follow through construction, obtaining an experimental certificate of airworthiness, and managing flight operations through the Phase 1 flight testing phase
publish a new topic in the Builder CoA pack regarding ‘Nominating your test pilot(s)’
develop a visual guide that sets out the essential process and requirements a builder needs to observe through the build of an aircraft
all documents will be updated to reflect the findings in this report.
Glossary
AC Advisory Circular
AP Authorised Person
BAP Builder’s Assist Program
CAA Civil Aviation Authority
CASA Civil Aviation Safety Authority
CoA Special certificate of airworthiness – experimental (amateur-built)
CTAF Common Terminal Area Frequency
DNMS Delegate Notification Management System
EST Eastern Standard Time
FAA Federal Aviation Administration
LAME Licenced Aircraft Maintenance Engineer
NZ New Zealand
PFA Popular Flying Association
RRAv Risk Radar Aviation
SAAA Sport Aircraft Association of Australia
SACAA South African Civil Aviation Authority
TC Technical Counsellor
UK United Kingdom
Sources and submissions
Sources of information
The sources of information during the investigation included the:
owner/builder of aircraft
authorised person
engine rebuild workshop
Sport Aircraft Association of Australia
Civil Aviation Safety Authority
New South Wales Police Force
accident witnesses
video footage of the accident flight
OzRunways flight data
engine manufacturer
Air Accidents Investigation Branch, United Kingdom
References
CASA (Civil Aviation Safety Authority) (2000), Advisory Circular 21.4(2), Amateur-built experimental aircraft – certification, September 2000, Australia.
CASA (Civil Aviation Safety Authority) (2019) Advisory Circular 21.47(1.1), Flight test safety, March 2019, Australia.
CASA (Civil Aviation Safety Authority) (2019) Advisory circular 21-10 v 4.2, Experimental certificates, March 2019, Australia.
FAA (Federal Aviation Administration) (2015) Advisory Circular 90–89B, Amateur-built aircraft and ultralight flight testing handbook, April 2015, United States.
FAA (Federal Aviation Administration) Advisory Circular 43.13-1B, Acceptable methods, techniques, and practices–aircraft inspection and repair, September 1998, United States.
FAA (Federal Aviation Administration) (2009) Advisory Circular 20–27G, Certification and operations of amateur-built aircraft, September 2009, United States.
CAA (Civil Aviation Authority) New Zealand (2014) Advisory Circular 21-4, Special category – Amateur-built aircraft airworthiness certificates, February 2014, New Zealand.
CAA (Civil Aviation Authority) United Kingdom (2005) Civil Aviation Procedure 659, Amateur built aircraft A guide to approval, construction and operations of amateur built aircraft, November 2005, United Kingdom.
CAA (Civil Aviation Authority) South Africa (2017) Technical Guidance Material, Amateur-built aircraft guidance material for constructing and certification of an amateur-built aircraft, December 2017, South Africa.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
owner/builder of aircraft
authorised person
engine manufacturer
Sport Aircraft Association of Australia
Civil Aviation Safety Authority
New South Wales Police Force
National Transportation Safety Board, United States
Air Accidents Investigation Branch, United Kingdom
Submissions were received from:
owner/builder of aircraft
Sport Aircraft Association of Australia
Civil Aviation Safety Authority
Air Accidents Investigation Branch, United Kingdom
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Acknowledgements
The ATSB acknowledges the significant assistance provided by the Sport Aviation Association of Australia throughout the investigation and the safety action they have undertaken in response to this accident.
Appendices
Appendix A – Summary of Sport Aircraft Association of Australia reference handbooks available to a builder in 2017–2018
SAAA reference
Information related to inspections contained in booklets
IPM18-001 Information paper – construction records and stage inspections
This booklet advised the builder to conduct stage inspections as recommended in Advisory Circular 21.4 section 6.3, however it did not advise that the ‘nuts and bolts’ inspection was required.
RRAv report tutorials
There was a section on SAAA website which provided tutorials on how to use the RRAv report. One slide titled ‘RRAv - When to use and reporting requirements’ stated that the build and test phase was required prior to CoA presentation and a report was required by the owner and discretionary by TC. There was a note which stated the RRAv report must be signed by both TC and owner as part of CoA package submitted by an AP to CASA.
Members handbook
This booklet stated the builder was not legally required to engage a TC, but, irrespective of the builder’s experience, a TC afforded a second pair of eyes and some check and balance as no one is infallible.
In regard to issuance of a CofA, it also stated that the person responsible for issuing the CoA needed to have confidence in the quality of the build, and if a TC had not been involved during the build, this could be problematic.
COA1.1-002 SAAA CofA Pack process and framework
This booklet included a flow chart of the process. The flow chart stated a TC was available to help and that the builder, TC and flight safety advisor should agree that the builder is ready to apply for CoA.
Information on the AP’s on-site visit stated the TC was available to assist the builder to ensure the aircraft was complete and ready to fly.
The checklist of required documentation listed the RRAv report, however it did not specify that this must be TC‑endorsed.
The section on the RRAv report stated the RRAv report was required to be completed by the builder.
Appendix B – Summary of comparable international amateur‑built aircraft systems
United States Federal Aviation Administration (FAA) publication AC 20-27GCertification and Operation of amateur-built aircraft stated that, while aircraft were not inspected by the FAA during the build, the aircraft was inspected for general airworthiness before a certificate of airworthiness was issued. They also required evidence of inspections conducted by an Experimental Aircraft Association technical counsellor, certified mechanic or other builders/commercial assistance providers during construction. The FAA could refuse to issue a certificate of airworthiness if it was considered that the aircraft was unsafe to fly.
Civil Aviation Authority of New Zealand (CAA NZ) AC 21-4Special category – Amateur-built aircraft airworthiness certificates advised that the builder should contact CAA NZ prior to commencing the project. It also stated an aircraft was not inspected by the CAA NZ during the build, however evidence of inspections conducted during the construction of the aircraft was required including mentor visits and vital point inspections.[1] Vital point inspections should be carried out by an appropriately rated licenced aircraft maintenance engineer, mentor appointed by Sport Aircraft Association of New Zealand, or a person nominated by the builder who was acceptable to CAA NZ.
South Africa Civil Aviation Authority (SACAA) Technical guidance material Guidance material for constructing and certification of an amateur-built aircraft advised that builders must register that they are commencing a build project with the SACAA. To receive an authorisation to conduct a ‘proving flight’, the builder must supply evidence describing the inspections which were conducted during the build. The SACAA may conduct an inspection of the aircraft to enable the applicant to demonstrate compliance, including examination of the aircraft builder’s logbook and the completed aircraft.
United Kingdom Civil Aviation Authority (CAA) Civil aviation publication (CAP) 659 Amateur-built aircraft A guide to approval, construction and operation of amateur built aircraft advised that an amateur‑built aircraft could not qualify for a certificate of airworthiness as it had not been designed and constructed by an appropriately qualified organisation. However, an amateur‑built aircraft could receive a permit to fly. To do so, the builder must register with the CAA or Popular Flying Association (PFA) before the project was commenced. The CAA, or PFA, appointed a licenced engineer, or similar, to oversee the project. They approved the design of the aircraft, and inspected the premises it was to be built, and then conduct inspections as required. The licenced engineer had responsibility for the quality and design of the aircraft.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 26/06/2020
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
The occurrence
On 17 May 2020, at 1002 Eastern Standard Time,[1] an amateur-built Osprey 2 amphibian aircraft, registered VH-WID, departed Maitland Airport, New South Wales on a private flight (Figure 1). The flight was intended as a test flight and the pilot was the sole occupant. This was the third flight for the aircraft, which was operating under a special certificate of airworthiness – experimental. This certificate required that 25 hours of flight-testing be conducted.
The aircraft took off to the south-west from runway 23[2] before turning left, with the intention to climb to 3,000 ft and conduct the flight-testing over the airfield.
Figure 1: VH-WID
Source: Aircraft owner
About 3 minutes after the take-off, a number of people observed white smoke coming from the aircraft and a person on the ground informed the pilot over the radio about the smoke. The pilot replied that the engine was running rough and that the intent would be to return to the airport for a landing on runway 23. Witnesses then observed the aircraft circling while descending over the north of the airport.
Figure 2: Maitland Airport
Source: Google Earth, annotated by ATSB
At 1010, the pilot reported on the downwind leg of the circuit for runway 05 (the opposite direction to which the aircraft took off). This circuit took the aircraft to the north and west of the airport. The engine subsequently failed completely, and the pilot reported changing to runway 08.
A number of witnesses observed the aircraft on approach to runway 08 and reported that the aircraft appeared to be low and slow. The witnesses reported that there was no engine sound, and several reported that they observed the propeller to be stationary. The aircraft was observed to roll to the left, descend and impact terrain (Figure 3). Residents of the adjoining properties attempted to rescue the pilot and provide first aid; however, the pilot sustained fatal injuries. The aircraft was destroyed.
Figure 3: VH-WID at accident site
Source: ATSB
Ongoing investigation
The investigation is continuing and will include examination of:
the aircraft’s engine
aircraft maintenance documentation and operational records
aircraft build documentation
recovered instruments and electronic devices
aircraft performance characteristics and recorded flight data
pilot qualifications and experience.
Should any safety critical information be discovered at any time during the investigation, the ATSB will immediately notify operators and regulators so appropriate and timely safety action can be taken.
A final report will be published at the conclusion of the investigation.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
![BCU speed[20] and brake demands from the intended stopping point](/sites/default/files/2022-11/RO-2020-007%20Figure%2011.png)
![Figure 37: Speed (BCU)[7] and braking profile comparison of trains 8185 and 8181](/sites/default/files/2022-11/RO-2020-007%20Figure%2037.png)
