On 16 December 2019, a BRM Aero Bristell aircraft, recreational registration 24-8555, collided with terrain in Kanangra-Boyd National Park, near Oberon, New South Wales. The pilot was fatally injured.
In response, Recreational Aviation Australia (RAAus) commenced an investigation into the occurrence and requested technical assistance from the ATSB in the recovery of flight data from two instrumentation units – a Dynon SV-D1000 and Garmin aera 795; both of which were subsequently provided by NSW Police.
The ATSB successfully downloaded data from both devices, including flight path information and aircraft operational parameters. Figures 1 and 2 summarise this information.
Both instrumentation units were returned to NSW Police on 23 June 2020 and a technical report and all recovered data provided to RAAus on 24 June 2020.
With the completion of this work, the ATSB has concluded its involvement in the investigation of this accident. Any further enquiries in relation to the investigation should be directed to Recreational Aviation Australia.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Figure 1: Flight paths from Garmin and Dynon units
On 22 January 2020, a Boeing 777 was being operated by United Airlines as regular public transport flight UA870 from Sydney, Australia to San Francisco, United States.
At about the same time, a GIE Avions de Transport Régional ATR 72 was being operated by Virgin Australia as regular public transport flight VOZ1153 from Sydney to Tamworth, New South Wales.
Sydney Airport was configured for parallel runway operations, including simultaneous independent departures. VOZ1153 departed from runway 34R to an assigned heading of 350º, just prior to UA870 departing from runway 34L. UA870 was required to maintain runway heading (335º) until reaching 1,500 ft, at which point the aircraft was cleared to turn left and track towards Richmond, northwest of Sydney. However, UA870 climbed straight ahead through to about 2,100 ft and then the aircraft turned to the right about 45º from the required heading, resulting in a loss of separation with VOZ1153. At their closest point of approach, the two aircraft were separated by 1,843 m (about 1.0 NM) laterally and 60 m (about 200 ft) vertically.
Air traffic control detected the loss of separation and issued interventional instructions to both aircraft. The required separation was re-established and both flights continued without further incident.
What the ATSB found
The ATSB found that the UA870 pilot flying was expecting a more simplistic procedure often provided to foreign crew departing Sydney for an oceanic route. The pilot flying then became confused regarding aspects of the flight management computer (FMC) coding generated to represent the actual departure clearance provided. This may have been due to an unfamiliarity with radar transitions from a standard instrument departure to an en route track. This led the pilot flying to incorrectly adjust the FMC prior to engine start, and resulted in the aircraft turning right after departure, bringing it into conflict with VOZ1153.
The pilot flying probably did not effectively communicate the changes made to the FMC to the crew. The FMC departure specific coding was also not effectively cross-checked by the pilot monitoring or relief pilots prior to take-off.
Safety message
The ATSB’s SafetyWatch program highlights broad safety concerns that come out of ATSB investigation findings and from the occurrence data reports by industry. One of these safety concerns is data input errors.
This occurrence illustrates the importance of procedural correctness, effective communication and crew coordination towards the conduct of safe flight operations. Any amendment to the flight management computer, particularly those applicable to the more critical phases of flight (departure and arrival procedures) should always be announced, and then carefully and independently verified by at least one other crew member. The incident also outlines that, when possible, air traffic controllers can potentially further assist foreign crew by proactively factoring the crew’s unfamiliarity when providing airways clearances.
The investigation
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of findings that affect safety and possible safety actions.
The occurrence
On the early afternoon of 22 January 2020, a Boeing 777-300ER (777), registered N2333U, was being operated by United Airlines as regular public transport flight UA870 from Sydney, New South Wales to San Francisco, United States.
At about the same time, a GIE Avions de Transport Régional ATR 72-600 (ATR72), registered VH-FVQ, was being operated by Virgin Australia as regular public transport flight VOZ1153 from Sydney to Tamworth, New South Wales.
The Sydney Airport automatic terminal information service (ATIS)[1] indicated to all crews that parallel runway operations were in progress, including simultaneous independent departures[2] from runways 34L and 34R. The weather was fine, with excellent visibility, no cloud below 10,000 ft and a light wind from the northwest.
The flight crew for flight UA870 consisted of a captain and three first officers. The captain was the pilot flying (PF) and one of the first officers was the pilot monitoring (PM).[3] The remaining first officers occupied the two observers’ seats positioned directly behind the PF and PM on the flight deck.
Sydney air traffic control attempt to facilitate expeditious departures to all aircraft, particularly aircraft transiting over extended distances (oceanic crossings). This regularly involves a clearance via the SYDNEY ONE RADAR (SYD1) standard instrument departure (SID).[4] The PF had operated from Sydney Airport on a number of other occasions. While preparing for departure at the gate, after receiving the ATIS, but prior to receiving their pre-departure clearance, the PF configured the flight management computer (FMC)[5] for the SYD1 based on an expectation from prior experience.
At about 1330 Eastern Summer Time (ESuT),[6] Sydney clearance delivery (SCD) air traffic control (ATC) provided a different pre-departure clearance via VHF radio:
United eight seventy (UA870), delivery, cleared to San Francisco via DIPSO,[7] flight planned route, runway three four left (34L), Richmond five departure, radar transition, climb via SID to five thousand (5,000)…
The PM provided a truncated read back of the clearance to ATC, inadvertently not repeating the radar transition[8] component.
At the same time as the UA870 crew were preparing for their departure, VOZ1153 was cleared to depart via the SYD1 radar SID via runway 34R. This procedure required the ATR72 to maintain a heading of 350º after take-off, until directed otherwise by ATC.
The UA870 crew reviewed the RICHMOND FIVE (RIC5) SID chart (Figure 1). That chart included two distinct caution notes about the initial climb. The more detailed caution stated:
Parallel runway operations - DO NOT TURN RIGHT. Track 335⁰. At 1500 [ft] turn LEFT, track direct RIC NDB [Richmond], then follow transition instruction.
Figure 1: RICHMOND 5 Standard Instrument Departure (SID) from runway 34L
Source: Jeppesen (via United Airlines flight safety). Annotated by the ATSB.
The PF then re-programmed the FMC, replacing the SYD1 procedure with the RIC5. At this point, the PF reported being unsure regarding the coding specific to the two transition options (radar or Richmond) presented by the FMC.
The radar transition option in the FMC included a deliberate discontinuity[9] (gap) in the waypoint[10] sequence (coding). The discontinuity represented the point where air traffic control would provide radar vectors to facilitate a re-join to the oceanic track (to San Francisco) after the aircraft passed 12 NM from Sydney (see Figure 1).
The PF then closed (removed) the discontinuity.[11] In effect, the PF had removed the pre-programmed radar transition procedure, which meant that after the 1,500 ft left turn, the next waypoint on the route was DIPSO, not 12 NM Sydney. The PF recalled communicating removing the discontinuity to the PM, but it was not acknowledged by the PM. The PM did not recall hearing about the coding change.
Later in the pre-departure preparation, the PM reported verifying the new departure in the FMC using the summary route (RTE) page. However, the PM did not review it using the more detailed LEGS page (see Flight management computer discontinuities).
While taxiing to the runway for take-off, the PM recalled that when completing the departure review[12] with the PF, they noted the FMC RTE page read:
Runway 34L, Richmond Five (RIC5), no transition
At 1421:41 the tower controller for runway 34R cleared VOZ1153 for take-off, and 42 seconds later, the tower controller for runway 34L cleared UA870 for take-off.
At 1422:29, VOZ1153 departed runway 34R. About 35 seconds later, as VOZ1153 was climbing through 1,500 ft, UA870 departed runway 34L. (The runway 34L threshold is about 1,000 m north [ahead] of the runway 34R threshold [see Figure 1].)
At about 1424:06, climbing through 1,417 ft, the UA870 crew were instructed to contact Sydney departures control.
At 1424:33, as UA870 was climbing through 2,120 ft, the Sydney departures controller detected that the aircraft was turning right and instructed the crew to immediately turn left, to a heading of 270°. The flight crew had also identified the incorrect turn to the right. The departures controller then issued a separate interventional instruction to VOZ1153 to turn right immediately, to a heading of 090°.
On receiving their instruction, the two UA870 pilots in the observers’ seats identified the traffic (VOZ1153) visually (right-hand observer) and via the traffic alert and collision avoidance system (TCAS)[13] display (left-hand observer).
Recorded flight data showed that the UA870 autopilot was disengaged about 3 seconds after the interventional instruction to UA870 was received, at an altitude of 2,160 ft. Due to the momentum of the 777, the aircraft continued turning right through a further 5 degrees to heading 018º, prior to the PF manually reversing the turn back to the left. The minimum distance between the two aircraft was 1.0 NM laterally and 200 ft vertically (Figure 2).
Both aircraft continued flight to their respective destinations without further incident.
Figure 2: Aircraft tracks showing closest point of approach
Source: Google Earth overlaid with United Airlines and Virgin Australia data. Annotated by the ATSB.
Context
Flight crew
The flight crew of UA870 was augmented[14] with two cruise in-flight relief pilots (also first officers), due to the duration of the flight and the operator’s flight crew fatigue management framework. Neither the PM or PF reported being fatigued or tired at the time of the incident. Both relief pilots reported minor tiredness at the time of the incident. All the flight crew reported having achieved two separate periods of sleep during their layover in Sydney. UA870 flight crew experience is summarised in General details.
Transition routes
SIDs are designed to allow pilots to navigate away from an airport with minimal radio communication with ATC (departures control). Charted transition routes facilitate the transition from the end of a basic SID to a location in the en route airways structure. In this case, the radar transition allowed for UA870 to join their route to San Francisco at waypoint DIPSO after departing Sydney via the RIC5 procedure.
Normally a transition route includes a course, altitude requirements and distances between waypoints along the transition. Some SIDs have multiple transitions. The Richmond 5 SID had two transition routes.
The radar transition segment relied on the Sydney departures controller providing radar vectors for the aircraft to follow back to the east, after the aircraft passed the ‘12 NM Sydney’ point, but prior to Richmond. The aircraft would then re-join their flight planned (oceanic) route to San Francisco. In the event that a radar vector was not provided by 12 NM northwest of Sydney, the autopilot would simply maintain the aircraft’s heading from that point, until a vector was provided to the crew, or the crew amended the FMC route. The procedure required the aircraft track to initially track to the west to allow for separation with aircraft departing simultaneously from the parallel runway (34R).
The presence of a route discontinuity is unusual in a departure or arrival procedure, but it serves to highlight to the flight crew that at the point of discontinuity, a further clearance or direction is required from ATC.
Flight management computer discontinuities
The PF uploaded the flight plan to the FMC via satellite datalink. Procedurally, the crew (usually the PF), then manually entered the SID based on the departure clearance provided, which is contained within the FMC memory.[15] The majority of procedural SIDs could then be joined to the uploaded route by removing the discontinuity created between the end waypoint defining the departure procedure and the first waypoint of the main route to their destination. This was the normal process dictated by the operator’s procedures, where it was emphasised that for most departures the remaining FMC discontinuities should be rectified (removed) using the FMC legs (LEGS) page (Figure 3).
Guidance was also provided that this should not be completed in isolation from the rest of the crew.
The PF reported some confusion with the coding specific to the radar transition component of the RIC5 SID. That is, misunderstanding the necessity for the pre-programmed discontinuity as it was depicted by the FMC, which represented the radar transition segment during which ATC would provide radar vectors.
A discontinuity can be viewed by either the FMC LEGS page or route (RTE) page. The RTE page is a summary page generated displaying significant waypoints and airways (routes) that, in sequence, define the coded route the aircraft is programmed to fly via either the autopilot, if engaged or the flight director, if flying manually. The RTE page does not contain the same level of detail contained via the FMC LEGS page (Figure 3).
The operator’s supplementary procedures regarding the FMC setup prior to departure also included the following warning:
Do not use the RTE page to repair discontinuities resulting from SID entries. Critical changes in departure ground track may result.
Figure 3: Example of a route discontinuity displayed via the B777 FMC LEGS page
Source: Boeing B777 supplementary procedures (via United Airlines)
United Airlines procedures
The operator’s procedural documentation included guidance and direction specific to departure preparation. They detailed the PF and PM tasks and responsibilities, including the requirement to conduct a pre-departure briefing. The crew were also required to conduct a comprehensive departure review, immediately prior to take-off, which included a final confirmation of the FMC departure route setup. These procedures highlighted the importance of verbalisation, independent review and cross-checking.
The operator also provided guidance specific to Sydney Airport departures, including tailored charts illustrating the RIC5 SID (detailing the radar transition procedure), specifically the requirement to not turn right.
The operator’s procedures also mandated that relief pilots were to remain at their designated stations (observer’s seats) on the flight deck from the commencement of the departure briefing until the aircraft was above flight level 180.[16] More generally, a number of important support duties were also defined for relief pilots including active participation in crew briefings (departure briefing and review) and a specific requirement to ensure compliance with clearances.
Air traffic control information
Separation standards[17] are used by air traffic controllers to manage air traffic safely. They refer to the minimum horizontal and/or vertical distance, or time apart, that aircraft operating in controlled airspace must maintain. When the separation between two or more aircraft is less than the standard, there is a loss of separation.
A surveillance separation standard is used when aircraft position information is derived from air traffic services’ surveillance systems (including radar). When aircraft are operating inside terminal area airspace, such as Sydney, controllers must maintain a minimum separation between aircraft of 3 NM (5.6 km) laterally or 1,000 ft vertically.
A runway separation standard is applied for aircraft taking off from parallel runways. Following take-off, separation is facilitated visually until a surveillance (radar) or vertical separation standard exists. Aerodrome controllers (ADCs) may reduce the radar separation minima in the vicinity of aerodromes when adequate separation can be provided using visual observation and each aircraft is continuously visible to the ADC. However, ADCs are not permitted to provide visual separation if the projected flight paths of the aircraft conflict.
When a significant loss of separation occurs, air traffic control is required to issue a safety alert[18] to notify pilots of information that is of a time-sensitive and safety-critical nature. It is important pilots understand the critical nature of these instructions and respond in a timely manner to ensure the safe conduct of flight.[19]
Traffic alert and collision avoidance system
Modern high-capacity transport aircraft such as the 777 and ATR72 are required to be equipped with an advanced traffic alert and collision avoidance system (TCAS).[20] TCAS is designed to prevent mid-air collisions between aircraft. TCAS operates independently of ATC by using on-board surveillance capability to detect other transponder-equipped traffic and provides:
Traffic display (proximate traffic) and traffic advisories (TA) for situational awareness of relatively close aircraft
Resolution advisories (RA) for very close aircraft with vertical guidance to resolve the threat.
Both TA and RA are generated based on the projected closest point of approach (CPA) or miss distance and the time to co-altitude (TAU). In general, the thresholds (time and distance) for CPA and TAU increase as altitude increases.
All RA are inhibited when below 1,000 ft (+/- 100) above ground level (AGL) and all TCAS aural alerts are inhibited when below 500 ft (+/- 100).[21] This is to ensure that alerts are not generated during the initial take-off climb for two reasons: to avoid distracting the crew and, because the aircraft is already flying close to the performance limit (body angle/attitude and thrust).
Safety analysis
Flight management computer – departure setup
The foreign captain was expecting to receive a clearance via the SYD1 standard instrument departure and had pre-programmed the FMC in anticipation of this and briefed the other crew accordingly. However, the pre-departure clearance provided by air traffic control was different (RIC5). This was likely due to the captain’s limited exposure to the varying Sydney-centric departure procedures (SYD1 versus RIC5). In addition, the clearance included the radar transition procedure, with which the captain was unfamiliar, due to the predominant use of procedural-based transitions in the United States. Anything non-standard in departures or arrivals can add additional complexity, but particularly for crew that have very limited experience with the location, such as long-haul foreign crew. Air traffic controllers have an opportunity to take into account the likelihood of a crew’s familiarity with the airport when issuing clearances to foreign crew.
The clearance meant the FMC needed to be re-programmed for the RIC5 procedure. During this process, the PF removed the discontinuity that was automatically generated in the FMC flight path, that is, the waypoint sequence to the cleared oceanic route. This would have been appropriate for many procedural transitions but not for a radar transition. The predominance of procedural transitions in the United States likely meant that the PF was focussed on removing the discontinuity (gap) in the FMC coding.
In this case, the purpose of the discontinuity was to represent controller-issued vectors as the aircraft tracked beyond 12 NM northwest of Sydney. In effect, the aircraft was cleared to 12 NM. From that point they were required to wait for a controller initiated radar vector to re-join their cleared oceanic route to San Francisco commencing at waypoint DIPSO (to the east). In removing the discontinuity, the aircraft was re-programmed to track directly to DIPSO after reaching the initial waypoint at 1,500 ft where the aircraft should have turned left (before they reached the 12 NM point). Ultimately, this resulted in a right turn and, therefore, the loss of separation.
Crew coordination
Effective crew coordination is fundamentally dependent upon effective communication. In order for cockpit crew members to share a ‘mental model’, or common understanding of the nature of events relevant to the safety and efficiency of the flight, communication is critical.[22] The operator’s procedures were clear and provided an established framework for the flight crew to communicate and coordinate their activities to ensure a safe and expeditious departure.
A number of opportunities existed not only for the PM, but also the crew positioned in the observers’ seats (in-flight relief pilots), to verify the FMC setup between the departure briefing and entering the runway prior to take-off. The operator’s procedures included a comprehensive process by which crew use different pages (information sources) within the FMC to ensure the departure clearance is reflected accurately by the computer coding (waypoint sequence).
The PM was not aware of the amendment to the radar transition (deletion of the route discontinuity), which indicated that the PF may not have clearly verbalised the change and/or ensured the PM heard and understood the change, in accordance with the operator’s procedures. By not clearly verbalising this misunderstanding or the amendments to the departure route setup, the PF did not provide an opportunity for the rest of the crew to contribute effectively.
However, there were further opportunities for the PM or relief pilots to discover this error. The PM verified the FMC set up, but only used the summary RTE page rather than the LEGS page with greater detail, and therefore the waypoint sequencing error was not detected. Further, in the departure review just before take-off, both the PF and the PM noticed the ‘no transition’ on the FMC RTE page, but no-one recognised this was not in accordance with the radar transition segment of the clearance.
Communication
Effective communications also includes with external sources such as air traffic control. Readbacks of clearances and instructions to crew in the aviation context serves two main purposes; acknowledgement of both the intent and content of the clearance, and to reinforce the message has been acknowledged and understood. In this case, the PM provided a truncated readback to ATC, which did not provide this assurance. The truncated readback was not challenged by the controller. As such, the controller did not have any assurance that the flight crew heard and understood that they were cleared for a radar transition. This increased the risk of errors to the FMC setup and could have led to further confusion during the initial climb.
Findings
Contributing factors
The pilot flying incorrectly amended the flight management computer (FMC) for the cleared departure.
The amended FMC setup was probably not effectively communicated to the crew or effectively cross-checked by the pilot monitoring or relief pilots.
Other factors increasing risk
The pilot monitoring did not complete a full readback of the radar transition component of the pre-departure clearance, nor did the Sydney clearance delivery controller insist on a full readback.
Other findings
The Sydney departures controller observed UA870 turning right and towards VOZ1153 and quickly issued unambiguous and immediate instructions to both aircraft to rectify the situation and re-establish the required separation.
Crew details
United Airlines 870
Captain
Senior FO
Observer 1 (FO)
Observer 2 (FO)
Total Flight hours
21,072
19,000
17,600
14,200
Flight hours on B777
4,309
3,500
2,500
2,600
Flight hours in last 90 days
166
350
175
148
Total instrument hours
11,000
18,500
500
Not available
Instrument hours last 90 days
100
350
3
Not available
Medical
Class 1
Class 1
Class 1
Class 1
Last simulator check*
13 Dec 2019
21 Aug 2019
28 Jun 2019
20 Jun 2020
*Note: In United Airlines, crew resource management (CRM) and threat and error management (TEM) is incorporated into training and evaluation events, or simulator checking activities.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 23 January 2020, the crew of a Lockheed Corporation (now Lockheed Martin) EC-130Q large air tanker, registered N134CG, were conducting bushfire control operations in the Snowy Mountains region of New South Wales. After assessing the initial fire-retardant drop site at Adaminaby as not suitable, the crew accepted an alternate tasking to the Good Good (Peak View) fire-ground.
After conducting a partial retardant drop at Peak View, the aircraft was in a left turn and climbed for about 10 seconds to about 170 ft above the drop height. Following this, the aircraft was then observed descending. The aircraft was seen at a very low height above the ground, in a slight left bank, immediately followed by a significant left roll just before ground impact. The 3 crew were fatally injured and the aircraft destroyed.
What the ATSB found
The ATSB found that the forecast and actual weather conditions present in the Snowy Mountains region were hazardous, with strong gusting winds and mountain wave activity, producing turbulence. This was likely exacerbated by the fire and local terrain. Subsequently, the ATSB determined that the conditions were conducive to windshear and downdraft development at a time when the aircraft was most vulnerable, with a low airspeed and at a low altitude.
Despite an awareness of these conditions and that all other fire‑control aircraft (including a Boeing 737 large air tanker) were not operating in the area at the time due to the weather conditions, the New South Wales Rural Fire Service (RFS) continued with their tasking of N134CG to Adaminaby without aerial supervision (birddog). In addition, they relied on the pilot in command to assess the appropriateness of the tasking but did not provide them all the available information to make an informed decision on flight safety. That information for the tasking to Adaminaby should have included details about actual hazardous environmental conditions, resulting in the cessation of local aerial operations, the birddog pilot declining the tasking due to the forecast weather conditions, and a report from the Boeing 737 crew that conditions precluded them from returning to the fire-ground.
The crew of N134CG were therefore very likely not aware that the birddog pilot had declined the tasking to the Adaminaby fire-ground, nor that the smaller fire-control aircraft had ceased operations in the area, due to the hazardous environmental conditions. While this was only one risk factor among others that would be considered by the crew when accepting a task, having this information would have allowed them to make a more informed decision about the weather conditions.
Nonetheless, the pilot in command of N134CG accepted the tasking to the Adaminaby fire‑ground, which was subject to hazardous environmental conditions. After assessing the conditions as unsuitable at Adaminaby, the crew accepted an alternative tasking to continue to the Good Good fire-ground, which had the same weather conditions. The acceptance of these taskings was consistent with the operator’s practices to depart and assess the conditions to find a workable solution rather than rely solely on a weather forecast, which may not necessarily reflect the actual conditions at the fire-ground.
At the Good Good fire-ground, following a partial retardant drop and left turn, the aircraft was very likely subjected to hazardous environmental conditions including low-level windshear and an increased tailwind component. From a combination of witness video, and real-time position and flight path data, it was established that the aircraft’s climb performance degraded. Subsequently, while at a low height and airspeed, it was likely the aircraft aerodynamically stalled, resulting in a collision with terrain. In the limited time available, the remainder of the fire-retardant load was not jettisoned prior to the aircraft stalling.
The ATSB established that, while a safety management system was not required under Australian regulations at the time of the accident, Coulson Aviation's safety risk management processes did not adequately manage the risks associated with large air tanker operations. In particular, they had not conducted formal risk assessments of the hazards identified in their operations manual, and did not maintain a tool, such as a risk register, to track risk acceptance levels. Further, incident reports submitted through the safety reporting system were mainly related to maintenance issues, and therefore operational risks were less likely to be considered or monitored. This limited their ability to identify and implement control measures to manage the risks associated with their aerial firefighting operations.
It is critical that crews can differentiate between a low-risk and high-risk flight during the planning stage to establish the overall risk profile. While identifying it as a high-risk activity, Coulson Aviation had not identified a need for a pre-flight risk assessment for their firefighting large air tanker crews. This would have provided crews with predefined criteria to ensure consistent and objective decision-making with accepting or rejecting tasks, and include factors relating to crew, environment, aircraft and external pressures and factors.
There are a number of mitigators for windshear, including pilot training and procedures, and airborne detection systems. However, Coulson Aviation did not include a windshear recovery procedure in their C‑130 Airplane Flight Manual. Further, it was noted that a briefing on windshear recovery was incorporated into the training syllabus, but there was no requirement to conduct a simulator-based low-level windshear recovery scenario. Combined, these strategies could provide crews with the experience needed to recognise the symptoms of windshear and practice a recovery procedure. In addition, Coulson Aviation had not assessed their fleet of C-130 aircraft for fitment with a windshear detection system. This increased the risk of a windshear encounter and/or delayed response to an encounter.
While the New South Wales RFS was not an aviation organisation or directly responsible for flight safety, they were closely involved in the aerial operation, being responsible for determining the task objectives and selecting aircraft for the task. The ATSB found that the RFS had limited large air tanker policies and procedures for aerial supervision requirements and no procedures for deployment without aerial supervision. In addition, they did not have a policy or procedures in place to manage task rejections, nor to communicate this information internally or to other pilots working in the same area of operation. Such policies and associated procedures would provide frontline personnel with the required steps to effectively and safely manage taskings, and provide guidance for decision-making.
It was also identified that, while not applicable to the accident crew, the RFS procedures allowed aircraft operators to determine when pilots were initial attack capable. This was inconsistent with their intention for pilots to be certified by the United States Department of Agriculture Forest Service certification process.
While not contributing to the accident, the aircraft's cockpit voice recorder did not record the accident flight. This resulted in a valuable source of safety information not being available to the investigation, which not only increased the time taken to determine contributing factors to the accident but also limited the extent to which important safety issues could be identified and analysed.
What has been done as a result
As a result of this investigation, Coulson Aviation have incorporated a windshear recovery procedure into their C-130 Airplane Flight Manuals and plan to introduce simulator-based recurrent windshear training. Related to the consideration of risk in aerial firefighting operations, they have also implemented a pre-flight risk assessment to be completed by the pilot in command prior to the first tasking of the day. They will also be introducing a three-tier risk management approach, of organisational risk, operational risk, and tactical/mission risk, to be utilised during the upcoming fire season in Australia. Further, Coulson Aviation have updated their pre-flight procedures to incorporate a cockpit voice recorder system check before each flight. Lastly, the Retardant Aerial Delivery System software was reprogrammed so that the system will not require re-arming between partial load drops where less than 100% was selected.
The ATSB has issued 2 safety recommendations to Coulson Aviation. These are to further consider:
fitment of a windshear detection system to their C-130 aircraft to minimise the time taken for crews to recognise and respond to an encounter particularly when operating at low-level and low speed
incorporating foreseeable external factors into their pre-flight assessment tool to ensure the overall risk profile of a tasking can be consistently assessed by crews.
The New South Wales Rural Fire Service advised the ATSB that they intend to take the following actions in response to this accident:
Commissioned an independent report into the management of airspace in which aircraft are operating in support of fire-fighting activities.
Formalise and establish a ‘Large Air Tanker Co-ordinator’ role description, to be positioned on the State Air Desk during heightened fire activity.
Undertake an immediate audit, in conjunction with operators, of pilots qualified as initial attack capable and ensure appropriate records are accessible by RFS personnel.
Undertake detailed research to identify best practice (nationally and internationally) relating to task rejection and aerial supervision policies and procedures as well as initial attack training and certification.
Undertake a comprehensive review of RFS aviation doctrine to incorporate outcomes of the above-mentioned research into existing policies and procedures.
Promulgate the revised doctrine detailing the task rejection policies and procedures and aerial supervision requirements to all operational personnel, pilots/aircrew and other key stakeholders. This is to be reinforced at the aviation operators briefing held annually prior to the bushfire season.
Provide the National Aerial Firefighting Centre and national fire-fighting agencies with copies of the updated doctrine relating to these issues.
While the ATSB acknowledges the commitment to undertake reviews and research, at the time of publication, the New South Wales Rural Fire Service had not yet committed to adopting any safety action that would reduce the risk associated with the 3 identified safety issues to an acceptable level. As such, the ATSB has issued three safety recommendations to the RFS to take further action:
to address the absence of policies and procedures for personnel to effectively manage and communicate task rejections on the basis of operational safety concerns
to address the absence of policies and procedures regarding minimum aerial supervision requirements and the use of initial attack to assist frontline staff with making acceptable risk‑based tasking decisions
to address the ambiguity with the interpretation of ‘initial attack’ in the NSW and ACT Aviation Standard Operating Procedures with the intent of this requirement.
Safety message
As noted by the National Aerial Firefighting Centre, aerial firefighting has become a critical capability for the management and suppression of bushfires in Australia. To effectively achieve this, aircraft are flown at low altitudes and low airspeeds, often in challenging environmental conditions. This creates a high-risk environment, which requires a continued focus on risk mitigation.
Previous research conducted by the ATSB emphasised that any decisions made by tasking agencies during the management of an aerial campaigns (firefighting) could influence the level of risk of the operation. Therefore, if safety was to be maintained, this responsibility had to be shared between the tasking agency and the aircraft operator. This accident highlights the importance of having effective risk management processes, supported by robust operating procedures and training to support that shared responsibility.
While the identification of hazards is the initial step in safety risk management, conducting risk assessments, implementing risk mitigators, and having effective oversight of the process through a tool such as a risk register are critical aspects of this process. This provides the mechanism for organisations to consider the specific challenges associated with firefighting operations such as hazardous environmental conditions, and ensure they have the appropriate risk controls in place to support crew decision-making when conducting high-risk activities.
Further, the adoption of good systems for managing risk by the tasking agency could provide an effective additional layer of defences over and above that provided by each aircraft operator to protect against an incident or accident. This also ensures that one aspect of the operation does not compromise another aspect. This may include the development of procedures to support decision-making processes rather than personnel having to exercise judgement to the best of their abilities, based on their experience, skills and knowledge. This would include aspects such as tasking decisions, task rejection policies and procedures, and minimum aerial supervision requirements.
The occurrence
Overview
During the Australian ‘black summer’ of 2019-2020, the east coast experienced many severe bushfires. As part of the firefighting efforts, small and large aircraft were used for aerial fire suppression and intelligence gathering. The larger aircraft included large air tankers (LATs),[1] located at the Richmond Royal Australian Air Force (RAAF) Base, New South Wales (NSW). This included a United States-registered Lockheed Martin EC-130Q,[2] registered N134CG, operated by Coulson Aviation. On 23 January 2020, the aircraft was applying retardant for property protection in the Good Good fire-ground (near Peak View) in the Snowy Mountains region of NSW. While attempting to climb away after a partial fire-retardant drop, the aircraft collided with terrain. The 3 crew were fatally injured and the aircraft was destroyed.
Daily briefings at Richmond Base
On 23 January 2020, at about 0900 Eastern Daylight-saving Time,[3] the NSW Rural Fire Service (RFS) Richmond airbase manager (ABM)[4] had conducted a briefing with the crews of the air tanker and birddog[5] aircraft based there. The briefing included the current and anticipated fire activity and discussed fire-related weather conditions across the state. Following the briefing, the crews then remained on standby until they received a tasking from the RFS, with a contracted 15‑minute departure time following the completion of retardant loading.
The operator of two LATs at Richmond, Coulson Aviation, reported[6] that they had also conducted their daily safety management system call between management and crews, which would typically discuss the operations to be conducted on the day, and any reported issues encountered in the previous 24 hours. However, as there were no notes taken for the call, the details of the conversation were unknown.
Fire situation in the Snowy Mountains region
On the day, the Snowy Mountains region in NSW had a severe fire danger rating,[7] due to high temperatures, strong winds and forecast thunderstorms. This region included the Adaminaby and Good Good fire-grounds, which were both under the control of the RFS Cooma Fire Control Centre (FCC).[8]
At about 1100, the Cooma FCC incident controller[9] made a phone call to the RFS State Operations Centre.[10]A number of senior personnel from the State Operations Centre were involved in the conference call. They discussed the escalating fire danger at the Adaminaby fire‑ground, with rural properties under threat and concern the town would be impacted if containment lines did not hold. During that call, RFS personnel stated that there were strong winds, severe fire weather conditions, and that the smaller fire-control aircraft were not operating in the area due to the winds and poor visibility. There was also discussion as to whether a birddog aircraft had already departed to assess the conditions. However, a senior RFS officer stated they should send the Boeing 737 LAT aircraft irrespective, ‘as it can bomb by itself if need be’ and ‘not wait for the birddog assessment’.
Consequently, the State Operations Centre tasked 2 LATs[11] and a birddog to the Adaminaby fire‑ground: a Boeing 737 aircraft, registered N137CG, call sign ‘Bomber 137’ (B137); a Lockheed Martin C-130 aircraft, registered N134CG, call sign ‘Bomber 134’ (B134); and a Rockwell International 690-B aircraft (operating as a birddog). All 3 aircraft were based at the Richmond Base, about 316 km north-east of the Adaminaby fire-ground.
‘B137’ tasking to Adaminaby
Following the 1100 call, the tasking was communicated by the state air desk (SAD)[12] to the Richmond ABM. At 1120, the Cooma aerial operations manager log recorded that LATs were inbound, with no birddog. At about 1121, the crew of B137 had commenced taxiing at Richmond for another task to the north[13] when they were re-tasked to the Adaminaby fire-ground by the ABM. After the initial coordinates, location details, and information regarding the expected direction of the fire were provided, the pilot in command (PIC) of B137 requested details for the fire common traffic advisory frequency. The Richmond ABM was unable to provide these details immediately, but indicated the SAD ‘want to get them in the air and down there’. The ABM also advised the crew of the objective to ‘keep the fire out of Adaminaby’, that ‘the fire is burning towards the north-west’, that there were no other aircraft in the area, and that it ‘is very windy down there….take care’. The ABM further advised ‘the birddog won’t be down there’.[14] Therefore, the PIC was aware they would be operating as initial attack.[15] The aircraft subsequently departed at about 1127.
While en route, the crew contacted various fire centres to determine the correct ground-based contact, eventually communicating with the Cooma aviation radio operator (ARO), located at the Cooma FCC. At about 1155, B137 arrived overhead the Adaminaby fire-ground, but the crew were unsure of the actual planned location for the drop. After further discussion with the ARO, it was determined they were overhead the intended location.
Due to the weather conditions and ground-based fire-fighters in the planned drop area, the crew orbited for about 25 minutes. At interview, the PIC reported that, while assessing the conditions in the Adaminaby area, the aircraft encountered uncommanded rolls up to 45° angle of bank (due to wind) and they received a windshear[16] warning from the aircraft’s onboard systems.[17] The PIC elected to operate on the upwind side of the hills to avoid lee side mechanical turbulence.[18] They also reported that the wind speed at the Adaminaby fire-ground was 50 kt at 800 ft above ground level (AGL) and about 37 kt at the fire‑retardant drop height of 200 ft AGL. At about 1225, B137 departed the Adaminaby fire‑ground, having successfully deployed a retardant load.
After completing the retardant drop, the PIC reported that they advised the Cooma ARO to cancel all the aircraft operating in the area, although it was not clear if the ARO had received that message. They also sent a text message to the birddog pilot assigned to the Adaminaby fire‑ground indicating that the conditions were ‘horrible down there. Don’t send anybody and we’re not going back’. During B137’s return flight to Richmond, at about 1232, the PIC contacted the Richmond ABM and stated they were going ‘to put themselves on hold’, but would be available for other taskings. The ABM requested that they reload the aircraft with fire retardant in Canberra and return to Adaminaby. The PIC replied that they would not be returning to Adaminaby due to the weather conditions, as the ‘winds were getting too strong and the visibility is down’, and continued to Richmond. Subsequently, when the ABM communicated B137 PICs decision to the SAD, they indicated the weather was ‘fairly dicey…probably won’t go back’. There was some discussion as to the availability of other LATs to task to Adaminaby, however, the decision was made to wait for a report from B134 before any further tasking.
Birddog rejection of tasking
Meanwhile, at about 1137, the Richmond ABM contacted the SAD to confirm the dispatch of a birddog to Adaminaby. The birddog crew consisted of the birddog pilot and the LAT air attack supervisor.[19] The ABM had also noted in their log at 1130 and 1140 that they were intending to send the birddog to Adaminaby. The 1130 log entry also indicated that the incident air attack supervisor was not operating ‘due to extreme wind conditions’. By the time of the 1137 phone call, B137 had already departed Richmond as initial attack and B134 was being prepared for departure, with the expectation from the RFS that both LATs would do multiple retardant drops. The ABM and SAD discussed that the 2 LATs would beat the birddog to the fire‑ground, but it was considered unlikely ‘they will get through as [it] will be too windy for them’.[20]
The birddog pilot reported having experienced moderate to severe turbulence in the Snowy Mountains region about 2 weeks prior, which resulted in an uncommanded roll up to 30–40° angle of bank. This, combined with a downdraft, required the pilot to execute an escape manoeuvre. On receipt of the tasking to Adaminaby, the birddog pilot reviewed the weather and concluded that the conditions were forecast to be worse than previously experienced, and therefore declined the task. The RFS reported the SAD log recorded the birddog declining the task to Adaminaby at 1204.
At about 1209, the ABM had a conversation with the SAD and discussed that the birddog pilot was ‘questioning the weather conditions’. The SAD instructed the ABM to ‘get them on their way, and then turn them around’ (that is, rather than accept a rejection based on the forecast, they would prefer they re-assess the conditions in-flight). When the ABM communicated this to the birddog pilot, the pilot indicated to the ABM that B137 would arrive overhead Adaminaby shortly, and they could then report the actual conditions. At about 1235, following a report of the conditions from the PIC of B137, the ABM reportedly agreed that the birddog pilot had made an appropriate assessment to reject the task to Adaminaby.
The birddog pilot reported that they had not spoken to the crew of B134 following the receipt of the tasking on the day of the accident as they were both focussing on their pre‑flight planning, which was normal practice. Subsequently, the birddog pilot accepted an alternate tasking at 1259.
Figure 1 provides a timeline of the key communications regarding tasking allocation for B134, B137 and the birddog.
Figure 1: Timeline of tasking communications
Source: ATSB
‘B134’ tasking to Adaminaby
At about 1205,[21] while B137 was overhead the Adaminaby fire-ground, and about the same time the SAD logged the birddog rejection, B134 departed Richmond as initial attack. On board were the PIC, the copilot and flight engineer.
In response to the draft report, the RFS provided excerpts from the state operations controller (SOC) log.[22] entry was written in the log by the SOC following the accident.[23] The SOC noted having been advised that the birddog had indicated it was ‘not safe to fly’ and that B137 was not returning to the area until the conditions had eased. However, B134 would continue with the PIC to make the ‘decision of safety of bombing operations’. The RFS advised the ATSB that the SOC had the authority to cancel B134’s tasking, but instead allowed it to proceed, with the intention of gathering additional intelligence to assist in determining whether further aerial operations would proceed. The RFS further reported that this indicated an ongoing intelligence gathering and assessment process by the SOC.
At about 1235, while returning to Richmond, the PIC of B137 heard the PIC of B134 on the Canberra approach frequency and contacted them via their designated operating frequency. At that time, B134 was about 112 km north-east of Adaminaby, en route to the fire-ground (Figure 2). In this conversation, the PIC of B137 informed them of the actual conditions and that they would not be returning to Adaminaby. The PIC of B137 reported that they could not recall the specific details of the call, but that the conversation included that they were ‘getting crazy winds’ and ‘you can go take a look’ ’but I am not going back’. It was also noted that the PIC of B134 had asked several questions. It was reported by the majority of the operator’s pilots that, despite receiving information from another pilot, they would have also continued with the tasking under these circumstances, to assess the conditions themselves.
At about 1242, the crew of B134 contacted air traffic control to advise them of the coordinates they would be working at, provide an ‘ops normal’[24] call time, and confirm there was no reported instrument flight rules[25] aircraft in the area. About 5 minutes later, the Richmond ABM also attempted to contact the crew of B134 to confirm ‘ops normal’, firstly by radio, and then by text to the PIC’s mobile phone, but did not receive a response.
The automatic dependent surveillance broadcast (ADS-B) data showed that, after arriving at the Adaminaby fire-ground at about 1251, the crew of B134 completed several circuits at about 2,000 ft AGL.[26] At about 1255, the crew advised the Cooma ARO that it was too smoky and windy to complete a retardant drop at that location. The Cooma ARO then provided the crew with the approximate coordinates of the Good Good fire, about 58 km to the east of Adaminaby. The ARO further indicated that they had no specific requirements, but they could look for targets of opportunity, with the objective of conducting structure and property protection near Peak View.
Figure 2: Flight track of B134 (white line), timing and location of external communications, and key locations, with an inset detailing the circuits at Adaminaby
Source: Google earth, ADS-B data and radio calls, annotated by the ATSB
‘B134’ tasking to the Good Good fire-ground
At about 1259, the crew of B134 contacted air traffic control to advise that they had been re‑tasked to the Good Good fire-ground and provided updated coordinates. At about the same time, the RFS ground firefighters at the Good Good fire-ground, near Feeney’s Road in Peak View, contacted the Cooma FCC and requested additional assets for property protection. They were advised that a LAT would be passing overhead in about 10 minutes. The firefighters acknowledged the intention of a LAT retardant drop and advised the Cooma FCC they would wait in open country on Feeney’s Road, clear of any properties targeted for protection.
At about 1307, B134 arrived overhead the drop area (Figure 3). The drop area was located to the east of a ridgeline, with the fire on the western side of the ridgeline. The aircraft’s recorded track data (SkyTrac) showed that the crew conducted 3 left circuits, at about 1,500 ft, 500 ft and 1,000 ft AGL respectively, prior to commencing the drop circuit (Figure 4). At about 1312, after conducting about 2 circuits, they advised the Cooma ARO of their intention to complete multiple drops on the eastern side of the Good Good fire, and that they would advise the coordinates after the first delivery.
Figure 3: B134’s approach and circuits overhead the drop location; the inset shows the track from the Adaminaby to the Good Good fire‑ground
Source: Google earth and SkyTrac data, annotated by the ATSB
At 1315:15,[27] a partial retardant drop was conducted on a heading of about 190°, at about 190 ft AGL (3,600 ft above mean sea level). During the drop, about 1,200 US gallons (4,500 L) of fire retardant was released over a period of about 2 seconds. A ground speed of 144 kt was recorded at the time of the drop.
A witness video taken by ground fire-fighters captured the drop and showed the aircraft immediately after the drop in an initial left turn with a positive rate of climb, before it became obscured by smoke[28] While being intermittently obscured by smoke, the aircraft climbed to about 330 ft AGL (3,770 ft above mean sea level). At about this time, ATSB analysis of the video showed that the aircraft was rolling from about 18° left angle of bank to about a 6° right angle of bank. Following this, the aircraft descended and about 17 seconds after the completion of the partial retardant drop, it was seen at a very low height above the ground, in a slight left bank. Video analysis and accident site examination showed there was no further (emergency) drop of retardant. Throughout this period, the recorded groundspeed increased slightly to a maximum of 151 kt. Shortly after, there was a significant left roll just prior to ground impact.
Figure 4: Accident circuit and location of the firefighters and retardant drop
Source: Google earth and SkyTrac data, annotated by the ATSB
At about 1315:37, the aircraft collided with terrain and a post-impact fuel-fed fire ensued. The 3 crew were fatally injured, and the aircraft was destroyed.
A review of the Airservices Australia audio recording of the applicable air traffic control frequency found no distress calls were received by controllers prior to the impact.
The pilot in command’s (PIC) logbook, combined with the operator’s records for the accident aircraft showed that the PIC had a total flying experience of about 4,010 hours, which included 3,010.3 hours in the C-130 aircraft and 994 air tanker drops. The PIC had also accrued a further 1,616.8 hours as a flight navigator.
The PIC commenced work in Australia on 1 December 2019. In the 30 days prior to the accident, the PIC had flown about 32 hours. In the 72 hours prior, the PIC had flown 4.5 hours, all of which were in B134. The accident flight was the first flight of the day.
The PIC was initially trained as a navigator and pilot in the United States (US) Air National Guard. During this time, the PIC gained experience in firefighting operations through the modular airborne firefighting system (MAFFS)[29] program. The PIC joined Coulson Aviation in 2015 on a part-time basis, before being employed full-time in 2017.
Qualifications
The PIC held a current airline transport pilot certificate with ratings for multi-engine land airplane including the EC-130Q, issued by the US Federal Aviation Administration (FAA) on 13 October 2017. The PIC’s most recent flight instructor certificate with ratings for multi-engine and instrument aircraft was issued by the FAA on 6 April 2019. On 18 April 2019, the PIC’s latest ‘airplane pilot qualification card’ was issued from the US Department of Agriculture, Forest Service,[30] for the C-130 aircraft, which included the authorised missions of:
low level (below 500 ft above ground level)
mountainous terrain
airtanker initial attack.
An air tanker initial attack certification allowed a pilot to conduct fire retardant drops without the supervision of a birddog or air tactical (attack) supervisor.
At interview, other flight crew reported the PIC was ‘methodical’, ‘conservative’, who ‘always did his due diligence’ and was not considered to take unnecessary risks. It was also reported that Coulson Aviation pilots were not being paid per flight or by flying hours, and therefore that was not a motivational factor to accept a tasking. In addition, the PIC had recently resigned from the operator and accepted a US-based position.
Training
The PIC last completed training with Coulson Aviation in March and April 2019,[31] which included annual C-130 simulator training, controlled flight into terrain awareness and crew resource management courses. In addition, the PIC completed 2 assessed training flights in the C-130 on 14‑15 April 2019. The flight on 14 April included approach to aerodynamic stalls[32] in the circuit (with 50% flap) and drop (with 100% flap) configurations, and go-arounds with a full load (water). The flight on 15 April included drop planning (hazards, tactics, ingress, egress, and dry run) and an emergency on the drop run. The drop run emergency was a simulated ‘down air’ [downdraft]. All the assessed sequences, which included jettison of the load during a (simulated) emergency condition,[33] were recorded as satisfactory.
Copilot
The copilot had joined Coulson Aviation in September 2019, after 20 years in the US military, including experience flying the C-130. The copilot’s logbook combined with the operator’s records showed a total flying experience of about 1,744 hours, of which about 1,364 hours were on the C‑130. This was the copilot’s first fire season, and they commenced work in Australia on 1 December 2019. Since the start of the fire season, the copilot had flown about 85 hours, with about 28 hours in the last 30 days and about 4.5 hours in the 72-hour period prior to the accident.
The copilot held a current airline transport pilot certificate and ratings for multi-engine land aircraft, including the EC-130Q (second-in-command privileges only), issued by the FAA on 7 November 2019. The copilot also held a flight instructor certificate with ratings for single, multi‑engine and instrument aircraft, issued by the FAA on 14 August 2019.
The copilot’s C-130 check flight with the operator was completed on 12 September 2019, and was assessed as satisfactory against the qualification standards for second‑in‑command. On 13 September 2019, the copilot completed the crew resource management and controlled flight into terrain awareness courses and reviewed the US Department of Agriculture Forest Service’s air tanker pilot training video.
On 16 September 2019, the copilot was issued with an ‘airplane pilot qualification card’ from the US Department of Agriculture Forest Service for the C-130, which included the authorised missions of:
low level (below 500 ft above ground level)
mountainous terrain
airtanker SIC (second-in-command).
Flight engineer
The flight engineer joined Coulson Aviation in November 2019, after about 25 years in the US military. This was the flight engineer’s first fire season. The flight engineer held a flight engineer certificate with a rating for turbo-propeller powered aircraft, issued by the FAA on 20 November 2019. On the flight engineer application form, the flight engineer reported accruing about 4,050 hours on the C‑130. The flight engineer also held a mechanic certificate with ratings for airframe and powerplant, issued by the FAA on 2 June 2019.
The flight engineer’s check flight was completed with the operator on 20 November 2019. In addition to this flight, the flight engineer completed 2 air tanker drops under supervision in Australia on 12 January 2020. The flight engineer commenced work in Australia on 13 January 2020.
72-hour prior history
In Australia, each crew member’s roster cycle was 14 duty days followed by 2 rest days. The accident flight occurred on the PIC’s 9th day, and the copilot’s and flight engineer’s 11th day of their respective current duty periods.
Table 1, based on the operator’s records, details the crew’s sign-on and sign-off times for the 3 days before the accident. On 23 January 2020, the crew signed on at 0900.
Table 1: B134 crew working hours
20 January
21 January
22 January
23 January
Sign-on
1000
0800
1000
0900
Sign-off
1800
1700
1900
-
Duty time
8 hours
9 hours
9 hours
-
Information from the crew’s telephone and hotel records, in addition to work and flying duties, were used to determine their activities in the previous days. There were no indications of fatigue for the 3 crew members. However, there was insufficient information available to the ATSB about their sleep and non-duty activities to estimate fatigue levels with confidence.
Aircraft information
General information
The C-130 is predominantly an all-metal, high-wing aircraft, designed for military operations. The accident aircraft (Figure 5) was manufactured by the Lockheed Corporation (now Lockheed Martin Corporation) in 1981 and was powered by 4 Allison T56-A-15 turbopropeller engines, fitted with Hamilton Sundstrand 54-H60-91 4-blade propellers. The T56‑A‑15 is a constant speed engine, with a variable pitch propeller.
Previously owned by the US Navy, the aircraft was transferred to the US National Aeronautics and Space Agency in 1992 and later placed in storage. It was then re‑purposed for firefighting activities by Coulson Aviation and registered in the restricted category.[34] At that time, Coulson Aviation became the type certificate holder and assumed the responsibilities of the aircraft manufacturer for the entire aircraft and any modifications made.
Initially registered as N130CG in 2018, this was later changed to N134CG in April 2019. Modifications to the aircraft included the installation of an avionics package and firefighting tank system, known as the Retardant Aerial Delivery System XXL (RADS).
Figure 5: N134CG
Source: Coulson Aviation
Retardant Aerial Delivery System XXL
The RADS included a 4,000 US gallon (15,000 L) tank system located within the aircraft’s fuselage. The system was designed to deliver discrete quantities of retardant, dependant on the coverage factor[35] selected and the duration the doors remained open. This was controlled from the cockpit, with drop controls located on both the PIC and copilot yokes.
The drop quantity was manually controlled by the crew by setting the coverage factor and either selecting a pre-set percentage or setting 100%. The latter option allowed the crew to control the amount of retardant released by holding a button on the yoke until the desired amount was dispensed. The RADS system was designed that, if less than 100% volume was selected, the system would disarm after a partial load drop and the crew would need to re‑arm the system to complete further releases. It was reported that the crew on B134 normally selected 100%.
The system also included a guarded emergency dump (’e-dump’) switch, located in reach of all 3 crew members, which would fully open the doors and jettison the load in a period of about 2 seconds. Following an emergency dump, the doors would remain open until the RADS was reset by the crew.
Maintenance history
The aircraft had a total time-in-service of 11,888 hours and had accrued 683 hours of firefighting operations since the tanker conversion in 2018. The aircraft had a current certificate of airworthiness and was maintained in accordance with an FAA approved program.
N134CG arrived in Australia in November 2019. The last daily inspection conducted on 22 January 2020, at the end of flying activities the day before the accident, identified the propeller anti-icing system on engine number 2 was unserviceable, and rectification had been deferred in accordance with the minimum equipment list.[36]
In addition to a maintenance requirement to perform engine power efficiency checks at 150-hour intervals, the operator reported pilots were required to perform power checks before every take‑off. Operations were only permitted if a minimum performance requirement of 95% was met.
Weight and balance
The last weight and balance report for the aircraft, in April 2019, showed its basic empty weight was 75,794 lb (34,380 kg) and according to the RADS Airplane Flight Manual (AFM) supplement, the maximum take-off weight was 150,718 lb (68,365 kg). The aircraft flight and maintenance log indicated the PIC had the aircraft refuelled to a total of 34,000 lb (15,422 kg) at the completion of flying on 22 January 2020. The operational load monitoring system[37] indicated there was 35,514 lb (16,109 kg) of retardant on board prior to the accident drop, in addition to a 2,000 lb (907 kg) pallet of gel. This resulted in a take-off weight of about 147,308 lb (66,818 kg) and the centre of gravity being at the aft limit on departure from Richmond.
Using the operator’s reported fuel consumption for air tanker drop missions of 5,000 lb/h (2,268 kg/h) for a 70-minute flight, and the retardant drop of 10,764 lb (4,882 kg), the estimated post-drop weight was 130,656 lb (59,265 kg). The centre of gravity remained close to the aft limit. This was consistent with reports from the operator’s other crews that the location of the RADS tank in the aircraft meant there was no appreciable change in the centre of gravity following a retardant drop.
Aerodynamic stall
Stalling
An aircraft’s wing is said to be ‘aerodynamically stalled’ when the airflow over the wing separates from the wing; that is, the airflow no longer follows the contour of the top surface of the wing. This results in a rapid loss of lift, which balances the weight of the aircraft, and the aircraft will rapidly descend. An aerodynamic stall will also normally result in the nose of the aircraft pitching down, often with a left-wing drop.
The aerodynamic characteristics of an aircraft wing are such that the airflow will separate and the wing stalls when the angle of attack, the relative angle between the wing and the airflow, reaches a critical value. The C-130H did not have an angle of attack instrument, however, this could be referenced to an equivalent airspeed. The airspeed at which a stall occurs is not fixed to a single value, and varies depending on the flap setting, aircraft weight, and load factor.[38] The stall speeds are typically presented in the AFM (refer to section titled Aircraft performance).
The C-130 aircraft has 4 wing mounted engines driving propellers. The placement of the propellers forward of the wings results in the propeller slipstream providing a relative airflow over each of the wings in addition to the forward speed of the aircraft, which varies in strength with the power produced. This is known colloquially as a ‘blown lift’ wing and results in the stall speed lowering as power is increased. For the C-130, the published power-on stall speed with 50% flap is based on maximum power. Therefore, the stall speed will be higher when less than maximum power is applied. The higher power-off stall speeds are based on idle engine power.
Stall characteristics of the C-130
A C-130 discussion paper (Mizell, 2009), based on data obtained during US Air Force testing, described the aircraft as having a ‘very good natural stall warning... However, once in a stall, the plane becomes much less predictable’. In a clean (no flap) power-off stall:
The flying characteristics of the plane are very benign all the way up to full stall. A significant buffet was experienced 10 knots prior to stall. 3 knots above stall, a deterring buffet was experienced, giving a clear signal to the crew that stall was imminent. Immediately before stall, a yaw acceleration was detected by the data, but nearly imperceptible to the crew.
However, the 50% flap and 100% flap power-on stall ‘present a much larger hazard..’. Specifically, the paper noted that:
Similar to 0% flap, but with less buffet warning, the left-wing stalls first resulting in large, uncontrolled bank excursions and subsequent nose low attitudes. In some cases, the aircraft remained uncontrollable until the bank exceeded 100 degrees and the nose approached 75 degrees down. This caused massive altitude loss and overspeed of airframe components.
The approach to stall at 50% and 100% configurations also exhibited high descent rates.
The accident aircraft was not fitted with a stall warning system, nor was one required or available. However, according to the C-130 pilots consulted during the investigation, the aircraft had a noticeable pre-stall buffet through the rudder pedals and control column, and this was reported as being distinct from a turbulence-induced buffet, which could be felt throughout the aircraft. In addition, the flight controls become less effective at these lower speeds, described by pilots as ‘sluggish’ and ‘unresponsive’. The Lockheed Martin AFM also indicated that:
With flight idle power, stall warning buffet initially occurs at 4% to 15% above stall speed, depending upon configuration, and progresses to moderate or heavy buffet at the stall. The greatest stall warning airspeed margin exists in the take-off and approach configuration and less margin exists in the landing and cruise configurations. The stall of the C-130 is characterized by either a mild pitch down or a mild roll-off to the right or left depending on slightly unequal power settings.
Stall recovery
The Lockheed Martin AFM described the recovery actions for a stall as:
If in climbing or bank attitude, immediately drop the nose, level the wings, and apply power to limit loss of altitude. Move controls smoothly and avoid abrupt actions. Avoid diving the airplane and avoid abrupt or accelerated pull-up after recovery.
While the ATSB did not find a published procedure in the operator’s AFM (refer to section titled Operating documents) for stall symptoms and recovery actions, their C-130 pilots all reported that approaches to stall (start of the buffet) training[39] was conducted in the aircraft on an annual basis in various configurations. According to the operator’s Company Operations Manual (COM),[40] training for approaches to the stall were conducted in the clean, take-off and landing configurations.[41] The recovery procedure referred to both low altitude (ground contact imminent) and higher altitude (ground contact irrelevant) scenarios.
The C-130 pilots’ descriptions of the symptoms and recovery actions were consistent with the manufacturer’s published material, with some additions specific to their operation. These included the addition of load jettison and flying the aircraft towards their pre-briefed escape route from the release point. Although their recovery descriptions for a pre-stall buffet, following a fire-retardant drop, was to apply maximum power by pushing the power levers full forward, this was not a procedure that could be practically trained in the aircraft. The engine power was managed manually, therefore, pushing the power levers full forward during training could result in an over‑torque or over‑temperature condition for the engines. However, they reported they would apply as much power as needed and as quickly as possible in a real low-level stall situation.
Aircraft performance
Stall speeds
The aircraft stall speeds were contained in the respective performance charts in the Lockheed Martin AFM. The ATSB calculated the power-on and power-off stall speeds for an aircraft weight of 131,000 lbs (59,420 kg), in level flight and with 50% flap at 83 kt (IAS)[42] and 101 kt (IAS) respectively. This configuration and attitude were considered most representative of the aircraft state just prior to the observed descent (refer to sections titled Weight and balance, Wreckage and impact information, and Recorded information sections), noting that a pitch-up attitude, any bank angle above 0° and a decreasing flap setting would increase the stall speed. It was a standard operating procedure for the crew to calculate the power-off stall speeds at the take-off weight for 0-flap, 50% flap and 100% flap, for 0° and 45° angle of bank for each flight. A 25,000 lb (11,340 kg) weight reduction from a jettison of the remaining fire retardant would have reduced the power‑on stall speed to 76 kt.
Turbulence will also affect an aircraft’s stall speed. According to the Bureau of Meteorology, moderate turbulence is associated with a load factor increase of 0.5 to 0.99 G[43] with appreciable changes in attitude and/or altitude, while severe turbulence is associated with a load factor increase of 1.0 G to 1.99 G with large abrupt changes in attitude and/or altitude. Turbulence was forecast (refer to section titled Bureau of Meteorology forecasts) and likely experienced (refer to section titled Bureau of Meteorology analysis) at the accident location. Applying the moderate turbulence load factors as boundary conditions to the 50% flap power-on stall speed at 59,420 kg produced a range of 101-117 kt (IAS). Similarly, for severe turbulence, this produced a power-on stall speed range of 117-143 kt (IAS) at 59,420 kg.
Regarding turbulence, the airspeeds limitation section of the operator’s AFM stated that:
The aircraft should not be operated in conditions of severe turbulence [actual conditions] because gusts can be encountered that may impose excessive loads. However, if flight in severe turbulence cannot be avoided, flight should be in the range of 65 knots above the power-off stall speed (not to exceed 180 KIAS) for the operating gross weight.[44]
Emergency climb performance
The aircraft’s emergency climb performance with maximum power at 131,000 lb (59,420 kg) and 50% flap was about 1,500 ft/min. With a reduced weight from a jettison of the remaining fire retardant, the emergency climb performance would have increased to about 2,250 ft/min, representing a 50% improvement. This was the absolute best rate of climb that could have been achieved.
Meteorological information
Bureau of Meteorology forecasts
A Bureau of Meteorology graphical area forecast was issued at 0924 and was valid for the time of the flight. It forecast moderate mountain wave activity[45] above 3,000 ft above mean sea level (AMSL) and severe turbulence below 8,000 ft AMSL in the area of operation from Richmond to Cooma. This included the Adaminaby and Good Good fire-grounds. In addition, a SIGMET[46] issued at 0947, and valid for the flight, forecast severe turbulence[47] below 10,000 ft AMSL for the area. Of note, when commenting on the general nature of forecasts, some of the operator’s pilots indicated that they could be broad and cover a large area of the state, which may not accurately reflect the actual conditions over the fire-ground. The only operational limitation cited at interview by the pilots were related to thunderstorm activity.
The aerodrome forecast for the Cooma-Snowy Mountains Airport,[48] located 50 km south-west of the accident site was amended at 0948. It indicated wind speeds of 25 kt, gusting to 48 kt, with a mean wind direction of 300° from 1100 and visibility reduced to 8,000 m in light showers. Severe turbulence below 5,000 ft AGL was forecast from 0900-1500. A PROB30[49] for visibility reduced to 2,000 m in blowing dust and a broken[50] layer of cloud at 1,000 ft AGL was forecast for the period 1100–1700.
At 1012, the Richmond airbase manager (ABM) sent a text message to the air tanker and birddog pilots to advise them of an airport warning at Richmond for wind gusts in excess of 35 kt between 1000 and 1700.
Observations of the weather in the area
Other fire-control aircraft
On the day of the accident, several fire-control aircraft, primarily consisting of fixed-wing Air Tractors (single-engine air tankers) and Bell 206 helicopters, were operating from the Polo Flat airstrip, located 33 km south-west of the accident site. The Cooma Fire Control Centre (FCC) aviation radio operator (ARO) received reports of strong winds in the area from the fire-control pilots in the early morning. This included winds of 30-40 kt at 0839, 40-50 kt at 0902, and 52 kt at 0937. The ARO recorded in their operations log that, due to the weather conditions, all fire‑control aircraft had departed the area or landed by 1030.
In addition, the crew of B137 reported that the wind conditions at Adaminaby at about 1200 were 50 kt at 800 ft AGL and about 37 kt at 200 ft AGL.
Witness reports
Following the accident, the ATSB received multiple witness reports of the weather conditions at Peak View. They all consistently reported very strong winds from the north-west, with gusts up to 43 kt recorded at ground level. One resident noted that, although the prevailing wind was from the north-west, the direction and strength at ground level were also being influenced by the local terrain.
Glider pilots familiar with the area commented that, due to the local terrain, the area was often subject to turbulence and rotor conditions (refer to section titled Mountain wave activity). It was also a well-known area for mountain wave activity and that on the day of the accident it was a ‘terrible wave day’.
Weather station recorded conditions
About 12 minutes prior to the accident, the Cooma-Snowy Mountains Airport weather station indicated a wind speed of 25 kt, gusting to 39 kt, from a direction of 320°. The visibility was 6,000 m, with a QNH[51] of 1002 hPa, and temperature of 26 °C.
A personal weather station at Peak View, located about 1.3 km from both the drop and accident sites (Figure 6), recorded the conditions twice per hour. At about 1309 (7 minutes prior to the accident), the station recorded a mean wind of 15 kt from the west and a peak gust of 32 kt from the north, a temperature of 30 °C, and a QNH of 995 hPa.[52] At about 1330 (14 minutes after the accident), the station recorded a mean wind of 16 kt from the west and a peak gust of 42 kt from the north-west.
Figure 6: Accident circuit with predominant wind direction, direction of travel (DOT), and terrain
Source: Google earth, Peak View weather station and SkyTrac data, annotated by the ATSB
Bureau of Meteorology analysis
The Bureau of Meteorology analysed the conditions on the day and indicated that a cold front was approaching the accident location, with hot and strong north to north-westerly winds ahead of the front. High resolution weather model data indicated the winds at 5,000 ft AMSL were about 45 kt from the north-west, increasing in strength with height up to 80 kt from the north-west at 10,000 ft AMSL.
Gusting winds had produced some areas of blowing dust, which likely reduced visibility. Bushfire smoke in the area had also affected visibility. While nearby observations at the Cooma-Snowy Mountains Airport showed intermittent reductions in visibility, it was noted that measuring equipment may not have accurately reported visibility in smoke conditions. Therefore, it was likely that the actual visibility was lower than that reported by the instruments.
The strong winds over the terrain likely resulted in severe turbulence and mountain wave development. Satellite imagery of cloud formations confirmed the presence of mountain wave activity during the day. The conditions in the area at the time were generally favourable for mountain wave development, however, the Bureau of Meteorology were unable to determine the severity of this from the data available.
The Bureau of Meteorology considered that the conditions at the Cooma-Snowy Mountains Airport were likely representative of the general conditions experienced at the accident location. Further, their analysis of the weather conditions in the area was consistent with what was forecast on the day.
Accessing meteorological information
For operations in NSW, following the briefing with the Richmond ABM each morning, the crews would return to their own operational areas until they received a tasking from the RFS. On receipt of a tasking, crews would conduct their flight planning. It was reported that the operator’s crews used an electronic flight bag (their company issued iPad including the Foreflight app) to submit their flight plan to Airservices Australia, which also provided access to the required weather forecasts. While specific weather data access could not be confirmed, as the flight plan had been submitted, it was considered very likely that the crew of B134 would have also accessed the relevant weather information at that time.
In addition, the operator outlined that conditions at a fire could change rapidly, and when the fire was an hour or more flight time away, reported weather conditions were likely to be inconsistent with the actual conditions on arrival.
Weather systems: Mountain waves and windshear
Mountain wave activity
Mountain waves[53] are the result of flowing air being forced to rise up the windward side of a mountain range, then as a result of certain atmospheric conditions, sinking down the leeward side (ATSB, 2009). Immediately downwind of the range there is a strong downdraft followed quickly by an updraft, which produces the wave motion. According to Underdown and Standen (2003), mountain waves can develop when the wind direction is near perpendicular to a continuous mountain range and at a speed of 15 kt or more[54] at the summit, and increasing with height in a stable atmosphere. Aircraft may encounter severe turbulence in mountain wave systems.
Rotors or eddies can also be found embedded in mountain waves. Their formation usually occurs where wind speeds change in a wave or where friction slows the wind near to the ground. Often these rotors will be experienced as wind gusts or windshear (ATSB, 2009). According to the FAA (1997), localised gusts of 50 kt, with downdrafts greater than 1,500 ft/min, are not unusual in mountain wave systems. Although this phenomenon is usually forecast reasonably well by the Bureau of Meteorology, many local factors may also affect the formation of mountain wave activity.
When discussing the consequence on aircraft performance, the ATSB’s safety publication Mountain wave turbulence noted that (ATSB, 2009):
Many dangers lie in the effects of mountain waves and associated turbulence on aircraft performance and control. In addition to generating turbulence that has demonstrated sufficient ferocity to significantly damage aircraft or lead to loss of aircraft control, the more prevailing danger to aircraft in the lower levels in Australia seems to be the effect on the climb rate of an aircraft.
Study of mountain waves associated with bushfires
According to the Bushfire and Natural Hazards Cooperative Research Centre,[55] one of the most challenging situations in fire management was when relatively benign weather conditions were expected, but a severe fire eventuated. In December 2016, the centre released Hazard note issue 24: Fire escalation by downslope winds. The note, authored by specialists from the Bureau of Meteorology, investigated the meteorology of unexpected severe fire behaviour associated with mountain wave activity and identified 3 relevant bushfires. A detailed case study of the New South Wales (NSW) Blue Mountains fires of October 2013 was undertaken, focussing on 17 October at 1300. Of interest was the behaviour of the winds in the vicinity of the State Mine fire.
Figure 7 shows a cross-section of the horizontal wind speeds (left image) and vertical wind speeds (right image) along a section passing from the north-west to the south-east through the State Mine fire‑ground. The red circled region in the left image shows strong horizontal winds extending downwards towards the surface in the vicinity of the fire. Downwind (to the right) of the fire are oscillations (left image) in the wind speeds and alternating bands of ascending and descending air (right image), both of which are characteristic features of mountain waves. The note described mountain waves as:
Mountain waves are oscillations that can occur when the wind blows across a mountain or hill. They are somewhat similar to water flowing over a rock in a stream, but are much more complex because their existence and amplitude is sensitive to the atmospheric temperature structure (stability) and vertical variation of the wind (wind shear). They often lead to strongly accelerated flow attached to the lee slope of the mountain or hill, known as downslope winds…
Figure 7: North-west to south-east cross section of fire, illustrating horizontal (left image) and vertical (right image) wind speed changes, with the fire located near the number 6 on the horizontal axis
Source: Bushfire and Natural Hazards Cooperative Research Centre
While the purpose of the note was to consider the wind effect on the severity of a fire, this has potential implications for firefighting aircraft, particularly if low-level windshear was present. As a comparison, at position 1 on the horizontal axis (left image), the wind speed band of 45–55 kt would not be encountered until reaching a height greater than 8,000 ft (2,450 m) above the surface. However, at the fire-ground at position 6, these wind speeds could be encountered within a few hundred feet above the surface. The note also highlighted that this research revealed features at the location of the fire-ground that might not have been captured or possibly filtered out of broader‑scale forecasts.
Windshear
Windshear is defined by the Bureau of Meteorology (2014) as a ‘wind direction and/or speed change over a vertical or horizontal distance’. It is always present in turbulent air but can also occur without turbulence being present. This phenomenon becomes particularly significant when an aircraft is abruptly displaced from its intended flight path and substantial corrective action is required by the pilot. This is more so at lower levels and low speed, such as during take-off and landing. The hazards are a rapidly changing headwind and tailwind, strong side gusts, and a change in lift on the wings, all during a time when an aircraft is most vulnerable (Minor, 2000). Specifically, the Bureau of Meteorology (2014) noted that:
During the climb-out and approach phases of flight, aircraft airspeed and height are near critical values, rendering the aircraft especially susceptible to the adverse effects of wind shear.
Aircraft taking-off may be significantly affected by changes in headwind and tailwind components which create changes in the amount of lift experienced. A decrease in the vertical headwind component, or an increase in the tailwind component, will result in a reduction in airspeed, and in extreme cases the resulting loss of lift may be enough to cause the aircraft to stall or fly into the ground.
Likewise, the adverse effects on aircraft performance from low-level windshear was also discussed by Bowles (1990), when analysing airborne forward-looking windshear detection systems:
The hazard of windshear arises principally from its deceptive nature: In a windshear situation, from a microburst[56] or any other source, the pilot may be confronted with a performance-increasing headwind, followed a few seconds later by a powerful, performance-decreasing tailwind. To cope with the headwind, the pilot may take actions to prevent the plane from climbing. These actions are then compounded by performance loss caused by the tailwind and downdraft, so that it may be impossible to avoid ground impact.
Depending on crew action, a typical low altitude windshear may result in reduced airspeed and rate‑of-climb, which often result in significant altitude loss and possible ground impact. Full performance capability depends on two key factors: timely recognition and appropriate response.
Windshear controls
Aviation specific windshear research
In 1985, the FAA contracted a consortium of aviation specialists to study windshear. As a result of that work, a windshear training aid was developed. The aid provided an effective means of training crews to minimise the windshear threat through avoidance, cockpit recognition, and recovery techniques. This included the 1988 publication Pilot windshear guide (FAA advisory circular 00‑54). This outlined the limitations in pilot avoidance, with a reliance on visual indications, which can be complicated by marginal weather, and reports from other aircraft in high density traffic areas.
According to the advisory circular, between 1964 and 1986, there were at least 32 air transport accidents and incidents in which windshear was identified as a contributing factor, resulting in over 600 fatalities. There was also evidence to suggest that this figure was underestimated as it did not include undocumented ‘close calls’ and general aviation statistics.
Generally, the research showed that only 5 to 15 seconds may be available for the crew to recognise and respond to a windshear encounter. In describing a typical encounter shortly after take-off, with windshear encountered prior to a stabilised climb (Figure 8), for the first 5 seconds the take-off appeared normal, with early trends in airspeed, pitch attitude, vertical speed and altitude appearing normal. However, as airspeed decreased, pitch attitude was reduced, limiting performance capability, and resulting in a loss of altitude.
Figure 8: Effect of a windshear encounter on the aircraft flight path during take-off
Source: US Federal Aviation Administration
The timeframe mentioned above was consistent with windshear research reported by Tsukagoshi (1999) conducted following a 1993 Douglas DC-9-41 hard landing accident in Japan following windshear during the landing approach (while crossing the runway threshold in Japan). Following the occurrence, the Japan Federation of Flight Crew Unions established a project to obtain objective and quantitative data on flight crews’ reactions to windshear. The research was supervised by Dr Sado Horino from Kanagawa University, Japan, and was conducted on a DC-9 flight simulator at Northwest Aerospace Training Corporation near Minneapolis, US.
Eight DC-9 pilots completed 35 test approaches to land on the simulator. Windshear was encountered at random heights, from 50 ft to 900 ft. Of particular note, the results demonstrated that the average recognition time for a windshear encounter was about 5.5 seconds. Recognition time was defined as the time between the windshear encounter and when the pilot first moved the elevator control.
Windshear risk control systems
Windshear avoidance, based on pilot awareness and training, cannot be 100% effective. There are also limitations in recognition and recovery procedures, as this requires the aircraft to have entered the windshear condition, which can potentially exceed the aircraft’s performance capability, regardless of pilot actions. Therefore, ground-based and airborne detection systems have also been introduced to reduce the hazard of an inadvertent windshear encounter (Bowles, 1990).
Ground-based low-level windshear alerting systems were developed and introduced at selected airports, predominantly in the US. However, there were 2 prominent windshear accidents in the 1980s (a Pan Am Boeing 727 on 9 July 1982; and a Delta Airlines Lockheed L-1011 on 2 August 1985), which prompted the FAA, in 1988, to mandate the use of airborne windshear detection systems for passenger aircraft.
The initial airborne windshear detection systems were reactive systems, which relied on the aircraft performance instruments, combined with attitude, angle of attack and accelerometer inputs. According to FAA advisory circular 25-12, Airworthiness Criteria for the Approval of Airborne Windshear Warning Systems in Transport Category Airplanes, even reactive systems ‘provide a valuable service in the detection, timely annunciation, and confirmation of a potentially hazardous windshear condition generally in advance of human pilot recognition time’. With the development of digital signal processors in the 1990s, weather radar with forward-looking (predictive) windshear detection became possible and the first system was certified by the FAA in 1994. The requirement was to provide at least 10 seconds advance warning to the crew of a microburst. These systems used doppler weather radar and the moisture in the atmosphere to collect wind velocity data. Therefore, drier air would reduce the reflectivity and windshear warning time.
An article published by Honeywell Aerospace (2019), Radar Corner: Understanding Airborne Windshear Detection Systems, Part One, emphasised that ‘It is the advanced warning time that saves the aircraft’. This time allowed the pilot to increase engine power, and retract the flaps and landing gear, thereby increasing the aircraft’s energy state and climbing, so that the windshear encounter would occur at a higher, ‘more survivable altitude’. The article further indicated that, during studies evaluating windshear recovery manoeuvres, it was found that when a windshear recovery manoeuvre was delayed by 5 seconds, the average altitude loss increased by 300 ft.
Another study on Wind-Shear System Cost-Benefit Analysis (Hallowell and Cho, 2010) reviewed the effectiveness of various detection systems, as the FAA considered the options for managing aging systems and evaluating new systems. The study also considered windshear mitigation strategies, which were categorised into 3 groups: pilot recognition and recovery training, airborne (aircraft systems), and ground‑based systems.[57] While noting the difficulties in determining the effectiveness of pilot training in recognition and avoidance, for comparative purposes, this was estimated to be effective about 25% of the time. Conversely, while only measured in simulated environments, the effectiveness of predictive windshear (airborne) systems had often exceeded 95%, although this may be reduced in dry environments.
Notably, Hallowell and Cho (2010) identified that each of these categories provided their own advantages, with the greatest benefit achieved when multiple categories were combined. It also noted that air taxi and aerial work operations, which included firefighting aircraft, operated at low‑level and low‑speed outside the ground-based protection areas more frequently than air transport. Further, airborne systems including both reactive and predictive windshear systems, were not routinely available on air taxi, aerial work or general aviation aircraft.
While there are limitations to reactive and predictive systems, where these systems were fitted to firefighting aircraft, and warnings had activated in the low-level environment, several pilots reported at interview this had a positive effect on their management of the situation. In addition, in 2018, Lockheed Martin developed a civil-certified firefighting air tanker, which was a variant of the C-130J. The LM‑100J ‘FireHerc’ had numerous advanced features that provided increased situational awareness and modern safety features to protect and guide crews through challenging flight conditions. Of most relevance to this investigation was the inclusion of warning systems with visual and aural alerts for windshear detection.
The accident aircraft was not fitted with a windshear detection system as it was built in 1981, prior to such technology becoming available. Likewise, the operator’s other C-130 aircraft did not have this system. Retrofitted systems suitable for the C-130 have since become available.[58] However, the operator advised that they had not considered installing these systems into their C-130 fleet. Further, it was not required by regulation or contract to be installed.
On 10 July 2022, in response to the draft report, Coulson Aviation advised that aerial firefighting operate in very dry environments conducive to active fires. Therefore, with minimal or nil moisture present in the atmosphere it could be concluded that a forward-looking windshear detection system would provide little to no advance warning of a windshear event. They further indicated that their crews were highly experienced in recognising windshear events and crew reaction times would be as timely, if not quicker than a reactive-based system. The operator further advised that this statement was based on ‘rational conclusion’ based on experience supported by informed opinion. The ATSB was unable identify any research that supported this comment.
Lockheed Martin Airplane Flight Manual
The Lockheed Martin AFM contained a section on adverse environmental conditions, which defined windshear as ‘any rapid change in wind direction or velocity that results in an airspeed change of more than 10 knots’. Severe windshear was defined as ‘a rapid change in wind direction or velocity causing airspeed changes greater than 15 knots, or vertical speed changes greater than 500 fpm [ft/min]’.
The AFM also warned pilots that severe windshear, particularly those with downdrafts, could exceed aircraft performance capability. It was considered to be most dangerous at low levels when encountering a decreasing headwind (or increasing tail wind) such as during take-off and approach. At these times, the aircraft is at low-level and low speed, and the initial reaction of the aircraft will be a drop in indicated airspeed and a decrease in pitch attitude, resulting in a loss of altitude.
By 2010, the Lockheed Martin AFM had introduced a recovery procedure for severe windshear encountered during approach to land as:
1. Announce a go around.
2.Set maximum power and select a go around (G/A) flight director mode, if applicable. Best initial pitch attitude will be a function of the conditions. If ground impact is a concern, rotate above the G/A flight director cue, as necessary, to target threshold speed until safe altitude above the ground is reached.
3.The co-pilot will monitor and call sink rate (VVI/VSI) and airspeed as appropriate.
4.The navigator/engineer will monitor and call out radar altimeter.
5.If flaps are at 100%, transition to 50% flaps after assuring continued positive rate of climb at no lower than Obstacle Clearance Speed.
6.Do not retract the landing gear until recovery is complete with positive climb rate and increasing terrain separation.
7.When clear of the wind shear, adjust pitch and power for normal climbout.
8. When conditions permit, report the encounter with ATC.
Coulson Aviation’s Airplane Flight Manual and Company Operations Manual
On 10 July 2022, in response to the draft report, Coulson Aviation stated that the precursors that generally defined windshear would be routinely encountered in normal aerial firefighting operations due to the hot, dry, and windy conditions that lead to most bushfires. Therefore, the procedures, experience, and training to deal with, and respond to these conditions were in-built for their aerial firefighting operations. However, the ATSB noted that there was no windshear recovery procedure published in the operator’s AFM, nor did it contain a section on adverse environmental conditions.
The manual did contain a warning associated with the go-around procedure, which was described by the operator’s pilots as similar to the post-retardant drop climb out:
Retracting flaps from 100 percent to 50 percent will increase stall speed. Without proper power and attitude corrections, sink rate will also increase. This is particularly noticeable at lower than normal airspeeds. If safe altitude and airspeed are not attained, inadvertent touchdown and/or stall may occur.[59]
The COM contained information on windshear in the departure procedures section, which stated:
…wind shear may create a severe hazard for aircraft below 1,000 ft…the best defence is to avoid downdrafts altogether as it could be beyond you or your aircraft’s capability… If wind shear is encountered, prompt action is required. In the EC-130Q/L382G, the recovery requires full power and pitch attitude consistent with the maximum angle of attack for the aircraft.
The majority of the crew interviewed provided accounts of personal experiences with either a real or simulated windshear event in the low-level airdrop environment. It was noted that in-aircraft training was conducted by the operator for emergency scenarios with a focus on jettisoning the retardant. These descriptions were consistent with the manufacturer’s procedures for windshear recovery, with additional consideration of jettisoning the load if aircraft performance did not improve after maximum power was applied.
Coulson Aviation windshear training
A review of the operator’s C-130 simulator training syllabus noted there was no specific training item for a low-level windshear recovery scenario. The syllabus only noted that a briefing on recovery from windshear was to be conducted.
The operator conducted yearly training that consisted of ground school, simulator training, and in-aircraft flight training. Included in the ground school training were ‘consider the load’ discussions, where if there was an emergency or performance concern, they could jettison the load to improve aircraft performance. Further, in-aircraft training was conducted where each PIC completed a ‘consider the load’ scenario, with a focus on jettisoning the retardant. Any applicable emergency or non-normal event could be used for this purpose, which at times included a simulated ‘down air’ (downdraft) scenario.
At interview, it was noted by at least one pilot that the air drop[60] scenario was quite different between the firefighting and military scenarios, and that standardisation for completing these operations occurred through the operator’s yearly training sessions.
On 10 July 2022, in response to the draft report, Coulson Aviation indicated that the response to a downdraft was consistent with the windshear escape manoeuvre for most large aircraft, with the added protection of being able to jettison the load to increase aircraft performance. In addition, the operator emphasised that the majority of their C-130 crews were current or former military pilots, where windshear recovery training was conducted on a bi‑annual basis. Therefore, the operator considered their pilots to be ‘extremely familiar’ with the procedure.
Wreckage and impact information
Accident site
The accident site was located on slightly sloping, partially wooded terrain, near Peak View, 50 km north-east of the Cooma-Snowy Mountains Airport. The wreckage trail (Figure 9) was approximately on a heading of 100°, with the initial impact at an elevation of about 3,440 ft AMSL. The debris trail began at the lower end of the slope, with the wreckage distributed linearly over about 180 m.
Figure 9: Accident site overview showing the wreckage trail
Source: ATSB
Wreckage examination
The ATSB’s on-site examination of the wreckage, damage to the surrounding vegetation, and ground markings, all indicated that the aircraft initially impacted a tree in a left wing down attitude of about 55°, before colliding with the ground. An intense post-impact fuel-fed fire destroyed the aircraft. The ATSB’s on-site examination also found (Figure 10):
no pre-existing airframe issues
all major sections of the aircraft’s structure were identified and there was no evidence of an in‑flight break-up or pre-impact structural damage[61]
the cockpit and associated avionics were identified about two-thirds of the way along the wreckage trail
the cockpit and forward section of the airframe had separated from the fuselage, was inverted, and had been destroyed in the impact and fire
sections of the wing skin, leading edge spar, wing tips and portions of the wings were identified along the wreckage trail, having fragmented during the impact sequence, and sustained further damage during the fire
all flight control surfaces were identified, however, flight control continuity could not be established due to the impact and fire
the vertical and horizontal stabilisers had remained attached to the aft section of the fuselage
the 4 engines and 16 propeller blades were located on-site and some of the propeller blades remained attached to the propeller hubs, while others had detached through impact forces
there were varying degrees of damage observed across the 4 engines, likely due to the impact sequence of each engine, with the damage indicating the engines were rotating at impact.
The RADS tank remained upright, with no fire retardant identified between the drop area and the initial impact location. However, a large amount of retardant was located in the wreckage near the tank. The system was badly damaged, with the doors fragmented throughout the wreckage, and its operational state could not be established.
Figure 10: Main aircraft wreckage components
Source: ATSB
Aircraft configuration
The aircraft was equipped with 4 trailing edge flaps. All flaps had separated from the aircraft during the impact sequence. On-site measurements of the flap screw jacks indicated the flaps were set at 50% at impact. This was consistent with the expected setting following a retardant drop. Due to the extent of damage, the elevator, aileron, and rudder trim settings could not be established.
Fuel testing
Fuel samples were retained from the 2 fuel tankers that last serviced the aircraft and from the refuelling storage tank at Richmond. The fuel samples were independently tested by a commercial fuel company for correct specifications, with nil abnormal indications found. In addition, there were no reports of fuel quality concerns with any other aircraft using the same fuel source.
Engine and propeller examinations
With the assistance of the Australian Army, the engines, partial remnants of the reduction gearboxes, and propeller assemblies and blades were transported to a secure hangar at Richmond Royal Australian Air Force (RAAF) Base for further examination. The engine manufacturer attended the inspections, where it was confirmed that all engines were rotating at impact, and there were no noted pre‑existing issues. As power changes were controlled by changes to the propeller blade pitch while maintaining a constant engine speed, the engine power levels were determined from the blade pitch angle at impact.
During the propeller hub assembly inspection, measurements of the internal components were recorded. The ATSB consulted the propeller manufacturer to determine the propeller blade angles at impact, and establish engine power levels. The propeller manufacturer concluded the following:
The calculations indicate that, based on the operating conditions estimated by the ATSB,[62] all the propellers were absorbing power from their respective engines and were producing positive thrust. The horsepower computed for each of the four engines are within the normal operating range for the T56 engine installed on this aircraft.
Recorded information
General information
The aircraft was not fitted with a flight data recorder, nor was it required to be by Australian or US regulations. However, there were devices on board that recorded information relevant to the flight path, as well as data that was transmitted in real time. Further, 2 firefighters located near the accident had videoed the aircraft. An analysis of these sources are presented below.
Witness video
Two firefighters were located on Feeney’s Road (800 m from the accident site), and both videoed the aircraft during the retardant drop. One video was taken in the landscape orientation and had a duration of 18 seconds. This video captured the drop and stopped as the aircraft was descending). The other video was taken in the portrait orientation and was 37 seconds in duration. It captured the aircraft descending into the drop zone and ended after the aircraft impacted with terrain. Collectively, the videos captured the aircraft from 10 seconds prior to the retardant drop, the drop, and the 5 seconds after the drop when the aircraft became obscured by smoke and was only intermittently visible (Figure 11). From the witness video, it was unclear if the aircraft flew behind the smoke, or entered the smoke. Seventeen seconds after the drop, the aircraft was seen at low-level, followed by the collision with terrain and post-impact fire.
The videos were analysed by the ATSB using commercial camera tracking software[63] to estimate the aircraft’s flight path and attitude. The RAAF Aircraft Research and Development Unit also analysed the video to evaluate the aircraft attitude. These analyses indicated that:
at 1315:15 (commencement of the drop), the aircraft was at a left bank angle of 10°, with a pitch of 0°
at 1315:17 (end of the drop), the aircraft was at a left bank of 17° and a pitch-up of 6°
at 1315:21, the aircraft reached its maximum left bank of 31°and maximum pitch-up of 12°
at 1315:22 and 1315:23, the aircraft was obscured by smoke and the attitude could not be determined
at 1315:25, the aircraft was at a left bank of 18° and a pitch-up of 8°
at 1315:26, the aircraft was at a left bank of 5° and a pitch-up of 6°
at 1315:27, the aircraft was at a right bank of 6° and pitch-up of 5°.
From 1315:27 the aircraft was obscured by smoke, and the attitude could not be determined using SynthEyes. The general attitude could be determined from basic photogrammetry at limited points from this time.
Figure 11: Aircraft attitude and approximate flight path at key times
Source: Google earth and SkyTrac data, annotated by the ATSB
For about 10 seconds after the completion of the drop, a positive rate of climb was achieved, with the aircraft climbing about 170 ft (to 3,770 ft AMSL) from the drop height. Following this, the aircraft was then observed descending. At 1315:34, the aircraft was seen at a very low height above the ground, in a slight left bank, immediately followed by a significant left roll just before ground impact. The elevation of the terrain, while undulating, also increased by about 40 ft from the drop site to the accident site.
The footage was also used to review aircraft control and configuration changes, such as flap positions and aileron movement. Shortly after the drop, the flap position was assessed as being 100%, consistent with the operator’s AFM supplement drop procedure. However, further assessments could not be made due to limitations with the video quality, visibility, and aircraft attitude. At various points in the video, both left and right aileron movement could be seen, but actual deflections could not be determined.
The videos also provided a general understanding of the low-level wind conditions at the time, with significant audible and visual movement of the surrounding trees and smoke, and blowing dust at ground level. It was also noted that there was no video evidence of any retardant being dropped between the initial drop location and the impact site.
Operational load monitoring system
Aerial firefighting contract requirements in the US required the aircraft be fitted with an operational load monitoring system (OLMS), predominantly for monitoring aircraft loading during operation. The OLMS was located behind the centre wing section in the fuselage and recorded data at a rate of 32 Hz (32 times per second). This recording device had no impact or fire protection, and was destroyed in the accident sequence.
Six months of historical data for B134 was made available to the ATSB, to allow for a comparison of the available accident flight data with previous flights. This review identified that the pitch and angle of bank data was not recorded correctly by the OLMS. Therefore, only the flap retraction timing and duration, and the vertical speed (rate of climb/descent) could be compared. While there was no comparable data available for flights with the entire accident crew, a review of the PIC’s recent flights and comparison with other crews indicated that the flap retraction was generally initiated between 2.5 and 5.5 seconds (with an average of 3 seconds) after the drop was completed. It also showed that the actual flap retraction from 100% to 50% flap took about 4-5 seconds and was completed, on average, about 7-8 seconds after the drop.
The rate of climb post‑drop varied between 500 ft/min and 2,400 ft/min, with the majority of the flights between 1,100‑1,500 ft/min. These variations were possibly related to weather patterns, terrain limitations, and the operational requirements, which were unique to each drop.
SkyTrac and automatic dependent surveillance broadcast (ADS-B) data
Aerial firefighting contracting requirements in Australia required the aircraft to be fitted with a tracking capability. The aircraft was fitted with SkyTrac, a system that could transmit the aircraft’s position in real-time, and was monitored by the NSW Rural Fire Service (RFS). The SkyTrac unit was recovered from the wreckage and transported to the ATSB’s technical facility for examination and download. The Canadian Transportation Safety Board assisted in the conversion of the downloaded data.[64] The SkyTrac unit recorded data at 5 second intervals.
Data broadcast by the automatic dependent surveillance broadcast (ADS-B) equipment fitted to the aircraft for air traffic control purposes was also obtained from various providers. This system determined the aircraft’s position using GPS and then broadcast this information, along with pressure altitude,[65] ground speed,[66] and other data, at regular intervals. ADS-B data was transmitted every 0.5 seconds, however, not all transmissions were available, with gaps of up to 5 seconds during the accident flight. Aside from the difference in recording intervals, the data provided for the common parameters across both sources was identical.[67] Table 2 shows the parameters recorded by SkyTrac and ADS-B.
Table 2: SkyTrac and ADS-B recorded parameters
SkyTrac
ADS-B
· time
· time
· latitude and longitude (position)
· latitude and longitude (position)
· ground speed
· ground speed
· track
· track
· GPS altitude (AMSL)
· pressure altitude
· vertical rate of climb/descent
Airspeed calculations
Using the ground speed from the SkyTrac and ADS-B data, and the weather observations from Peak View, the wind speeds of 15, 30 and 40 kt from the north-west were used to estimate the aircraft’s true airspeed.[68] These values were consistent with a review of the aircraft ground speed in the drop planning circuits. These circuits showed a periodic variation consistent with the aircraft flying into, and then with, the wind, and indicated that the wind speed was likely of a magnitude of 20-40 kt from a north‑westerly direction during their drop planning circuits.
The calculated true airspeed values were then converted to a computed calibrated airspeed (CAS)[69] using temperature and pressure data also from Peak View. The airspeed calibration charts in the operator’s C-130 AFM showed that there was a negligible difference between the CAS and indicated airspeed at the airspeed range being considered. Therefore, the CAS was equivalent to the indicated airspeed that would have been presented to the crew on the airspeed indicator.
The data showed a limited increase in the ground speed from 144 kt at the start of the drop, to 149 kt during the post-drop climb-out period, to a maximum of 151 kt just prior to the collision with terrain. However, the CAS (Figure 12) can be seen to be significantly lower, and with a much smaller increase during the climb. In the last 15 seconds of the available data, the calculated CAS was between 100 and 123 kt.
Vertical speed
From the SkyTrac data, a positive rate of climb was recorded for the 10 seconds following the drop, with the aircraft climbing to about 170 ft above the drop height, which was consistent with the witness video. The derived vertical speed,[70] while noting its limitations (as described above for the operational load monitoring system), increased from zero at the end of the drop to about 1,000 ft/min in the 8-10 seconds after the drop, then decreased to about 0 over the next 5 second period. At the last data point, the aircraft was descending at about 2,000 ft/min.
Aircraft track
From both SkyTrac and ADS-B data, the retardant drop was conducted on a track of about 190°. The aircraft was then turned through 160° as the climb rate peaked, with the last recorded track of 133°, about 3 seconds prior to impact.
The recorded ground speed, calculated CAS, track, derived vertical rate, and altitude for the last 30 seconds of flight is shown in Figure 12.
Figure 12: Recorded flight path data, derived airspeed, and rate of climb for the last 30 seconds of flight
Source: SkyTrac and Geoscience Australia digital elevation data, annotated by the ATSB
Low pressure spike
Prior to the drop, the ADS-B pressure altitude was, on average, about 250 ft above the SkyTrac GPS altitude (Figure 13), which was consistent with the QNH on the day. It was noted that there was a small increase in the ADS‑B pressure altitude immediately following the drop. This was consistent with the RADS tank doors closing on previous drops, but this returned to about a 250 ft difference with the GPS-based SkyTrac altitude.
However, at about 1315:24, the ADS-B pressure altitude and the vertical rate began to diverge significantly, with a low atmospheric pressure spike at about 1315:29. This was identified by an abrupt increase in both the pressure altitude[71] and barometric vertical speed. In comparison, the SkyTrac GPS-based derived vertical speed showed a smaller increase, which correlated with the SkyTrac altitude.
As there were several data points associated with this spike, this was considered more likely to be associated with a real event, rather than an erroneous reading. The abrupt rise and fall in these parameters suggested the aircraft encountered a region of low pressure, relative to the surrounding air, with a steep pressure altitude gradient during the climb‑out.
The reason for the localised pressure change could not be determined by the ATSB. Aircraft configuration changes (the RADS tank doors opening or closing, and flap changes) were excluded based on a review of the historical OLMS data. Several other potential factors were considered, including localised turbulence, wind gusts, terrain effects, temperature changes, and fire driven changes associated with smoke plumes. However, limitations in the available evidence prevented a determination.
Figure 13: Comparison of SkyTrac and ADS-B altitude and vertical rate data showing the low-pressure spike
Note: ADS-B pressure altitude shown as recorded references the international standard atmosphere QNH rather than actual QNH.
Source: ADS-B and SkyTrac, annotated by the ATSB
Cockpit voice recorder
The cockpit voice recorder (CVR) fitted to the aircraft was a solid-state memory Universal Avionics Model CVR-30B, part number 1603-02-03 (Figure 14). CVRs are designed on an endless loop principle, with the oldest audio continuously overwritten by the most recent audio. In this case, the CVR recorded crew and cockpit audio for a duration of at least 30 minutes. While the aircraft was not required to be fitted with a CVR under the US or Australian regulations, it was a contract requirement with the US Department of Agriculture, Forest Service (USFS).
Figure 14: N134CG cockpit voice recorder
Source: ATSB
The CVR was recovered from the aircraft and transported to the ATSB’s technical facility in Canberra on 25 January 2020 for examination and download. Thirty‑one minutes of audio data was successfully downloaded. However, the audio was from a previous flight when the aircraft was operating in the US. No audio from the accident flight was recorded on the CVR.
Inertia switch
The power supply to the CVR was fitted with an inertia switch. Inertia switches are designed to stop the recording function by removing power to the CVR when a pre-set deceleration force was detected. The recovered audio was of crew training flights undertaken on 7 May 2019 near Sacramento McClellan Airport, California. The audio included 4 landings conducted as part of that training. The recording ceased immediately after the fourth landing, and the post-landing taxi and engine shutdowns were not recorded. It was likely that the inertia switch was activated during this landing and consequently disconnected power to the CVR.
Pre-flight testing
Following installation in an aircraft, supplemental material related to the operation of the CVR must be attached to the approved AFM. The supplement for the accident aircraft indicated that the CVR conducted a self-test at power up, and the status of the system would be presented to the crew on the CVR control unit, located on the copilot side console. A CVR system check for crew was also included in the operator’s AFM supplement, but was not included in their pre-flight checklists. None of the operator’s C-130 flight crew interviewed were aware of the need to check this system status prior to flight.
CVR maintenance
A review of the aircraft’s maintenance logs indicated that the underwater locating beacon attached to the front of the CVR was replaced on 24 December 2019. This was a self-contained, replaceable unit, and a full maintenance service check was not required with this replacement. A maintenance check was conducted yearly, and had last been performed in February 2019.
Medical and pathological information
Pilot in command
The PIC held a first-class medical certificate that was issued on 5 September 2019 by the FAA, with a limitation to wear corrective lenses. The PIC’s aviation medical records were provided for the period 2013 to 2019. Overall, these examinations reported no significant medical conditions or abnormal physical findings. Of note, the PICs last electrocardiogram (ECG),[72] conducted as part of their annual medical examinations, showed indications of an inter-atrial conduction delay,[73] while previous ECGs noted sinus bradycardia.[74] Otherwise, the ECGs were considered normal and were ‘cleared’ by the FAA medical officer.
The PIC was reported to be fit and active, with no known medical conditions. On the morning of the accident flight, the PIC’s behaviour appeared normal and there was no evidence to indicate any concerns regarding their general health. While limited, the post‑mortem examination did not identify any pre‑existing medical conditions that could have contributed to the accident nor detect any commonly used drugs or alcohol. Due to limited blood samples, carbon monoxide testing could not be conducted.
Copilot
The copilot’s most recent first-class medical examination was issued on 17 July 2019 with no limitations. The copilot’s aviation medical records were provided for 2018 and 2019. The records reported no significant medical conditions or abnormal physical findings. The records noted that they were taking prescribed medication to lower blood cholesterol and reduce the risk of heart disease. The copilot’s last ECG noted several common anomalies,[75] but it was ‘cleared’ by the FAA medical officer.
The post-mortem examination identified narrowing and areas of calcification[76] in both the left anterior descending artery and right coronary artery of the heart. However, the muscle layer of the heart showed no identifiable scarring and there was no indication of an acute coronary artery occlusion (blockage). While no other evidence of significant natural disease was identified, the examination concluded that, the significance of the narrowing, in the absence of any evidence to indicate a blockage in the heart, was unclear. In addition, toxicology testing did not detect the presence of any alcohol, or common medications and illicit drugs. Carbon monoxide testing could not be conducted due to the lack of a suitable sample material.
Flight engineer
The flight engineer’s most recent second-class medical examination was issued on 27 August 2019 with no limitations. From their 2019 aviation medical records, there were no reported medical conditions or abnormal physical findings that could have affected aircraft operations. While limited, the post‑mortem examination did not identify any pre‑existing medical conditions that could have contributed to the accident. The toxicological analysis identified traces of a commonly used over-the-counter antihistamine. Carbon monoxide testing could not be conducted due to the lack of suitable sample material.
Aviation medical specialist
The ATSB engaged an aviation medical specialist to review the crew’s aviation medical records and post-mortem examinations. Noting the limited evidence that could be collected from the examinations due to the nature of the accident, the specialist concluded that:
As best as could be determined, there was no suggestion of in-flight incapacitation.
The copilot’s examination identified that 2 of the arteries in their heart showed evidence of narrowing and calcification, but there was no pathological evidence of acute coronary occlusion. The copilot had been taking prescribed medication to treat elevated cholesterol levels for several years. This medication was approved for use by flight crew in both the US and Australia. Further, the copilot’s blood pressure readings and last ECG tracing were all within normal limits.
The detection of the antihistamine and the reported concentration could not be used to determine with any certainty if the flight engineer was using the medication at the time of the accident or during non-flying periods. This was considered an ‘incidental’ finding.
While any exposure to carbon monoxide from the fires could not be determined in this case, limited research on a small cohort of ground fire-fighters many years earlier, determined that carboxyhaemoglobin[77] levels of around 6% were indicative of fire-ground exposures. This level, had it been present in the crew, was not likely to have caused in‑flight incapacitation.
Test and research
Reconstruction flight
On 24 January 2021, at about 1300, the operator reconstructed the flight path from the drop location to the accident site. The intention was to record the perspective and challenges of the terrain, while acknowledging the lack of bushfire smoke and environmental conditions. The flight was in a Cessna Citation 550 (business jet), with the Director of Flight Operations on board. They flew the path twice, firstly at 3,665 ft AMSL and then at 3,610 ft AMSL (noting the accident flight path was at about 3,600 ft AMSL). They noted that, as they turned toward the drop exit and were flying towards the accident site, they experienced an airspeed decay, even as engine power was increasing. While this was not considered ‘extreme’ on the day, it was ‘a bit surprising’. Further, they stated that the path flown by the crew of B134 from the drop to the accident site was into slightly rising terrain.
At the time of the flight, the METAR[78] for the Cooma-Snowy Mountains Airport recorded wind was 13 kt at 250°, with the direction varying between 200° and 290°. However, at 1143, a SPECI[79] recorded winds of 15 kt gusting to 29 kt at 260°, and the aerodrome forecast issued from 1200 indicated winds of 14 kt gusting to 25 kt at 270°.
C-130 simulator testing
Purpose
A series of tests were undertaken in a simulator representative of the accident aircraft, the RAAF C-130J-30 full flight mission simulator. The purpose of the testing was to determine if, and under what conditions, wind speeds representative of the strength and prevailing direction reported on the day of the accident could potentially affect aircraft performance. In particular, if the airspeed of the simulator could decay to the power‑on stall speed given the accident flight profile, of a climbing turn from 200 ft AGL. In addition, tests were also conducted to evaluate the effect following a weight reduction of 25,000 lbs (11,340 kg), from a jettison of the remaining fire retardant.
The testing was performed by RAAF Aircraft Research and Development Unit C-130 qualified test pilots (QTPs), supported by the simulator fidelity manager, under the direction of the ATSB. There were no recordings available of the accident crew’s actions. Therefore, the testing was limited to attempting to replicate the known flight path and aircraft attitude, with crew inputs (configuration and power setting changes) described as typical by the operator’s crew. The accident site and drop location were in the simulator database, which enabled a recreation of the accident flight profile from the start of the drop to be used for the tests. The intent was not to recreate the accident flight in full, or review the crew’s potential response to the situation, but focussed on the aircraft performance in the environmental conditions.
Aircraft differences
Access to a C-130H model simulator was limited, with none located in Australia and restrictions imposed by the COVID-19 pandemic. However, a C‑130J model simulator was offered to the ATSB. The C-130H (accident aircraft) and the C-130J were both listed on the same FAA Type Certificate. A discussion of the differences and limitations was held with the RAAF’s Aircraft Research and Development Unit chief of flight test, which considered the airframe, engines, aircraft controls, wings, aircraft systems and modelling limitations. The primary differences with respect to the aircraft were that the C-130J simulator had:
a longer airframe affecting some aircraft handling qualities
significant upgrades to the propulsion units
stall speeds likely to be slightly lower
aural and visual stall warnings, tactile stall warning (stick shaker) and stall avoidance (stick pusher) systems (not installed on the H model).
As control effectiveness was not being tested, the differences in aircraft handling qualities were of little impact to the proposed assessment. Similarly, an equivalent thrust level could be used to determine the necessary power settings, and limited to the available C-130H levels. To characterise the potential differences in stall speeds, a series of tests were completed, documented in the Results below. The stick shaker and stick pusher functions were both turned off during testing.
Simulator limitations
The ATSB also considered the limitations of the simulator, noting that they are designed for flight training, with the following being of most importance:
it had a pre-programmed stall characteristic of a 50° left wing drop
the stall was not considered to be well modelled
complex weather phenomena such as mountain waves and rotors could not be modelled
pre-programmed windshear models had a tailwind of 60 kt
wind gusts could be modelled, but the timing of the gusts could not be controlled.
As the test objectives were to characterise the flight profile with wind speeds that could reduce the airspeed to the stall speed, the pre‑programmed stall behaviour and modelling did not impose any limitations on the assessment. As the pre-programmed windshear model was in excess of the planned test conditions, the simulator fidelity manager developed a method to simulate windshear using the wind gradient tool. This resulted in the wind magnitude changing linearly, proportional to the altitude increase. This also required the test runs to commence in level flight at the drop height of 200 ft AGL, rather than from a descent profile to avoid a pre-drop windshear disrupting the climb-out test profile. A consequence of this methodology was that, on the occasions the simulator entered a pre-stall sink, it exited the windshear condition, which allowed it to recover airspeed and fly-away.
Test summary
The planned test criteria included constant winds of increasing strength, windshear of increasing strength, followed by the addition of turbulence[80] and gusts to each of these base conditions. Three thrust settings were calculated, based on the calculated true airspeeds (refer to section titled SkyTrac and automatic dependent surveillance broadcast (ADS-B) data) and propeller blade angles (refer to section titled Engine and propeller examinations) considered to provide reasonable boundary conditions.
Fourteen test profiles were developed, which included:
Three initial tests to establish the equivalent power settings, and comparison of the stall values against the C-130J and C130H flight manuals. It also included the development of the flight profile for the QTPs to practice using the pitch changes, bank angles and heading changes provided by the ATSB.
Eight profiles were planned for the QTPs to fly the accident profile under various wind conditions. These conditions included constant wind speed environments of varying strengths, windshear environments of varying strength, followed by the addition of turbulence and wind gust profiles.
Three profiles were developed to test the effect on the stall speed of a reduction of 25,000 lbs, simulating the emergency dump of the remaining fire retardant.
Multiple flight runs were then undertaken for each test profile by 2 QTPs.
Results
The RAAF simulator for the C-130J-30 demonstrated stall speeds comparable to those published for the C-130H at the approximate weight of the accident, 131,000 lb (59,420 kg), in the unaccelerated level flight condition. The power-off stall speeds were 98 kt (simulator) and 101 kt (C-130H), and power-on stall speeds were 82 kt (simulator) and 83 kt (C-130H).
The simulator provided useful insight into the potential for a significant loss of airspeed to occur when a combined maximum wind speed (mean wind plus gust) of 50 kt was used as the control variable. Although this was greater than the surface wind speed recorded at Peak View of 43 kt, it was consistent with the pilot reports from the smaller fire-control aircraft earlier on the day of the accident.
The key outcomes from the simulator testing were:
A constant strong (40 kt) north-westerly wind resulted in a small loss of airspeed during the climb-out, with minimum airspeeds of about 113 kt IAS, and a ground speed of about 160 kt. There were no aural stall warnings activated, the pilots reported no indications of any pre‑stall buffet or other warnings, and was a notably higher ground speeds than the accident flight.
A moderate (15 kt) north-westerly wind, combined with a 15 kt windshear, a 25 kt windshear and a 35 kt windshear during the climb-out resulted in an airspeed decay to between 98 kt and 104 kt, with intermittent aural stall warnings. The pilots also reported the controls were less responsive in the higher wind speed scenarios, indicative of approaching the stall.
A moderate (15 kt) north-westerly wind, with +10 kt gust and +25 kt windshear during climb‑out produced similar ground speeds to the accident flight. This consistently resulted in the airspeed decaying into the stall speed region between power-on (82 kt IAS) and power‑off (98 kt IAS) with repeated stall warnings. The minimum airspeed was in the range 84–98 kt IAS and the ground speed was in the range 141–151 kt.
When simulating an emergency dump of the remaining fire retardant, the rapid weight reduction, if made after the aural stall warning activation,[81] but prior to aerodynamic stall, reduced the stall speed. The simulator exited the stall warning/pre-buffet stall regime and improved the performance as expected.
Aerial firefighting in Australia
Overview
The National Aerial Firefighting Centre (NAFC) was formed by the Australian States and Territories in 2003 to provide a cooperative national arrangement for combating bushfires by facilitating the coordination and procurement of specialised firefighting aircraft.
The NAFC contracted aircraft on behalf of all the states and territories, with leasing arrangements allowing for aircraft to be moved around the country to address the prevailing bushfire risk. For each aircraft, a state or territory then assumed primary responsibility, and managed the operation and deployment of that aircraft.
As detailed in the National Aerial Firefighting Strategy 2021–26 (National Aerial Firefighting Centre, 2021), firefighters operate in an escalating risk environment frequently challenged by ‘changing fuel, vegetation and vulnerabilities’. At the same time, they strive to meet the community, government, and media expectations for protecting lives, properties, and the environment. This has resulted in:
…situations where aerial assets can provide effective support are increasing, and with them, community expectations. Meeting these expectations is a risk. Aerial firefighting has grown from ‘just another tool in the toolbox’ to a point where the community expect firefighting aircraft over every fire (especially ‘their’ fire).
Consequently, aerial firefighting has become a critical capability for the management and suppression of bushfires in Australia. To effectively achieve this, aircraft are flown at low altitudes and low airspeeds, often over inhospitable terrain with reduced visibility from smoke. This creates a high-risk environment, which ‘requires an enduring focus on training, compliance, and risk mitigation’ (National Aerial Firefighting Centre, 2021).
Operating environment and limitations
In 2020, although born out of the 2019-2020 bushfires, an inquiry into Australia’s national natural disaster coordination arrangements was conducted. The final report, Royal Commission into National Natural Disaster Arrangements, was published in October 2020. The report noted that the effectiveness of aerial firefighting was dependent on a number of factors including the distance and time to travel to the fire-ground, the type of aircraft used, pilot skill, weather conditions, fire‑fuel type, intensity and size of the fire, type of suppressant use, and the tactics employed to respond to the fire. Specifically, the report identified the following limitations:
Aircraft alone are not a solution to fighting bushfires. Interaction between aircraft and fire crews is necessary to bring a fire fully under control…
…poor weather conditions can limit and sometimes prevent the use of aircraft. For example, requirements for pilots to maintain visibility of terrain can limit the use of aircraft in severe conditions (eg low visibility in heavy smoke or cloud); and turbulence caused by strong winds and the terrain can make operating aircraft unsafe, especially at low altitude.
Poor weather conditions can also restrict the effectiveness and use of aerial firefighting. For example, during the 2019 SA [South Australian] Cudlee Creek and Kangaroo Island fires, weather conditions prevented all attempts by aircraft, including LATs, from containing the forward spread of the fires. Furthermore, extreme weather conditions experienced periodically throughout the 2019-2020 bushfire season meant there were a number of days when aerial firefighting could not be employed.
Activity
According to research conducted by the ATSB (2020), A safety analysis of aerial firefighting occurrences in Australia, the number of occurrences per financial year increased steadily between 2016–17 and the bushfire season 2019-20. However, data collected by the NAFC and presented in the Australian and New Zealand National Council for fire and emergency services’ (AFAC) 2019-20 annual report, estimated that aerial firefighting activity for the 2019-20 season was around 4 times higher than previous seasons. Given the increased activity, the rising trend in the number of occurrences could be expected and probably did not indicate a significant increase in the risk per flight.
In addition, the ATSB research report identified that half of all reported aerial firefighting occurrences and four fifths of more severe aerial firefighting occurrences were operational in nature, typically terrain collisions, with around one quarter of the more severe occurrences associated with aircraft control. Further, there were 2 fatal accidents between August 2018 and the report publication in May 2020, whereas the previous 17 years only had 3 fatal accidents.
While there have been various deployments and trials of larger aircraft over many years, the current LAT program including the use of C-130 aircraft was evaluated during the 2014-2015 bushfire season. Since commencing operations in Australia in 2015, these LATs have been operating between North America and Australia over alternate bushfire seasons.
On 1 June 2022, in response to the draft report, the RFS reported that the 2019-2020 bush fire season was unprecedented, which meant that a large contingent of aerial resources was required for firefighting, personnel and resource movement, and for surveillance and reconnaissance missions. The RFS acknowledged that aircraft were particularly valuable for fires in difficult terrain or fast-moving fires that were too dangerous for ground personnel to confront.
Over the season, there were 317 aircraft engaged in firefighting activities including 2 very large air tankers (VLATs)[82] and 4 LATs. Together, the LATs and VLATs completed a total of 1,708 missions and dropped more than 24 million litres of fire suppressant. This represented the largest contingent of VLAT and LAT used in Australia to date.
The RFS further noted:
The season also challenged assumptions about how agencies fight fires - techniques and strategies that worked in previous seasons often did not work as well in the 2019-20 season. The scale of the fires stretched the capacity of fire authorities with many ignitions started by lightning in remote and rugged terrain, quickly spreading to the point where suppression was extremely difficult.
For the 2019-2020 season, the RFS contracted one C-130 and one Boeing 737 from Coulson Aviation via a service agreement subject to the NAFC contract.
Coulson Aviation
General information
Coulson Aircrane Ltd. was a privately-owned company based in British Columbia, Canada. The company had been involved in aviation for over 36 years, operating both fixed-wing and rotary‑wing aircraft. The company's operations included helicopter logging, forest fire suppression, power-line construction, airliner passenger, transport, and other industrial heavy lift operations. Coulson Aviation (USA) Inc. was a subsidiary of Coulson Aircrane Ltd., and contracted rotary and fixed-wing aircraft to the US and Australia.
Coulson Aviation (Australia) PTY Ltd. was formed in 2010 to support Coulson Aircrane's long-term commitment in Australia. The company provided aircraft personnel for Coulson’s rotary and fixed‑wing aircraft operating under contract in Australia for the 2019-2020 bushfire season through the National Aerial Firefighting Centre (NAFC). At the time of the accident, they had a fixed‑wing fleet in Australia consisting of two C-130 aircraft and one Boeing 737 aircraft. They also provided crews for the NSW Rural Fire Service (RFS) Boeing 737, which had previously been purchased from Coulson Aviation in 2019. Following the Australian bushfire season, the aircraft and crews returned to North America for heavy maintenance and recurrent training prior to the US season.
B134 was contracted on an absolute availability requirement. This included standing charges, paid on an hourly availability, with additional charges for flight time (to account for fuel and other costs). Flight time charges were paid regardless of the fire retardant or suppressant being used.
Operating documents
Coulson Aviation maintained a suite of documents, which provided the necessary information for conducting operations in Australia and for operating the C-130 aircraft including N134CG. These were:
Company operations manual (COM): The COM contained the procedures, instructions and information required by CASA necessary to enable the operations personnel, including crews, to perform their duties safely and ensure the safe conduct of flight operations. The COM was for Australian operations only and applied to both fixed-wing and rotary-wing aircraft.
Airplane flight manual (AFM): Coulson Aviation, as the type certificate holder, developed their own C-130 AFM for FAA acceptance and approval. The manual was derived from the 1989 US Naval Air System Command document for the EC‑130Q. It detailed the recommended procedures for normal and emergency operations, operating limitations, aircraft systems and equipment, weight and balance, and the aircraft performance that should be achieved when operating in accordance with these procedures. The AFM was approved by the FAA in 2013 with a supplement for the RADS later approved in 2016, and a supplement for an avionics upgrade, which included the CVR installation, approved in 2018.
The FAA advised the ATSB that, for restricted category/military surplus aircraft, the original equipment manufacturer (in this case, Lockheed Martin) did not usually provide any support to the operator, or issue amendments or offer a subscription service, as would normally occur for transport category aircraft. Rather, the source for documents and manuals was normally the military service, although Lockheed Martin may have originally prepared the manuals for the military.
While the COM contained some procedures applicable to all aircraft operations, at least one of the operator’s C-130 PICs did not consider this manual as the reference document for operating the aircraft. Instead, they considered the AFM and checklists were the appropriate source.
Retardant drop procedures
The operator’s RADS AFM supplement outlined the operating limitations and configuration for the retardant drop procedure. This included 100% flap selection, the landing gear retracted, and airspeed lower and upper limits of 118 kt and 170 kt respectively.
At interview, the operator’s pilots reported the targeted parameters for the C-130 drop were 200 ft above ground level (AGL) and an indicated airspeed target of 120 kt. On completion of the drop, the climb-out procedure was for the PIC to increase power and request the copilot retract the flaps to the 50% position, while the flight engineer monitored and called the engine parameters (temperature and torque). The operator’s crews also reported that they typically targeted 150 kt during the climb-out, with an initial climb to at least 500 ft. The crews who had previously flown with the accident PIC, indicated there was about a 2-3 second period from the completion of the drop to the start of the flap retraction when flying with the PIC.
Where the retardant drop was conducted without a birddog or aerial supervision (refer to section title Aerial supervision), prior to conducting the drop, the LAT crew conduct a number of assessment circuits at various altitudes. These circuits were for drop planning purposes, and as outlined in the COM, would include identifying hazards, the retardant drop plan, entry and exit strategies, as well as a dry run at 500 ft AGL and 150 kt.
Safety management system
Coulson Aviation had introduced a safety management system (SMS) in 2013. At the time of the accident, it was not mandated under either the CASA[83] or FAA regulations, although it was required under the USFS contract. The International Civil Aviation Organization (ICAO, 2018) defined SMS as:
A systematic approach to managing safety, including the necessary organizational structures, accountability, responsibilities, policies and procedures.
It is designed to continuously improve safety performance through the identification of hazards, the collection and analysis of safety data and safety information, and the continuous assessment of safety risks. The SMS seeks to proactively mitigate safety risks before they result in aviation accidents and incidents.
An SMS comprised 4 components: safety policy and objectives, safety risk management, safety assurance, and safety promotion. The component of most relevance to this investigation was safety risk management, which included hazard identification, and safety risk assessment and mitigation.
From an Australian perspective, the NAFC indicated that an operator with an SMS would be highly regarded, but it was not compulsory. If an operator had an SMS, a requirement was included in their contract, to ensure the operator maintained the same safety standard throughout the contract period. The NAFC also indicated that they would not review or evaluate the SMS, with the expectation, if required for safety regulation purposes, that this would be undertaken by CASA. A review of CASA records found that, while surveillance had been conducted on the operator, these did not include an audit of the SMS, nor was it required as the system was not mandated.
The operator’s SMS manual outlined the company’s safety policy, processes, and procedures for implementing the SMS and safety management plan. It also included information regarding safety oversight, which included their safety reporting processes.
Safety risk management process
ICAO (2018) described the safety risk management process as:
… a key component of safety management and includes hazard identification, safety risk assessment, safety risk mitigation and risk acceptance. SRM [safety risk management] is a continuous activity because the aviation system is constantly changing, new hazards can be introduced, and some hazards and associated safety risks may change over time. In addition, the effectiveness of implemented safety risk mitigation strategies must be monitored to determine if further action is required.
The process allows validation of decisions, evaluation of the results, and provides an opportunity to assess the need for further risk mitigation. Where risks cannot be reasonably eliminated, risk management enables the tasking to be accomplished by controlling risks to acceptable levels.
The operator’s safety and risk management processes were detailed in the COM and were described as:
…safety management processes provide a structure for Coulson to exercise its appropriate duty of care to minimise the risks involved.
…provide a formal mechanism that are designed to capture all aspects of safety performance, conformance with approved procedures, continued improvement of procedures, regulatory compliance and operational risks that have the potential to adversely affect the operation.
Risk management is a structured approach to managing uncertainty related to a threat or hazard through a sequence of activities including risk assessments, strategies developed to manage the threat and mitigation of risk...
Hazard identification
According to ICAO (2018), a hazard can be considered as a dormant potential for harm, which is present in one form or another within the system or its environment. Therefore, hazard identification is the first step in the safety risk management process. The intention is to proactively identify hazards before they lead to accidents, incidents, or other safety‑related occurrences. Hazard identification may also consider hazards that are generated outside of the organisation and outside their direct control, such as weather (ICAO, 2018).
The COM stated that ‘Coulson acknowledges that a certain element of risk exists in all aspects of its business’ and that ‘the implementation of a comprehensive safety system can greatly assist in reducing risk’. As part of their fatigue risk management system, the COM outlined the potential hazards crews may encounter in all types of operations (Table 3).
Table 3: Some hazards identified in the Company Operations Manual
· Unfamiliarity or low experience with the type of operation
· Operations at low altitude
· Lack of experience in operating under specific operational conditions
· Operations in reduced visibility
· Lack of familiarity with, or low experience on, specific aircraft equipment
· Operations at high density altitude
· Operations in high wind or turbulent conditions, particularly if accompanied by high ambient temperatures
· Operations at high ambient temperatures
· Operations in areas of mountainous or hilly terrain
· Contact of flight crew with high-demand clients
In addition to the hazards identified above, the ATSB’s review of the COM found numerous references to other hazards. The fire-bombing procedures made references to factors such as prevailing winds (particularly with mountain flying), turbulence and downdrafts associated with either mountain or fire generated conditions, and visibility. Further, the training and checking, and standard operating procedures sections for fixed-wing aircraft also referred to windshear.
Hazards are detectable through many sources including reporting systems, inspections, audits, brainstorming sessions, and expert judgement. These sources are categorised as being either formal or informal methods and can be used to detect hazards at all levels of an organisation. The operator’s SMS used both informal and formal methods for hazard identification. This included a safety reporting system where all employees were encouraged to report issues, hazards and incidents that affected flight or ground safety. Further, the operator had a daily SMS conference call at the start of the day, which discussed the previous days operations, and the operations to be conducted that day. Present on the call were senior management, the safety manager, and the crew. They would discuss the current status of the crew and aircraft, any reported issues, and would often end with a relevant safety message or topical discussion. On 10 July 2022, in response to the draft report, the operator reported that this process allowed the group to tactically manage the risks in a dynamic environment providing an opportunity to discuss actual or emerging hazards and risks in an open and supportive environment.
Safety reporting system and daily SMS calls
The operator’s safety reports for the period 2019 and 2020[84] were provided to the ATSB. A review of these 32 reports found that around 60% were related to maintenance issues, while only 9% were operationally focused. These operational events included aircraft separation issues and retardant overload events. While previous years’ data was unavailable, the operator had conducted yearly SMS reviews, and these summaries were provided for the earlier period. Although the individual reports were not available, based on these summaries, it was likely the previous years’ safety reports followed a similar reporting pattern, with a majority being maintenance related.
During the investigation, several of the operator’s crew provided the ATSB with accounts of previous windshear encounters they had experienced:
In the previous firefighting season, while conducting structure protection, they encountered a windshear event, which resulted in an uncommanded bank angle of 80°. The crew recovered the situation by flying the planned exit into an area of lower terrain (valley).
In the season of the accident, while climbing out after completing a drop, the airspeed fluctuated ‘quite a bit’ (10 kt) and the aircraft sank slightly, while being ‘tossed around’. This was while working with the birddog. After this encounter, the decision was made not to return to the drop area.
On the day of the accident, the crew of B137 received a windshear warning and uncommanded bank angles up to 45° in the Adaminaby area.[85]
These encounters were not recorded in the operator’s safety reporting system, nor were any other weather-related incidents found in the reports provided to the ATSB. Neither the former[86] nor current safety manager recalled any such reports in the system. At interview, one pilot reported that the online SMS program was used for issues that were considered applicable across the company. Issues that could be resolved within the small group of fixed-wing pilots, or could be taken directly to the chief pilot, noting they spoke on a daily basis, would not necessarily be included in the system.
In addition, the ATSB reviewed the daily SMS call notes from 2018 to 2020. While limited in detail, the topics most frequently discussed were maintenance issues. In the days preceding the accident, the hot and severe weather conditions were noted. These were the only occasions where the weather conditions were noted in the calls. In response to the draft report, the operator advised that they considered the incident reporting numbers discussed above were mitigated by the daily SMS calls’ impact on flight risk awareness.
Risk assessment
A risk assessment is a process where sources of potential harm (hazards) and the chances of an adverse event happening due to the hazard were identified, analysed, and evaluated (CASA, 2021). This evaluation was expressed in terms of likelihood and consequence, and should highlight the risks to be considered before and while carrying out an operation.
Organisations should have multiple layers of controls or defences in place (CASA, 2014) to manage their identified hazards. Risk assessments should be carried out across all levels of an organisation and at different stages in the operation. These could consist of a formal, documented process or a continuous ongoing mental assessment carried out by a pilot, or a combination of both. Examples of a formal risk assessment may include an operational risk assessment conducted by the operator to consider and evaluate the risks associated with the type of work being undertaken, and pre-flight risk assessments, conducted by the PIC and associated with a specific tasking. An example of continuous processes could include in-flight tactical[87] risk assessments.[88]
The operator’s SMS manual stated that, if a risk assessment was required, the SMS manager would conduct and document the process by completing the risk management worksheet. The associated risk matrix categorised the risk as either acceptable, mitigable or unacceptable, although there was no guidance on how to categorise the risk. These risk assessments only applied to the safety reports and change management processes that were captured in the operator’s online SMS program. At interview, both the former and current safety managers indicated there was no formal risk assessments conducted on the identified operational hazards, such as those listed in the COM.
Prior to the accident, the operator had voluntarily initiated the International Standard for Business Aircraft Operations audit phase II,[89] which was conducted between December 2019 and March 2020. This audit identified significant growth since the stage 1 audit completed in 2017, and that the SMS had not fully matured to be as effective as it could be. Of note, it identified that the operator could not provide a process for assessing risk potential in terms of likelihood and severity.
After the safety risks have been assessed, the appropriate risk controls can be implemented. ICAO (2018) noted that:
It is important to involve the “end users” and subject matter experts in determining appropriate safety risk controls. Ensuring the right people are involved will maximize the practicality of safety risk chosen mitigations. A determination of any unintended consequences, particularly the introduction of new hazards, should be made prior to the implementation of any safety risk controls.
In response to the draft report, Coulson Aviation stated that aerial firefighting was conducted within an ‘unforgiving, dynamic, and complex operational and meteorological environment’. Consequently, they considered aerial firefighting lends itself to a more tactical approach to risk identification and mitigation.
Risk register
Safety risk management activities should be documented, including any assumptions underlying the probability and severity assessment, decisions made, and risk controls implemented (ICAO, 2018). A tool such as a risk register could be used to ensure identified hazards were tracked and mitigated as part of a formal risk management process of prioritisation, documentation, and assessment. The register could include the hazard, potential consequences, assessment of the associated risks, and any controls put in place to manage the risk. This not only allowed for ongoing tracking and monitoring of the identified hazards, but also (ICAO, 2018):
…becomes a historical source of organizational safety knowledge which can be used as reference when making safety decisions and for safety information exchange. This safety knowledge provides material for safety trend analyses and safety training and communication. It is also useful for internal audits to assess whether safety risk controls and actions have been implemented and are effective.
At the time of the accident, the operator did not maintain a risk register, or any alternate means to track the identified hazards and associated controls, as part of their SMS.
Assessing pre-flight risk
Flight risk assessment tool
Aerial firefighting activities, like other aerial work operations, are subject to elevated risks. A 2014 National Transportation Safety Board study of agricultural (aerial work) accidents in the US found the following:
…the mission priorities…present pilots with unique hazards, challenges and constraints, some of which cannot be completely eliminated. For example, pilots must manoeuvre their aircraft at very low altitude over terrain and must therefore accept an elevated risk of terrain and obstacle collisions, as well as having limited time to safely respond to an aircraft mechanical anomaly or recover from an inadvertent aerodynamic stall.
Risk management is a decision-making process by which pilots can systematically identify hazards, assess the degree of risk, and determine the best course of action. Effective risk management involves good decision-making that allows a pilot to identify personal attitudes that are hazardous to safe flying, apply behavioural modification techniques, recognize and cope with stress, and effectively use all resources. Risk management strategies can help pilots apply a systematic process that can help them resist pressures that can adversely affect their decision-making and performance and can help them mitigate other hazards that could adversely affect the safety of flight.
The study also concluded that risk management guidelines and best practices specific to agricultural aircraft operations were necessary tools to help operators and pilots mitigate the unique risks associated with their operations. In addition to the safety risk management processes discussed above, another such tool was a flight risk assessment tool (FRAT). In 2016, the FAA Safety Team released their FRAT with the introduction:
When implementing a Safety Management System (SMS), one of the most critical components to develop is a Flight Risk Assessment Tool (FRAT). Because every flight has some level of risk, it is critical that pilots are able to differentiate, in advance, between a low-risk flight and a high risk flight, and then establish a review process and develop risk mitigation strategies. A FRAT enables proactive hazard identification, is easy to use, and can visually depict risk. It is an invaluable tool in helping pilots make better go/no-go decisions and should be a part of every flight.
Every flight has hazards and some level of risk associated with it. It is critical that management and pilots are able to differentiate, in advance, between a low-risk flight and a high-risk flight using a risk assessment tool that allows pilots, managers and dispatchers to see the risk profile of a flight in its planning stages. When the risk for a flight exceeds the defined acceptable level, the flight will be further evaluated and risk decisions made by appropriate leadership.
The USFS (Forest Service Manual: Aviation Management Handbook) also recognised that risk management was a critical component of their SMS, and the identification of new hazards, determination of risk levels and effectiveness of mitigations ‘must be collaborated’ from the local level to aviation staff in their headquarters. Noting this, they discussed the different types of risk assessments, which included a ‘time critical risk assessment’:
Time critical risk assessment is the tool that pilots and managers use to assess actual risks specific to the day of flight. The product representing a time critical risk assessment is a Flight Risk Assessment Tool (FRAT)… While completing a FRAT, if an emerging hazard or higher than expected risk level is identified, the Aviation Manager (for example a helicopter manager, flight manager, project aviation manager, pilot in command), must follow up with the appropriate management level before a mission commences.
A FRAT was an efficient and structured process that allowed for a consistent and objective evaluation of flight risks, and could be adapted to manage the unique risks present for a specific operation or tasking. The tool established the risk profile for an individual flight and prompted the pilot or operator to take appropriate mitigation actions. It also allowed for better visibility by the operator, as to crew decisions made in accepting or rejecting tasks. However, it should be noted that a FRAT cannot anticipate all the hazards and corresponding risks that may emerge during a flight.
The FRAT could incorporate factors relating to the crew, such as operational experience and fatigue; environmental conditions, both at the airport and en route; aircraft factors, such as equipment serviceability; and any external pressures or factors, such as task rejection by another pilot or operator. Each of these factors was then assigned a numerical risk value and a total risk score was calculated. Based on this score, the risk profile was determined using predefined criteria for acceptable levels of risk, elevated levels of risk that required mitigation such as escalation to a more senior pilot, or task rejection.
The operator’s COM acknowledged the risks associated with their operations, stating ‘the combination of terrain, weather, fire occurrence patterns, and visibility can make firebombing extremely challenging’. The COM also required their rotary-wing pilots conducting firefighting activities using night vision goggles to complete a pre-flight risk assessment. However, the operator relied on the LAT crews to conduct their normal pre-flight planning and make their own assessment of the suitability of a tasking, without the need for a formal pre‑flight risk assessment. The former safety manager also confirmed that, while the LAT operation was considered high risk, there was no FRAT available for the crews.
Accident flight estimated risk profile
Following the change in safety managers in 2020, the operator introduced a FRAT into their LAT operations, with the criteria for an acceptable level of risk (score <30), a level of risk that required mitigation or escalation (30–39), and a ‘no-go’ level of risk (40+). Using this tool, the ATSB calculated a score within the range that required mitigation or escalation for the accident flight. However, the ATSB noted that the FRAT did not consider factors such as a weather‑related task rejection by another pilot, in this case, by the birddog pilot. Task rejection was a potential risk indicator for a FRAT, as explained in the US FAA advisory circular 135-14B for helicopter air ambulance operators:
Declined HAA [helicopter air ambulance] Flight Requests. The operator must establish a procedure for determining whether another HAA operator has declined the flight request under consideration and if so, for what reason (weather, maintenance, etc.). If applicable, the reason for the declined flight must be factored into the required risk assessment process, i.e., do not include a declined flight due to a maintenance issue or pilot not available. This could be as simple as asking the requestor whether or not this specific flight request has previously been made and declined and why.
Similarly, the Helicopter Association International’s FRAT tool included the risk factor of ‘Flight Turned Down By Other Operators Due to Weather’, which had the highest risk score of all the example factors.
Civil Aviation Safety Authority
When operating in Australia, Coulson Aviation aircraft were operated under a short-term air operator certificate authorisation issued by CASA, involving the use of foreign aircraft under relevant legislation and national aviation authorities. The certificate permitted aerial work including aerial spotting (fire and flood), dropping (water and fire retardant), and other activities such as search and rescue and surveillance.
As part of this process, CASA required Coulson to have a Company Operations Manual (COM) for Australian operations. CASA required Coulson Aviation to comply with their COM, which included reference to the FAA approved AFM. In these circumstances, CASA relies on the FAA approval process, and has no role in reviewing the AFM.
CASA had conducted 5 surveillance events in the past 5 years across 3 different short-term AOCs for this operator. All events were level 2[90] operational checks and no safety findings were raised. No CASA surveillance events were performed on Coulson during the 2019-2020 firefighting season. The short-term AOCs were not included in CASA’s national surveillance selection process, and therefore no level 1[91] surveillance activities were conducted.
New South Wales Rural Fire Service
General
The NSW Rural Fire Service (RFS) was the lead combat agency for bushfires in NSW. They worked closely with other agencies to respond to a range of emergencies including bush and grass fires, bushfire mitigation, structure fires, search and rescue, motor vehicle accidents, and storms that occurred within rural fire districts. The RFS was primarily made up of volunteers, with paid staff members managing day-to-day operations, Fire Control Centres (FCCs), and operational support, among other roles. There were many roles involved in the RFS emergency management response; for simplicity, only those roles applicable on the day of the accident are discussed below.
The multiagency state-wide response to large bushfire emergencies were overseen and coordinated by the State Operations Centre, located at NSW RFS Headquarters in Sydney Olympic Park (Sydney). The State Operations Centre provided a variety of specialised resources to the FCCs, including but not limited to, aviation resources. The state operations controller (SOC), located in the State Operations Centre, maintained an overall awareness of the firefighting effort across the state, and ensured resources were allocated as needed. The State Operations Centre also contained the state air desk (SAD), which was the state level multiagency team responsible for coordination of aircraft operations.
FCCs were the administrative and operational base of each rural fire district or zone. The coordination and management of local brigade responses to fires and other incidents was undertaken through the incident management team, led by the incident controller. For each emergency response, an incident controller was responsible for that response, including the objectives, operations, and application of resources. Where necessary, an aviation unit was established to manage and support deployment of aviation resources within the rural district, including an aviation radio operator (ARO).
The LATs were based at an airbase overseen by an airbase manager (ABM). The ABM was responsible for the supervision and coordination of airbase personnel and the layout and operation of the airbase. They operated as a liaison for the RFS SAD, and could be from another organisation.
Aircraft management procedures
The RFS maintained a suite of documents, which detailed the procedures for managing aerial firefighting. The 2 primary documents for air tanker operations were the NSW and ACT Aviation Standard Operating Procedures (operating procedures), which outlined the basic procedure of all air tanker operations, and the Operating guidelines for air tanker operations (operating guidelines), which provided further details specifically for the LAT program.[92] The preface to the operating procedures stated it was ‘produced to assist all members…in the safe, efficient, and effective management and use of aircraft for operational purposes’. This should be read in conjunction with other relevant documents, ‘which may contain more comprehensive information, specification and overarching operational and incident management procedures’. Additional procedures and forms were contained in the Operational management procedures and Incident management procedures.
While the RFS were responsible for coordinating aircraft and conducted training on various aviation aspects, they did not claim to be aviation experts. Therefore, it was possible that the frontline staff may have had a limited understanding of the operational capabilities and constraints for the varied aircraft used. The ATSB noted that there was limited information contained in any documentation provided to the frontline staff regarding the capabilities and constraints of each aircraft type within the LAT category. Where a LAT was requested by an incident management team, the asset was selected based on availability, location, and response time, rather than aircraft type. There was no distinction of capability between LAT aircraft types aside from information related to tank capacity, delivery system, and cruise capability. It did not contain any performance capability information related to operating conditions. However, the documents acknowledged that, ‘it is essential that all personnel seek specialist advice when planning or conducting air operations’. It also stated that ‘any agency members, contractors or air crew may decline to carry out tasks for which they are unfamiliar, unprepared or consider unsafe’.
On 1 June 2022, in response to the draft report, the RFS acknowledged that aerial ‘operations are risky, made more so as weather conditions deteriorated. However, when assessing tasking decisions, the RFS must balance this against the risk posed by fire to civilians and [ground] fire fighters… with the ability of aerial operations to achieve far greater gain’ than ground-based firefighting. Further, they considered that the tasking of large air tankers ‘may be sufficiently safe in circumstances that were not necessarily safe for other aircraft.’ They also indicated that ‘B134 had greater flight capability than other aircraft’ used by the RFS and was able to make a different assessment of risk. ‘Therefore, conditions that may have been unsafe for other aircraft, including B137, may not have been so for B134.’
Aerial supervision
The air attack supervisor (AAS) was a tactical command position, which ensured that aerial operations were consistent with the procedures and incident controller’s intent. This included maintaining communications with relevant incident management team personnel, and coordinating ground and air communications to achieve these objectives.
An incident AAS would be in an independent local aircraft overseeing the fire-ground, responsible for coordinating the aviation assets over an incident. They were responsible for coordinating the smaller aircraft and overall strategy, and in place when there were 3 or more aircraft operating on an incident. When LATs were involved, the incident AAS would normally communicate to another AAS onboard the birddog aircraft (LAT AAS).
A LAT AAS was located in the birddog aircraft, and coordinated the LAT movement with the incident AAS. Their role included briefing the LAT crew on the specific assignment, identify hazards, tactics and manage communications with the incident AAS. In practice, the LAT AAS established contact with the assigned LAT crews as they approached the relevant fire-ground to provide this information.
Requirements
When discussing aerial supervision for air tanker firefighting operations, the RFS operating procedures stated the following requirements:
Generally, Air Tanker Suppression operations, training flights and evaluation flights should not be undertaken without the supervision of an authorised AAS [air attack supervisor]. The AAS provides tactical aircraft coordination with the Incident AAS and/or IMT [incident management team] and directs the firebombing aircraft to critical areas of a fire for suppressant or retardant drops.
The only exception to the above may be in the event that an Air Tanker has an ‘initial’ attack’ certified crew on board who understand the mission requirements, Agency Air Tanker Procedures and there are operational advantages to the LAT commencing operations prior to an AAS arriving.
Operational advantages, while not defined or outlined in any documentation, were described at interview as including aspects such as the faster LAT transit times,[93] when a birddog was not available due to resourcing constraints, or a crew specific concern such as fatigue or exceeded duty times. There were no further requirements or considerations in either the operating procedures or guidelines regarding aerial supervision for LATs, or its use when an AAS was not available due to an operational safety concern. It was also noted that there was no policy, procedure or guidance identified in the provided documentation for tasking air tankers with initial attack certified crew in the case where a birddog pilot, and therefore the associated AAS, had rejected the tasking.
On 1 June 2022, in response to the draft report, the RFS advised that it was always their intention to send a birddog when possible. However, due to the constantly changing circumstances on the day, this was not possible to do. The decision to deploy the LATs without the birddog was based on an evaluation of the available information at the time and the unavailability of the birddog. In addition, the RFS stated that prohibiting LATs from operating if a birddog had not assessed the conditions, or if it was considered unsafe for smaller aircraft to operate would have severe impacts on firefighting operations across the state, and the resultant safety of people and property on the ground.
Initial attack certification recognition
The ATSB was unable to find a definition for the term ‘initial attack certified’ within the RFS documentation and sought clarification from the RFS. The RFS advised that it was their intention to recognise the initial attack certification endorsed by the US Forest Service (USFS). Broadly, this certification required a minimum flight time as a PIC in the specified aircraft type; a minimum flight time conducting low-level retardant drops; ground school training on relevant aspects such as hazard identification, ingress and egress strategies, and communications; and the satisfactory completion of 25 supervised drops.
In addition, the RFS advised that they did not maintain a register of initial attack certified pilots, and did not confirm the crew were initial attack certified when issuing the tasking. Rather, they relied on the individual aircraft operators for ensuring pilots held and maintained the necessary licences and certification. When the ATSB discussed the initial attack certification with Coulson Aviation, they also noted that this had not been defined by the RFS. Therefore, they utilised their own internal training framework to determine when a PIC was capable of operating without aerial supervision. One such example cited was the PIC of the Boeing 737 (B137) who had received the requisite internal training, but had not yet completed the required number of supervised drops to gain the USFS certification.
Tasking large air tankers
The operating procedures, and more so the operating guidelines, detailed the process for the tasking and mission management of air tankers. This included what aspects were to be considered when tasking an air tanker, the request and approval process, and dispatch. The ATSB noted that some functions during this process could be completed by multiple RFS positions. However, for simplicity, only those roles applicable on the day of the accident are discussed below.
Considerations and request
The operating procedures noted that air tankers could provide large volumes of suppressant, and careful planning and supervision was needed to ensure this was used effectively. The first step involved the incident controller (incident management team in the FCC) advising the intent to consider a tanker to the SAD, and outlining a strategy in conjunction with the SAD who could provide ‘guidance on availability and suitability’.
When considering tasking air tankers, the operating procedures stated the incident controller was to consider the following:
incident objectives
threats (life/property, assets, forests)
a proposed strategy
prevailing and/or forecast weather conditions
the likely period of deployment or loads [suppressant/retardant] required
the terrain and fuel (grass, urban, forest) type
possible risks and safety issues
time of day (last light considerations)
the mission alternatives.
A similar list of considerations was also included in the operating guidelines (for both air tanker and birddog taskings), with the addition of the elapsed time for the aircraft to arrive onsite. The operating guidelines stated that these considerations were a ‘risk assessment’. However, there was no further guidance on assessing each of these considerations.
Approval
The SAD would then brief the SOC. The SAD would provide advice on the availability, competing priorities, strategies, and load requirements for the LAT. The SOC then decided on the mission approval. Following that approval, the SAD would advise the LAT airbase manager (ABM) of the approval and mission objectives.
In this case, the Cooma incident controller did not request the tasking of the LATs. Rather, the decision to task a LAT was determined during the 1100 conference call discussing the fire situation at Adaminaby with senior personnel from the State Operations Centre (which included the RFS Commissioner and Deputy Commissioner). On that 3.5-minute conference call, while aware that the smaller fire-control aircraft were not flying due to the weather conditions, it was decided to send the LATs. They were unsure if a birddog had been launched to assess the conditions due to the known visibility and weather conditions, but determined that rather than wait for the birddog assessment, they could send a LAT ‘as it can bomb by itself if need be, if the opportunity presents’. The tasking decision was then communicated to the SAD, who then communicated the tasking for B137, B134, and the birddog from Richmond airbase to the Richmond ABM.
While the tasking on the day did not follow the RFS procedure outlined above, it was very likely that the LATs and birddog would have still been tasked if the above procedures had been followed.
Dispatch
The LAT ABM then conducted a pre-mission briefing with the crew, providing the required tasking details. The RFS operating guidelines indicated that these details would include, at a minimum, the latitude and longitude, a geographic location (referencing a map or chart), the incident air attack supervisor’s contact details, communication details for the incident controller radio channel and fire location’s common traffic advisory frequency, information on any aircraft working in the same location, and the type of load product.
Generally, the birddog with an aerial attack supervisor would arrive at the fire-ground ahead of the LATs. Given that the smaller birddog aircraft would generally fly slower than a LAT, it was common for the birddog to depart before the LATs. However, where there was an urgency to dispatch aircraft due to the rapid spread or the impending impact of the fire, and the crew were appropriately certified, it was standard practice to launch the LATs at the same time, or ahead of, tasking the associated birddog.
Re-tasking
Generally, re-tasking would be managed through the SAD in consultation with the incident management team and the LAT AAS, noting that the LAT crew would take on the AAS role when flying initial attack operations. On the day of the accident, the re‑tasking from the Adaminaby fire‑ground to the Good Good fire-ground was managed by the Cooma incident management team, who were in direct contact with the crew via the Cooma aviation radio operator (ARO). This re-tasking was considered within scope, as both fires were being managed by the Cooma team, and therefore, they could direct the crew as necessary at the local level.
Task rejections
The ATSB were provided with an example of a previous occasion where a task was stopped in‑flight, while operating in Australia. In that case, an aircraft had a number of warnings activated, and the crew elected not to continue. This decision was communicated among the other crews involved in the tasking, who were in continual contact with each other, and the task was subsequently stopped by the AAS.
For the tasking related to the accident, a task rejection had been made on the ground by the birddog pilot (due to weather-related safety concerns) and no communication had been established with other crews. The birddog pilot reported that they had not conveyed the decision to the crew of B134, but expected the RFS personnel would relay this information in their continued coordination of the tasking, or cancel the tasking.
A review of the available radio recordings provided by the RFS found no evidence to indicate that the birddog pilot’s rejection of the tasking had been communicated to the LAT crews (B134 and B137) by either the Richmond ABM or the SAD. In addition, the Cooma ARO, who could reasonably be expected to be in contact with the crews, reported that they were not aware of the birddog rejection. However, it was noted that not all radio communications were recorded.
At interview, mixed responses were received from pilots regarding their expectations on task rejections. All were consistent in that, there was a need to be informed of, and the reason for, the rejection decision, so this could be factored into their decision-making, in line with their company policies and procedures. Others stated that a weather-related rejection should result in cancellation of the tasking. The operator indicated that while a birddog can provide valuable risk mitigations, when the PIC is initial attack trained, they do not consider it to be a requirement. However, for a tasking without the birddog, the reason for this would need to be factored into the PIC’s pre-flight planning.
In addition, the birddog pilot had also reported that, after making the decision to reject the tasking based on the weather conditions, an air attack supervisor had advised them that the smaller fire‑control aircraft had earlier ceased operations due the wind conditions. The birddog pilot further stated that this information was generally not passed on to the pilots by the RFS.
The ATSB reviewed the available RFS documentation and procedures. No policy or procedure was in place to support the ABM or SAD’s management and communication of a task rejection by any of the crews operating in the tasking area that day or involved in the task.
In response to the draft report, the RFS stated they were of the view that ultimate responsibility for assessing risk, and accepting or rejecting a task, was the responsibility of the PIC. For the RFS to make such assessments on behalf of the PIC would constitute a shift in RFS responsibility.
United States firefighting practices
For comparison, the ATSB reviewed the aerial firefighting practices currently in place in the US. This was particularly relevant as many of the LAT operators worked in both the US and Australia, and the NSW RFS reviewed the practices from the US Department of Agriculture, Forest Service (USFS) when implementing their current LAT program.
Task rejections
The USFS placed a significant focus on managing risk exposure. They outlined their safety expectations in a statement of intent, placing emphasis on implementing:
…strategies and tactics that commit responders only to operations where and when they can be successful…[and that] understanding and acceptance that intense fire behaviour may mean we can’t protect values at risk under all circumstances…this direction also requires greater focus on identification of unnecessary exposure.
These expectations were then supported in the USFS Forest Service Manual – Aviation Management Handbook, which included the following statement:
Pilots and aviation users are expected to make sound decisions, including cancelling a flight, when conditions or circumstances may cause undue risk…
Forest Service employees perform challenging work in very high-risk and dynamic environments that are not always predictable. This responsibility can only be realized through participation of every employee. Safety is the first priority, and leadership at all levels must foster a culture that encourages employees to communicate unsafe conditions, policies, or acts that could lead to accidents without fear of reprisal...
The USFS 2019 Standards for Airtanker Operations detailed the processes and procedures to be followed by staff, supervisors, specialists, and managers when planning, administering and conducting airtanker operations. When discussing aviation safety, one aspect considered was task rejections or a ‘turn down’. Notably, the document stated:
Every individual (government and contracted employees) has the right and obligation to report safety problems affecting his or her safety and has the right to contribute ideas to correct the hazard. In return, supervisors are expected to give these concerns and ideas serious consideration. When an individual feels an assignment is unsafe, he or she also has the obligation to identify, to the degree possible, safe alternatives for completing that assignment. Turning down an assignment is one possible outcome of managing risk.
A “turn down” is a situation where an individual has determined he or she cannot undertake an assignment as given and is unable to negotiate an alternative solution. The turn down of an assignment must be based on assessment of risks and the ability of the individual or organization to control or mitigate those risks. Individuals may turn down an assignment because of safety reasons…
The standards further indicated that those individuals who turned down a task were to directly advise their supervisor. That supervisor would then communicate this information to others associated with the management of fire control activities. In addition, when a tasking had been turned down and the supervisor then asked another individual (resource) to perform the task:
…he or she [the supervisor] is responsible to inform the new resource that the assignment had been turned down and the reasons why. Furthermore, personnel need to realize that a “turn down” does not stop the completion of the assigned operation. The “turn down” protocol is an integral element that improves the effective management of risk, for it provides timely identification of hazards within the chain of command, raises risk awareness for both leaders and subordinates, and promotes accountability.
Proper handling of turn downs provides accountability for decisions and initiates communication of safety concerns within the incident organization.
Task rejections, including those related to weather, was also recognised within the Alaskan USFS Forest Service Handbook – Flight Operations Handbook: 33.1 - Forest Service Flight Operations, as follows:
If a flight is cancelled or refused by one operator or pilot because of weather or other operating conditions, the flight will be postponed until the weather improves. Forest Service employees shall not “shop” for an operator that will make the trip when another operator has refused.
Aerial supervision
The USFS Standards for Airtanker Operations outlined the circumstances and minimum supervision required based on the following situations:
number of aircraft assigned to an incident
drops conducted in high traffic areas
low light conditions
use of the modular airborne firefighting system or very large air tankers
airtanker flight crews not initial attack carded
combination of different types of aircraft operating simultaneously
use of foreign aircraft
periods of marginal weather, poor visibility or turbulence
night operations
if requested by the airtanker, birddog or others involved.
It also noted that initial attack certified pilots were authorised to drop retardant without the supervision of a birddog and/or AAS. However, the standard stated that:
Aerial supervision resources must be launched together with the airtanker on the initial order to maximize safety, effectiveness, and efficiency of incident operations. Incidents with 3 or more aircraft over/assigned will have aerial supervision over/assigned the incident.
Likewise, The US National Wildfire Coordinating Group[94] document, Standards for Aerial Supervision, stated that ‘a safe aviation operation depends on accurate risk assessment and informed decision making’. It further indicated that, often, incident response flights were conducted under adverse flight conditions, and this complexity dictated the level of supervision required to conduct aerial operations safely and effectively. While noting factors similar to those listed above, it outlined:
There is no way to define an exact trigger point for adjusting, downsizing, or completely suspending aviation operations. The factors listed below [similar to those listed above] should be evaluated to determine whether additional Aerial Supervision resources are needed, or tactical/logistical missions need to be modified/suspended.
The standard further stated that, in some cases, the aerial supervisor would be required to shut down or suspend operations. In this case, ‘air operations must not proceed until risk mitigations are in place’.
Flight risk assessment tool
When considering aviation safety, the USFS 2019 Standards for Airtanker Operations, stated that a FRAT was required for every flight conducted for the USFS. They also recommended that a FRAT sheet be used when planning a mission and that this should be updated as necessary. The tool, provided as an appendix to the standards, contained the following note:
Because the overall cumulative score is a composite of individual flight, environmental, and operational values, it may not fully emphasize a heightened level of risk that may be associated with an individual category. For example, extremely adverse weather in itself, exclusive of the other categories, may alone merit the suspension of operations. Conditions also change over time and distance, therefore, this tool should be used periodically throughout a mission as conditions change to assure that individual or overall risks have not measurably increased.
Lessons learnt from aerial campaign management
In response to 3 accidents involving helicopters undertaking locust control operations in 2004, the ATSB commenced a research investigation (B2004/0337) into the practices used by Government organisations to contract aerial operators. While focused on locust control, the report findings were also applicable to fire control, other pest management, and emergency service operations. Collectively referred to as ‘aerial campaigns’, these types of operations were generally conducted in relatively hazardous environments that also had the potential to be high-risk environments characterised by:
a significant community need for the operation, possibly urgent
requiring the coordination of significant numbers of resources and organisations
a degree of irregularity or unpredictability as to when the operation will be required and the size the operation
requiring aerial operations with a relatively high hazard level
a regularly changing operational environment throughout the course of the campaign.
The report identified that organisations that contracted aerial operators were directly involved in the management of significant parts of the aerial campaign, such as assigning tasks and briefing pilots. Therefore, decisions made in the management process had the capacity to influence the level of risk of the operations. If safety was to be maintained, that capacity had to be monitored and managed: leaving responsibility for safety to another party that was not managing the overall campaign would not be effective.
In addition, the organisational complexity of aerial campaigns and the subsequent coordination effort required may lead to a diffusion of responsibility among the parties involved. This complexity was further increased when staff from different organisations were working together towards a joint outcome.
The report concluded that, while the aerial component of the operation was provided by an aerial contractor, the campaign control organisation was in a central position to understand the big picture. The adoption of good systems for managing risk by the contracting organisation could provide an effective additional layer of defences over and above that provided by each operator to protect against an incident or accident. An effective overall management system could ensure that no one aspect of the operation compromised another aspect.
Similar occurrences
This accident was the first occurrence of a collision with terrain involving a LAT in Australia. However, the ATSB identified another C-130H firefighting weather‑related accident, and a windshear encounter during firefighting operations in the US where the retardant was not jettisoned. A summary of these reports is provided below.
US Air Force Aircraft Accident Investigation Board investigation
On 1 July 2012, the crew of a US Air Force Lockheed Martin C-130H aircraft was conducting wildland firefighting operations near Edgemont, South Dakota, US. While following a lead aircraft (birddog) and positioning for a fire-retardant drop, both aircraft encountered a microburst.
The pilot of the lead aircraft conducted a ‘show me’ run,[95] and shortly after, the crew of the C-130 established a 0.5 NM (1 km) trail formation for the first drop. About 7 minutes later, while setting up for the second drop, the C-130 was in about a 1 NM (1.9 km) trail formation when the lead aircraft hit a ‘bad sinker’, resulting in a loss of altitude and airspeed. The lead aircraft came within 10 ft of the ground, and the pilot called ‘I got to go around’. One second later, the C-130 crew also elected to go-around, and 16 seconds after, they called ‘E-dump, E-dump’. Despite completing an emergency dump of the remaining retardant, the C-130 collided with terrain shortly after, fatally injuring 4 crew and seriously injuring 2 crew.
The investigation found that an inadequate assessment of the operational conditions resulted in the aircraft impacting the ground after flying into a microburst. In addition, it was established that there was a failure to communicate critical operational information from the lead aircraft and air attack crew to the C-130 crew, and there was conflicting guidance concerning thunderstorm avoidance.
The USFS and Department of the Interior maintained an aviation safety reporting system as part of its safety program and published a yearly safety summary. On average, it was noted there were about 8 weather-related events reported in the database yearly, with an incident of significance to this investigation described below.
On 17 June 2017, the flight crew of a British Aerospace BAe-146 aircraft were conducting firefighting operations in northern New Mexico, US. The pilot reported that, during a fire-retardant drop, they experienced significant ‘down air’, which resulted in them coming close to terrain. While slowing the aircraft through 130 kt when about 500 ft above the planned drop height, ‘the bottom fell out’ resulting in a loss of about 10 kt airspeed and 300 ft altitude. The pilot applied engine power and manoeuvred the aircraft toward lower terrain, but they did not achieve the expected climb performance and passed just above the tree line. The pilot indicated that the event took less than 10 seconds, and while they should have jettisoned the load in hindsight, they did not consider this at the time as they were focused on flying the escape manoeuvre.
About midday on 23 January 2020, a Lockheed Martin C-130 aircraft, call sign ‘Bomber 134’ (B134), departed the Richmond Royal Australian Air Force Base, New South Wales (NSW) on a firefighting tasking to Adaminaby. On arrival at Adaminaby, the crew determined that the conditions were unsuitable for a fire-retardant drop and were subsequently re-tasked to the Good Good fire near Peak View. Shortly after conducting a partial drop, and while in a left turn, the aircraft stopped climbing. The pitch attitude reduced, followed by a slight right wing down attitude. Shortly after, the aircraft was observed left wing down at low-level before colliding with terrain. The 3 crew were fatally injured and the aircraft was destroyed.
The extent of the impact damage and post‑impact fire meant the ATSB was unable to verify the operation of every aircraft system. However, there were no known defects that would have affected the aircraft’s serviceability, with the only item noted relating to the propeller anti-icing system on engine number 2, with rectification deferred in accordance with the minimum equipment list. There was no evidence of pre-impact structural damage, and detailed examination showed all engines were operational and producing power at the time of impact.
The ATSB established that the crew were appropriately qualified to perform the flight and there was no evidence of fatigue. While the post-mortem examination identified abnormalities with the copilot’s heart, there was no pathological evidence of scarring or a blockage suggesting a pre‑existing heart condition. Although elevated blood cholesterol levels increase the risk of coronary heart disease, the copilot had been appropriately treated for several years prior to the accident, and their blood pressure readings and last electrocardiogram were all within normal limits. In addition, ATSB research into pilot incapacitation occurrences (AR-2015-096) emphasised that multi-pilot operations provide a safety net if one crew member becomes incapacitated and that such events had a minimal effect on flight. Therefore, noting the medical information above and that the copilot was not the pilot flying, it was considered very unlikely that they had experienced a heart‑related condition that contributed to the accident.
This analysis will examine the environmental conditions and how this influenced the aircraft’s degraded performance and subsequent stall. The tasking process, management of task rejections, and the crew’s awareness of such on the day will also be discussed. It will also consider the risk management of large air tankers, the use of a flight risk assessment tool, and the aerial supervision and initial attack certification requirements in place. Further, the impact of limited recorded flight data and cockpit voice recordings, along with the benefits of on-board windshear systems will also be discussed.
Hazardous weather conditions
The Bureau of Meteorology graphical area forecasts for the area of operation contained strong winds, mountain wave activity and severe turbulence, which extended from Richmond to the Adaminaby and Good Good (at Peak View) fire‑grounds. The Cooma-Snowy Mountains Airport (50 km from the accident site) aerodrome forecast also indicated gusting winds nearing 50 kt and reduced visibility from blowing dust. These forecasts were consistent with the Peak View weather station recordings, witness reports, and video of the actual conditions. The ATSB’s analysis of the aircraft’s ground speed from the automatic dependent surveillance broadcast (ADS-B) data also showed that the wind speed was likely of a magnitude of 20-40 kt from a north‑westerly direction during their drop planning circuits at Peak View.
Overall, the Bureau of Meteorology concluded that the actual conditions in the accident area were consistent with the forecasts. This was reinforced by the pilot reports in the morning, which resulted in the smaller fire-control aircraft ceasing operations due to winds of about 50 kt. In addition, the pilot in command (PIC) of the Boeing 737 (B137) reported similar winds and experiencing a windshear warning and uncommanded roll when at Adaminaby. Of note, the birddog pilot had rejected the tasking to Adaminaby as the forecast conditions were worse than what they had experienced 2 weeks prior, where they were subjected to moderate to severe turbulence and downdrafts.
At Peak View, the crew had followed their procedures and conducted a number of circuits over the drop location, which was on the eastern side of a ridgeline. As the crew had elected to conduct the drop, this would indicate that they had assessed the meteorological conditions during these circuits as suitable to continue. However, the lowest circuit height of 500 ft may not have been low enough for the crew to accurately assess the conditions at the drop height and identify any localised terrain or fire effects.
The low-pressure spike recorded in the ADS-B data potentially indicated the aircraft had been subjected to localised weather effects, but due to limited information the reason for this could not be conclusively determined. The drop was located on the lee side of a ridgeline, an area prone to turbulence and potential development of mountain waves. However, while mountain waves were confirmed by the Bureau of Meteorology analysis to be present across the Snowy Mountains region at the time of the accident, the severity of this could not be ascertained from the available information. In addition, the drop was in an area noted by local glider pilots to be subject to turbulence and rotor conditions.
Strong winds and mountain waves are considered hazardous conditions due to their ability to generate strong downdrafts that may adversely affect an aircraft’s climb performance. They may also create windshear, which is of particular significance when it results in an increased tailwind component, with a subsequent reduction in airspeed. At the same time, moderate to severe turbulence would increase the stall speed.
In addition, the presence of a large fire will produce smoke and heat plumes, and potentially fire‑driven winds, that is likely to exacerbate the forecast conditions. The Blue Mountains fire case study suggested the possibility of fires drawing strong winds down closer to the surface than might otherwise be forecast.
Therefore, the environmental conditions in the accident area were conducive to windshear and downdraft development at a time when the aircraft was most vulnerable, with low airspeed and low height.
Tasking continuation by the Rural Fire Service
In the 1100 conference call between the Cooma incident controller and several senior personnel from the State Operations Centre, they discussed the severe fire weather conditions and escalating fire threat at Adaminaby. They also acknowledged that the smaller fire-control aircraft (which included the incident air attack supervisor), had stopped operations due to strong winds, with pilots reports of winds up to 52 kt and limited visibility. In that same conference call, a senior NSW Rural Fire Service (RFS) officer indicated that they should send B137 rather than wait for a birddog assessment. That is, they elected to send the LATs as initial attack to determine if they could work the fire-ground, rather than wait for an assessment prior to re-starting aerial operations. Following this, the State Operations Centre tasked 2 large air tankers (LATs), and subsequently the birddog, from Richmond to Adaminaby knowing the conditions were marginal, and that the LATs would arrive prior to the birddog.
During the initial crew tasking, the Richmond airbase manager (ABM) had mentioned the wind conditions to the crew of B137 and advised them to ‘take care’. Similarly, subsequent calls made between the ABM and the state air desk (SAD) at 1137 and 1209 discussed the adverse environmental conditions and that the birddog pilot was questioning the suitability of the weather. When the birddog pilot rejected the tasking, based on operational safety concerns, there was an expectation from them and the operator’s pilots that the tasking for the LATs would be cancelled, or at least reconsidered. This was consistent with the normal practice for a ‘turn down’ in the United States (US), and the need for aerial supervision in marginal weather conditions as outlined in the US Department of Agriculture, Forest Service (USFS) Standards for Airtanker Operations and Forest Service Handbook. However, despite an awareness of the hazardous environmental conditions, the earlier withdrawal of the smaller fire-control aircraft and the birddog pilot rejection, the tasking was continued, and this information was not relayed to either B137 or B134 crews.
Subsequently, following the drop at Adaminaby, the PIC of B137 reportedly advised the RFS Cooma aviation radio operator to cancel all aircraft operating in the area and indicated to the ABM (at about 1232) that they would not be returning due to the weather. While the crew of B134 had already been tasked and were en route to Adaminaby, this was another opportunity for the RFS to reassess the suitability of the tasking. In addition, the RFS, having received information that further operations in the Adaminaby area were unsuitable for LAT operations, did not communicate this information to the Cooma aviation radio operator or B134. In response to the ATSB draft report, the RFS noted that, while the State Operations Controller was aware of these rejections, they elected to allow B134 to continue, for further intelligence gathering purposes.
It was recognised that RFS personnel may have a limited understanding of aviation operations and therefore, there was a reliance on aircraft operators and crew to manage safety. However, in this case, the crew were not provided with a full awareness of the situation, with no knowledge of the birddog pilot rejection or that the smaller fire‑control aircraft were no longer flying. In addition, while B134 had been in contact with B137 and received advice on the conditions, this was unknown to the RFS at the time.
While some RFS personnel considered it unlikely that the LATs would be able to achieve the planned objectives due to the weather conditions, they continued with the tasking, relying on the crews to independently assess the conditions and cancel the tasking while airborne. As highlighted in the ATSB’s research into aerial campaign management, leaving the responsibility of safety to another party (the operator and crew in this instance) who are not managing the overall campaign is not effective. When there is a high-level decision to proceed with a tasking despite known elevated risk factors, providing information on those risks would allow crews and operators to make more informed decisions.
Crew awareness of task rejection
As discussed above, the smaller fire-control aircraft had ceased operations in the area earlier that day, which had been acknowledged by the RFS personnel from the State Operations Centre in the 1100 conference call. Also, the birddog pilot had rejected the tasking to Adaminaby, unaware that the smaller aircraft had stopped flying at that time. The birddog pilot indicated that it was not routine to talk to the other pilots about taskings. Therefore, they did not communicate with the crew of B134 that they had declined the tasking, but expected the RFS personnel would relay this information.
In addition, there was no indication in the available radio calls or at interview that the cessation of operations earlier that day or the birddog pilot task rejection was communicated to the crew of B134 by any RFS personnel. It was noted that this information was not required to be passed on in any of the tasking or dispatch procedures. While not directly communicated to the crew, there was the potential that they may have been monitoring the radio call between the SAD and the Richmond ABM at 1209, shortly after they had departed. However, there was no clear statement of the rejection in that call, rather, they only discussed the birddog pilot’s uncertainty about the weather conditions.
Therefore, while known to RFS personnel, it was very unlikely that the crew of B134 were aware that the birddog pilot had rejected the tasking, or that the smaller fire‑control aircraft were no longer operating in the area, due to the hazardous environmental conditions. While this was only one risk factor among others that would be considered by the crew, having this information would have allowed them to make a more informed decision about the weather conditions and task acceptance.
Nevertheless, as the tasking to Adaminaby for B134 had been provided prior to the assignment of the birddog, it was likely the crew expected to be departing as initial attack. In which case, even if they were aware of this information, it was possible that they may have still departed to self‑assess the conditions, particularly given the fire-ground was at least 45 minutes away. However, as this was an individual judgement, it could not be established how this information alone would have influenced their decision on the day.
Task acceptance by the crew
The weather forecasts applicable at the time of the flight contained mountain wave activity and severe turbulence, which extended from Richmond to both the Adaminaby and Good Good fire‑grounds. While the crew’s access to weather information on the day could not be determined, the usual practice of filing a flight plan through the operator’s electronic flight bag provided access to the required forecasts. They had also attended the morning RFS briefing with the Richmond ABM in which the weather conditions across the state were discussed. In addition, the PIC was one of the recipients of the ABM’s text message for the weather alert for Richmond in the morning prior to the tasking.
Although the PIC of B137 was made aware by the ABM at the time of the initial tasking that there no other aircraft operating at Adaminaby, they were not aware of the reason for this. Therefore, it was plausible that the crew of B134 were also not aware of this information and were not able to factor in the actual conditions to their decision when accepting the initial tasking to Adaminaby. Further, as discussed above, they were very likely unaware of the birddog pilot’s rejection of the task. Irrespective, it was reasonable to conclude that the crew of B134 were at least aware of the forecast conditions for the area of operation before departing Richmond.
While both the operator’s and manufacturer’s documents stated that flight was prohibited in known severe turbulence, this did not prevent crews from departing when severe turbulence was forecast. The only weather-related operational limitations were associated with thunderstorm activity. Therefore, it was considered normal practice to accept a tasking in these forecast conditions. Most of the operator’s LAT pilots interviewed indicated a preference to depart and assess the actual conditions to determine if they could find a workable solution rather than rely solely on a forecast, which could cover a large area and time frame, and may not necessarily reflect the actual conditions at the fire‑ground.
When B134 was en route to Adaminaby, the PIC of B137 (returning to Richmond) discussed the actual conditions with the PIC of B134, and advised they were not returning. Although B134 continued to Adaminaby, the crew discontinued the task once there as they experienced similar conditions. Despite this, knowing the decision made by the PIC of B137 and the forecast conditions for the area, the crew of B134 accepted the alternate tasking to the nearby Good Good fire‑ground, consistent with company practice. Circuits were conducted at Good Good, as per the standard retardant drop planning, to identify the asset for protection and the suitability for a drop. While the details of the assessment were unknown, the crew elected to continue with the retardant drop. Ultimately, the decisions to accept the initial and alternate tasking, and proceed with the retardant drop by the crew exposed the aircraft to a situation where it experienced degraded performance following the drop.
Degraded aircraft climb performance
Witness video, ADS-B and SkyTrac data showed that, following the completion of the drop, the aircraft climbed about 170 ft over a period of about 10 seconds, which was comparable to previous climb rates from the operational load management system. It was reported by the operator’s pilots that, at this stage of the flight, they would be targeting an airspeed increase from the drop at 120 kt indicated airspeed (IAS) to 150 kt IAS, while climbing from the drop height of 200 ft to at least 500 ft above ground level. However, during this period, the ATSB calculated a calibrated airspeed (CAS) range of between 100 and 123 kt (comparable to the IAS), which indicated the airspeed likely stagnated or reduced over this period.
Following this initial 10 seconds, the climb ceased, and altitude appeared to be maintained for about 3 seconds before the aircraft began to sink with an estimated descent rate increasing to 2,000 ft/min. The CAS also continued to stagnate after the initial 10 seconds. The reduction in vertical speed and estimated airspeed stagnation occurred at the time it would be expected that the engine power would be increasing. This increase in power would either translate to an increased height (while maintaining IAS) or maintained altitude (with an increase in IAS). Of note, the ATSB had established that there were no indications of mechanical or technical failures with the aircraft.
After the drop, the aircraft was turned from a predominant crosswind to a predominant tailwind, based on the recorded mean wind direction. This would have resulted in an initial slight decrease in the IAS. At the same time, as previously established, there were strong gusting winds, turbulence, and mountain wave activity present at the time of the accident, and these conditions were conducive to windshear.
If there was an additional increase in this tailwind component from windshear, this would have resulted in a further reduction of the airspeed. There would also be a corresponding decrease in pitch attitude and rate of climb, with a subsequent loss in altitude, as highlighted in the Lockheed Martin C-130 Airplane Flight Manual (AFM), and by the Bureau of Meteorology (2014) and Bowles (1990). These descriptions were consistent with the ATSB’s analysis of the recorded information. The witness video showed that the maximum pitch-up angle occurred 4 seconds after the completion of the drop and from this point it decreased. Likewise, the aircraft initially had a rate of climb up to 1,000 ft/min, but this also decreased, and the aircraft descended.
For comparison, the simulator testing showed that a strong constant mean wind during the climb‑out resulted in a small loss of IAS, but a significantly higher ground speed than was seen in the accident sequence. However, scenarios that used a moderate (15 kt) mean wind with gusts and windshear between 15 kt and 35 kt (similar to the total wind speeds recorded on the day), produced similar ground speeds to the recorded accident data. They also consistently resulted in the IAS decaying into the stall speed region, with minimum speeds between 84 kt and 98 kt.
In addition, observations made on the reconstruction flight noted an airspeed decay when they turned and were flying toward the accident site, even though the engine power was increasing. This was consistent with the glider pilot comments that there could be localised effects in this area due to the terrain. On the day of the accident, while the reason could not be determined, the ADS‑B data recorded a low‑pressure spike, which also had the potential to result in decreased aircraft performance.
The intensity of the environmental conditions (including mountain wave activity, strong gusting winds and turbulence) and therefore the windshear, could not be determined. However, the ATSB’s analysis of the available recorded data showed that the aircraft’s performance had degraded during the climb-out, consistent with encountering windshear, while concurrently turning into an increased tailwind, based on the mean wind direction. This was supported by the C‑130 simulator testing. With the limitations of the available recordings, and the absence of a cockpit voice recorder, it could not be determined if the crew had identified the conditions or initiated a recovery procedure. As cautioned in the Lockheed Martin AFM, severe windshear could exceed aircraft performance capability.
Stall at low altitude
About 10 seconds after the completion of the drop, the aircraft had climbed to about 330 ft above ground level but then ceased climbing, and the altitude was maintained for a few seconds. Although the aircraft was in a nose-up attitude, the aircraft was sinking and developed a high sink rate up to 2,000 ft/min. This was followed by a significant left roll just prior to impact. This was consistent with the stall characteristics as outlined in the C-130 discussion paper (Mizell 2009), where the approach to the stall in this configuration exhibited high descent rates, before the left wing stalled resulting in a large angle of bank excursion.
The ATSB calculated the power-on stall speed, with 50% flap and at the post-drop weight, as 83 kt. Consideration was also given to the potential effect of turbulence, which increased the stall speed to between 101-117 kt for moderate turbulence and 117-143 kt for severe turbulence. Noting that the ATSB derived CAS for the accident flight was between 100 and 123 kt in the last 10 seconds of the available data, this presented a significant overlap with the calculated stall speeds. It was also noted that, in the simulator test scenario that was most consistent with the accident flight, the IAS consistently decayed into the stall speed region with repeated stall warnings activated.
In the absence of the cockpit audio recording, it was unknown if the PIC, as the pilot flying, had initiated a response to the stall. Despite this, in consideration of the observed high sink rate followed by a significant left-wing roll, and the overlap in the stall speed and CAS, it was likely that the aircraft aerodynamically stalled at a height that was insufficient to recover before colliding with terrain.
Coulson Aviation risk management of large air tankers
While there was no regulatory requirement at the time of the accident, Coulson Aviation had implemented a safety management system (SMS), it was a contract requirement in the US, and which was viewed favourably by the National Aerial Firefighting Centre. However, as the system was not mandated, it was not assessed by the Civil Aviation Safety Authority or the Federal Aviation Administration. The ATSB acknowledges that any operator’s SMS will evolve and mature with time. However, significant events like accidents need to be used to explore whether their SMS is operating in a way that can assure the highest level of safety given the nature of their operations.
Acknowledging the element of risk associated with firefighting operations, the ATSB reviewed the safety risk management component of the SMS. Although the operator’s SMS manual outlined that the online SMS program would record the identified hazards, this was limited to submitted incident reports, and did not contain previously identified hazards. Although, the Company Operations Manual had detailed several operational hazards, the current and previous safety managers indicated that no risk assessments for the identified hazards associated with the LAT operations had been conducted. However, it was noted that risk assessments were included in the SMS manual, but these only applied to safety reports and change management contained within the online SMS program. While some of these hazards may have been discussed during the daily SMS conference call, this process was not formalised.
Without formal operational risk assessments of the recognised hazards applicable to the LAT operation, there was no identified risk mitigation strategies nor was there any assurance that the risks were at an acceptable level. For example, windshear and downdrafts had been recognised as a potential hazard in the Company Operations Manual. However, as no formal assessment for the C-130 aircraft had been conducted, there was no opportunity to formally identify and assess potential risk mitigators, such as those discussed by Hallowell and Cho (2010).
As noted by ICAO (2018), safety risk management activities such as operational risk assessments should be documented. Both the current and previous safety managers indicated that the operator did not have a risk register as part of their SMS, or an alternative process, at the time of the accident. This limited their ability to track, monitor, and mitigate the identified hazards, and assess the effectiveness of any risk controls.
Another important element of safety risk management was the use of reporting systems for hazard identification. The ATSB’s review of the operator’s safety reporting system found that there were few reports related to flight operations, and there were no reports of weather-related incidents. This was despite several of the crews interviewed having recalled encountering windshear during firefighting operations, which affected the aircraft. Given the operator’s draft report response comments that they considered the incident reporting numbers were mitigated by the daily SMS calls, it was likely they relied on this informal process for flight risk awareness, rather than incident reporting. Although the weather conditions were mentioned in the days prior to the accident, there was minimal detail of the discussions recorded in the daily SMS conference calls. Therefore, as there was limited information on operational issues recorded in the SMS, there was limited ability to conduct risk assessments of any identified hazards, to gain an understanding of their potential impacts on operations and mitigate the associated risks, or to perform any safety trend analysis.
As established above, aerial firefighting operations were subjected to elevated risks. Therefore, the supporting risk management practices should consider risk assessments at all levels of the organisation and all stages of the operation. Acknowledging that the risks cannot be entirely eliminated, an operational risk assessment would have provided an opportunity to identify the need to establish acceptable risk levels associated with firefighting taskings. While elevated risks were individually identified, there was no clear process for pilots to review or assess all the factors collectively and consistently. Instead, the operator’s risk management process relied predominately on crews conducting their individual, undocumented risk assessments for each task as part of their normal pre-flight planning and tactical assessment during flight. In particular, there was no identification of the need for a risk-based decision‑making framework to support pilot decision‑making when accepting potentially high-risk taskings.
The operator’s voluntary audit had identified significant growth in the company since the initial audit 2 years earlier, but it also noted that the SMS had not yet fully matured. While it was recognised there was no requirement for Coulson Aviation to have an SMS in Australia, the ATSB identified that there was very limited oversight of the identified hazards. Without operational risk assessments for the LAT operations or a method to monitor identified hazards, associated risk assessments, or risk mitigation, this limited Coulson Aviation’s ability to manage the risks related to their LAT operation.
Pre-flight risk assessment tool
As noted by the US National Transportation Safety Board, effective risk management involves good decision-making. These skills are important in most work domains but are especially critical in high-risk settings when individuals may be functioning under time pressure and stress, such as firefighting operations.
The LAT operation was a 15-minute notice standby tasking arrangement, which could send the aircraft to any location within the bounds of the tasking authority. The retardant drop task was a response to a possibly urgent threat that involved low-level, low-speed operations in a potentially hazardous and challenging environment. This made it a comparatively high-risk activity, in addition to which pilots were also responding to an external tasking agency, a potential source of external pressure.
At the start of each day, the RFS conducted a briefing for the LAT and birddog crews, which provided an overview of the weather, likely areas of operation, and fire conditions. However, on receiving a tasking, crews were still required to conduct their own flight planning specific to the area of operation, in a timely manner, to determine what was an acceptable level of risk.
The only consideration provided at interview as no-go criteria by the Coulson Aviation crews was a thunderstorm. Consequently, there could be several flight planning factors, which individually were not a no-go criterion, but collectively elevated the risk to higher-than-normal for the LAT operation. There could also be additional external factors, such as task rejections or cancellations by other pilots, which could elevate the risk if they were known to the LAT crew.
While acknowledging that LAT operations had inherent risks, Coulson Aviation had not introduced a pre-flight risk assessment tool for their LATs. Instead, there was a reliance on the PIC to assess the acceptability of the task based on their assessment of the conditions. However, this process may not have necessarily detected the cumulative effect of several indicators of elevated risk.
On the day of the accident, there were multiple pre-flight risk indicators, which included:
forecast strong winds, severe turbulence, and mountain waves in the area of operation
operating in mountainous terrain
the Richmond Airport weather warning sent to the LAT crews by the ABM prior to the Adaminaby tasking
the cessation of the smaller fire-control aircraft due to the actual weather conditions in the Snowy Mountains
the birddog pilot’s rejection of the task following assessment of the forecast weather conditions for the area compared with a previous experience
the copilot and flight engineer were in their first firefighting season
potential pressure to respond to the bush-fire risk to the town of Adaminaby.
While it could not be determined if all factors were known to the crew of B134, or their assessment of each factor, none of the above risk indicators were likely to be individually sufficient for the PIC to reject the task. However, when assessed collectively against pre-defined criteria, they would have produced an elevated score, as identified in the ATSB’s estimate of the accident flight risk profile using the operators recently introduced pre-flight risk assessment tool. However, it was noted that this tool did not include weather-related task rejections, considered one of the highest risk indicators for helicopter operations by the Helicopter Association International.
While there was no regulatory requirement at the time, the use of a pre-flight risk assessment tool was a contract requirement with the USFS. A 2014 NTSB study of aerial work accidents outlined that risk management guidelines and best practices specific to aerial work aircraft operations included a pre-flight risk assessment tool. These help operators and pilots mitigate the unique risks associated with their operations, in particular, when the operation is often conducted in high‑risk circumstances. As emphasised by both the US Federal Aviation Administration (FAA) and USFS, every flight has some level of risk. Therefore, it is critical that crews can differentiate between a low-risk and high‑risk flight during the planning stage to establish the overall risk profile. Risk management strategies, such as a pre-flight risk assessment tool, can assist pilots with applying a systematic process that helps them resist pressures that can adversely affect their decision-making and identify risks that could affect the safety of the flight.
In this case, the availability of such a tool would have assisted the PIC with making a more informed go/no-go decision for the initial tasking to Adaminaby. This almost certainly would have resulted in the PIC identifying the elevated risk associated with the tasking, and having to consider implementing risk mitigations, or escalation of the decision-making, if not rejection of the task. In addition, the PIC was reported to be conservative, therefore, the knowledge of the cessation of aerial operations due to strong winds and limited visibility and followed by subsequent weather‑related rejections due to safety concerns, would have likely increased the risk above an acceptable level.
Rural Fire Service aerial supervision requirements
Although it was acknowledged that the RFS was not an aviation operator, they were responsible for tasking a variety of aerial assets, with substantially different operating capabilities, often in high pressure situations in challenging environmental conditions. It could be foreseen that there will be community expectations that the RFS respond to fire threats, and use all available aerial assets to achieve the planned objectives. Accordingly, the tasking agency needs to define the acceptable level of risk for the overall operation, to provide an effective additional layer of defence above that provided by the aircraft operator. Such systems and policies have been implemented in firefighting operations in the US.
Operationally, the tasking-related risk assessment noted in the RFS Aviation Standard Operating Procedures (operating procedures), predominantly focused on the use of the aircraft to manage the fire threat rather than ensuring the safe use of those aircraft. The RFS had identified considerations to ensure the effective use of LATs, and acknowledged that certain task environments had higher risks. However, there was no guidance provided to frontline RFS personnel on how to assess these risks as part of the tasking process, such as those noted by the USFS and the US National Wildfire Coordinating Group.
For example, the RFS tasking considerations included weather as a potential threat, but there was no further guidance around how to assess the environmental conditions, or under what circumstances taskings should be considered acceptable or not acceptable. For the tasking to Adaminaby, it was noted in the 1100 conference call and various logs that the weather conditions were hazardous and that no aircraft were flying in the area due to the wind and visibility conditions. Despite this, there was an expectation that the LATs had greater flight capabilities and the pilots could make their own assessment of the conditions. Therefore, the decision was to send the LATs, and see if an opportunity presented itself that allowed for their assistance.
However, if the RFS had implemented policies and supporting procedures applicable to minimum aerial supervision requirements, similar to those in place in the US, this would have provided guidance to the front-line staff to assist with tasking decision making. For example, the USFS documents outlined the requirement for aerial supervision in marginal weather, including limited visibility and turbulence, and further, where the aerial supervisor suspended operations, they must not proceed with further taskings until risk mitigations are in place. If such policies were in place, it was likely that RFS personnel would have identified the higher risk environment, and therefore the need for aerial supervision on this tasking. In turn, this would have likely identified that an initial attack deployment was not suitable in the elevated risk environment.
The operating procedures indicated that aerial supervision was generally required for LAT firefighting operations unless the crew were initial attack certified and there were operational advantages to commencing operations prior to aerial supervision arriving. Those advantages included considering the speed differential between a birddog and LAT, or when a birddog was not available due to resourcing constraints, such as diversion to another tasking. However, there was no differentiation between the use of an initial attack deployment where aerial supervision was not available, in comparison to the rejection or cessation of a tasking due to safety concerns.
While the initial deployment of B137 ahead of the birddog could reasonably be accepted as meeting an operational advantage, the departure of the smaller fire-control aircraft and subsequent rejection of the birddog should have resulted in reconsidering the use of ‘initial attack’. However, there was no supporting procedure or guidance on the use of ‘initial attack’ deployment in these elevated risk circumstances, such as when the task was rejected by the birddog due to safety concerns. In the case of the accident, this rejection occurred shortly prior to B134 departing Richmond, and there would have been sufficient opportunity to reassess the task, and potentially redirect the LAT elsewhere, prior to their arrival overhead Adaminaby.
Policies and procedures on aerial supervision should include consideration of the known factors that elevate risk associated with aerial firefighting tasks, and would ensure the RFS have minimum aerial supervision requirements in place for each tasking circumstance. It would also include policies and procedures for the deployment of LATs without aerial supervision (initial attack), and in what circumstances this would be acceptable. In order to make acceptable risk‑based tasking decisions, these considerations need to be enshrined in policies and procedures, to assist with time-critical decisions during the fire season by frontline staff. The RFS personnel would have to assess that the tasking meets the minimum aerial supervision requirements prior to approaching operators with taskings, to ensure the taskings can be conducted within their defined, accepted risk levels.
Rural Fire Service management of task rejections
The ATSB’s 2004 research into aerial campaign management stated that organisations that contracted aerial operations (such as the RFS) were directly involved in the management of significant parts of the aerial campaign and were in a central position to understand the big picture. Decisions made during this process had the capacity to influence the level of risk of the operations.
It could be reasonably expected that there will be situations in which tasks are declined for safety reasons. While the RFS Aviation Standard Operating Procedures and the Operating Guidelines for Air Tanker Operations outlined some initial considerations regarding the tasking of LATs, there was no further policies or procedures following the initial tasking process to support the ongoing task. Consequently, there was no process in place to support RFS frontline personnel on managing a task rejection by crews or operators.
These policies and procedures would detail when task rejections should be considered as a risk indicator, such as when flights were declined due to weather-related safety concerns. For comparison with the USFS Standards for Airtanker Operations, this may also include communication of this information to other crews, reassessment of the tasking, incorporation of appropriate mitigations, or cancellation of the task. They should also encourage pilots and operators to communicate unsafe conditions without fear of reprisal.
On the day of the accident, neither the Richmond ABM nor the SAD communicated to either of the LAT crews or the birddog pilot tasked to Adaminaby, information regarding the smaller fire-control aircraft ceasing operations due to unsuitable weather. Nor did they communicate the task rejection by the birddog pilot to the crew of B134 shortly prior to take-off from Richmond (noting this occurred about the time B137 was overhead Adaminaby). The LAT AAS (who would have been on board the birddog) also did not communicate this to the LAT crews, as their communication role did not commence due to the birddog aircraft not departing. In addition, this rejection was not communicated by RFS personnel to the Cooma Fire Control Centre aviation radio operator, who could reasonably be expected to be in contact with the LAT crew as they were operating as initial attack, and they were the appropriate local ground contact to coordinate the task. While acknowledging the LAT’s, birddogs, and the smaller fire‑control aircraft have different capabilities and performance limitations, this was relevant information (specifically, reported strong winds and limited visibility, and the rejection based on safety concerns) that could reasonably have been communicated to the crews. As previously discussed, there was an expectation from the birddog pilot and the operator’s pilots that the RFS would either relay this information to them so it could be included in their decision-making processes, or the task would be cancelled by the RFS.
The subsequent rejection of further tasking by B137 as the conditions were worsening and reportedly unsuitable for LAT operations, was also not communicated by either the ABM or SAD to the crew of B134 nor to the Cooma incident management team. In addition, shortly after this rejection, the ABM and SAD discussed sending an alternative LAT to Adaminaby. None of these rejections resulted in a reassessment or cancellation of the tasking for B134 to Adaminaby. Rather, the RFS allowed B134 to proceed with the intention of gathering additional intelligence to assist in determining whether further aerial operations would proceed. Subsequently, the Cooma aviation radio operator was also unaware of this rejection of further tasking by B137, or their assessment of the conditions when providing the secondary tasking to the B134 crew.
As outlined above, while some crews were initial attack certified and could operate without aerial supervision, the RFS operating procedures indicated that this was only to occur when there were operational advantages prior to an air attack supervisor (AAS) arriving. However, the operating procedures did not reference any circumstances, such as in the case of the accident flight, where a tasking had been rejected due to safety concerns, such as unsuitable weather. While initial attack crews were trained to conduct operations without the AAS, continuing a tasking where the local AAS had departed or grounded due to weather concerns, and/or the birddog pilot (and therefore LAT AAS) rejected the tasking, appeared outside of the intended scope of ‘initial attack’ deployments.
As the task rejections were on the basis of weather or fire-ground safety concerns, which equally applied to B134, appropriate policies and procedures regarding task rejection should have resulted in the initial tasking to Adaminaby being cancelled following the rejections. There were 2 opportunities for this. The first was at the time of the birddog rejection when B134 was departing Richmond, which, at the very least (noting the RFS understanding of differing capabilities between the birddog and the LATs) should have resulted in communication of that information to allow the LAT pilots to make their own more informed risk assessment. The second was when B134 was transiting over the Canberra region and the RFS received advice from B137 which indicated that it was not suitable for LAT operations. Task cancellation would have also been consistent with the RFS intended use of initial attack and the general operating principles in the US.
While the RFS was not an aviation organisation or directly responsible for flight safety, they were closely involved in the aerial operation, being responsible for determining the task objectives and selecting the aircraft category for the task. Policies and associated procedures for task rejections would provide RFS personnel with the required steps to effectively and safely manage taskings, and provide guidance for decision-making. It would allow for consideration of a rejection by other crews, resulting in clear communication from RFS personnel of crew rejection decisions both internally, and to all aircraft on the tasking, and additional risk treatments being implemented up to task cancellation. A policy would also provide all RFS personnel with an objective mechanism to cancel taskings on the basis of safety.
Retardant load not jettisoned
Although the aircraft was obscured by smoke at various points, the witness video showed no further retardant dispersal after the initial drop, nor was any found between the drop area and the accident location. At the site, the operational state of the retardant aerial delivery system could not be determined due to the damage sustained, but a large amount of retardant was found in the wreckage near the tank.
However, as there was only about 10 seconds between the climb performance degrading and the likely stall, there was limited time available for the crew to identify and respond to the situation. Past research shows pilot recognition time of windshear can be expected to be about 5 seconds, and the emergency dump function would take a further 2 seconds. However, in the absence of the cockpit audio recording, it could not be determined if the crew had considered or called for an emergency dump of the remaining load. Therefore, for reasons undetermined, the remaining 11,340 kg of retardant was not jettisoned during the accident sequence.
The ATSB established that jettisoning the remaining load would have lowered the stall speed and optimised the aircraft’s climb performance. This was also confirmed from the simulator testing. Nonetheless, it was not possible to determine if jettisoning the remaining load, taking into account the time available, and typical recognition and response times, would have prevented the collision with terrain. The outcome of the US Air Force C-130 accident, where the crew did jettison the load, is an example of when this action may not be sufficient to avoid a collision with terrain.
Windshear recovery procedure and training
It is acknowledged throughout the aerial firefighting industry that they operate in a challenging environment with elevated risk conditions. Windshear was a known phenomenon, which could be exacerbated by fire-associated winds that may be difficult to forecast and could be influenced by local terrain effects. Most of the operator’s crews interviewed reported encountering a windshear event during firefighting operations. The FAA study published in 2010 identified 3 categories of windshear mitigators: ground-based alerting systems, pilot training, and airborne detection systems.
Large air tanker firefighting operations were generally conducted away from airports often over inhospitable terrain. Therefore, it would be unlikely the ground-based systems, or weather-based monitoring from airports would be available for windshear alerting during a retardant drop.
The Lockheed Martin C-130 AFM had been updated prior to 2010 to include a section on adverse environmental conditions, which included a windshear recovery procedure. Although the FAA had approved the Coulson Aviation C-130 AFM in 2013, the operator had used an earlier version (1989) of a military document to develop the manual. This was consistent with comments provided by the FAA to the ATSB, where the documents and manuals for military surplus aircraft would normally be sourced from the military rather than the manufacturer. Therefore, the windshear recovery procedure was not included in the Coulson Aviation C-130 AFM.
While both the departures and standard operating procedures sections of the Company Operations Manual provided basic windshear recovery guidance for the C-130, it was not presented as an emergency procedure, nor did it consider any specific requirements for firefighting activities, such as the potential jettison capability offered by the retardant aerial delivery system. In addition, while this manual was applicable to all aircraft types, it was specifically developed for Australian operations only, although the company operated internationally. At least one of the operator’s C-130 pilots stated that they did not consider this manual to be the reference document for operating the aircraft, rather, the AFM and checklists were the appropriate source. This was consistent with the purpose of an AFM, which was to provide the procedures for operating the aircraft.
Although the PIC of B134 had completed an in-flight training scenario in 2019 that incorporated a simulated downdraft, the training generally focussed on responding to an emergency on the drop run, rather than specific to windshear. While a windshear encounter could be simulated airborne in the aircraft, it was not possible to replicate the effect on aircraft performance. Therefore, this would not provide pilots with the performance instrument indications that would be typically experienced. However, the operator provided their C-130 pilots with annual simulator training. While it was noted that a briefing on windshear recovery was incorporated into the training syllabus, there was no requirement to conduct a simulator-based low-level windshear recovery scenario as part of initial or recurrent training. This could provide crews with the experience needed to recognise the symptoms of windshear and practice a recovery procedure.
The operator also noted that most of their crews were former or current military pilots and would have received windshear training on a bi-annual basis when serving members. However, for those pilots no longer in the military, no recurrent training was provided by the operator to maintain proficiency in windshear recovery. Further, it was also recognised that the air drop scenario conducted in the military differed somewhat from a retardant drop. Most notably was the inclusion of the retardant aerial delivery system and capability to conduct an emergency dump to improve aircraft performance.
Research conducted on behalf of the FAA found that there was only about 5-15 seconds available for pilots to recognise and respond to a windshear encounter. Japanese research into pilot reactions to windshear on landing approach found that about 5.5 seconds was the average time to recognise a windshear event. As such, when in a low airspeed and low height scenario associated with a retardant drop, recognition and reaction to a significant windshear event must be prompt to avoid a collision. However, as no cockpit audio recording was available for the accident flight, it could not be determined if the crew had recognised that they very likely experienced a windshear event and/or had initiated a recovery. Despite this, an effective training program, using a combination of theory and practice, could provide pilots with the necessary skills and experience to recognise and respond to a low-level windshear encounter with minimal delay.
In multi-pilot operations, effective crew coordination and performance depends on the crew having a shared mental model of the task. This mental model is founded on operating procedures (ICAO, 2015). Such procedures are designed to help reduce variation within a given process and ensure operations are performed correctly. Without formal procedures, pilots are required to exercise judgement to the best of their abilities, based on their experience, skills and knowledge. Together, a recovery procedure specific to the nature of the operation supported by training, should provide pilots with a shared mental model of the symptoms and recovery actions for a windshear encounter.
Windshear system not fitted
Where it has been recognised that pilot awareness and training are not 100% effective for windshear avoidance, advanced warning systems are designed to detect and confirm the hazardous condition prior to the encounter. This provides additional time for the crew to increase the aircraft’s energy state and climb, so that any windshear encountered is at a higher, safer altitude. Alternatively, reactive systems alert the crew that they are experiencing windshear so that they can respond immediately, thereby minimising the time required for the crew to identify the situation before responding. These systems are particularly relevant to aerial firefighting aircraft, where there is an increased risk of encountering windshear, which is most hazardous in the low-level low‑speed environment where they regularly conduct operations. As noted by some pilots interviewed, the fitment of such a system was reported to have had a positive effect on their management of a windshear encounter.
While a birddog pilot could provide advanced warning of a windshear condition, there may not be enough time for the LAT crew to respond and avoid the encounter. In the 2012 US Air Force C‑130H accident, the birddog aircraft was about 1 NM (about 2 km) ahead when a warning was provided. This was insufficient for the C-130 crew to prevent a collision with terrain after experiencing low‑level windshear, despite conducting an emergency retardant jettison. It was also noted that LATs deployed as initial attack, such as in the case of the accident, will not have aerial supervision, or an aircraft providing a ‘show me’ run.
Airborne forward-looking, or predictive, windshear detection systems have been developed in response to commercial aviation accidents and have been shown to be around 95% effective (in simulator studies). It is acknowledged that the bushfire environment will be dry (low relative humidity) and the effectiveness of a forward-looking system may be reduced. However, the Lockheed Martin FireHerc aircraft, a civilian-certified aerial firefighting tanker is fitted with a windshear warning system. This would suggest these systems offer an enhanced level of safety for firefighting operations, in particular where operations are at low level in windshear prone environments, which would assist pilots in the early identification and/or potential avoidance of windshear, minimising any loss of aircraft performance. In addition, reactive systems are considered capable of confirming potentially hazardous windshear conditions in advance of human pilot recognition time. The activation of the warning on B137 at Adaminaby, and the crew’s subsequent response and adjustment of the drop location indicated a standard response to a windshear warning in aerial firefighting operations.
B134 and the operator’s other C-130 aircraft were not fitted with any windshear warning systems as these were not available at the time of manufacture and there was no regulatory or contract requirement to have them. The operator also indicated that they had not considered installing windshear detection systems into their C‑130 fleet when they were re‑purposed for firefighting activities.
Given the local weather conditions, the fact that B134 was very likely subjected to windshear, and the activation of the warning on B137 in similar environmental circumstances, it was possible that the crew of B134 would have also received a warning. If a warning had triggered, it was reasonable to expect that the crew would have responded. In addition, if this had occurred during the drop planning phase, it would have also assisted the crew in their hazard assessment and identification that the location was possibly unsuitable before committing to the drop run. If it had occurred during, or following the drop at Peak View, it would have provided immediate identification to all crew of the situation, assisting with timely recognition and response.
However, in the absence of an airborne system, windshear detection is reliant on the pilot’s assessment of the conditions based on the information available and their interpretation of that information. Without any known weather phenomena or reports from that location, detection is likely to be reactive, and dependent on the crew identifying a loss of aircraft performance. The recovery is subject to timely recognition and response, which could take 5 to 15 seconds and potentially result in further altitude loss. In this case, there was only 10-15 seconds and 330 ft between the degradation in climb performance and the impact.
Either a reactive or a predictive windshear detection system may have warned the crew of B134 of the actual or impending windshear and allowed for an earlier response. However, given the limited time and height available, it could not be determined if this would have been sufficient to have reduced the performance loss and prevent the accident. Despite this, research conducted on behalf of the FAA indicated that the risks associated with a windshear encounter would be reduced through a combination of pilot training and the use of on-board systems.
Initial attack certification
The NSW and ACT Aviation Standard Operating Procedures stated that aerial supervision was generally required for air tanker firefighting operations, except for those crew who were ‘initial attack certified’. While the RFS documentation did not define the requirements for this, their intention was to recognise the US Department of Agriculture, Forest Service (USFS) certification and for operators to ensure crews held this certification. However, without a definition, or any reference to the USFS certification in the procedures, this allowed individual operators to determine when pilots were initial attack capable, without necessarily having the official USFS certification. This was consistent with Coulson Aviation’s understanding, where they determined if a pilot was initial attack capable based on their internal training framework, rather than relying on the USFS certification. Despite this, this did not influence the development of the accident as the PIC of B134 held the initial attack certification from the USFS.
Standard operating procedures, among other risks controls, are fundamental for safe operations. They provide a common ground for users by ensuring consistency and predictability across all aspects of an operation. However, if procedures are not clearly defined, this results in a risk control not being applied as intended, lessening their effectiveness in managing safety. In this case, an individual operator may assess the capability of their pilots as satisfactory based on their own training, but it may not necessarily reflect the same requirements as that achieved through the USFS certification process.
Lack of recorded data
While the aircraft was not required to be fitted with a cockpit voice recorder (CVR) under the Australian or US regulations, it was a contract requirement in the US.
As detailed in the AFM supplement, when power was applied to the CVR, the system conducted a self-test, and the status of that test was presented to the crew. However, the CVR did not record the accident flight as a result of the inertia switch activating on a previous flight about 8 months prior. Subsequently, the aircraft was operated on multiple flights by several crews in the intervening period with the CVR in an unserviceable condition. It was very likely that the inertia switch had not been reset during that time as the checklist being used in B134 did not include the requirement for the crew to check the status of the CVR. None of the operator’s C‑130 crew interviewed were aware of this requirement.
While this had no influence on the accident, the CVR being inoperable resulted in a valuable source of information not being available to the investigation. This increased the time taken to determine the contributing safety factors, and restricted the extent to which important safety issues could be identified and analysed. The benefits of flight recorders were further outlined in the ATSB publication Black box flight recorders, which highlighted recorders, such as the CVR, could be an invaluable tool to assist in identifying the factors behind an accident. The CVR captured more than crew communications, it also captured the audio environment in the cockpit, which could include radio transmissions, aural alarms, switch activations and engine noise.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the collision with terrain involving Lockheed EC-130Q, registered N134CG (call sign B134), that occurred near Peak View, New South Wales, on 23 January 2020.
Contributing factors
Hazardous weather conditions were forecast and present at the drop site near Peak View, which included strong gusting winds and mountain wave activity, producing turbulence. These conditions were likely exacerbated by the fire and local terrain.
The Rural Fire Service continued the B134 tasking to Adaminaby when they learned that no other aircraft would continue to operate due to the environmental conditions. In addition, they relied on the pilot in command to assess the appropriateness of the tasking to Adaminaby without providing them all the available information to make an informed decision on flight safety.
The pilot in command of B134 accepted the Adaminaby fire-ground tasking, which was in an area of forecast mountain wave activity and severe turbulence. After assessing the conditions as unsuitable, the crew accepted an alternate tasking to continue to the Good Good (Peak View) fire-ground, which was subject to the same weather conditions. The acceptance of these taskings were consistent with company practices.
Following the partial retardant drop and left turn, the aircraft was very likely subjected to hazardous environmental conditions including low-level windshear and an increased tailwind component, which degraded the aircraft’s climb performance.
While at a low height and airspeed, it was likely the aircraft aerodynamically stalled, leading to a collision with terrain.
Coulson Aviation's safety risk management processes did not adequately manage the risks associated with large air tanker operations. There were no operational risk assessments conducted or a risk register maintained. Further, as safety incident reports submitted were mainly related to maintenance issues, operational risks were less likely to be considered or monitored. Overall, this limited their ability to identify and implement mitigations to manage the risks associated with their aerial firefighting operations. (Safety issue)
Coulson Aviation did not provide a pre-flight risk assessment for their firefighting large air tanker crews. This would provide predefined criteria to ensure consistent and objective decision-making with accepting or rejecting tasks, including factors relating to crew, environment, aircraft and external pressures. (Safety issue)
The New South Wales Rural Fire Service had limited large air tanker policies and procedures for aerial supervision requirements and no procedures for deployment without aerial supervision. (Safety issue)
The New South Wales Rural Fire Service did not have a policy or procedures in place to manage task rejections, nor to communicate this information internally or to other pilots working in the same area of operation. (Safety issue)
Other factors that increased risk
The B134 crew were very likely not aware that the 'birddog' pilot had declined the tasking to Adaminaby fire-ground, and the smaller fire-control aircraft had ceased operations in the area, due to the hazardous environmental conditions
In the limited time available, the remainder of the fire-retardant load was not jettisoned prior to the aircraft stalling.
Coulson Aviation did not include a windshear recovery procedure or scenario in their C‑130 Airplane Flight Manual and annual simulator training respectively, to ensure that crews consistently and correctly responded to a windshear encounter with minimal delay. (Safety issue)
Coulson Aviation fleet of C-130 aircraft were not fitted with a windshear detection system, which increased the risk of a windshear encounter and/or delayed response to a windshear encounter during low level operations. (Safety issue)
The New South Wales Rural Fire Service procedures allowed operators to determine when pilots were initial attack capable. However, they intended for the pilot in command to be certified by the United States Department of Agriculture Forest Service certification process. (Safety issue)
Other findings
The aircraft's cockpit voice recorder did not record the accident flight, which resulted in a valuable source of safety information not being available. This limited the extent to which potential factors contributing to the accident could be identified.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Rural Fire Service task rejection management
Safety issue number: AO-2020-007-SI-01 Safety issue description: The New South Wales Rural Fire Service did not have a policy or procedures in place to manage task rejections, nor to communicate this information internally or to other pilots working in the same area of operation.Safety issue description: The New South Wales Rural Fire Service did not have a policy or procedures in place to manage task rejections, nor to communicate this information internally or to other pilots working in the same area of operation.
Rural Fire Service aerial supervision requirements
Safety issue number: AO-2020-007-SI-02 Safety issue description: The New South Wales Rural Fire Service had limited large air tanker policies and procedures for aerial supervision requirements and no procedures for deployment without aerial supervision.
Initial attack certification
Safety issue number: AO-2020-007-SI-07 Safety issue description: The New South Wales Rural Fire Service procedures allowed operators to determine when pilots were initial attack capable. However, they intended for the pilot in command to be certified by the United States Department of Agriculture Forest Service certification process.
Coulson Aviation’s risk management processes
Safety issue number: AO-2020-007-SI-05 Safety issue description: Coulson Aviation's safety risk management processes did not adequately manage the risks associated with large air tanker operations. There were no operational risk assessments conducted or a risk register maintained. Further, as safety incident reports submitted were mainly related to maintenance issues, operational risks were less likely to be considered or monitored. Overall, this limited their ability to identify and implement mitigations to manage the risks associated with their aerial firefighting operations.
Windshear procedures and training
Safety issue number: AO-2020-007-SI-06 Safety issue description: Coulson Aviation did not include a windshear recovery procedure or scenario in their C‑130 Airplane Flight Manual and annual simulator training respectively, to ensure that crews consistently and correctly responded to a windshear encounter with minimal delay.
Windshear warning systems
Safety issue number: AO-2020-007-SI-04 Safety issue description: Coulson Aviation fleet of C-130 aircraft were not fitted with a windshear detection system, which increased the risk of a windshear encounter and/or delayed response to a windshear encounter during low level operations.
Pre-flight risk assessment tool
Safety issue number: AO-2020-007-SI-03 Safety issue description: Coulson Aviation did not provide a pre-flight risk assessment for their fire-fighting large air tanker crews. This would provide predefined criteria to ensure consistent and objective decision-making with accepting or rejecting tasks, including factors relating to crew, environment, aircraft and external pressures.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action by Coulson Aviation
The ATSB has been advised of the following proactive safety action taken by Coulson Aviation in response to this accident:
The Retardant Aerial Delivery system (RADS) software was reprogrammed so that the system would not require re-arming between partial load drops where less than 100% volume was selected.
Updated their pre-flight procedures to incorporate a cockpit voice recorder system check in their abbreviated checklist before each flight.
Glossary
ABM
Airbase manager, responsible for the supervision and coordination of airbase personnel and the layout and operation of an airbase.
ADS-B
Automatic dependent surveillance broadcast
AFM
Airplane Flight Manual. The aircraft manufacturer, Lockheed Martin, produced a C-130 AFM for military operations. When introducing the aircraft to the civilian register, the FAA required the operator to produce an AFM, meeting the FAA requirements. The operator’s AFM was based on the US Navy flight manual, but incorporated procedures and limitations for the intended use of the aircraft.
AGL
Above ground level
AMSL
Above mean sea level
ARO
Aviation radio operator
ATC
Air traffic control
B134
A Lockheed Martin C-130H aircraft, registered N134CG, a large air tanker with the callsign ‘Bomber 134’.
B137
A Boeing 737 aircraft, registered N137CG, large air tanker with the callsign ‘Bomber 137’.
Birddog
Birddog aircraft were used to lead large air tanker aircraft across the fire‑ground and provide guidance on the release of the water or fire suppressant (retardant or gel). The birddog crew consisted of a birddog pilot and a large air tanker air attack supervisor (LAT AAS).
CAS
Calibrated airspeed
CASA
Civil Aviation Safety Authority
COM
Company Operations Manual (Coulson Aviation). The COM was developed to contain the procedures, instructions and information required by CASA for the conduct of operations in Australia.
CVR
Cockpit voice recorder
ECG
Electrocardiogram
FAA
Federal Aviation Administration (US)
FCC
A Fire Control Centre forms the administrative and operational base of the rural fire district or zone. The coordination and management of local brigade responses to fire and other incidents was undertaken through the Fire Control Centre.
FRAT
Flight risk assessment tool
GPS
Global positioning system
IAS
Indicated airspeed
ICAO
International Civil Aviation Organization
Incident controller
The incident controller was responsible for all aspects of an emergency response, and managed the response, including the objectives, operations, and application of resources of the FCC.
Incident management team
The coordination and management of local brigade responses to fire and other incidents was undertaken through the incident management team, led by the incident controller.
Incident AAS
Incident air attack supervisor
LAT
Large air tanker. An aircraft with a minimum suppressant/retardant capacity of 3,000 US gallons (11,356 L).
LAT AAS
Large air tanker air attack supervisor (onboard the birddog aircraft)
MAFFS
Modular airborne firefighting system
NAFC
National Aerial Firefighting Centre. Formed by the Australian States and Territories in 2003, NAFC provided a cooperative national arrangement for combating bushfires by facilitating the coordination and procurement of specialised firefighting aircraft.
NSW
New South Wales
OLMS
Operational load monitoring system
PIC
Pilot in command
RAAF
Royal Australian Air Force
RADS
Retardant aerial delivery system XXL
RFS
Rural Fire Service (NSW)
SAD
State air desk. The state level multi agency team located in the State Operations Centre responsible for coordination of aircraft operations.
SMS
Safety management system. A systematic approach to organisational safety encompassing safety policy and objectives, risk management, safety assurance, safety promotion, third party interfaces, internal investigation and SMS implementation.
SOC
State operations controller roles was to maintain overall awareness of the firefighting effort across the state ensuring information and warnings are being distributed and resources are being allocated where needed. The SOC was located within the State Operations Centre.
State Operations Centre
State Operations Centre was located at NSW RFS Headquarters in Lidcombe and allows the RFS and its partners to effectively oversee and coordinate incidents. The staff within the Centre monitor developments, analyse their potential and provide a variety of specialised resources to the incident management teams and firefighters on the ground.
TAS
True airspeed
US
United States
USFS
US Department of Agriculture, Forest Service
Sources and submissions
Sources of information
The sources of information during the investigation included:
Coulson Aviation
Coulson Aviation current and former personnel
other C-130 crews and maintenance staff
New South Wales Rural Fire Service
Lockheed Martin
a number of witnesses
Royal Australian Air Force
Defence Flight Safety Bureau
the Bureau of Meteorology
ATSB aviation medical specialist
Rolls Royce
Hamilton Sundstrand
National Aerial Firefighting Centre
CAL FIRE
Airservices Australia
United States Federal Aviation Administration
United States Department of Agriculture, Forest Service
Canadian Transportation Safety Board
next-of-kin
video footage of the accident flight
recorded data from automatic dependent surveillance broadcast (ADS-B), SkyTrac and historic data for the operational load monitoring system.
Australian Transport Safety Bureau (2004) Risks associated with aerial campaign management: Lesson from a case study of aerial locust control. Retrieved from /publications/2005/aerial_locust_control/
Australian Transport Safety Bureau (2015) Pilot incapacitation occurrences 2010-2014. Retrieved from /publications/2015/ar-2015-096/
Bowles, R. L. (1990) Reducing Windshear Risk Through Airborne Systems Technology. Proceedings of 17th Congress of the International Council of the Aeronautical Sciences, pp 1603-1630.
International Civil Aviation Organization (2015). Model advisory circular for air operator's: Standard Operating Procedures for Flight Deck Crewmembers, Montreal: ICAO.
Mosier, KL, Fischer, U, Cunningham, K, Munc, A, Reich, K, Tomko, L, and Orasanu, J (2012) Aviation decision making issues and outcomes: Evidence from ASRS and NTSB reports, Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 56(1):1794-1798.
Tsukagoshi, H. (1999) Another look at windshear accidents. Proceedings of the International Society of Air Safety Investigators annual seminar, pp 67-86.
US Air Force (2012) Aircraft accident investigation, C-130H3, T/N 93-1458, Edgemont, South Dakota, 1 July 2012. United States Air Force Aircraft Accident Investigation Board Report.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Coulson Aviation
New South Wales Rural Fire Service
Coulson Aviation personnel
Lockheed Martin
Royal Australian Air Force Aircraft Research and Development Unit
the Bureau of Meteorology
ATSB aviation medical specialist
National Aerial Firefighting Centre
Civil Aviation Safety Authority
United States National Transportation Safety Board
the birddog pilot.
In addition, the draft report was sent to the NSW State Coroner for information.
Submissions were received from:
Coulson Aviation
New South Wales Rural Fire Service
Royal Australian Air Force Aircraft Research and Development Unit
the Bureau of Meteorology
Civil Aviation Safety Authority
the birddog pilot.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Interim report
Report release date: 24/09/2020
This interim report details factual information established in the investigation’s evidence collection phase and has been prepared to provide timely information to the industry and public. Interim reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this interim report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Fire situation in the Snowy Mountains region
On 23 January 2020, the Snowy Mountains region in New South Wales (NSW) had a severe fire danger rating,[1] due to high temperatures, strong winds and forecast thunderstorms. This region included the Adaminaby and Good Good fire-grounds, which were both under the control of the Cooma Fire Control Centre (FCC).
At about 1100 Eastern Daylight-saving Time,[2] the Cooma FCC incident commander made a call to the NSW Rural Fire Service (RFS) State Operations Centre, to discuss the escalating fire danger at the Adaminaby fire-ground. During that call, it was noted that the smaller firefighting aircraft were not flying in the area due to strong winds and poor visibility. Consequently, a birddog[3] and two large air tankers (LAT) were tasked by the State Operations Centre to the Adaminaby fire-ground: a Rockwell International 690-B aircraft; a Boeing 737 aircraft, registered N137CG, call sign ‘Bomber 137’ (B137); and a Lockheed EC130Q[4] aircraft, registered N134CG, call sign ‘Bomber 134’ (B134). All three aircraft were based at Richmond Royal Australian Air Force (RAAF) Base, NSW, about 316 km north-east of the Adaminaby fire-ground.
‘B137’ tasking to Adaminaby
At about 1121, B137 had commenced taxiing at Richmond for a task when the crew were re‑tasked to the Adaminaby fire-ground. The aircraft subsequently departed at 1127, with the crew having been notified by the Richmond airbase manager[5] that there was no birddog in the area, and that it ‘is very windy down there’.
The birddog pilot had experienced moderate to severe turbulence in the Snowy Mountains region about 2 weeks prior to the day of the accident. On receipt of the tasking to Adaminaby, the birddog pilot reviewed the weather and concluded that the conditions were forecast to be worse than previously experienced, and therefore declined the task. In addition, as B137 was already en route to Adaminaby, the crew of that aircraft would be able to provide a report to the birddog pilot and other crews of the actual conditions.
At about 1155, B137 arrived overhead the Adaminaby fire-ground. At interview, the pilot in command (PIC) of B137 reported the wind speed at the Adaminaby fire-ground was 50 kt[6] at 800 ft above ground level (AGL), and about 37 kt at the retardant drop height of 200 ft AGL. While assessing the conditions in the Adaminaby area, the crew reported experiencing uncommanded aircraft rolls up to 45° angle of bank (due to wind) and a windshear[7] warning from the aircraft on‑board systems. The PIC of B137 elected to operate on the upwind side of the hills to avoid lee‑side mechanical turbulence.[8] At about 1225, B137 departed the Adaminaby fire‑ground, having successfully deployed a retardant load.
After completing the retardant drop, the B137 crew sent a text message to the birddog pilot assigned to the Adaminaby fire-ground indicating that the conditions were ‘horrible down there. Don’t send anybody and we’re not going back’. They also reported to the Cooma FCC that the conditions were unsuitable for firebombing operations. During B137’s return flight to Richmond, the Richmond air base manager requested that they reload the aircraft in Canberra and return to Adaminaby. The PIC replied that they would not be returning to Adaminaby due to the weather conditions.
‘B134’ tasking at Adaminaby
While B137 was still at the fire-ground, at about 1205, B134 departed Richmond with the PIC, co‑pilot and flight engineer on board.
At about 1235, the PIC of B137 had a conversation with the PIC of B134 on their designated operating frequency, to inform them of the actual conditions, and that they would not be returning to Adaminaby. At that time, B134 was about 112 km north-east of Adaminaby, en route to the Adaminaby fire-ground.
At about 1242, the crew of B134 contacted air traffic control (ATC), advising them of the co‑ordinates they would be working at, provided an ‘ops normal’[9] call time, and confirmed there was no reported instrument flight rules[10] traffic in the area. About 5 minutes later, the Richmond air base manager also attempted to contact B134 to confirm ‘ops normal’, firstly by radio, and then by text to the PIC’s mobile phone, but did not receive a response.
The automatic dependent surveillance broadcast (ADS-B) data showed that after arriving at the Adaminaby fire-ground (Figure 1), the crew of B134 completed several circuits at about 2,000 ft AGL.[11] At about 1255, the crew contacted the air operations officer at the Cooma FCC by radio and advised them that it was too smoky and windy to complete a retardant drop at that location. The Cooma air operations officer then provided the crew with the location details (co‑ordinates) of the Good Good fire, about 58 km to the east of Adaminaby, with the objective of conducting structure and property protection near Peak View.
Figure 1: Flight path overview (in white), including the times and locations of where the crew of B134 was in communication with others
Source: Google earth and ADS-B data, annotated by the ATSB
‘B134’ tasking at the Good Good fire-ground
At 1259, the crew of B134 contacted ATC, to advise them that they had been re‑tasked to the Good Good fire-ground for a retardant drop and provided the updated co‑ordinates. At about the same time, the RFS ground firefighters at the Good Good fire-ground, near Feeney’s Road in Peak View, contacted the Cooma FCC and requested additional assets for property protection. They were advised that a LAT would be passing overhead in about 10 minutes. The firefighters acknowledged the intention of a LAT drop, and advised the Cooma FCC they would wait in open country on Feeney’s Road, clear of the properties targeted for protection.
At about 1307, B134 arrived overhead the drop area (Figure 2). From the aircraft’s recorded tracking data, the crew conducted three left circuits, at about 1,500 ft, 500 ft and 1,000 ft AGL respectively, prior to commencing the drop circuit.
At 1315:15,[12] the retardant drop was conducted on a heading of about 190° and at about 190 ft AGL (3,595 above mean sea level (AMSL)) with a drop time of about 2 seconds. During the drop, about 1,200 US gallons (4,500 L) of fire retardant was released. Witness video footage and images showed that at the commencement of the drop, the aircraft was at an approximate bank angle of 10°, with the flaps set at 100 per cent. A ground speed of 144 kt was recorded at the time of the drop.
Figure 2: B134’s approach and circuits overhead the drop location, and the position of the firefighters
Source: Google earth and Skytrac data, annotated by the ATSB
The ATSB’s analysis of the witness videos found that, at the completion of the drop at 1315:17, the aircraft was observed to be banked about 17° to the left (Figure 3). About 4 seconds after the drop at 1315:21, the aircraft had a pitch-up attitude of about 12°, with an increase to about 30° angle of bank. Over the next 1.5 seconds, the aircraft’s angle of bank and pitch attitude reduced to about 22° and 10° respectively. The aircraft then became obscured by smoke.[13]
While being intermittently obscured by smoke, a positive rate of climb was achieved for about 10 seconds, with the aircraft climbing to about 330 ft AGL (3,770 ft AMSL) at 1315:27. Just prior to this, from about 1315:25, a right roll was observed on the video. The video captured the aircraft at about an 18° left angle of bank at 13:15:25, and then at about a 6° right angle of bank at 13:15:27. At the same time, the aircraft pitch attitude had decreased to about 6°. Following this, the aircraft was then observed descending. A further 7 seconds after this, at 1315:34, the aircraft was seen at a very low height above the ground, in a left bank. Throughout this period, the recorded groundspeed increased slightly to a maximum of 151 kt.
Shortly after, at about 1315:37, the aircraft collided with terrain and a post-impact fuel-fed fire ensued. The three crew were fatally injured and the aircraft destroyed.
A review of the Airservices Australia audio recording of the applicable air traffic control frequency found no distress calls were received by ATC prior to the impact.
Figure 3: Aircraft attitude and approximate flight path at key times
Source: Google earth, witness videos and Skytrac data, annotated by the ATSB
Context
Operator
Coulson Aviation are a USA (US) based operator, with US registered aircraft and US licensed crew contracted to Australia for the 2019/2020 fire season through the National Aerial Firefighting Centre. At the time of the accident, Coulson Aviation had a fixed wing fleet in Australia consisting of two C130 aircraft, and one Boeing 737 aircraft. They also provided flight crews for the NSW RFS Boeing 737 which had previously been purchased from Coulson Aviation in 2019.
The RFS subsequently contracted one C130 and one 737 from Coulson Aviation via a service agreement subject to the National Aerial Firefighting Centre contract. Following the Australian fire season, the aircraft and crews then return to North America for heavy maintenance and recurrent training prior to the US fire season.
Crew information
Pilot in command
Qualifications and experience
The PIC was initially trained as a navigator and pilot in the United States Air National Guard. During this time, the PIC gained experience in firefighting operations through the modular airborne firefighting system (MAFFS)[14] program. The PIC subsequently joined the operator in 2015 on a part-time basis, before being employed full-time in 2017.
The PIC’s logbook, combined with the operator’s records for the accident aircraft showed that the pilot had a total flying experience of about 4,010 hours, which included 3,010.3 hours in the C130 aircraft, and 994 air tanker drops. The PIC had also accrued a further 1,616.8 hours as a flight navigator.
The PIC held a current airline transport pilot certificate with ratings for multi-engine land aircraft including the EC130Q, issued by the US Federal Aviation Administration (FAA) on 13 October 2017. The PIC’s most recent flight instructor certificate with ratings for multi-engine and instrument aircraft was issued by the FAA on 6 April 2019. On 18 April 2019, the PIC’s latest airplane pilot qualification card was issued from the US Department of Agriculture, Forest Service,[15] for the C130 aircraft, which included the authorised missions of: Low level (below 500 ft above ground level); Mountainous terrain; and Airtanker Initial Attack. An air tanker initial attack qualification allows a pilot to conduct fire retardant drops without the supervision of a birddog or air tactical supervisor.
The PIC’s most recent first-class medical examination was on 5 September 2019, with the certificate issued with a limitation to wear corrective lenses.
Training
The PIC’s training with the operator in March and April 2019[16] included annual C130 simulator training, controlled flight into terrain awareness, and crew resource management. In addition, the PIC completed two assessed training flights with the operator in the C130 on 14‑15 April 2019. The training flight on 14 April included approach to stalls in the circuit (50 per cent flap) and drop (100 per cent flap) configurations, and go-arounds with a full load. The flight on 15 April included drop planning (hazards, tactics, ingress, egress and dry run) and an emergency on the drop run. The drop run emergency was a simulated ‘down air’ [downdraught] with the comment ‘Jettison for down air’. All the assessed sequences, which included jettison of the load during an emergency condition,[17] were recorded as satisfactory.
Co-pilot
The co-pilot had joined the operator in September 2019, after 20 years in the military, including experience flying the C130. This was the co-pilot’s first fire season. The co-pilot’s logbook combined with the operator’s records showed a total flying experience of about 1,744 hours, of which about 1,364 were on the C130. The co-pilot held a current airline transport pilot certificate and ratings for multi-engine land aircraft, including the EC130Q (second-in-command privileges only), issued by the FAA on 7 November 2019. The co-pilot also held a flight instructor certificate with ratings for single, multi-engine and instrument aircraft, issued by the FAA on 14 August 2019. The co-pilot’s most recent first-class medical examination was issued on 17 July 2019 with no limitations.
The co-pilot’s check flight with the operator was completed on the C130 on 12 September 2019, and was assessed as satisfactory against the qualification standards for second-in-command. On 13 September 2019, the co-pilot completed the operator’s crew resource management and controlled flight into terrain awareness courses, and reviewed the US Department of Agriculture Forest Service’s air tanker pilot training video.
On 16 September 2019, the co-pilot was issued with an airplane pilot qualification card from the US Department of Agriculture Forest Service for the C130 aircraft, which included the authorised missions of: Low level (below 500 ft above ground level); Mountainous terrain; and Airtanker SIC (second-in-command).
Flight engineer
The flight engineer joined the operator in November 2019, after about 25 years in the US military. This was the flight engineer’s first fire season. The flight engineer held a flight engineer certificate with a rating for turbo-propeller powered aircraft, issued by the FAA on 20 November 2019. On the flight engineer application form, the flight engineer reported accruing 4,050 hours on the C130 aircraft. The flight engineer also held a mechanic certificate with ratings for airframe and powerplant, issued by the FAA on 2 June 2019. The flight engineer’s most recent second-class medical examination was issued on 27 August 2019 with no limitations.
The flight engineer’s check flight was completed with the operator on 20 November 2019. In addition to this check flight, the FE completed two air tanker drops with a supervising flight engineer in Australia on 12 January 2020.
72 hour prior history
The PIC and co-pilot commenced work in Australia on 1 December 2019 and the flight engineer on 13 January 2020. Each crew member’s roster cycle was 14 duty days followed by two rest days. The operator’s records show they signed on between 0800 and 1000, and signed off between 1700 and 2100, with their duty times varied between 7.5 and 12 hours per day.
The accident flight occurred on the PIC’s 9th day, and the co-pilot’s and flight engineer’s 11th day of their respective current duty periods.
Table 1, based on the operator’s records, details the crew’s sign on and sign off times for the 3 days before the accident. On 23 January 2020, the crew signed on at 0900.
Table 1: B134 crew working hours
20 January
21 January
22 January
Sign on
1000
0800
1000
Sign off
1800
1700
1900
Information from the crew’s telephones and hotel records, in addition to work and flying duties, were used to determine their activities in the previous days. There were no indications of fatigue for the three crew members. However, there was insufficient information available to the ATSB about their sleep and non-duty activities to estimate fatigue levels with confidence.
Aircraft information
General information
The C130 is predominantly an all-metal, high-wing aircraft, designed for military operations. The accident aircraft (Figure 4) was manufactured in 1981 and was powered by four Allison T56-A-15 turboprop engines, fitted with Hamilton Sundstrand 54-H60-91 four blade propellers. The T56‑A‑15 is a constant speed engine, with a variable pitch propeller.
Previously owned by the US Navy, the aircraft was transferred to the US National Aeronautics and Space Agency (NASA) in 1992 and later placed in storage. It was removed from storage, re‑purposed for firefighting activities by the operator and registered in the restricted category.[18] Initially registered as N130CG in 2018, its registration was later changed to N134CG in April 2019. The modifications included the installation of an avionics package and firefighting tank system, known as the Retardant Aerial Delivery System XXL (RADS).
Figure 4: N134CG
Source: Coulson Aviation
Maintenance history
The aircraft had a total time-in-service of 11,888 hours and had accrued 683 hours of firefighting operations since the tanker conversion in 2018.
N134CG arrived in Australia in November 2019. The aircraft had a current certificate of airworthiness, and was maintained in accordance with an FAA approved program. The last daily inspection conducted on 22 January 2020, at the end of the day’s flying activities the day before the accident, identified the propeller anti-icing system on engine number 2 was unserviceable, and rectification had been deferred in accordance with the minimum equipment list.[19]
In addition to a maintenance requirement to perform engine power efficiency checks at 150-hour intervals, the operator reported pilots were required to perform power checks before every take off, with operations only permitted if a minimum performance requirement of 95 per cent was met.
Retardant Aerial Delivery System XXL
The Retardant Aerial Delivery system (RADS) included a 4,000 US gallon (15,000 L) tank system located within the aircraft’s fuselage. The system could deliver discrete quantities of retardant, dependant on the duration that the doors remained open. It was controlled from the cockpit, with drop controls located on both the PIC and co-pilot yokes.
The drop quantity could be controlled either as a pre-set percentage by the crew, or alternatively, if selected at 100 per cent, the crew could control the amount of retardant released by holding the button until the desired amount was dispensed. The RADS system was designed that, if less than 100 per cent volume was selected, the system would disarm after a partial load drop, and the crew would need to re-arm the system to complete further releases. It was reported that the crew on B134 normally selected 100 per cent volume and released the drop button once the desired amount had been dispensed.
The system also included a guarded emergency dump switch, located in reach of all three crew members, which would fully open the doors and jettison the load in a period of about 2 seconds. Following an emergency dump, the doors would remain open until the RADS was reset by the crew.
Weight and balance
The last weight and balance report for the aircraft, in April 2019, showed its basic empty weight was 75,794 lb (35,380 kg) and according to the RADS flight manual supplement, the maximum take-off weight was 150,718 lb (68,365 kg). The aircraft flight and maintenance log entry for 22 January 2020 indicated the PIC had the aircraft refuelled to a total of 34,000 lb (15,422 kg) at the completion of flying the previous day. The operational load monitoring system[20] indicated there was 35,514 lb (16,109 kg) of retardant on board prior to the drop, in addition to which the aircraft carried a 2,000 lb (907 kg) pallet of gel. This resulted in a take-off weight of about 147,253 lb (66,826 kg) and centre of gravity at the aft limit.
Using the operator’s reported fuel consumption for air tanker drop missions of 5,000 lb/h (2,268 kg/h) for a 70 minute flight, and the retardant drop of 10,764 lb (4,882 kg), the estimated post-drop weight was 130,656 lb (59,265 kg). The centre of gravity remained close to the aft limit, which was consistent with the reports from the operator’s other crews that the location of the RADS tank in the aircraft meant there was no appreciable change in the centre of gravity following a retardant drop.
Meteorological information
Bureau of Meteorology forecasts
A Bureau of Meteorology graphical area forecast was issued at 0924 and was valid for the time of the flight. It forecast moderate mountain wave activity[21] above 3,000 ft AMSL and severe turbulence below 8,000 ft AMSL in the area of operation from Richmond to Cooma. This included the Adaminaby and Good Good fire-grounds. In addition, a SIGMET[22] issued at 0947, and valid for the flight, forecast severe turbulence[23] below 10,000 ft AMSL for the area.
The aerodrome forecast for the Cooma-Snowy Mountains Airport,[24] located 50 km south-west of the accident site was amended at 0948. It indicated wind speeds of 25 kt, gusting to 48 kt, with a mean wind direction of 300° from 1100 and visibility reduced to 8,000 m in light showers. Severe turbulence below 5,000 ft AGL was forecast from 0900-1500, and a PROB30[25] for visibility reduced to 2,000 m in blowing dust and a broken[26] layer of cloud at 1,000 ft AGL was forecast for the period 1100–1700.
At 1012, the Richmond air base manager sent a text message to the air tanker and birddog pilots to advise them of an airport warning for wind gusts in excess of 35 kt between 1000 and 1700 at the Richmond base.
Observations of the weather in the area
Other fire control aircraft
On the day of the accident, several fire-control aircraft, primarily consisting of fixed-wing Air Tractors and Bell 206 helicopters, were operating from the Polo Flat airstrip, located 33 km south-west of the accident site. The Cooma FCC received reports of strong winds in the area from the fire-control pilots in the early morning. This included winds of 30-40 kt at 0839, 40-50 kt at 0902, and 52 kt at 0937. All fire-control aircraft had departed the area or landed by 1030.
Additionally, the flight crew of B137 reported that the wind conditions at Adaminaby at about 1200 were 50 kt at 800 ft AGL, and about 37 kt at 200 ft AGL.
Witness reports
Following the accident, the ATSB received multiple witness reports of the weather conditions at Peak View. They all consistently reported very strong winds from the north-west, with gusts up to 43 kt recorded at ground level. One resident noted that, although the prevailing wind was from the north-west, the direction and strength at ground level were also being influenced by the local terrain.
Weather station recorded conditions
About 12 minutes prior to the accident, the Cooma-Snowy Mountains Airport weather station indicated a wind speed of 25 kt, gusting to 39 kt, from a direction of 320°. The visibility was 6,000 m, with a QNH[27] of 1002 hPa and temperature of 26 °C.
A personal weather station at Peak View, located about 1.3 km from both the drop and accident sites (Figure 5) recorded the conditions twice per hour. At about 1309 (7 minutes prior to the accident), the station recorded a mean wind of 15 kt from the west and a peak gust of 32 kt from the north.[28] At about 1330 (14 minutes after the accident), the station recorded a mean wind of 16 kt from the west and a peak gust of 42 kt from the north-west.
Figure 5: Accident circuit with predominant wind direction and terrain
Source: Google earth and SkyTrac data, annotated by the ATSB
Bureau of Meteorology analysis
The Bureau of Meteorology analysed the conditions on the day and indicated that a cold front was approaching the accident location, with hot and strong north to north-westerly winds ahead of the front. High resolution weather model data indicated the winds at 5,000 ft AMSL were about 45 kt from the north-west, increasing in strength with height up to 80 kt from the north-west at 10,000 ft AMSL. They reported that their analysis of the weather conditions in the accident area was consistent with what was forecast on the day.
The Bureau of Meteorology considered the conditions on the day were favourable for mountain wave development, and satellite imagery of cloud formations confirmed their presence in the general area of the accident. However, they were unable to determine the severity of the mountain wave activity from the data available.
Recorded information
Cockpit voice recorder
Cockpit voice recorders (CVR) are designed on an endless loop principle, where the oldest audio is continuously overwritten by the most recent audio. The CVR fitted to the aircraft was a Universal Avionics Model CVR-30B, part number 1603-02-03 (Figure 6). This solid-state memory CVR recorded crew and cockpit audio for a recording duration of at least 30 minutes. While the aircraft was not required to be fitted with a CVR under US or Australian regulations, it was required under contract requirements in the US.
Figure 6: N134CG cockpit voice recorder
Source: ATSB
The CVR was recovered from the aircraft and transported to the ATSB’s technical facility in Canberra, Australian Capital Territory, on 25 January 2020 for examination and download. The CVR was successfully downloaded, and the recording downloaded contained 31 minutes of audio. However, the audio was from a previous flight when the aircraft was operating in the US. No audio from the accident flight was recorded on the CVR.
Inertia switch
The power supply for the CVR was fitted with an inertia switch. Inertia switches are designed to stop the recording function by removing power to the CVR when a pre-set deceleration force is detected. The recovered audio was of crew training flights undertaken on 7 May 2019 near Sacramento McClellan Airport, California. The audio included four landings conducted as part of the training in the aircraft on that day. The recording ceased immediately after the fourth landing, and the post-landing taxi and engine shutdowns were not recorded. It was likely that the inertia switch was activated during this landing and consequently disconnected power to the CVR.
Pre-flight testing
Following a CVR installation in an aircraft, supplemental material related to the operation of the CVR must be attached to the approved airplane flight manual. The supplement for the aircraft indicated the CVR conducted a self-test at power up, and the status of the CVR would be presented to the crew on the CVR control unit, located on the co-pilot side console. A CVR system check was not included in any of the operator’s checklists, and none of the operator’s flight crew were aware of the need to check this system status prior to flight.
Flight data
The aircraft was not fitted with a flight data recorder, nor was it required to be by Australian or US regulations. However, contracting requirements in the US required the aircraft be fitted with an operational load monitoring system, which was located behind the centre wing section in the fuselage. This recording device had no impact or fire protection and was destroyed in the accident sequence.
The aircraft was also fitted with SkyTrac, a tracking system that can transmit the aircraft’s position in real-time. This system was able to be monitored by the NSW RFS, and generally had an update rate of about 1 minute. The SkyTrac unit was recovered from the wreckage and transported to the ATSB’s technical facility for examination and download. The SkyTrac unit recorded data at 5 second intervals.
Data broadcast by the ADS-B equipment fitted to the aircraft for ATC purposes was also obtained from various providers. ADS-B data is transmitted nominally every 0.5 seconds; not all transmission were available, with gaps of up to 5 seconds during the accident flight. Table 2 shows the parameters recorded by SkyTrac and ADS-B.
Table 2: SkyTrac and ADS-B recorded parameters
SkyTrac
ADS-B
time
time
latitude and longitude
latitude and longitude
groundspeed (GPS)
groundspeed
altitude (GPS)
pressure altitude
track (GPS course)
track
vertical rate of climb/descent
A detailed review of the available recorded data is ongoing and will be included in the ATSB’s final investigation report.
Witness video
Two firefighters were located on Feeney’s Road (800 m from the accident site), and videoed the aircraft during the retardant drop and subsequent accident. Overall, the video footage had a duration of 37 seconds. It captured the aircraft from 10 seconds prior to the drop, the drop, and 4 seconds after the drop, when the aircraft became obscured by smoke, and was only intermittently visible. Eleven seconds after being obscured by the smoke, the aircraft was seen at low level, followed by a collision with terrain and post-impact fire. The ATSB’s analysis of this footage is continuing and will be included in the final investigation report.
Wreckage and impact information
Accident site
The accident site was located on slightly sloping, partially wooded terrain, near Peak View, 50 km north-east of Cooma-Snowy Mountains Airport. The wreckage trail (Figure 7) was approximately on a heading of 100°, with the initial impact at an elevation of about 3,440 ft AMSL. The debris trail began at the lower end of the slope, with the wreckage distributed linearly over about 180 m.
Figure 7: Accident site overview showing the wreckage trail
Source: ATSB
Wreckage examination
The ATSB’s on-site examination of the wreckage, damage to the surrounding vegetation, and ground markings, indicated that the aircraft initially impacted a tree in a left wing down attitude, of about 55°, before colliding with the ground. An intense post-impact fuel-fed fire destroyed the aircraft. The ATSB’s on-site examination (Figure 8) also found:
no pre-existing airframe issues
all major sections of the aircraft’s structure were identified and there was no evidence of an in‑flight break-up or pre-impact structural damage[29]
the cockpit and associated avionics were identified about two-thirds of the way along the wreckage trail
the cockpit and forward section of the airframe had separated from the fuselage, was inverted, and had been destroyed in the impact and subsequent fire
sections of the wing skin, leading edge spar, wing tips and portions of the wings were identified along the wreckage trail, having fragmented during the impact sequence, and sustained further damage during the resultant fire
all flight control surfaces were identified, however, due to the impact and fire, flight control continuity could not be established
the four engines and 16 propeller blades were located on-site and some of the propeller blades remained attached to the propeller hubs, while others had detached through impact forces
there were varying degrees of damage observed across the four engines, likely due to the impact sequence of each engine, with the damage indicating the engines were rotating at impact.
The RADS tank remained upright (Figure 8), along with the aft section of the fuselage, with the vertical and horizontal stabilisers attached. There was no retardant identified between the drop area and the initial impact location, however, a large amount of retardant was located in the wreckage near the tank. The system was badly damaged, with the doors fragmented throughout the wreckage, and its operational state could not be established.
Figure 8: Main aircraft wreckage components
Source: ATSB
Aircraft configuration
The aircraft was equipped with four trailing edge flaps. All flaps had separated from the aircraft during the impact sequence. On-site measurements of the flap screw jacks indicated the flaps were set at 50 per cent at impact. This was consistent with the expected setting following a retardant drop. Due to the extent of damage, the elevator, aileron and rudder trim settings could not be established.
Fuel testing
Fuel samples were retained from the two fuel tankers that last serviced the aircraft and from the refuelling storage tank at Richmond. The fuel samples were independently tested by a commercial fuel company for correct specifications, with nil abnormal indications found. In addition, there were no reports of fuel quality concerns with any other aircraft using the same fuel source.
Engine and propeller examinations
With the assistance of the Australian Army, the engines, partial remnants of the reduction gearboxes, propeller assemblies and blades were transported to a secure hangar at Richmond RAAF Base for further examination.
The engine manufacturer attended the engine inspections, where it was confirmed that all engines were rotating at impact, and there were no noted pre-existing issues. As power changes are controlled by changes to the propeller blade pitch while maintaining a constant engine speed, the engine power levels were determined from the blade pitch angle at impact.
During the propeller hub assembly inspection, measurements of the internal components were recorded. The ATSB consulted the propeller manufacturer to determine the propeller blade angles at impact and establish engine power levels. The propeller manufacturer concluded the following:
The calculations indicate that, based on the operating conditions estimated by the ATSB, all the propellers were absorbing power from their respective engines and were producing positive thrust. The horsepower computed for each of the four engines are within the normal operating range for the T56 engine installed on this aircraft.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk.
The ATSB has been advised of the following proactive safety action taken by Coulson Aviation in response to this accident:
The Retardant Aerial Delivery system (RADS) software was reprogrammed so that the system will not require re-arming between partial load drops where less than 100 per cent volume is selected.
Updated their pre-flight procedures to incorporate a cockpit voice recorder system check before each flight.
Ongoing investigation
To-date, the ATSB has interviewed Coulson Aviation pilots and key personnel, NSW RFS personnel involved in the large air tanker and aviation operations, witnesses, C130 and other aerial firefighting pilots, and key personnel in overseas aerial firefighting operations. In addition, the ATSB has conducted a detailed examination of the aircraft, engines and propellers; reviewed recorded RFS radio calls; and engaged C130 subject matter experts.
The investigation is continuing and will include consideration of the following:
ongoing analysis of recorded data, including the on-board systems and witness videos
aircraft performance and handling characteristics
review and analysis of environmental influences
operating policies and procedures
aircraft maintenance history
cockpit instruments examination
crew health and medical history
similar occurrences.
Should a critical safety issue be identified during the course of the investigation, the ATSB will immediately notify relevant parties so appropriate and timely safety action can be taken.
A final report will be released at the conclusion of the investigation.
This interim report details factual information established in the investigation’s evidence collection phase and has been prepared to provide timely information to the industry and public. Interim reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this interim report is released in accordance with section 26 of the Transport Safety Investigation Act 2003.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Sequence of events
On 23 January 2020, at about 1205 Eastern Daylight-saving Time,[1] a Lockheed EC130Q (C‑130) aircraft, registered N134CG and contracted to the New South Wales (NSW) Rural Fire Service, departed Richmond RAAF Base, NSW. The crew had been tasked with a fire retardant drop over the ‘Adaminaby Complex’ bush fire.
After approaching the Adaminaby complex fire, the drop was unable to be completed and the aircraft was diverted to a secondary tasking, to drop retardant on the ‘Good Good’ fire (Figure 1). Witnesses reported seeing the aircraft complete a number of circuits, prior to completing the retardant drop. The drop was conducted on a heading of about 190°, at about 200 ft above ground level, with a drop time of approximately 2 seconds. The crew released about 1,200 US gallons (4,500 L) of fire retardant during the drop.
Figure 1: Flight path of N134CG (white)
Source: Google Earth, Aireon and RFS tracking data, annotated by the ATSB
Witness videos taken of the aircraft leading up to the accident showed a number of passes conducted at varying heights prior to the retardant drop. Following the retardant drop (Figure 2), the aircraft was observed to bank left, before becoming obscured by smoke[2] after about 5 seconds. A further 15 seconds after this, the aircraft was seen flying at a very low height above the ground, in a left wing down attitude. Shortly after, at about 1316, the aircraft collided with terrain and a post-impact fuel-fed fire ensued. The three crew were fatally injured and the aircraft was destroyed.
Figure 2: Overview of the drop zone (red fire retardant) and accident location
Source: ATSB
A review of the Airservices Australia audio recording of the applicable air traffic control frequency found no distress calls were made by the crew prior to the impact.
Wreckage and impact information
The accident site was located on slightly sloping, partially wooded terrain, about 50 km north-east of the Cooma-Snowy Mountains Airport. The wreckage trail (Figure 3) was approximately on a heading of 100°, with the initial impact at an elevation of about 3,440 ft above mean sea level.
The ATSB’s on-site examination of the wreckage, damage to the surrounding vegetation, and ground markings indicated that the aircraft initially impacted a tree in a left wing down attitude, before colliding with the ground. The post-impact fuel-fed fire destroyed the aircraft. The examination also found that an emergency dump of the fire retardant had not been activated.
The engines, propellers, and several other components have been retained by the ATSB for further examination.
Figure 3: Aircraft impact and wreckage
Source: ATSB
Aircraft information
The Lockheed C-130 is predominantly an all-metal, high-wing aircraft, largely designed for military operations. The aircraft was manufactured in 1981 and was powered by four Allison T56-A-15 turboprop engines, fitted with Hamilton Sundstrand 54-H60-91 four blade propellers. Previously owned by the United States Navy, the aircraft was re-purposed for firefighting activities and registered as N134CG in 2018 (Figure 4). The modifications included the installation of an avionics package and firefighting tank system known as Retardant Aerial Delivery System XXL (RADS).
The RADS included a 4,000 US gallons (15,000 L) tank system located within the aircraft’s fuselage. The system was capable of delivering discrete quantities of retardant, dependent on the duration that the doors remained open. It was controlled from the cockpit, with drop controls located on both the pilot and copilot yokes. The system also included an emergency dump switch, which, when activated, fully opened the doors and jettisoned the load. The doors remained open until the RADS was reset by the crew.
N134CG arrived in Australia in November 2019, but had previously operated in the country during the 2018‑2019 fire season. The aircraft was designated as a ‘large air tanker’.
Figure 4: N134CG
Source: Coulson Aviation
Meteorological information
A Bureau of Meteorology graphical area forecast, issued at 0924 and valid for the time of the flight, forecast moderate mountain wave activity above 3,000 ft (above mean sea level) in the area of operation from Richmond to Cooma, and included the Adaminaby and Good Good fire grounds. A SIGMET[3] issued at 0947 forecast severe turbulence below 10,000 ft.
The aerodrome forecast for the Cooma-Snowy Mountains Airport[4] was amended at 0948, and indicated wind speeds of 30 kt, gusting to 48 kt, with a mean wind direction of 320°. It also included blowing dust and visibility of 2,000 m, with severe turbulence below 5,000 ft above ground level.
The weather observations recorded at the airport about 11 minutes prior to the accident, indicated a wind speed of 25 kt, gusting to 39 kt, from a direction of 320°, with visibility reduced to 6,000 m.
Cockpit voice recorder
Cockpit voice recorders (CVR) are designed on an endless loop principle, where the oldest audio is continuously overwritten by the most recent audio. The CVR fitted to the aircraft was a Universal model CVR-30B, part number 1603-02-03, serial number 1541. This model of recorder used solid-state memory to record cockpit audio and had a recording duration of 30 minutes.
The CVR was recovered from the aircraft and transported to the ATSB’s technical facility in Canberra, Australian Capital Territory, on 25 January 2020 for examination and download. The CVR was successfully downloaded, however, no audio from the accident flight had been recorded. All recovered audio was from a previous flight when the aircraft was operating in the United States.
Further investigation
The investigation is continuing and will include consideration of the following:
engine, gearbox and propeller component examinations
aircraft maintenance history
aircraft performance and handling characteristics
impact sequence
analysis of numerous witness reports
review and analysis of the available recorded data, including witness videos, aircraft tracking data, audio recordings and any onboard systems
review and analysis of environmental influences
the crew's qualifications, experience and medical information
the nature of aerial fire-fighting operations
operating policies and procedures
exploring the possible reasons why the CVR did not record the accident flight
similar occurrences.
The ATSB will continue to consult with the engine and airframe type certificate holders. Accredited representatives from the United States National Transportation Safety Board (NTSB) have been appointed to participate in the investigation.
Acknowledgments
The ATSB acknowledges the support of the NSW Police Force, NSW Rural Fire Service, NSW Fire and Rescue, the Australian Defence Force, and those involved with facilitating safe access to an active fire ground and supporting the ATSB’s on-site investigation team.
_________
The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this preliminary report. As such, no analysis or findings are included.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 22 January 2020, a Cessna 182Q, registered VH-WNR, took off from Caloundra Aerodrome, Queensland. The pilot was conducting a private sightseeing flight with one passenger on board. At 1624, the aircraft passed the northern tip of Moreton Island at about 1,200 ft in a shallow descent towards nearby Flinders Reef.
The aircraft’s descent rate began to increase with no significant changes to direction or speed. At 1626:26, the pilot made a MAYDAY call identifying the aircraft but not its position or nature of the emergency. At this time, the aircraft was east of Flinders Reef and descending at about 1,400 ft/min through 300 ft with a groundspeed of about 115 kt. The aircraft continued north-east for 15–20 seconds after the MAYDAY call before colliding with water.
On 29 January 2020, the aircraft was located on the ocean floor to the north-east of Flinders Reef, about 45 m from the estimated point of impact with water. The pilot and passenger were not located.
What the ATSB found
The nature of any in-flight emergency or abnormal situation, and any effect it had on the pilot’s ability to control and configure the aircraft for ditching, could not be established.
ATSB analysis found that the engine’s power was reducing over the last part of the flight, over a period of about 100 seconds. At the time of the accident, the weather conditions were conducive to carburettor icing. These conditions are common in the region. However, a conclusion regarding the possible influence of carburettor icing on the development of the accident could not be drawn with any certainty.
The ATSB also found that the pilot had descended over water beyond the glide range of a suitable landing area twice on a previous flight, limiting the options for a forced landing in the event of an emergency.
Safety message
Although it could not be determined whether the aircraft’s descent out of glide range was intentional, pilots are reminded that the operation of single engine aircraft over water should at all times be conducted with consideration of the aircraft’s glide distance to a suitable landing area.
The occurrence
On 22 January 2020, at about 1530 Australian Eastern Standard Time,[1] a Cessna 182Q, registered VH‑WNR, took off from Caloundra Aerodrome, Queensland. The pilot was conducting a private sightseeing flight with one passenger on board. The flight was being conducted under visual flight rules (VFR).[2] Weather observations and the short-term forecasts for the area indicated that good visual flying conditions existed at the time of the flight.
The aircraft flew south to the VFR route[3] at Bribie Island, climbing to transit at 3,500 ft to Moreton Island. At 1606, the pilot reported on the Brisbane Centre air traffic control (ATC) frequency that the aircraft’s position was overhead Tangalooma at 2,500 ft. The pilot broadcast their intention to track south to the southern end of Moreton Island and then north up the eastern side of the island.
Recorded radar data at 5-second intervals indicated that, from about 1613, the aircraft flew north along Moreton Island’s eastern coastline at 1,400–1,500 ft above mean sea level with a groundspeed of 100–110 kt (Figure 1). The wind was about 19 kt from the north-north-east, meaning the aircraft’s airspeed would have been about 120–130 kt.
Figure 1: Flight path of VH-WNR on the accident flight
Source: Google Earth, modified by the ATSB
At 1623, the aircraft commenced a shallow descent (about 162 ft/min) from 1,500 ft. At 1625, the aircraft passed Cape Moreton at the northern tip of the island at about 1,300 ft and continued north-east towards Flinders Reef, at a similar airspeed and descent rate (Figure 2).
Figure 2: Flight path of VH-WNR, near Flinders Reef
Source: Google Earth, modified by the ATSB
At 1625:09, the aircraft passed through an altitude of 1,200 ft and the descent rate began to increase with a concurrent reduction in engine power. At 1626:26, the pilot made a MAYDAY[4] call on the Brisbane Centre ATC frequency, identifying the aircraft’s callsign but not its position or the nature of the emergency. At this time, the aircraft was east of Flinders Reef and descending at about 1,400 ft/min through 300 ft with a groundspeed of about 115 kt. The air traffic controller attempted to establish contact with the pilot; however, no further transmissions from the aircraft were received.
The aircraft’s transponder continued to transmit. Analysis of the recorded radar data indicated that the aircraft continued north-east for 15–20 seconds, while still descending, after the MAYDAY call. There were no witnesses.
An aerial and marine search was immediately initiated. The aircraft was located on the ocean floor on 29 January 2020, north-east of Flinders Reef (Figure 2). The pilot and passenger were not located.
The pilot was reported to have flown aircraft overseas and in Australia decades earlier. Logbook records showed that the pilot had an extended break from flying and resumed in late 2019. After conducting 13.5 hours of flight training, the pilot was issued a Civil Aviation Safety Regulation Part 61 Private Pilot (Aeroplane) Licence on 17 October 2019 with a class rating for single engine aeroplanes.
The pilot held a Class 2 Aviation Medical Certificate that was issued on 17 October 2019 and valid until 17 October 2021, with a condition requiring reading correction be available when exercising the privileges of the licence. A review of the pilot’s medical records and interview with a close family member identified no significant medical conditions.
The pilot’s logbook records showed about 1,700 hours total aeronautical experience and previous night VFR[5] and instrument flight rules[6] experience. The pilot was also reported to have significant experience on the Cessna 182 type and had flown VH‑WNR 6 times over the previous fortnight, including around Moreton Island (see also Previous flights in VH-WNR). Prior to the accident flight, the pilot’s last logged flight was on 19 January 2020.
Aircraft information
General
The Cessna 182Q is a high-wing, all-metal, unpressurised aircraft with a fixed landing gear. The accident aircraft had a single, Continental O-470-U reciprocating piston engine driving a constant-speed propeller. The engine ignition system comprised two magnetos that provided a self-generated charge to the engine spark plugs and was independent of the aircraft electrical system.
An engine driven alternator supplied electrical power to aircraft systems. The alternator was also used to charge the battery and was controlled by a voltage regulator. A battery supplied power for engine starting and was a reserve source of power in the event of alternator failure.
VH-WNR (Figure 3) was manufactured in 1978 and was first registered in Australia in the same year. The aircraft was privately hired by the pilot for the flight.
Figure 3: VH-WNR in 2019
Source: Aircraft operator
Maintenance history
At the time of the accident, VH-WNR had about 3,318 hours total time in service and had flown about 73 hours since the previous periodic inspection (100 hourly), which was conducted on 21 August 2019. The engine was installed new in December 2013 and had accumulated about 742 hours time in service.
During a flight on 19 January 2020,[7] the aircraft began to experience electrical issues over a period of about 3 minutes, resulting in the loss of some aircraft systems including the radio and transponder. After landing, engineers identified that the aircraft charging system was unserviceable and the battery had discharged. The battery was charged for the return flight to Caloundra. A new voltage regulator and alternator were fitted and the battery was charged again. On the morning of 22 January 2020, 6–7 ground runs were carried out to test and adjust the replaced components before the aircraft was released to service.
Weight and balance
According to a witness, the pilot visually checked the aircraft’s fuel quantity prior to the accident flight with the aid of a dipstick, which showed there was 135 L on board. A correction was made to the fuel record, which had been incorrectly annotated as 130 L. This amount was more than sufficient fuel for the intended flight.
Based on witness observations as well as estimates of fuel and occupant weights, the aircraft was likely within its weight and balance limits for the entire flight.
Meteorological information
The nearest weather station to the flight path of the aircraft was at Cape Moreton, at the northern end of Moreton Island, 328 ft above sea level. Observations taken at 1600 and 1630 both showed the wind speed at 19 kt from 030°, gusting to 24 kt, with no recorded precipitation.
Satellite images taken at 1620 and 1630 indicated visual meteorological conditions in the vicinity of the northern end of Moreton Island. The 1630 meteorological aerodrome report for Brisbane Airport, about 53 km south-west of Cape Moreton, stated the cloud cover as ‘few’ at 2,000 ft and ‘broken’ at 27,000 ft.[9]
Another pilot was conducting a training flight in the vicinity of Bribie Island shortly before the accident. That pilot described the conditions and visibility as good for VFR operations with some low-level turbulence. Above 1,000 ft the conditions were smoother with a north-westerly wind at about 18 kt.
Wreckage and impact information
Wreckage location
Immediately after the accident, after being advised by Airservices Australia that contact was lost with VH-WNR, the Queensland Police Service (QPS) and the Australian Maritime Safety Authority (AMSA) commenced an aerial and marine search operation. That evening, floating debris from the aircraft was found and recovered. The following day the marine search focused on a position near Flinders Reef, but the aircraft could not be located.
At the request of the QPS, the ATSB analysed the supplied radar data and refined the estimated position of the aircraft on 28 January 2020. The wreckage was located by the QPS on the morning of 29 January 2020, about 45 m from the supplied coordinates in about 30 m of water. The engine and propeller were found about 10 m north-east of the main wreckage. The QPS took underwater video of the wreckage on 29–30 January 2020.
Partial wreckage recovery
On 6 February, with assistance from the QPS, specialists from the New South Wales Police Force and the Queensland National Parks and Wildlife Service, the ATSB recovered various aircraft components including the engine, propeller and instruments for detailed examination.
Wreckage examination
ATSB examination of the underwater video identified that the aircraft was likely destroyed by collision with water at a moderately high speed (Figure 4). Damage to the aircraft cabin from the collision with water indicated that it was unlikely to be survivable. There was no evidence of fire.
All major aircraft components were accounted for, and there was no evidence of pre-impact defects or structural failure. As far as could be established, cockpit switch positions were configured as expected for normal flight.
The flap control and right flap were found in the ‘up’ position. The left flap was observed to be displaced towards the down position from disruption caused during accident sequence to the adjacent wing structure. One of the front seats was found floating some distance from the wreckage, and the other front seat was not located. The seatbelts for both front seats were found to be attached to the airframe and latched.
The carburettor heat control, used to prevent or recover from engine icing, was in the ‘off’ position. However, due to the disruption of the wreckage, this may not have been indicative of its position prior to the accident.
Figure 4: Wreckage of VH-WNR on the ocean floor
A weight, rope and buoy had been attached to the aircraft tail by the divers.
Source: Queensland Police Service
Engine examination
The engine was disassembled and examined at a Civil Aviation Safety Authority (CASA) approved overhaul facility under the supervision of the ATSB. Apart from impact and submersion damage, the engine was generally in good condition. Some components such as the magnetos, alternator and voltage regulator were extensively damaged by their immersion in seawater and their function could not be tested. No pre-existing defects were evident, and there was no evidence of fire or overheating (Figure 5).
Figure 5: Corrosion damage to the magnetos
Source: ATSB
Propeller examination
The propeller was disassembled and examined at a CASA-approved overhaul facility under the supervision of the ATSB. No pre-existing defects or irregularities were identified. The propeller could not be functionally tested because of internal damage that occurred during the accident sequence.
The propeller blades were observed to be progressively bent out of plane (Figure 6), in a manner indicative of low but non-zero power. The pitch change lugs on all three blades were sheared off, with the direction of the fracture surface smearing being consistent with the blades being forcibly rotated towards low (fine) pitch, which is an indication of low power or windmilling.
Preload plates are fitted to each propeller blade at their base, within the propeller hub. Each blade pitch change lug transverses through a cut-out in the plates. Using damage signatures made by the propeller blade pitch change lugs onto the preload plates (Figure 6, inset), and estimating the propeller speed from the known velocity of the aircraft in the moments prior to impact, an estimate of power and the blade angle at impact was made using established datums with the assistance of the propeller manufacturer. These calculations were limited in accuracy as the preload plates are not indexed (such as with a key or slot), and so during assembly there could be slight variations with their position. The results of the calculations indicated that the propeller was rotating under low power, and with a blade angle at or near the low pitch stop.
Figure 6: VH-WNR propeller blade bending and inset image of example preload plate damage signatures
Source: ATSB
Recorded data
Accident flight radar data
Airservices Australia provided radar data for the accident flight. This data combined primary surveillance radar (PSR) and secondary surveillance radar (SSR) data into a single, smoothed track. PSR has a shorter range than SSR, and is generally less reliable, but it is used to enhance the accuracy of SSR tracks and provide position information when SSR is not available.
Position data for the accident flight was generally recorded at 5‑second intervals, and occasionally at a 4- or 6-second interval. It included Mode C altitude data that was obtained from the aircraft static system referenced to the standard atmospheric pressure (1,013.25 hPa) and rounded to the nearest 100 ft. The aircraft’s average groundspeed between data points was derived from the position and time data.
The approximate position the aircraft collided with water was determined from the system track by extrapolating the estimate of groundspeed and a fitted altitude curve to sea level.
Engine monitoring recorder
The ATSB identified that the only item on the aircraft that was likely to record any data was a J.P. Instruments EDM-700 engine monitoring recorder. The ATSB recovered the instrument, however the recorded data it contained did not include the accident flight.
Additional information
Previous flights in VH-WNR
In the weeks prior to the accident, the pilot flew VH-WNR on the following 6 return flights from Caloundra Aerodrome, with available aircraft tracks shown in Figure 7:
1 hours on 8 January as a proficiency check with an instructor (radar data not available)
8 hours with one passenger on 11 January (radar data not available)
8 hours with two passengers on 14 January (radar data not available)
4 hours with two passengers on 15 January (blue line)
2 hours with two passengers on 17 January (orange line)
1 hours with two passengers on 19 January (red line).
Figure 7: Accident pilot’s previous flights in VH-WNR
Source: Google Earth, modified by the ATSB
On the 15 January flight, the pilot transited between Bribie Island and Moreton Island at about 2,000 ft and 80–90 kt groundspeed. The flight profile was broadly similar to the accident flight past Cape Moreton towards Flinders Reef (Figure 8). On the return leg, the pilot flew from Flinders Reef direct to Bribie Island at about 1,800 ft.
Figure 8: Previous flights and the accident flight compared
Source: Google Earth, modified by the ATSB
ATSB analysis indicated that two segments of the 15 January flight, including between Moreton Island and Flinders Reef, were further from land than the aircraft was capable of gliding with no engine power. Although complete analysis of glide distances was not feasible, the ATSB estimated that the aircraft was also flown near or beyond the limits of its glide range to land on other flights in this area. During the accident flight on 22 January, the aircraft similarly reached a point further from glide distance to land about halfway between Moreton Island and Flinders Reef.
On the 19 January flight, when the aircraft was approaching Moreton Island, the Brisbane Centre controller attempted to contact the pilot to advise that the aircraft was 2 NM west of Moreton Island at 3,900 ft (that is, they had entered controlled airspace by climbing above 3,500 ft in that area). After receiving assistance from the pilot of another aircraft in the area, the pilot of VH-WNR made contact with the controller, who explained the problem. The pilot apologised and stated that the entry to controlled airspace was unintentional, and they confirmed they were now at 3,000 ft approaching the eastern side of the island. The controller reminded the pilot to keep at or below 3,500 ft on the way back to Caloundra. On that flight, the pilot did not descend when travelling along the eastern side of Moreton Island.
As noted in The occurrence, during the accident flight on 22 January, the pilot contacted Brisbane Centre to report they were at 2,500 ft approaching Moreton Island. There was no requirement for the pilot to make a call on that frequency in that area while they remained at or below 3,500 ft.
Analysis of thrust required
A performance analysis was carried out on the last minutes of the accident flight based on the radar data, documented performance characteristics of the aircraft type (such as lift and drag coefficients), and estimates of aircraft weight. The analysis calculated the propulsive power that would be required for the aircraft’s estimated airspeed and altitude. For the section of flight analysed, the aircraft was flown with likely minor changes in heading and pitch, for which the radar data was considered sufficiently accurate. The analysis provided an estimate of the thrust power, not engine power, as efficiencies and other power losses were not calculated.
The analysis relied on the following assumptions:
Thrust opposed drag along the longitudinal axis of the aircraft.
The aircraft was not accelerating longitudinally (as indicated by the relatively constant groundspeed).
The aircraft was not banking, slipping, or accelerating vertically (turbulence).
Wing flaps were retracted.
Wind did not vary.
The analysis indicated that there was a reduction in thrust during the last 100 seconds of the flight.[10] At the end of the recorded data, due to the flight path being flown, the thrust power required by the aircraft was approximately zero.
Speech analysis
The ATSB conducted a basic speech analysis on the pilot’s ATC and Caloundra Aerodrome common traffic advisory frequency (CTAF)[11] radio transmissions. The pilot’s response times, delay between microphone keying and speaking, microphone un-keying delay, duration to annunciate the aircraft callsign, average speech rate, and voice pitch were analysed. The analysis was inconclusive regarding whether there were any changes to the pilot’s speech during the accident flight.
Carburettor icing
According to the CASA Visual Flight Rules Guide:
Carburettor icing is of particular concern because, unlike airframe icing, the risk of ice build-up in the carburettor can be high even with no visible moisture and an OAT [outside air temperature] of up to 38°C.
Carburettor icing occurs when the air temperature adiabatically decreases sufficiently to condense water vapour and for the localised air temperature to reduce below freezing. Ice builds up as the chilled condensed water makes contact with localised surfaces, such as the butterfly valve and the venturi walls. Carburettors experience additional cooling because of the evaporation of fuel. Furthermore, the risk of carburettor icing is significantly increased at partial power settings (for example, when power is reduced during descent), because of the cooling effect of a partly-closed throttle.
The effect of carburettor icing on aircraft may result in reduced power output, poor engine performance, rough running and in extreme cases engine failure. The onset of this may be evidenced by an unexplained drop in manifold pressure.
The pilot’s operating handbook (POH) for VH-WNR was not recovered. A reviewed sample of Cessna 182Q POHs required pilots who suspect carburettor icing to apply full throttle and set the carburettor heat control to ‘on’ until the engine ran smoothly.
To assist pilots in anticipating the potential for carburettor icing, CASA published a carburettor icing probability chart (Figure 9). The temperature recorded at Cape Moreton at the time of the accident was 27.1 °C, and the dewpoint 24.9 °C. This gave a dewpoint depression of 2.2 °C. The intersection between the resulting temperature and dewpoint lines was just inside the shaded area where ‘serious’ icing under descent power is possible.
Figure 9: Carburettor icing probability chart with local observations
Source: CASA, annotated by the ATSB
An ATSB review of temperature and dewpoint observations for the south-east Queensland region showed that, over a 12-month period, carburettor icing conditions are frequent.
Previous ATSB investigations found to be, or potentially be, related to carburettor icing include:
AO-2018-050, Wirestrike and collision with terrain involving Cessna 172RG, VH-LCZ, Parafield Airport, South Australia, on 3 July 2018
AO-2016-059, Engine failure involving Piper PA-28, VH-IPO, Mangalore Airport, Victoria, on 16 June 2016
AO-2014-149, Collision with terrain involving Van's Aircraft RV-6, VH-TXF near Mudgee Airport, NSW on 14 September 2014
AO-2012-078, Collision with terrain - Robinson R44, VH-HOU, 93 km S Alice Springs Airport, NT, 10 June 2012.
Flights over water
Civil Aviation Regulation (CAR) 258 (Flights over water) stated:
The pilot in command of the aircraft must not fly over water at a distance from land greater than the distance from which the aircraft could reach land if the engine… were inoperative.
The Aeronautical Information Publication (AIP) stated in ENR 1.1 (section 11.11) that CAR 258 did not apply to charter, aerial work or private operations if each occupant was wearing a life jacket, unless they were exempted from doing so under Civil Aviation Order (CAO) 20.11 (Emergency and life saving equipment and passenger control in emergencies). CAO 20.11 paragraph 5.1.1 (a) stated that a single engine aircraft must carry a life jacket for each occupant when the aircraft was operated over water at a distance from land greater than that it could reach with its engine inoperative. In such cases, paragraph 5.1.7 also stated that each occupant shall wear a life jacket, but this was not required for occupants of aeroplanes during flight above 2,000 ft.
The operator stated that the pilot was briefed to transit between Bribie Island and Moreton Island (a distance of about 15 km) at 3,500 ft using the VFR route. The operator also stated that, after some previous flights, it briefed the pilot that its preference for the pilot was to not operate on the northern side of Cape Moreton.
The operator stated that it encouraged the pilot to take life jackets on board the aircraft, which was done on previous flights. However, witnesses reported that no life jackets were taken on the accident flight.
Carriage of emergency locator transmitter
The aircraft was fitted with a deceleration-activated emergency locator transmitter (ELT), which was not serviceable at the time of the accident. The carriage of an ELT was not required for flights within 50 NM of the origin. A personal locator beacon was carried on board the aircraft at the time, in the glove box of the aircraft.
Cessna 182 emergency procedures
Engine failure
The POH for the Cessna 182Q contained an emergency procedure for an engine failure in flight. For this scenario, pilots were required to establish a best glide speed of 70 kt with the wing flaps retracted, and to identify a suitable landing area (Figure 10).
Figure 10: Cessna 182Q maximum glide distance chart
Source: Cessna, annotated by the ATSB
Ditching
The POH procedure for ditching included transmitting a MAYDAY message over the radio, unlatching the cabin doors, and establishing a level attitude during descent. If engine power was available, the flaps were to be set to 20–40° and the aircraft established in a 60 kt and 300 ft/min descent. In an engine failure situation, the glide speed and configuration should be 70 kt with flaps up or 65 kt with 10° of flap.
The aircraft’s flight path was not indicative of uncontrolled flight, and no pre-existing defects with the aircraft could be identified. Other than a likely gradual loss of engine power, discussed below, there was no evidence of engine overheating, fire, loss of control, or other in-flight emergencies. However, as the entire aircraft could not be recovered, it was not possible to verify the operation of all aircraft systems.
The existence of secondary surveillance radar data for the aircraft almost to its collision with water, as well as the reception of the MAYDAY call, indicated that the aircraft’s electrical systems were receiving power. However, it was not possible to determine whether this was battery or alternator power. In any case, electrical power was not necessary for flight or ditching.
Analysis of the radar data showed there was likely a gradual reduction in thrust (and therefore engine power) during the last 100 seconds of the flight, and that this correlated with the increasing descent rate. The impact signatures on the propeller and propeller pitch change lugs were also consistent with a low level of engine power or windmilling at impact. Although the power reduction may have been due to pilot action, no reason for doing so at this point in the flight could be identified.
The aircraft maintained a moderately high speed until radar contact was lost at about 180 ft. Had the engine been inoperative, the radar data would have indicated a significantly steeper descent profile.
Regardless, a gradual reduction in engine power should not necessarily lead to very serious consequences. If detected early enough, with a suitable emergency landing area within range, a pilot could attempt to land. If no such landing area was available, a pilot could attempt a forced landing or ditching.
In this case, the aircraft maintained course away from suitable landing areas at a speed well above the aircraft’s best glide speed. The pilot may have been initially unaware of the gradual reduction in power and resulting descent. Although this would have been indicated on the aircraft’s instruments, the constant-speed propeller would maintain engine and propeller speed, and a gradual power loss would result in little or no change in sound and feel.
The MAYDAY call shortly before the impact indicated that the pilot was not totally incapacitated. However, in the absence of other evidence, a partial incapacitation could not be excluded.
The aircraft’s final position on the sea floor close to the last radar position strongly indicated that it continued along the established flight path without turning or, more critically, reducing descent rate and speed for a ditching. Furthermore, examination of the video footage of the wreckage on the sea floor showed the flaps were likely up at impact and that the aircraft had been significantly disrupted by a relatively high-speed collision with water.
In summary, the nature of any in-flight emergency or abnormal situation, and any effect it had on the pilot’s ability to control and configure the aircraft for ditching, could not be established.
Descent over water beyond glide range
On 15 January 2020, the pilot descended over water beyond the maximum glide distance of a suitable landing area for a Cessna 182Q during two segments of that flight. However, there was insufficient evidence to determine if an emergency landing on Moreton Island was possible had the pilot been able to turn the aircraft and establish the optimal glide speed. Nevertheless, flight outside of the glide range of a suitable landing area limits the opportunities for recovery in the event of an engine failure or other emergency. The same situation occurred on the accident flight, although the extent to which this was intentional could not be determined.
Carburettor icing
Carburettor icing can be insidious in its development and have serious consequences. Weather observations taken at Cape Moreton at the time of the accident, and plotted on the carburettor icing probability chart, showed that carburettor icing was possible. The plotted point was just inside the serious icing range at descent power and adjacent to the light icing range in cruise or descent power.
The likely reduction in power in the last 100 seconds of recorded flight could plausibly have been due to carburettor icing. However, carburettor icing conditions are frequently encountered in the region, and prevention and management of carburettor icing is easily done through use of carburettor heating. As the pilot had significant experience on the Cessna 182, they would very likely have been familiar with the use of carburettor heating. Due to wreckage disruption during the impact sequence, the position of the carburettor heat control during the accident flight could not be established. Overall, a conclusion regarding carburettor icing could not be drawn with any certainty.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the collision with water involving Cessna 182, registered VH-WNR, 6 km north-west of Moreton Island, Queensland, on 22 January 2020.
Contributing factors
After passing the northern end of Moreton Island at 1,200 ft, the aircraft continued descending away from the island at about 110 kt groundspeed, with no significant change in direction and with reducing engine power. The pilot broadcast a MAYDAY when passing 300 ft; however, for reasons that could not be determined, the flight path and speed of the aircraft did not significantly change after this point until it collided with water.
Other factors that increased risk
The pilot had descended over water beyond the glide range of a suitable landing area twice on a previous flight, limiting the options for a forced landing in the event of an emergency.
At the time of the accident, the meteorological conditions were conducive to carburettor icing. However, such conditions are common in the region, and able to be easily managed with the aircraft’s carburettor heat control.
Other findings
From the limited evidence available, no pre-existing aircraft defects could be identified.
Glossary
AMSA Australian Maritime Safety Authority
ATC Air traffic control
CASA Civil Aviation Safety Authority
POH Pilot’s operating handbook
PSR Primary surveillance radar
QPS Queensland Police Service
SSR Secondary surveillance radar
VFR Visual flight rules
Sources and submissions
Sources of information
The sources of information during the investigation included:
another pilot who flew VH-WNR
the aircraft operator
Civil Aviation Safety Authority
Queensland Police Service
the maintenance provider
Hartzell propeller
Airservices Australia
Bureau of Meteorology.
References
National Aeronautics and Space Administration 1973, Point and path performance of light aircraft, Contractor report NASA CR-2272.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the aircraft operator
the maintenance provider
Civil Aviation Safety Authority
US National Transportation Safety Board
Hartzell propeller.
Submissions were received from the aircraft operator, the Civil Aviation Safety Authority, and Hartzell propeller. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 15/04/2020
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
The occurrence
On 22 January 2020, at about 1530 Eastern Standard Time,[1] a Cessna 182Q, registered VH‑WNR, took off from Caloundra aerodrome, Queensland. The pilot was conducting a private sightseeing flight with one passenger on board.
The aircraft flew south to the light aircraft lane at Woorim on Bribie Island, climbing to transit to Moreton Island. At 1606, the pilot reported on the Brisbane air traffic control (ATC) frequency that the aircraft’s position was overhead Tangalooma resort, Moreton Island, at 2,500 ft. He also stated that his intention was to track south to the end of Moreton Island and then north up the eastern side of the island.
Recorded radar data at 5-second intervals indicated that, from about 1613, the aircraft flew north along Moreton Island’s eastern coastline at 1400–1500 ft above mean sea level (AMSL) with a groundspeed of 100–110 kt (Figure 1). The wind at the time was about 19 kt from the north-north-east, so the aircraft’s airspeed would have been about 120–130 kt.
Figure 1: Preliminary representation of the flight path of VH-WNR
Source: Google Earth, modified by the ATSB.
At 1624, the aircraft passed the northern tip of the island at about 1,100 ft in a shallow descent (about 160 ft/minute). It then continued north-east towards Flinders Reef, 6 km away (Figure 2), at a similar airspeed and descent rate.
Figure 2: Preliminary representation of the flight path of VH-WNR, near Flinders Reef
Source: Google Earth, modified by the ATSB.
The aircraft’s descent rate began to increase from 1625:09. At 1626:26, the pilot made a MAYDAY[2] call on the Brisbane ATC frequency, without identifying the nature of the problem. At this time, the aircraft was east of Flinders Reef and descending at about 1,400 ft/minute through 300 ft with a groundspeed of about 115 kt. The air traffic controller attempted to establish contact with the pilot; however, no further transmissions from the aircraft were received.
The aircraft’s transponder continued to transmit. Later analysis of the recorded radar data indicated that the aircraft probably continued north-east for 15–20 seconds after the MAYDAY call before colliding with water. There were no witnesses.
An aerial and marine search was initiated. The aircraft was located on the ocean floor on 29 January 2020, north-east of Flinders Reef. The pilot and passenger have not been located.
Context
Pilot information
The pilot was reported to have flown in Africa and Australia decades earlier. He then had an extended break from flying and resumed in late 2019. After conducting 13.5 hours flying training he was reissued a Private Pilot Licence (Aeroplane) on 17 October 2019 with a class rating for single engine aeroplanes.
The pilot held a Class 2 Aviation Medical Certificate that was issued on 17 October 2019 and valid until 17 October 2021.
The available information from the pilot’s records indicated that he had about 1,700 hours total aeronautical experience and had previously held night VFR[3] and instrument ratings. He was also reported to have significant experience on the Cessna 182 type and had flown VH‑WNR several times over the previous week, including around Moreton Island. His last flight prior to the accident flight was on 19 January.
Aircraft information
The aircraft (Figure 3) was manufactured in 1978 and was first registered in Australia in the same year.
The aircraft was fitted a Continental O-470-U piston engine, installed new in December 2013. It had been operated for approximately 742 hours before the accident flight.
The aircraft was operated by a flying school. It was privately hired to the pilot for the flight.
The aircraft’s last periodic (100 hourly) inspection was conducted on 21 August 2019 and the last maintenance release was issued on the same date. At the time of the accident, the aircraft had about 3,318 hours total time in service and 73 hours time in service since the previous periodic inspection.
The last maintenance conducted on the aircraft was on 21-22 January 2020, when the alternator and regulator were replaced to rectify an electrical defect reported by another pilot on 20 January.
Figure 3: Cessna 182, registered VH-WNR, in 2019
Source: Aircraft operator.
Site and wreckage
The wreckage was located in about 30 m of water. The engine and propeller were found about 10 m away from the main wreckage.
The Queensland Police Service (QPS) took underwater video footage of the wreckage on 29–30 January 2020. The ATSB examination of the video footage identified that the aircraft was destroyed by impact with water (Figure 4). Damage to the cabin indicated that the impact was unlikely to be survivable. One of the front seats was found floating some distance from the wreckage, and the other front seat was not located. Both of the front seats’ seat belts were found to be attached to the airframe and latched. All major aircraft components were accounted for in the video footage.
On 6 February, with assistance from the QPS and the Queensland National Parks and Wildlife Service, the ATSB recovered some aircraft components including the engine, propeller and instruments for examination. No pre-existing defects were identified during workshop examinations of the engine and propeller.
The ATSB identified that the only item on the aircraft that was likely to record any data was a J.P. Instruments EDM-700 engine monitoring recorder. The ATSB recovered the instrument and obtained data from it. Further analysis will be required to determine whether the data is relevant to the accident flight.
Figure 4: Wreckage of VH-WNR on ocean floor
Source: Queensland Police Service.
Meteorological information
Relevant aviation weather forecast(s) indicated good visual flying conditions would have existed at the time of the flight.
The nearest weather station to the aircraft’s flight path was at Cape Moreton, at the northern end of Moreton Island and a height of 328 ft AMSL. Observations taken at 1600 and 1630 showed the wind speed was 19 kt, gusting to 24 kt. No precipitation was recorded. The temperature at 1630 was 27.1 °C, dew point 24.9 °C and QNH 1,009.5 hPa. Other nearby weather stations recorded similar observations.
Satellite images taken at 1620 and 1630 indicated no significant cloud in the vicinity of the northern end of Moreton Island. The 1630 METAR (meteorological aerodrome report) for Brisbane Airport, 29 NM south-west of Cape Moreton, reported few cloud at 2,000 ft and broken cloud[4] at 27,000 ft.
A pilot, who was flying over Bribie Island at about 1600, recalled the visibility over Tangalooma on Moreton Island was clear.
Further investigation
The investigation is continuing and will include further examination and analysis of the:
recovered components including engines and propellers
aircraft’s maintenance and operational records
video footage of the wreckage
pilot qualifications, experience and medical history
recorded radio, radar and engine monitoring data.
Should a critical safety issue be identified during the course of the investigation, the ATSB will immediately notify relevant parties so appropriate and timely safety action can be taken.
A final report will be released at the conclusion of the investigation.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the afternoon of 12 January 2020, the pilot of an amateur-built Wittman Tailwind aircraft, registered VH-TWQ (TWQ), departed Evans Head Airport, New South Wales, with one passenger on board. The pilot was conducting a private flight under the visual flight rules from Evans Head, to Boonah, Queensland.
The pilot flew in a north-north-westerly direction towards Boonah via the Richmond River valley. At 1353, the pilot commenced a 180° turn overhead the township of Kyogle and diverted, due to the weather, south back down the valley to Casino Aerodrome, landing at 1406.
At 1454, the pilot took off from Casino and flew in a west-north-westerly direction. At 1512 TWQ commenced a series of rapid descents and climbs followed by a descending left turn. The turn and descent continued until TWQ collided with terrain. The pilot and passenger were fatally injured, and the aircraft was destroyed.
What the ATSB found
The ATSB found that the pilot departed an interim landing site for Boonah under the visual flight rules with a high risk of encountering forecast cloud. En route to Boonah, the aircraft entered an area of reduced visibility and the pilot likely became spatially disorientated resulting in a loss of control and collision with terrain.
Safety message
Weather-related accidents remain one of the most significant causes of fatal accidents in general aviation and continues to be a focus of the ATSB’s SafetyWatch initiative. SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns relates to inflight decision making, particularly involving pilots flying with reduced visual reference. SafetyWatch provides information about each safety concern, and strategies to help manage risk areas, along with links to safety resources. In relation to visual flight rules (VFR) pilots flying into areas of reduced visibility, some key messages are:
Pilots should avoid deteriorating weather by conducting thorough pre-flight planning. They should ensure they have alternate plans in case of an unexpected deterioration in the weather and make timely decisions to turn back, divert or hold in an area of good weather.
VFR pilots should use a ‘personal minimums’ checklist to help control and manage flight risks through identifying risk factors that include marginal weather conditions and only fly in environments that do not exceed their capabilities.
Pilot’s should consider reducing speed and/or altering the configuration of the aircraft to allow more time for decision making and manoeuvring in areas of deteriorating or marginal weather conditions
Pressing on into instrument meteorological conditions without a current instrument rating carries a significant risk of severe spatial disorientation due to powerful and misleading orientation sensations with reduced visual cues. Disorientation can affect any pilot, no matter what their level of experience.
If VFR pilots find themselves in marginal weather and becoming disoriented or lost, they should seek whatever help is available. Air Traffic Services (ATS) may be able to provide assistance, especially if the aircraft is in ATS surveillance coverage. There have been a number of reported occurrences where this simple action has averted potential disaster.
The occurrence
On Friday, 10 January 2020 the pilot of an amateur-built Wittman Tailwind aircraft, registered VH‑TWQ (TWQ), departed Toowoomba, Queensland, and flew via Boonah, to Evans Head, New South Wales. The purpose of the flight was to pick up a passenger at Boonah and then attend the Great Eastern Fly-In (Fly-In) at Evans Head. The Fly-In was planned for the weekend of 11‑12 January. However, due to poor weather, the event program was significantly disrupted.
On the morning of 12 January 2020, the pilot attended the Fly-In event briefing which included the meteorology for the day. The event was cancelled at 0830 due to the cloud base at Evans Head being approximately 1,000 ft above ground level (AGL) with a reduction to 600 ft AGL forecast during the day. Due to the cancellation of the event the pilot elected to return to Toowoomba and contacted relatives there for an update on the weather. They sent photos of the local conditions and said the cloud at Toowoomba was not really low, there was no wind and there had been some rain. At 1336 Eastern Daylight-saving Time,[1] the pilot departed Evans Head Airport , with one passenger on board. The pilot was conducting a private flight under the visual flight rules[2] to Toowoomba via Boonah (Figure 1).
Figure 1 - Accident flight departure, destination and accident locations
Source: Google Earth, annotated by the ATSB
The pilot flew in a north-north-westerly direction towards Boonah via the Richmond River valley (Figure 2). The aircraft reached a maximum altitude of 1,950 ft above mean sea level[3] just prior to reaching Kyogle. At 1353, the pilot commenced a 180° turn overhead the township of Kyogle and diverted, likely due to low cloud on their intended flight path. At 1357 a family member contacted the passenger as they had seen the turnaround overhead Kyogle on OzRunways.[4] The passenger replied to say they were ‘going home due low cloud’. The pilot flew south back down the valley to Casino Aerodrome, landing at 1406.
During the time on the ground at Casino, the pilot contacted a friend in the area and left a voice message. The message stated they could not get past Kyogle due to the weather, so they had landed at Casino. (refer to the section titled Meteorological information below.)
Figure 2 - Flight tracks for VH-TWQ on 12 January 2020
Source: Flightradar24 and Google Earth, annotated by the ATSB
At 1454, the pilot took off from Casino and flew in a west-north-westerly direction. At 1510 TWQ commenced a series of rapid descents and climbs, between 3,100 and 4,000 ft, followed by a left descending turn. Shortly afterwards TWQ collided with terrain. The pilot and passenger were fatally injured, and the aircraft was destroyed. There were no witnesses to the accident.
The pilot held a Private Pilot Licence (Aeroplane) issued in July 1982 and was qualified to fly by day under the visual flight rules. The pilot also held a single-engine aeroplane class rating. The pilot last conducted a single-engine aeroplane flight review in June 2018 that was valid until June 2020. The pilot had about 1,200 hours flying experience recorded in the pilot’s logbook with a total of about 140 hours on the Wittman Tailwind. In the 90 days prior to the accident, the pilot had flown 12.4 hours total, of which 11.2 hours were in TWQ.
The pilot’s logbook showed a total of 8.4 hours instrument flying experience. Of these, 5 hours were accumulated between 1982 and 1983. The remaining 3.4 hours were accumulated from 1986 to 2015. The pilot did not hold an instrument rating.
Medical information
The pilot held a Class 2 aviation medical certificate that was valid until October 2021 with two restrictions noted. One restriction required distance vision correction be worn and the other required reading correction to be available during flight.
The pilot was reported to be in good health and not taking any medications at the time of the accident.
Due to the pilot being away from home for the days preceding the accident, a detailed 72-hour history could not be obtained. From the limited information available there were no fatigue‑related concerns identified.
A limited post-mortem examination and toxicological screening was performed. There was nothing found to support incapacitation.
Aircraft information
Overview
VH-TWQ (TWQ) was a Wittman Tailwind, an amateur-built aircraft in the experimental category. TWQ had a two seat, side-by-side seating arrangement. The structure was a combination of tubular steel frames and fabric covering on the fuselage. Wooden wing ribs had a bonded plywood skin covering. The flight controls consisted of push-pull type control tubes. All flight controls and flaps were fabric covered. The Wittman had a fixed undercarriage in a taildragger configuration.
TWQ was fitted with a Lycoming XIO-320[5] four cylinder, horizontally opposed piston engine and was fitted with a ground adjustable Whirlwind two-bladed composite propeller.
Entries in the logbook indicated that the owner-pilot commenced construction of the aircraft as an amateur builder in January 2006. The aircraft was completed in August 2018. A CASA authorised person issued a special certificate of airworthiness in the experimental category on 25 December 2018.
On 28 June 2019, the pilot issued a maintenance release that was valid for 12 months. This allowed the aircraft to be operated privately under the day visual flight rules. The aircraft flew for 33.3 hours between 28 June 2019 and the day of the accident. No defects or unserviceable equipment endorsements were recorded on the maintenance release.
The last entry in the aircraft’s maintenance records was the change, by the pilot, of the engine oil and filter in October 2019. The pilot changed the engine oil filter in accordance with the maintenance schedule.
Operating limitations
Aircraft operating limitations were contained within the flight manual for the aircraft and relevant limitations are detailed in Table 1 and Table 2.
Table 1 – Airspeed limitations
Speed
Knots indicated airspeed (KIAS)
Remarks
Vne – Never exceed
174
Do not exceed this speed in any operation
Vno – Max structural cruising
155
Do not exceed this speed except in smooth air, then only with caution
Va – Manoeuvring
155
Do not make full or abrupt control movement above this speed, because under certain conditions the aircraft may be overstressed.
Table 2 - Stall speeds
Configuration
Power off (KIAS)
Power on (KIAS)
Clean
52
49
Flaps Land
47
40
Navigation / cockpit instruments
The aircraft was fitted with a Garmin G3X (G3X) flight display, capable of displaying the engine monitoring instruments, primary flight instruments and navigation information.
The pilot was reported to navigate primarily by using paper maps, using the main Garmin screen to display attitude and heading information as well as engine parameters. The pilot had an iPad mounted beside the G3X unit running the OzRunways application. It was reported that the pilot’s use of OzRunways navigation and flight planning features was limited to using the direct to function which plotted a track from the aircraft’s current location to a desired destination. The pilot was also reported to use the weather radar overlay function on OzRunways. This overlay displayed rain when detected by radar but did not display the presence of clouds.
Wreckage and accident site information
Accident site
The accident site was located in dense rainforest, about 72 km west-north-west of Casino, within the Tooloom National Park (Figure 2). The New South Wales Police Rescue and Bomb Disposal Unit assisted ATSB investigators to access the site on foot.
The accident site was on the eastern side of a ridgeline at an elevation of 3,170 ft. The highest ground in the immediate area of the accident site was approximately 3,200 ft.
Wreckage examination
The aircraft’s structure was substantially disrupted (Figure 3). The wreckage trail was about 120 m long on a bearing of approximately 270°. All major aircraft components were located at the accident site. ATSB investigators did not identify any signs of pre-existing airframe damage. Due to the disruption of the airframe, the aircraft’s attitude when it entered the tree canopy could not be determined. There was no evidence of fire. Site and wreckage examination did not identify any defects or anomalies that might have contributed to the accident.
Figure 3 - VH-TWQ’s empennage at the accident site
Source: ATSB
Engine and propeller
On-site examination of the engine and propeller did not identify any defects that could have contributed to the accident. Damage noted to the propeller, during this examination, were consistent with the engine producing significant power at the time of the accident.
Flight control system
All primary and secondary flight controls were located on-site. An examination of the flight control systems did not identify any faults that could have contributed to the accident.
Fuel
The fuel tank was located toward the end of the wreckage trail. It was torn from the fuselage and had ruptured. Rain had entered the tank post-accident, therefore the fuel that remained in the tank was not tested.
Weight and balance
The on-site examination found a small amount of lightweight cargo. It was reported that the occupants took minimal cargo with them when they departed for the weekend. Weight and balance was calculated using full fuel and maximum baggage on departure out of Toowoomba and was calculated to be within limits. The aircraft did not refuel again after departing Toowoomba. Weight and balance was also calculated for the expected fuel remaining at the time of the accident and was also within limits.
Emergency locator transmitter
The aircraft was not fitted with an ELT, nor was it required to be. An Emergency Position Indicating Radio Beacon was located in the wreckage and had not been activated. This unit was tested on-site and functioned as required.
Operational Information
The flight from Evans Head to Boonah required the pilot to cross the McPherson Range (Figure 4). The McPherson Range is a spur of the Great Dividing Range, heading in an easterly direction from near Wallangarra, Queensland, to the coast. It also forms part of the border between New South Wales and Queensland.
Figure 4 - Accident site and McPherson Range
Source: Google Earth and Flightradar24, annotated by the ATSB
Terrain across the range varies in altitude with several areas above 3,000 ft and some peaks above 4,000 ft.
The initial flight from Evans Head to Casino, indicated that the aircraft was attempting to cross the ranges via a route known as the ‘border loop’. The border loop is a route commonly used by VFR pilots to transit the range. Tracking is north up the Richmond River valley, past the town of Kyogle, then over the ranges where the railway cuts through the high ground.
Another common route over the ranges is to fly via the Toonumbar Dam, then Killarney to Warwick, which is similar to the track of the second flight. Another pilot who attended the Fly‑In reported that when attempting to fly over the ranges they use a minimum of 4,000 ft, and normally fly over the range at about 5,000 ft.
Meteorological information
Bureau of Meteorology forecast
The planned flight from Evans Head to Boonah traversed two Graphical Area Forecast (GAF)[6] areas. The accident site was located on the border of the GAF NSW East (NSW-E) and the GAF QLD South (QLD-S).
Forecast weather conditions in the GAF for NSW-E, valid from 1000 to 1600 on 12 January 2020, that potentially affected the flight included:
Average conditions of greater than 10 km visibility with areas of broken[7] stratocumulus clouds between 3,000 and 6,000 ft
Widespread smoke reducing visibility to 8,000 m
Isolated showers of rain reducing visibility to 4,000 m with associated cloud including broken stratus 1,000 to 2,000 ft and broken cumulus, stratocumulus 2,000 to 8,000 ft
Isolated thunderstorms and rain reducing visibility to 2,000 m with associated cloud including isolated cumulonimbus 6,000 to above 10,000 ft, broken stratus 500 to 2,000 ft and broken stratocumulus 2,000 to 6,000 ft
Isolated smoke over land reducing visibility to 1,000 m
Moderate turbulence is implied in cumulous, stratocumulus and altocumulus cloud. Severe turbulence is implied in thunderstorms, cumulonimbus and towering cumulus
The GAF for QLD-S was valid from 0900 to 1500. Forecast conditions that potentially affected the flight included:
Average conditions of greater than 10 km visibility with areas of scattered stratus 1,500 to 3,000 ft, scattered cumulus and stratocumulus 2,500 to 7,000 ft, and further cloud layers above 8,000 ft
Isolated dust and smoke reducing visibility to 7,000 m and 5,000 m respectively
Scattered rain reducing visibility to 5,000 m with associated broken stratus 1,200 to 4,000 ft, broken stratocumulus 5,000 to 8,000 ft and broken altocumulus and altostratus 8,000 to above 10,000 ft
Scattered showers of rain reducing visibility to 3,000 m with associated occasional towering cumulus 5,000 to above 10,000 ft and broken stratus 1,200 to 3,000 ft
Isolated thunderstorms and rain reducing visibility to 2,000 m with associated isolated cumulonimbus 4,000 to above 10,000 ft, broken stratus 1,500 to 4,000 ft and broken stratocumulus 4,000 to 6,000 ft
Moderate turbulence is implied in cumulous, stratocumulus and altocumulus cloud. Severe turbulence is implied in thunderstorms, cumulonimbus and towering cumulus
Neither of the GAFs were corrected and no SIGMETs or AIRMETs affecting the QLD-S area were issued during the validity period. An AIRMET was issued for the NSW-E GAF region, however this was for an area to the west of the flight path and did not affect the conduct of this flight.
The Bureau of Meteorology (BoM) Grid Point Wind and Temperature forecast valid at the time of the flight, forecast the wind to be 20 kt from 160° at 2,000 ft and 19 kt from 130° at 5,000 ft.
The BoM also provided an aerodrome forecast (TAF)[8] for Ballina and Lismore. Lismore Aerodrome was the closest aerodrome to the flight path with a TAF available. TWQ flew within 9.7 km of Lismore aerodrome on the flight from Evans Head to Casino. Lismore is located 20 km east north east of Casino with an elevation of 35 ft. The amended Lismore TAF, issued at 1145 on 12 January 2020, was valid from 1300 on the day of the accident. The TAF forecast 14 kt winds from 160°, visibility greater than 10 km and light showers of rain. Cloud was forecast to be scattered with a base of 2,000 ft above the aerodrome and broken with a base 3,000 ft above the aerodrome. The forecast indicated that between 1300 and 1700 there would be temporary periods, greater than 30 minutes but less than 60 minutes in duration, of deteriorating weather conditions. These conditions included visibility reducing to 4,000 m, showers of rain and broken cloud with a base of 1,000 ft above the aerodrome.
Great Eastern Fly-In event meteorology
On the morning of 12 January 2020, the pilot of TWQ attended the Fly-In pilot’s briefing which included the meteorology for the day. The briefing, delivered by event staff, included weather information based on forecasts available from the BoM for Evans Head, the surrounding airfields and the GAF NSW-E. The display was cancelled at 0830 during the briefing due to the cloud base at Evans Head being approximately 1,000 ft above ground level (AGL) with a reduction to 600 ft AGL forecast during the day.
Bureau of Meteorology observations and analysis
The BoM reported that there were no observations of the actual conditions at the location of the accident. The BoM commented that the winds south of the McPherson Range, below 5,000 ft, would have been south-west to south-easterly. The generally southerly wind flow, heading towards the range, would be consistent with orographic cloud[9] formation. The BoM noted that the forecast broken cloud at 3,000 ft was likely to be a reasonable representation of the conditions. The BoM also stated that the summits of Wilsons Peak at 4,030 ft and Mount Barney 4,430 ft are higher than the bases of the cloud forecast in this area. No thunderstorm activity was detected near the flight path from Casino.
Lismore airport observations
Half hourly observations[10] were recorded at Lismore Airport on the day of the accident. At 1500, the wind was from 170° at an average speed of 11.1 kt, with a gust of 15.9 kt recorded. The temperature was 23.2 °C and the mean seal level pressure was 1014.4 hectopascals (hPa). Cloud was overcast with a base of 3,300 ft.
Casino aerodrome weather recordings
The Casino Automatic Weather Station (AWS) recorded several weather parameters on the day of the accident. At 1500, the wind at Casino Aerodrome was from 170° at an average speed of 6 kt and the temperature was 23.6 °C. No cloud data is available for Casino AWS, as no ceilometer is installed at this location.
Witness observations of weather
Local residents
Residents in the vicinity of the accident location confirmed that the top of the ridgeline, where the accident site was located, was in cloud on the afternoon of the accident. Several of the witnesses commented they could see about three quarters of the way up the ridgeline, which was calculated to be approximately 2,800 ft. These residents commented that it was an overcast day and it had been raining on and off throughout the day.
Tooloom fire tower weather observations
The Forestry Corporation of New South Wales has several observation towers positioned in the region of the flight. The Tooloom tower is located closest to the flight path from Casino, at an elevation of 2,619 ft (Figure 5).
An observer was positioned in the tower on 12 January from 0900 to 1500 and recorded weather conditions on the hour. Throughout the day, visibility remained at 0 km, with the cloud recorded as 8 oktas. In addition, the relative humidity was recorded at 98 per cent or above throughout the day. The wind was from the south-south-east around 9 kt with an average gust of 19 kt.
Figure 5 – Tooloom fire tower location and proximity to flight track
Source: Google Earth and Flightradar24, annotated by the ATSB
Flight track proximity to Tooloom Fire Tower
At 1509, TWQ, at its closest, passed 4.23 km to the west-south-west of the Tooloom Fire Tower (Figure 5). The aircraft was tracking from the south-east to the north-west. At 1509 the aircraft was at 3,575 ft, with a ground speed of 141 kt and tracking 332°. Tooloom Fire Tower has an elevation of 2,619 ft, and was in cloud at 1500, as it had been since 0900.
Pilot access to weather information
On the morning of the accident, the pilot attended the Fly-In event briefing which included weather for the event and the area. There was no log recorded indicating that the pilot accessed the weather information through the National Aeronautical Information Processing System (NAIPS) on the day of the accident. However, it is possible that the pilot obtained additional weather information from other sources.
Recorded data
Overview
The aircraft was fitted with a Mode S transponder that broadcast ADS-B[11] data which included the position and altitude of the aircraft. The data was received by Flightradar24 and provided to the ATSB. Also on-board was a mobile device with the OzRunways electronic flight bag (EFB) application installed. The application had an option enabled for live flight tracking by transmitting the device’s position and altitude. OzRunways information was also obtained by the ATSB. This data had a sampling rate of every 5 seconds.
The ATSB compared the data from both sources and they were found to be consistent. The flight data from OzRunways was plotted for the accident flight along with the terrain elevation. (Figure 6).
Figure 6 - OzRunways data and terrain elevations for the final flight of TWQ
Figure 5 shows the aircraft’s flight data from OzRunways. Groundspeed is annotated in red, altitude in light blue and track in black. The altitude of Tooloom fire tower is also marked in blue. This line starts from the time where TWQ was abeam the fire tower. Terrain directly underneath the flight path is marked in green.
Source: OzRunways, US National Aeronautics and Space Administration Shuttle Radar Topography Mission data and ATSB
The first climb on the graph is part of the departure from Casino aerodrome. On a track generally to the north-west. The aircraft reached 3,000 ft and then descended to 2,200 ft.
The climb that commenced at approximately 1502 corresponded with the first range of high ground en route. A groundspeed of about 145 kt was maintained during this climb. The climb commenced at 2,200 ft and reached a peak of 4,100 ft.
The following descent from 4,100 ft to 3,100 ft, corresponded to a ground speed increase from 145 kt to 173 kt and a rate of descent of about 600 feet per minute. The altitude of TWQ at the bottom of this descent was above the altitude of Tooloom Fire Tower (Figure 6).
Over the last 4 minutes of the flight, the aircraft’s recorded groundspeed, rate of climb/descent and altitude oscillated significantly over short periods with the aircraft’s:
ground speed varying rapidly between 109 and 175 kt,
rate of climb and descent being between maximum values of +2,400 ft per minute and -2,400 ft per minute,
altitude oscillating between 4,000 and 3,100 ft.
At approximately 1512 the final descent and turn towards the high ground commenced. The descent commenced from 4,000 feet with the aircraft travelling at 133 kt groundspeed and tracking 316°.
The last data point was recorded at 1512:49. The aircraft was passing 3,100 ft with an 1,800 feet per minute rate of descent. It was travelling at 172 kt groundspeed and tracking 276°.
Of note, during the last few minutes of flight, prior to the collision with terrain, TWQ maintained more than 1,000 ft clearance with the ground and in most places more than 2,000 ft above the ground.
G3X flight display
The G3X unit can log flight and engine data on a removable SD card, or additionally to an internal Flight Log. The G3X unit was badly damaged in the accident sequence. The SD card and a number of circuit boards from the G3X unit were recovered from the accident site. The SD card was found in the read only mode and therefore did not contain any data from the accident flight. While some flight data was able to be recovered from the internal memory, the last recovered flight data was from 30 December 2019.
Air Traffic Control
TWQ was operating outside controlled airspace at the time of the accident. The Brisbane Centre audio recording was obtained from Airservices for the New England area, which covered the accident flight path. There were no radio calls recorded from TWQ, however, they were not required to make any routine radio calls on this frequency.
Additional information
Visual Flight Rules
The CASA Visual Flight Rules Guide outlined that flight under the visual flight rules (VFR) can only be conducted in Visual Meteorological Conditions (VMC).[12] Additionally, when operating at or below 2,000 ft above the ground or water, the pilot must be able to navigate by visual reference to the ground or water.
The flight, and the location of the accident, were in (non‑controlled) Class G airspace. The following conditions were stipulated for flight under the VFR in Class G airspace when below 10,000 ft and above 3,000 ft or 1,000 ft above ground level (whichever is higher):
a flight visibility of 5,000 m
a minimum vertical distance of 1,000 ft and horizontal distance of 1,500 m from cloud.
In the case of aeroplane operations in Class G at or below 3,000 ft or 1,000 ft above ground level (whichever is higher), the following minimum conditions were stipulated:
a flight visibility of 5,000 m
that the aeroplane shall be maintained clear of cloud and in sight of the ground or water
In addition to minimum visibility and distance from cloud, a pilot is also required to maintain a minimum height above the ground. CAR 157 details that a pilot in command must not fly the aircraft over:
any city, town, or populous area at a height lower than 1,000 ft; or
any other area at a height lower than 500 ft.
This does not apply if through stress of weather or any other unavoidable cause it is essential that a lower height be maintained.
Risks of flying in areas of reduced visual cues
The safety risks of VFR pilots flying from VMC conditions into instrument meteorological conditions (IMC)[13] are well documented. This has been the focus of numerous ATSB reports and publications, as VFR pilots flying into IMC represents a significant cause of aircraft accidents and fatalities. In 2013, the ATSB Avoidable Accidents series was re-published. Of these publications, the booklet titled Accidents involving pilots in Instrument Meteorological Conditions outlined that:
In the 5 years 2006–2010, there were 72 occurrences of visual flight rules (VFR) pilots flying in instrument meteorological conditions (IMC) reported to the ATSB…About one in ten VFR into IMC events result in a fatal outcome.
In another occurrence investigation,[14] the ATSB has found that the ‘continuation of flight towards an area of low cloud and rain was likely influenced by the inherent challenges of assessing low visibility conditions, particularly without instrument flying proficiency.’ This finding was based on the following references.
The United States National Transportation Safety Board (NTSB) (2005) found that ‘reduced-visibility weather represents a particularly high risk to [general aviation] operations’ and that ‘weather may…test the limits of pilot knowledge, training, and skill to the point that underlying issues are identified.’ The NTSB study also outlined that historically, about two-thirds of all general aviation (GA) accidents that occur in IMC are fatal, a rate much higher than the overall fatality rate for GA accidents.
Wiegmann and Goh (2000) explained that pilots may make errors in assessing the deteriorating weather conditions and decide to continue to VFR flight into the adverse weather. The previously mentioned NTSB report (2005) added that in these cases, pilots who might appear to intentionally engage in risky behaviour may actually be making choices that they mistakenly believe to be safe by underestimating the risks associated or overestimating their ability to handle the risks.
Wiggins and O’Hare (1995) further explained how errors in assessment can take place, acknowledging that weather-related decision making can be highly complex and therefore more prone to errors:
Because of the variable nature of operations in the aviation environment, weather-related decision making is often considered a skill that cannot be prescribed during training. Rather it is expected to develop gradually through practical experience. However, in developing this type of experience, relatively inexperienced pilots may be exposed to hazardous situations with which they are ill‑equipped to cope.
ATSB Aviation Research and Analysis Report B20070063, An overview of spatial disorientation as a factor in aviation accidents and incidents, stated that pilots should not attempt to fly into instrument meteorological conditions under the VFR. Pilots should develop a plan prior to take-off on what to do if the weather en route is different from that expected or deteriorates. This plan should consider a requirement to divert or turn back prior to entering instrument meteorological conditions. However, this depends on a pilot correctly assessing the weather conditions. The NTSB (2005) noted that targeted weather-related training programs have had some success in teaching pilots to recognise and respond to deteriorating weather conditions.
A cue-based training system called Weatherwise, was made available to pilots by the Civil Aviation Safety Authority (CASA). Additionally, CASA produced a Weather to Fly education program which focuses on topics such as the importance of pre-flight preparation, making decisions early, and talking to ATC.
One of the ATSB’s SafetyWatch priorities concerns in-flight decision making in relation to VFR flight in environments with reduced visual references. One of the key messages is for pilots to avoid deteriorating weather by conducting thorough pre-flight planning and to have alternate plans in case of an unexpected deterioration in the weather and making timely decisions to turn back or divert.
Spatial disorientation
Spatial disorientation is a type of loss of situation awareness, and is different to geographical disorientation, or incorrectly perceiving the aircraft’s distance or bearing from a fixed location. Spatial disorientation occurs when pilots do not correctly sense their aircraft’s attitude, airspeed or altitude in relation to the earth’s surface. In terms of an aircraft’s attitude, spatial disorientation is often described simply as the inability to determine ‘which way is up’, although the effects can often be more subtle than implied by that description.
Spatial disorientation occurs when the brain receives conflicting or ambiguous information from the sensory systems. It is likely to happen in conditions in which visual cues are poor or absent, such as in adverse weather or at night.[15] Spatial disorientation presents a danger to pilots, as the resulting confusion can often lead to incorrect control inputs and resultant loss of aircraft control.
Research on spatial disorientation indicates that, for pilots who are not instrument rated, loss of control will likely occur between about 60 seconds (Benson, 1988 in Gibb, Gray and Scharff, 2010) and 178 seconds on average (Bryan, Stonecipher, & Aron, 1954) after the loss of visual reference. These studies led to the FAA’s and CASA’s ‘178 seconds to live’ educational campaigns. Gibb, Gray and Scharff (2010) also stated that ‘spatial disorientation accidents have fatality rates of 90–91 percent, which indicates how compelling the misperceptions can be.’
Related Occurrences
There have been a number of accidents relating to VFR pilots flying into reduced visibility conditions. Many of these occurrences have been summarised in the research reports previously mentioned (B2005/0127 and AR-2011-050) as well as in ATSB accident reports (for example, AO‑2015-131 and AO-2016-006). Of particular interest are those occurrences where pilots have avoided an accident outcome by seeking assistance from other aircraft or from ATC. Of note are two occurrences that occurred on the same day in a similar location but with a very different outcome. See below for details.
On 16 June 2017, a Cessna Aircraft Company C172M, registered VH-FYN, was being operated on a private flight from Southport Mason Field, Queensland to Ballina Airport, New South Wales. The purpose of the flight was to ferry the aircraft to Ballina for scheduled maintenance. Enroute, near the town of Bangalow New South Wales, the aircraft entered an area of reduced visibility, including low cloud, fog and drizzle. The aircraft diverted off the initial track and was last seen disappearing into cloud heading inland. A short time later the aircraft collided with terrain and the pilot was fatally injured.
ATSB occurrence 201702740
On 16 June 2017, the pilot of a light aircraft was flying under VFR from Taree, New South Wales, to Southport, Queensland. While near Ballina, New South Wales the weather suddenly deteriorated and the pilot attempted to turn back to land at Coffs Harbor, New South Wales. However, the weather continued to close in, at which point the pilot reported to ATC that he was now flying in instrument meteorological conditions (IMC). ATC observed a sporadic radar return in the position described by the pilot and advised that the pilot gain altitude, which assisted with radar identification. ATC then guided the aircraft to Evans Head, New South Wales where the weather had cleared sufficiently for the aircraft to land safely.
While en route from Evans Head, New South Wales, to Boonah, Queensland, the pilot of amateur-built Wittman Tailwind aircraft, registered VH-TWQ (TWQ), diverted to Casino, New South Wales, due to low cloud on the McPherson range. The pilot then took off after approximately fifty minutes on the ground and attempted to reach Boonah via a different route across the range. During the flight TWQ entered an area of reduced visibility. Approximately fifteen minutes after take-off TWQ commenced a series of rapid climbs and descents followed by a descending left turn which continued until TWQ collided with terrain.
Site and wreckage examination did not identify any defects or anomalies that might have contributed to the accident. Additionally, there was no evidence to support the pilot being incapacitated. Therefore, this analysis will focus on the examination of the factors that led to a visual flight rules (VFR) pilot entering an area of reduced visibility and losing control of the aircraft.
Decisions to depart Evans Head and Casino
After the Fly-In was called off due to the poor forecast weather the pilot and passenger elected to fly home to Boonah and Toowoomba. The pilot had attended the Fly-In event briefing that morning and was therefore aware of the local weather conditions and forecast. Neither the pilot’s nor the passenger’s family could identify a time pressure for the aircraft to return to Boonah and Toowoomba that day.
The relevant Graphical Area Forecasts did not preclude a departure under the VFR from Evans Head via Boonah to Toowoomba. However, they indicated the possibility of encountering areas of cloud, dust and rain in which visibility would reduce below that required for VFR flight. The inland route to Boonah, required the aircraft fly across the McPherson Range. Several of the peaks along this range are greater than 3,000 ft and a few are greater than 4,000 ft.
The generally south-south-easterly wind flow, heading towards the range, would have had the effect of pushing the weather up against the McPherson Range and reducing the visibility. So, while it was possible to depart under the VFR, the forecast conditions would have indicated that it was likely there would have been cloud on the ranges and have necessitated planning for an alternate route or diversion to avoid the area if the actual conditions reflected the forecast.
The pilot’s decision to depart the interim landing site can be interpreted as likely taking advantage of acceptable conditions at Casino with the notion that the weather further inland may have allowed for VFR flight over the ranges.
Once airborne, the pilot would have been in a position to assess the in-flight visibility and cloud and rain in the intended direction of travel. However, as discussed in the United States National Transportation Safety Board report (2005), it is possible that the continuation of flight towards the area of low cloud was influenced by the inherent challenges of assessing low visibility conditions.
The ATSB was unable to determine the pilot’s understanding of the weather conditions ahead of the aircraft prior to entering an area of low visibility conditions. However, the pilot had demonstrated an awareness of the risk posed by the weather and the need to maintain visual reference by diverting from the original track and turning back from the first attempt to cross the Ranges.
Development of the accident
Flying into an area of reduced visibility
The majority of the flight from Casino was conducted between 2,000 and 4,000 ft. Approximately 30 km north-west of Casino the aircraft began a climb over the first area of high ground. Terrain in this area is approximately 1,800 ft high. At about 1506, the aircraft reached a maximum altitude of 4,100 ft then entered a 600 ft/min descent where the groundspeed rapidly increased from 145 kt to 173 kt. It is likely that the pilot initiated the climb to clear terrain and then descended when the cloud conditions became unsuitable. This climb took TWQ above the forecast and observed cloud heights in the area, which indicated a cloud base of around 2,600 - 2,800 ft. The descent levelled out at 3,100 ft, and the terrain underneath was about 1,430 ft, allowing the pilot to continue the descent a further 1,670 ft and remain clear of the terrain, if the pilot was visual with terrain. It is possible that the pilot entered an area of deteriorating visibility at this time leading to the rapid descent and level off well above terrain.
From this point on, the pilot flew no lower than 3,100 ft, which was around the height of the some of the ridge lines in the area. It is therefore possible that the pilot was aware of the spot heights of terrain in the area and was attempting to stay above them.
At about 1508, in the vicinity of the Tooloom Fire Tower, the pilot commenced another climb. As the fire tower was in cloud, it is likely that the pilot entered an area of cloud during this climb. Flight data showed that the final turn and descent of TWQ was towards the high ground. The accident site was located near the top of the ridgeline. Either side of this ridgeline were areas of low ground, which the pilot could have manoeuvred towards if visual with terrain. The direction of turn as well as the descent and acceleration towards the terrain indicate the pilot was not visual with terrain at the time of the accident.
Spatial disorientation resulting from a loss of visual cues
Flight data from the last 4 minutes of the flight recorded the aircraft’s groundspeed speed varying between 109 and 175 kt. The aircraft’s rate of climb and descent varied between +2,400 ft/min and -2,400 ft/min. The aircraft’s altitude varied between 4,000 and 3,100 ft.
Of note, the speed recorded by the data is ground speed. Forecast winds for the area were up to 20 kt in the direction of travel of TWQ and could be considered all tail wind. If the actual winds were as forecast, the aircraft was being operated above the published manoeuvring speed limit of 130 kt indicated airspeed KIAS and likely up to the maximum structural cruising speed at some points.
The final data point showed the aircraft descending through 3,100 ft and travelling at 172 kt groundspeed. The aircraft was descending at 1,800 ft/min and was tracking towards the high ground.
The flight data from the last 4 minutes of flight was not consistent with normal operations of a Wittman Tailwind. The abrupt speed and altitude reversals and the operation of the aircraft over and near these speed limitations are indicative of a loss of control.
It is therefore likely that within 4 minutes of flying into conditions of reduced visibility, without adequate visual reference to the horizon, the pilot of TWQ became spatially disorientated leading to a loss of control and collision with terrain. It is possible that the pilot of TWQ was able to maintain some control initially upon entering cloud due to the pilot’s previous instrument flying experience. However, without recent experience and the training and qualification of an instrument rating the pilot was unlikely to have been able to maintain control in cloud for an extended period of time.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving Wittman Tailwind, VH-TWQ, which occurred in Tooloom National Park, New South Wales, 12 January 2020.
Contributing factors
The pilot departed an interim landing site for Boonah under the visual flight rules with a high risk of encountering forecast cloud that reduced conditions below that required for visual flight.
It is likely the pilot encountered conditions of reduced visual cues and became spatially disorientated which led to a loss of control and collision with terrain.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Benson, AJ, 1999a, “Spatial disorientation – general aspects”, in J Ernsting, AN Nicholson & DJ Rainford (Eds.), Aviation Medicine (3rd ed.), Oxford, England, Butterworth Heinemann, pp. 419-436.
Gibb, R, Gray, R and Scharff, L, 2010, Aviation Visual Perception: Research, Misperceptions and Mishaps, Ashgate Publishing Limited, Surrey, United Kingdom.
Wiegmann, D and Goh, J, 2000, Visual Flight Rules (VFR) Flight into Adverse Weather: An Empirical Investigation of Factors Affecting Pilot Decision Making, Federal Aviation Administration research DTFA 00-G-010, Illinois, United States.
Wiggins, M and O’Hare, D, 1995, “Expertise in Aeronautical Weather-Related Decision Making: A Cross-Sectional Analysis of General Aviation Pilots”, Journal of Experimental Psychology: Applied Vol. 1 No. 4, pp. 305-320.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Family of the pilot
Civil Aviation Safety Authority
Fly-In Event Organiser
Fly-In Chief Marshall
Bureau of Meteorology
Coroner’s representative
Submissions were received from:
Bureau of Meteorology.
The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 11/03/2020
What happened
On 12 January 2020, at 1336 Eastern Daylight-saving Time,[1] the pilot of an amateur-built Wittman Tailwind aircraft, registered VH-TWQ (TWQ), departed Evans Head Airport, New South Wales, with one passenger on board (Figure 1). The pilot was conducting a private flight under the visual flight rules[2] from Evans Head, New South Wales to Boonah, Queensland.
The pilot flew in a north-north-westerly direction towards Boonah via the Richmond River valley. At 1353, the pilot commenced a 180° turn overhead the township of Kyogle and diverted south back down the valley to Casino aerodrome, landing at 1406.
At 1454, the pilot took off from Casino and flew in a west-north-westerly direction. At 1511, TWQ commenced a left turn and, shortly afterwards, collided with terrain. The pilot and passenger were fatally injured, and the aircraft was destroyed.
Figure 1: Flight tracks for VH-TWQ on 12 January 2020
Source: Flightradar24 and Google Earth, annotated by the ATSB
Recorded data
The aircraft was fitted with a Mode S transponder that broadcast ADS-B data. This information included the position and altitude of the aircraft and was received by Flightradar24 and provided to the ATSB. Also on board was a mobile device with the OzRunways application installed. This application provides the option for live flight tracking by transmitting the device’s position and altitude and that option was enabled for this flight. OzRunways information was also obtained by the ATSB. The data indicated that the aircraft was travelling at approximately 170 kt ground speed and in a descending left turn just prior to the collision with terrain.
Wreckage examination
The accident site was located in rainforest, about 72 km west-north-west of Casino, within the Tooloom National Park. Examination of the wreckage indicated that the aircraft collided with a number of trees before coming to rest on the rainforest floor at an elevation of 996 m (3,169 ft) (Figure 2).
Figure 2: VH-TWQ’s empennage at the accident site
Source: ATSB
The aircraft’s structure was substantially disrupted, with the wreckage trail on an approximate east to west heading and covering a length of about 120 metres. All major components were located at the accident site. Due to the disruption of the airframe, the aircraft’s attitude when it entered the tree canopy could not be determined. There was no evidence of fire.
Pilot details
The pilot held a Private Pilot (Aeroplane) Licence and was qualified to fly by day under the visual flight rules. The pilot also held a single-engine aeroplane class rating. The pilot last conducted a single-engine aeroplane flight review in June 2018 that was valid until June 2020. His logbook indicated he had a total of about 1,200 hours flying experience. The pilot held a Class 2 aviation medical certificate that was valid until October 2021.
Weather conditions
Forecast meteorological conditions valid for the accident flight included visibility of 10 km or greater and broken[3] cloud from 3,000 to 6,000 ft above mean sea level. Isolated rain and thunderstorms were also forecast, with associated reduced visibility and lower cloud bases. Widespread smoke was also forecast due to bush fires in the area, reducing visibility to 1,000‑8,000 m.
Ongoing investigation
The investigation is continuing and will include examination of:
meteorological conditions and pre‑flight preparation
pilot qualifications, experience
recovered wreckage, aircraft performance characteristics and recorded flight data
aircraft maintenance documentation and operational records.
Acknowledgement
The ATSB acknowledges the significant assistance provided by the New South Wales Police Force during the on-site phase of this investigation.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this update. As such, no analysis or findings are included.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 9 January 2020, the pilot of a Garlick Helicopters UH-1H, registered VH-ONZ, was tasked at Moruya, New South Wales, to assist fire-ground crews with a bush-fire clean-up operation near the town of Eden. After arriving in the hover overhead the Ben Boyd Reservoir to uplift water, the helicopter’s engine failed, resulting in a rapid descent, and impact with the water followed by sinking and rollover. The pilot conducted an underwater escape and sustained a minor injury. The helicopter was substantially damaged and later recovered from the reservoir.
What the ATSB found
The helicopter’s engine intake and compressor section were found to be damaged on initial examination by the operator’s maintenance organisation and the engine was subsequently sent to Honeywell Engines in the United States for a teardown inspection and failure analysis. Honeywell found indications of a restriction of oil flow to the main bearings in the front section of the engine, which led to their failure. This resulted in contact between the power and compressor shafts, disconnection of rotational drive to the fuel pump and fuel control, and subsequent fuel starvation. As the oil passages for the front section of the engine passed their flow tests, the reason for the restriction could not be determined.
The pilot had completed helicopter underwater escape training about 8 months prior to the accident and credited this as a life-saving course. The training also included elements for emergency breathing systems (EBS), but the pilot did not conduct those elements as the equipment had not been introduced into the company’s operation. Survivability research reports have consistently found drowning to be the leading cause of fatalities in helicopter water impact and ditching accidents, and therefore, the ATSB concluded that an EBS would have reduced the risk of drowning.
What has been done as a result
Following the accident, the pilot acquired a compressed air EBS and intends to conduct the EBS elements of future helicopter underwater escape training courses. The operator reported they have started investigating how to implement EBS company-wide, and how to attach the units to their pilots without limiting their movement when conducting long-line operations.
Safety message
Although helicopter fire control operations are predominantly conducted overland, the requirement to uplift water results in repeated approaches and departures overwater. If a catastrophic failure occurs in this period of the operation, the helicopter may have insufficient energy to be manoeuvred clear of water to an emergency landing site. Where helicopter underwater escape training is required for an operation, there is a recognition that an emergency may result in the need for an underwater escape, in which case an EBS would also likely be beneficial.
Summary video
The occurrence
On 9 January 2020, at about 0830 Eastern Daylight-saving Time,[1] the pilot of a Garlick Helicopters UH-1H, registered VH-ONZ, was tasked at Moruya, New South Wales, to assist fire‑ground crews with a bush-fire clean-up operation near the town of Eden. The helicopter was equipped with a 100 ft long-line and 1,400 L water bucket. It was flown from the left seat, with essential engine instruments and caution lights mounted on the left door for ease of reference. A bubble window was fitted to the left door so that the pilot could view the bucket at the end of the long-line underneath the helicopter.
TracPlus[2] data recorded the helicopter’s departure from Moruya Airport at 0957. On arrival at the Eden fire-ground, the pilot made radio contact with the fire-ground crew and received approval to use the Ben Boyd Reservoir as the water source for the day. Two refuels were conducted at Merimbula Airport at 1227 and 1516. The helicopter departed Merimbula on completion of the second refuel at 1547 to return to the fire-ground. The last recorded TracPlus data was overhead the Ben Boyd Reservoir at 1559 (Figure 1).
Figure 1: Flight track and key locations
Source: Google earth with TracPlus data supplied by operator, annotated by the ATSB
On arrival in a 100 ft hover over the reservoir, the pilot heard a grinding noise. At that time, the pilot was looking below the helicopter at the bucket and did not notice any engine gauge readings or if any caution lights activated. Following the grinding noise, the pilot jettisoned the long-line and bucket, and applied forward cyclic to move the helicopter forward to a small clearing on a headland. However, a complete loss of engine power occurred before the helicopter could reach land, resulting in an immediate descent into the water.
The pilot reported making several emergency broadcasts and using all the main rotor energy available to reduce the rate of descent before the helicopter impacted the water in what was described as a ‘belly-flop, straight down’. On impact, the chin-bubbles fragmented, and the helicopter rolled inverted, filled with water, and sank (Figure 2).
Figure 2: Helicopter inverted in reservoir
Source: Department of Defence, annotated by the ATSB
The pilot waited for all motion to cease and attempted to open the pilot’s left door using the normal mechanism. The door could not be opened, so the pilot released the lap-strap (harness) and moved across the cockpit to open the co-pilot door. This door could not be opened, and the pilot then moved into the cabin.
In the cabin, the pilot found a pocket of air and ‘took a couple of breaths’, then attempted to open the cabin sliding doors, but was unsuccessful (the cabin doors comprised a rear sliding door that latched to a forward hinged panel (quarter door)). The pilot then punched out the right sliding door rear window and egressed. No attempts were made to open any of the doors or windows using their emergency release mechanisms.
After exiting the cabin, the pilot inflated the lifejacket, swam to shore, and then walked about 1 km to a road to be collected. About 15 minutes later, an ambulance arrived to take the pilot to hospital for a medical examination. The pilot sustained a minor injury, and the helicopter was substantially damaged and later recovered from the reservoir (Figure 3).
Figure 3: Recovery of VH-ONZ - cabin sliding doors removed
The pilot held a Commercial Pilot Licence (Helicopter) with the required ratings and endorsements for the operation and had accumulated a total of 12,023 flying hours (3,008 hours on the UH-1H). The pilot held a valid Class 1 Aviation Medical Certificate and recalled feeling fully alert at the time of the accident.
Helicopter underwater escape training (HUET) was a New South Wales Rural Fire Service contract requirement with a 3-year currency. The pilot last completed the course on 13 May 2019, about 8 months prior to the accident, and had completed about five to six courses since the requirement was introduced. The HUET course included emergency breathing systems (EBS) for underwater escape, but the pilot did not complete those elements as the equipment had not been introduced into their operation. The carriage of EBS was not a requirement for the operation.
Engine information
The engine was a Honeywell model T53-L-13B, serial number LE-22213R.[3] This model of engine is a five-stage axial, single-stage centrifugal compressor driven by a two-stage gas generator turbine section. Output power is generated by a two-stage power turbine using a reverse flow, annular combustion chamber (Figure 4).
Figure 4: T53-L-13 engine
Source: Honeywell
Maintenance inspection of the engine
Following recovery of the helicopter from the reservoir, the engine was inspected by the operator’s maintenance organisation. A borescope inspection of the engine compressor section revealed a rotor blade failure in addition to other rotor blade and inlet guide vane damage (Figure 5). The engine was sent to Honeywell Engines in the United States for a teardown inspection and failure analysis. The following engine information sections summarise their findings.
Figure 5: Borescope image of damage to engine inlet and compressor
Source: Operator, annotated by the ATSB
Engine teardown and failure analysis
Honeywell’s examination found that the bearings at the front of the engine (no. 1 compressor shaft bearing and no. 21 power shaft bearing) had failed and exhibited excessive heat damage (Figure 6). However, the main bearings located at the rear of the engine (no. 2, no. 3 and no. 4) did not exhibit this damage. This indicated that a reduction in oil flow had occurred to the front section.
The engine is lubricated by filtered oil delivered from the oil pump, driven by the accessory gearbox, into two main flow paths. One flow path is through the internal passages in the inlet housing to the front section of the engine, while the other is through the external oil pressure hose assemblies to the rear section of the engine.
Debris adhering to the engine oil chip detector,[4] located nearest the external oil reservoir, was found to be consistent with the steel base and silver-plating materials for the no. 1 and no. 21 bearings and their cages.[5] This suggested that the bearings were failing while the engine was still rotating and transferring oil through the engine. A continuity check of the engine oil chip detector determined that the circuit was ‘closed’, which would indicate a chip detection (although none recalled by the pilot).
The oil flow passages for the no. 1 and no. 21 bearings were inspected and flow tested with no evidence of a blockage found. Metallic debris, consistent with bearing material, was captured from the power shaft bearing retainer (oil flow pathway to the front section). However, this material was released at a very low-pressure during testing, which indicated the debris was likely transported to this location during the last moments of the engine failure and shutdown and was not likely blocking oil flow during earlier operation. No other debris was noted in the lubrication oil passages to the no. 1 and no. 21 bearings that would have prevented normal operation.
Figure 6 depicts the compressor (N1 in blue) and power (N2 in red) sections of the engine, the locations of the main bearings for the front (no. 1 and no. 21) and rear (no.2, no.3 and no.4) sections, and the accessory drive system (includes drives for the oil pump and fuel control).
Figure 6: Cross-section of a T53-L-13 engine showing the location of the main components and bearings
Source: Honeywell, annotated by the ATSB
From the information provided by the pilot, and examination of the engine, Honeywell provided the following sequence of events for the engine failure:
Lubrication oil to the no. 21 and the no. 1 bearings was reduced or blocked.
The no. 21 bearing began to overheat and fail, resulting in excessive heat being generated in the power shaft and nearby components.
The forward compressor shaft seal assembly began to fail resulting in additional heat input to the nearby components.
The no. 1 bearing began to fail due to excessive heating.
Due to the no. 1 bearing failing, the forward end of the compressor shaft was no longer properly retained. This allowed contact between the compressor and power shafts as well as axial compressor blade tip contact with their respective shrouds. This likely resulted in the ‘grinding noise’ heard by the pilot shortly before the loss of engine power.
The compressor shaft accessory drive bevel gear, attached to the forward end of the compressor shaft, began to lose mesh with the driven accessory drive bevel gear, which provided rotational power to the fuel pump and the fuel control.
The fuel pump and fuel control stopped rotating due to the loss of drive from the compressor shaft accessory drive bevel gear.
The engine flamed out due to a loss of fuel flow from the fuel pump and fuel control.
Power was lost to the engine.
Figure 7 depicts the damage found to the power shaft (top and bottom left) and no. 21 bearing (bottom right). The yellow arrows depict wear, and the red bracket (bottom left) depicts a groove in the shaft at the location of the no. 21 bearing. Figure 8 depicts a comparison no. 21 bearing fitted to its power shaft bearing retainer.
Figure 7: Damaged power shaft and no. 21 bearing
Source: Honeywell
Figure 8: Comparison no. 21 bearing
Source: Honeywell
Engine bearings history
At the previous engine hot section[6] inspection on 22 February 2018, the no. 1 and no. 21 bearings were replaced. The engine inspection facility[7] reported that the no. 1 and no. 21 bearings were replaced for compliance with service bulletins T53-180 and T53-056, respectively. There were no defects regarding wear or discoloration of the removed bearings. Both bearings were replaced with new parts purchased directly from Honeywell. The engine oil supply and scavenge pump was functionally tested by another facility and deemed serviceable.
The engine was subject to 150-hourly oil filter inspections and 300-hourly oil replacements. The last 150-hourly inspection, which included an oil replacement and chip detector inspection, was certified as completed on 9 January 2020, the morning of the accident. No defects were found. The bearings had accumulated about 1,128 hours prior to the accident, at which stage the engine had accumulated about 1,880 hours since the last engine overhaul.
A search by Honeywell did not find any previous no. 21 bearing failures from inadequate lubrication reported to either Lycoming or Honeywell. Honeywell reported that, in the 1970s and 1980s, there were several no. 21 bearing failures attributed to the use of a bronze cage surrounding the rollers. Lycoming released a service bulletin in the 1980s to replace the bronze cage with a steel cage, with a compliance time limit. The accident no. 21 bearing had a steel cage, which did not fail.
A search of the Civil Aviation Safety Authority service defect reporting system found no reports for restriction or blockage of oil flow, or problems with the no. 1 or no. 21 bearings, in the previous 20 years for either the Lycoming T53 family of engines or the Honeywell T5313B engine. However, the ATSB was able to locate a Honeywell report from 29 October 2009 for a T53-L-703 engine failure in the United States. The report concluded that the engine experienced a failure of the no. 1 bearing and that a cage failure may have been the initiating event. This was a bronze cage that had separated into multiple fragments. There was evidence of high metal temperature exposure, but no evidence of oil starvation. The no. 21 bearing was not removed but observed to be intact and rotated freely. The cause of the cage failure and over-temperature condition could not be determined. The accident no. 1 bearing cage did not fail and was a different part number to the earlier 2009 report.
Survival aspects
Underwater exits
The pilot reported that normal and emergency release mechanisms for exits were included in the HUET course, but recalled that during the accident, ‘[I] didn’t think about any of the emergency releases for the doors or windows…if one didn’t work, then went for another exit’. The pilot reported that the cabin door window used for the escape was selected as ‘daylight’ could be seen through it and punched it with the belief that it was the quarter door window. Following the recovery of the helicopter it was found to be the right sliding door rear window that had an emergency release. The pilot could not recall how the air pocket was found in the cabin prior to the escape.
Following the recovery of the helicopter from the reservoir, the operator checked the pilot and co‑pilot doors and found that they were both jammed due to airframe distortion and could not be opened. The rear of the airframe was less distorted, and the cabin doors could be opened.
A 2020 European Union Aviation Safety Agency (EASA) research report, Underwater escape from helicopters, found that the ability to escape through a particular exit was influenced by several factors. They noted:
It is generally accepted that if a helicopter occupant needs to remove an exit or escape window, then it is highly desirable to do this with the seat harness still secured, enabling the individual to apply force effectively. This was confirmed by Mills and Muir (1998, 1999a); a number of their study participants had released their seat belt before operating the exit, making operation of the exit either difficult or impossible.
Despite the difficulty with the underwater escape, the pilot described the HUET course as ‘great’, and very realistic. When the helicopter impacted the water and started to sink and rollover, the pilot placed one hand on the seatbelt and the other on the door handle and waited for all movement to stop before attempting to escape, in accordance with one of the HUET objectives to maintain orientation. At interview, the pilot reported ‘would have been dead without HUET’. As previously emphasised by the ATSB (Regular helicopter underwater escape training):
…HUET (helicopter underwater escape training) is considered to provide individuals with familiarity with the crash environment and confidence in their ability to cope with the emergency situation. Interviews with survivors from helicopter accidents requiring underwater escape frequently mention they considered that HUET had been very important in their survival. Training provided reflex conditioning, a behaviour pattern to follow, reduced confusion, and reduced panic.
Figure 9 depicts the helicopter inverted in the reservoir and the location of the right sliding door rear window, used by the pilot for the underwater escape.
Figure 9: Location of escape window
Source: Department of Defence, annotated by the ATSB
Emergency breathing systems
In May 2001, the North Atlantic Treaty Organization’s Research and Technology Organization published report RTO-AG-341, The Requirements for an Emergency Breathing System (EBS) in Over-Water Helicopter and Fixed Wing Aircraft Operations. Their report concluded that a persistent 15 per cent fatality rate in helicopter ditching was due to drowning and that the principal cause was the inability to breath-hold long enough to make an escape. They concluded that some form of EBS, whether a rebreather or compressed air unit, would improve survivability.
In their February 2008 manual, the Research and Technology Organization discussed the benefits and limitations of three distinct types of EBS. They were the compressed air, rebreather, and hybrid rebreather systems.
Compressed air system
A compressed air system is based on a self-contained underwater breathing apparatus. This type of equipment is classed as an open-circuit demand system and can be purged underwater prior to use. This means that, when the user breathes out, the exhaled air leaves the demand valve and enters the water. None of the expelled air is collected and reused again, as in the case of a closed-circuit demand system such as a rebreather.
Rebreather system
The rebreather is based on exhaling and rebreathing your own air. As exhaled air contains un‑metabolised oxygen, it can be rebreathed many times before the oxygen is used up. The air is collected at atmospheric pressure by the wearer expelling a deep breath into a counter‑lung (air bladder) via the mouthpiece prior to submersion. It can then be inhaled and exhaled into the counter-lung when the user is unable to hold their breath anymore.
Hybrid rebreather system
This system works on the same principle as a rebreather, but it also contains a small cylinder of compressed air fitted to the counter-lung. The air cylinder can be automatically activated by saltwater immersion or manually activated using an emergency inflator pull cord. The reason for the cylinder is to provide some air for those who did not get a breath of air before submersion.
Technical standard for emergency breathing systems
Drowning is the primary cause of death in helicopter water impact accidents. It is a well documented fact that a helicopter will capsize and/or sink in a high proportion of water impact accidents (e.g. Rice & Greear, 1973; Brooks, 1989; Clifford, 1996). To make a successful escape, the occupant must be conscious, mobile, and be familiar with escape procedures and escape routes. The risk of drowning is very high due to the fact that there is a mismatch between the time needed to escape from the inverted and possibly sinking helicopter and the time that individuals can hold their breath underwater (Cheung et al, 2001). When considering the means of mitigating the risk of drowning, considerable effort has gone into improving both the crashworthiness of helicopters and the ability to keep helicopters afloat (see CAA, 2005 for review of research).
Emergency breathing systems (EBS) provide an alternative or additional means to mitigate the risk of drowning. They are designed to allow helicopter occupants to breathe underwater for at least 1 minute, overcoming the need to make a single breath last for the duration of the escape process. If deployed successfully, EBS use should therefore increase the likelihood of survival.
The CAP draft technical standard proposed two categories of EBS performance. Category ‘A’ systems were those with the capability to be deployed underwater and therefore suitable for use in the worst-case water impact accidents where capsize and/or sinking occur immediately after impact. Category ‘B’ systems were those that were required to be deployed in air, and therefore limited to ditching scenarios where there was sufficient time to deploy the system prior to submersion.
The CAP noted there was a small risk of barotrauma[8] associated with the compressed air EBS and hybrid EBS, and that a few injury cases had been reported during training. Therefore:
When selecting EBS, the end user must carry out a risk assessment looking at likely conditions of use, training needs, and maintenance and servicing requirements before deciding on a suitable device that best matches those requirements.
Height-speed envelope avoid area
If a helicopter is unable to be safely landed following a loss of power, the manufacturer must provide a limiting height-speed envelope diagram. The diagram must include the avoid areas, which denote the combinations of height and forward airspeed where it may not be possible to establish a satisfactory autorotation prior to contacting terrain. A height of 100 ft and airspeed less than 40 kt places the UH-1H helicopter with the T53-L-13B engine within the avoid area of its height-speed envelope, which is where the accident helicopter was at the time of the water uplift and engine failure.
While conducting fire control activities in the vicinity of Eden, New South Wales, using the Ben Boyd Reservoir as the water source, the helicopter’s engine failed in the hover over the reservoir. This resulted in a rapid descent into the water, followed by a successful underwater escape by the pilot.
This analysis will discuss the collision with water and underwater escape by the pilot, the results of the engine failure analysis and use of emergency breathing systems.
Collision with water and underwater escape
When the pilot heard a mechanical ‘grinding noise’, their attention was initially focussed on the bucket below the helicopter. The pilot then immediately transitioned to an emergency landing site in front of the helicopter. However, as the helicopter was in the avoid area of the height-speed envelope, the pilot was unable to arrest the rate of descent before impacting the water. The severity of the impact fragmented the chin bubbles and distorted the airframe, which resulted in the helicopter rapidly filling with water and sinking.
The pilot had completed helicopter underwater escape training about 8 months prior to the accident and was able to wait for all motion to cease, then perform the initial actions to maintain orientation. While the pilot did not attempt to open the pilot or co-pilot doors with the emergency release mechanism, it was unlikely the doors would have released due to the airframe distortion.
After moving from the cockpit into the cabin, the pilot found a pocket of air to breathe, but was unable to open the cabin sliding doors. This was likely a result of the underwater environment impeding the pilot’s ability to apply sufficient force to overcome the normal static friction of the sliding doors. However, the pilot was able to punch out the rear window of the right sliding door. This highlights the importance of the design of windows as emergency escape routes, and the potential need for a supplementary air supply for underwater escape, which is discussed further in the section on Emergency breathing systems.
Engine failure mechanism
Following the discovery of damage to the engine inlet and compressor section by the operator’s maintenance organisation, the engine was sent to Honeywell Engines for teardown and failure analysis. Honeywell concluded that the no. 1 and no. 21 bearings in the front section of the engine had failed and exhibited heat damage. This indicated a reduction in oil flow to the front of the engine. There was no evidence of this for the bearings at the rear section of the engine, which were supplied by a separate oil flow pathway.
The failure of the main bearings at the front of the engine resulted in contact between the power and compressor shafts, disconnection of rotational drive to the fuel pump and fuel control, and subsequent fuel starvation. As the oil passages to the bearings at the front of the engine passed their flow tests, it could not be determined how or why a reduction in lubrication occurred. A review by the manufacturer and ATSB found no historical evidence of a similar failure mechanism.
Emergency breathing systems
The ATSB reviewed several research reports into helicopter overwater accident survival and noted that they consistently reported drowning as the leading cause of fatalities. All reports attributed this to the inability of the occupant to breath-hold for the duration of the escape with a variety of contributing factors. In this accident, the cockpit doors were both jammed, which required the pilot to locate an alternate escape route through the cabin. The pilot found an air pocket in the cabin, which enabled the escape time to be extended beyond the initial breath-hold time. This provided the pilot with sufficient oxygen for the physical effort required to attempt to open the sliding doors and then push out a window. It could not be determined if the pilot would have drowned without the air pocket, but it would have increased the likelihood.
While helicopter underwater escape training provides a learning environment for the essential skills of maintaining orientation, location, and operation of exits, it does not address the potential need to extend an individual’s breath-hold. Extending breath-hold may be necessary for problem‑solving and physical effort during the underwater escape sequence, such as dealing with snagging hazards, obstructions, or inoperative exits that require an alternative escape route, as in this accident. An emergency breathing system would have afforded the pilot sufficient time to perform the escape actions without an air pocket and therefore reduce the risk of drowning.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the engine failure involving Garlick Helicopters UH-1H, registered VH-ONZ, near Eden, New South Wales, on 9 January 2020.
Contributing factors
While hovering over the Ben Boyd reservoir to uplift water for fire control operations, the helicopter's engine failed, which resulted in a collision with water and underwater escape by the pilot.
For reasons undetermined, the no. 1 and no. 21 bearings at the front of the engine failed due to inadequate lubrication. This resulted in contact between the power and compressor shafts, disconnection of rotational drive to the fuel pump and fuel control, and subsequent fuel starvation.
Other factors that increased risk
The pilot was not equipped with an emergency breathing system, nor required to be. Although the pilot was able to successfully escape from underwater after finding an air pocket, an emergency breathing system would have reduced the risk of drowning.
Other findings
The pilot had completed helicopter underwater escape training about 8 months prior to the accident and at 3-year intervals since it was introduced on the New South Wales firefighting aerial support contract.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.
Additional safety action by the pilot and operator
Following the accident, the pilot acquired a compressed air emergency breathing system and has decided to conduct those elements of future helicopter underwater escape training courses. The operator reported they have started investigating how to implement emergency breathing systems company-wide, and how to attach the units to their pilots without limiting their movement when conducting long-line operations.
Glossary
CAA Civil Aviation Authority (United Kingdom)
CAP Civil Aviation Publication (CAA)
EASA European Union Aviation Safety Agency
EBS Emergency breathing system
HUET Helicopter underwater escape training
RTO Research and Technology Organization (North Atlantic Treaty Organization)
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Department of Defence (Defence Flight Safety Bureau)
Honeywell Engines
operator
operator’s maintenance organisation
References
Brooks CJ, Tipton MJ 2001, The Requirements for an Emergency Breathing System (EBS) in Over-Water Helicopter and Fixed Wing Aircraft Operations, North Atlantic Treaty Organization Research and Technology Organization RTO-AG-341.
Coleshaw S, Howson D 2020, Research report: Underwater escape from helicopters, European Union Aviation Safety Agency.
Gibbs P 2008, The Principles of Emergency Breathing Systems (EBS) for Helicopter Underwater Escape, in Chapter 7 of Survival at Sea for Mariners, Aviators and Search and Rescue Personnel, North Atlantic Treaty Organization Research and Technology Organization RTO-AG-HFM-152.
UK Civil Aviation Authority 2013, Civil Aviation Publication 1034: Development of a technical standard for emergency breathing systems, The Stationary Office, May 2013.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Civil Aviation Safety Authority
Department of Defence (Defence Flight Safety Bureau)
Honeywell Engines
the operator
the operator’s maintenance organisation
the pilot
United States National Transportation Safety Board.
No submissions were received from the directly involved parties.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 9 January 2020, a Fokker 100 registered VH-NHY and operated by Network Aviation conducted a regular public transport service from Perth to Newman, Western Australia.
The weather forecast for Newman Airport included heavy rain, moderate to severe turbulence below 5,000 ft and a 25 kt crosswind. At the time the aircraft departed Perth, Newman Airport had received about 88 mm of rain since 0900 the previous morning.
After a stable approach, the aircraft touched down in moderate rain, at or before the touchdown zone, at a speed 16 kt above the reference landing speed for the configuration. The crosswind at the time was recorded as gusting to 35 kt. The flight crew experienced lower than expected braking performance and reported aquaplaning during the landing roll. The pilot flying used the aquaplaning response technique to maintain directional control and subsequently commanded maximum reverse thrust.
The aircraft stopped 70 m beyond the end of the runway inside the runway end safety area. There were no injuries to crew or passengers and an inspection of the aircraft found that the loose gravel had damaged some of the landing gear components
What the ATSB found
The combination of the approach speed required by the prevailing wind conditions and the poor braking effectiveness in the wet conditions resulted in the aircraft overrunning the runway.
The ATSB also found that despite assessing the weather as a threat, the flight crew did not identify the potential effect of the rainfall on the stopping distance. Additionally, neither the operator nor the regulator had guidance to allow the crew to recognise the conditions at the time as a hazard to the operation.
Prior to the occurrence, the runway had been examined and found to be requiring maintenance to ensure an adequate level of surface friction, however no maintenance was performed.
What has been done as a result
Following the occurrence, the operator circulated additional guidance and procedures to flight crew for identifying runway water contamination and to ensure appropriate speed control on approach and landing.
Since the occurrence, the Civil Aviation Safety Authority has published guidance, reflecting research from the United States Federal Aviation Authority, that found landing on ungrooved runways in moderate rain has the potential to significantly affect braking performance.
Safety message
Active precipitation, particularly moderate to heavy rainfall, is one of many factors that can influence the stopping distance of an aircraft. Water on a runway that is not grooved can significantly reduce the ability of the aircraft to slow down. In wet weather, additional conservatism is encouraged when calculating the required landing distances.
Operators and pilots are encouraged to review the latest guidance and tools available in relation to maintaining safety on runways and the factors that cause runway overruns.
The occurrence
On 9 January 2020, a Fokker 100 registered VH-NHY and operated by Network Aviation (a subsidiary of the Qantas Group), was conducting a regular public transport service from Perth to Newman, Western Australia.
Pre-flight, departure and cruise
The flight crew arrived at the airport at about 0430 Western Standard Time[1] to prepare for the flight. During the pre-flight briefing, the flight crew received the weather forecast for Newman, which included:
As a consequence of the significant weather, the captain requested additional fuel to provide for a potential diversion to an approved alternate, Port Hedland Airport. The weather observation from Newman Airport at the time indicated that the cumulative rainfall since 0900 the previous day was 87.6 mm.
The aircraft departed Perth at 0536 with 5 crew and 88 passengers on-board. Due to the unfavourable weather, the captain assumed the role of pilot flying and the first officer (FO) was pilot monitoring.[3]
During the cruise phase, the FO requested the latest Newman meteorological aerodrome report from Melbourne Centre. The controller provided updated observations for the destination, which included:
wind 150o at 19 knots, gusting to 30 knots
a reduction in visibility (reduced to 2,500 m)
cloud covers of scattered at 700 ft, broken at 1,100 ft and broken at 1,600 ft
recorded (actual) rain (1.6 mm within preceding 10 minutes, equivalent to 9.6 mm/hour).[4]
The approach
The captain reported that due to the potential for windshear during the final approach segment, a flaps 25 (rather than flaps 42) with speed brake extended approach was selected, resulting in a faster than usual final approach speed (VAPP)[] . The operator’s procedures (see the section titled Operator documentation and guidance) and the Fokker flight manual required an additional 10 knots be added to the usual reference landing speed (VREF[6] + 5 knots) to account for wind, bringing the final approach speed to 153 knots.
The captain reported not calculating the landing field length required on the day as they routinely operated to Newman and knew that the performance of the aircraft would allow for landing at maximum landing weight in dry or wet conditions. At interview, the captain recalled that the required landing field length for flaps 25 and maximum landing weight, the configuration and weight on the day, was about 1,750 m.
Prior to commencing the approach briefing, the flight crew interrogated the Newman aerodrome weather information service (AWIS).[7] The information they received was consistent with the previous weather observations provided by Melbourne Centre, except the wind direction had changed to 130o. Due to the wind direction the crew elected to conduct an approach to runway 05.
As part of the approach brief, the flight crew identified the weather as the primary threat to the operation and discussed a potential diversion to Port Hedland. Their discussions were focussed on the cloud base and the visibility required to conduct the approach, the expectation of windshear, turbulence and the strong crosswind. The rainfall rate and potential for runway contamination or reduced braking effectiveness were not discussed.
At 0655, 17 minutes prior to landing, the flight crew reinterrogated the AWIS. The visibility had reduced to 1,200 m and the rainfall rate had increased to 4.8 mm in 10 minutes (28.8 mm per hour). The captain commented to the FO that the reduced visibility was likely related to a rain shower.
Flight recorder data indicated that the approach was within the operator’s stable approach criteria. Recorded values of airspeed during the final approach and landing showed fluctuations consistent with gusty conditions. At the decision height, coincident with the FO beginning to state ‘no contact’,[8] the captain announced that the runway was in-sight and continued the approach.
At interview, the FO explained that they[9] were unable to see the runway due primarily to two factors. The FO was not familiar with the approach, which had a 6º offset angle between the approach path and the runway, causing the nose of the aircraft to point right of the centreline. This difference between the approach course and the runway heading was exacerbated by the crosswind from the right of the runway, further pushing the nose of aircraft to the right of the centreline.
At the time that the captain announced that the runway was in sight, the aircraft was 3.4 km from the runway threshold, which was the required visibility for the approach.
The flight crew reported that during the approach the rainfall was of a moderate intensity. The aerodrome reporting officer (ARO) reported observing a slight increase in the rain intensity just prior to the aircraft landing but considered it to be moderate rain.
Landing
At 0712, the time of the landing, a maximum crosswind gust of 35 knots was recorded.[10] This was the highest recorded gust between 0700 and 0730. The crosswind limit for the Fokker 100 is 35 knots. The aircraft touched down at 154 knots airspeed and a groundspeed of 159 knots (Figure 1). The touchdown was positive[11] and at, or slightly before, the touch down zone.
Figure 1: Flight data from the occurrence landing
Source: ATSB
Eleven seconds after landing, the captain requested assistance with the brakes[12] from the FO. The recorded deceleration during this part of the landing was medium to low (less than 0.25 G) and reduced further as the landing roll progressed (Figure 1). Throughout the landing, there were directional oscillations about the runway heading as the aircraft weathercocked into the strong crosswind.
The captain reported that the aircraft aquaplaned during the landing. Approximately 20 seconds after touching down, the aquaplaning response technique was conducted. This involved reducing manual braking (brake pressure) with the intent of regaining traction and stowing the thrust reversers to increase directional stability. After completion of the aquaplaning response technique, maximum reverse thrust was applied which provided high deceleration (greater than 0.5 G) just before the aircraft departed the runway.
The aircraft stopped about 70 m beyond the upwind runway threshold, off the runway surface, within the runway end safety area[13] (Figure 2). There were no injuries and the passengers and crew disembarked via the front stairs and were transported to the terminal.
Figure 2: Image taken of the aircraft stopped within the runway end safety area
Source: Network Aviation
A visual examination of the tyres identified some deep scratches, likely due to the abrasive surface of the runway end safety area. An inspection of the aircraft found that the loose gravel had damaged some of the landing gear components.
At the time of the occurrence, the captain had 5,594.7 hours total flying time with 1,963.4 hours on the Fokker 100. The captain had flown regularly to Newman, the last time being the week prior.
The first officer had 2,920.5 hours total flying time with 182.8 hours on the Fokker 100. It was the first officer’s second time flying into Newman.
Runway information
Newman Airport runway 05/23 was 2,072 m long, 30 m wide and ungrooved (lateral grooving is used to improve braking performance in wet conditions).
The most recent maintenance on the runway surface was a retexturing and excess rubber removal completed in June 2018 after a Civil Aviation Safety Authority (CASA) audit found that severe pavement bleeding and flushing[14] was occurring at the touchdown zones.
On the morning of the occurrence, the aerodrome reporting officer[15] (ARO) at Newman Airport inspected the runway at 0500 and again at 0630, 45 minutes before the aircraft landed. This was in accordance with the ARO’s procedures for the runway to be inspected ‘as soon as practicable prior to the first RPT [regular public transport] flight’. At those times, the ARO recalled a significant amount of standing water on the grass strips on either side of the runway. However, the ARO described that the main runway surface appeared clear of any noticeable standing water and was serviceable throughout the morning.
About a year after the occurrence, an image was taken of the runway showing standing water on the runway after rainfall (Figure 3).
Figure 3: Image of standing water on the runway at Newman Airport.
Source: Qantas
Friction tests
Aerodrome operators were required to ensured that runway friction levels were above minimum limits[16] as detailed in Part 139 (Aerodromes) of the Manual of Standards 2017, version 1.14, which was current at the time. In order to demonstrate compliance, the friction was required to be periodically tested via one of the prescribed methods. The Manual of Standards also specified the ‘maintenance planning level’ for friction, which is the level that if the measured friction falls below the aerodrome operator must initiate appropriate corrective maintenance action to improve the friction and ensure ongoing safety of the runway.
A runway friction test was conducted in March 2019. The test took continuous skid resistance measurements at 3 and 6 m offsets from the centreline at 65 km/h and 95 km/h. These measurements were averaged over 10 m to produce a continuous data plot of the friction. A 100 m rolling average was also included in the friction test report.
The report described the differences between the 65 and the 95 km/h test indicating that the 65 km/h test was affected more by the microtexture of the surface and the 95 km/h test was more affected by the macrotexture. Low friction values for the 65 km/h test indicated that the fine texture may be filled with rubber. The 95 km/h test gave an indication of how fast water was able to escape from the surface. The report also stated that seasonal variation can affect the friction measurements by up to 15 per cent.
The continuous friction measurements for the 95 km/h test recorded numerous measurements below the maintenance planning level and some measurements below the allowable minimum friction levels (Figure 3). However, when averaged over 100 m, the lowest friction measurements were at maintenance planning level. The Manual of Standards had no requirement, nor did it specifically permit the averaging of the friction measurements.
Figure 4: Results from runway friction report
These plots show the data from the 95 km/h test at 3 m offset from centreline. The upper image shows 10 m averages considered to the continuous friction measurement, the lower image is the same data using 100 m rolling averages.
Source – Fulton Hogan
The report did not mention the friction values below the minimum design limit and concluded that:
there were sections of the runway at maintenance planning level
the runway met the surface friction requirements as specified in the Manual of Standards.
Several weeks after the occurrence the runway was re-tested via the same method. The friction values recorded in the 2020 test were generally higher (i.e. better grip). However, there were still areas in the touch down zones that were at maintenance planning level. No rubber removal or surface maintenance had been performed between the 2019 and 2020 tests.
Aquaplaning
The three types of aquaplaning are dynamic, viscous and reverted rubber.
Dynamic aquaplaning occurs at high-speed and is the result of water being unable to be forced away from under the tyre. This creates a layer of water underneath the tyre thereby reducing the coefficient of friction.
Viscous aquaplaning is a similar phenomenon but can occur at lower speeds and relies on a low coefficient of friction of the runway surface, usually due to rubber build up. The smooth surface enables a small film of water to cause the tyre to slip during braking.
Reverted rubber aquaplaning is the breakdown of the tyre material from heat generated as part of the braking or as a result of a skid or lockup. Reverted rubber aquaplaning is the only type of aquaplaning that leaves evidence marks on the tyre surface.
Runway contamination
The Civil Aviation Order (CAO) 20.7.1B defined a contaminated runway as a runway that has more than 25 per cent of the runway surface area within the required length and width being used covered by:
water, or slush, more than 3 mm deep; or
loose snow more than 20 mm deep; or
compacted snow or ice, including wet ice.
Advice from runway subject matter experts indicated that strong crosswinds can increase the chances of the windward side of the runway being contaminated. This is because the wind effectively slows or stops the water from draining along the built-in slope away from the centreline.
Federal Aviation Administration (FAA) Safety Alert for Flight Operators (SAFO) 19003
In response to several landing events where the braking coefficient was found to be less than what was expected for a wet runway, the United States Federal Aviation Administration (FAA) issued Safety Alert for Flight Operators (SAFO) 15009 in August 2015. In 2019, this SAFO was updated with SAFO 19003 (Turbojet Braking Performance on Wet Runways) to align with current guidance.
While the FAA recognised that landing overruns on wet runways usually involved multiple contributing factors, their analysis of those landing events raised concerns regarding stopping performance assumptions. The cause of the braking underperformance was not fully understood, but the FAA in SAFO 15009 cited possible factors relating to runway conditions including texture, drainage, puddling in wheel tracks and active precipitation. Specifically, the analysis showed that, 30‑40 per cent of additional stopping distance may be required in certain cases where the runway was very wet, but not flooded.
As a result of the above, the FAA suggested that whenever there is likelihood of moderate or greater active rain on a smooth (ungrooved) runway, or heavy rain on a grooved or porous friction course runway, landing distance calculations should be done assuming the surface is contaminated.
There is no standard definition of rainfall intensity across the aviation industry. However, the World Meteorological Organization[17] stated:
While there is no agreed international definition regarding rainfall intensity, some use the following criteria: Heavy rain is defined as rates in excess of 4 mm per hour while heavy showers are defined as rates in excess of 10 mm per hour. Showers are further classified as being violent if the rate exceeds 50 mm per hour, although these are normally considered to be rates typical for tropical regions.
The below table includes the published definition from the FAA and the Australian Bureau of Meteorology (BoM).
Table 1: Comparison of rain intensity definitions between FAA and BOM
Rain intensity
FAA
BoM
Moderate
4.5 to 12.5 mm/hr
2.2 to 6 mm/hr
Heavy
12.5 to 50 mm/hr
Greater than 6 mm/hr
Calculation of required landing field length
Civil Aviation Order (CAO) 20.7.1B (Aeroplane weight and performance limitations) specified that landing distance required shall be 1.67 times the distance required to bring the aeroplane to a stop on a dry runway. For wet runways, an additional 15 per cent margin is to be added be added making the landing field length required 1.92 times the distance required to bring the aeroplane to a stop on a dry runway.
The Fokker 100 airplane flight manual (AFM) provided the required landing field length for flaps 25 for the aircraft weight as 1,520 m. In line with the CAO, the manual stated that if forecasts or observations indicate the runway may be wet, the required landing field length was an additional 15 per cent of the distance in dry conditions. This brought the required length to 1,748 m. These lengths were predicated on the aircraft being at the reference landing speed (VREF) at 50 ft above the runway threshold.
Fokker provided advice to the ATSB that they recognised that in normal operation the threshold crossing speed is often higher than VREF. In those cases, the landing distance may be larger than the landing distances determined during the certification flight tests of the aircraft. However, the increase will not be larger than the 1.67 factor used in the AFM graphs for required landing field length for dry conditions.
Operator documentation and guidance
Runway contamination
The weather briefing section of the Flight Administration Manual (FAM) indicated that the possibility of runways being contaminated at the departure and destination airports should be considered during the planning process. Network Aviation policy did not approve operations on contaminated runways. However, limited guidance within the documented material was provided on how to determine if the runway was contaminated, and moderate or heavy rain were not identified as possible runway contaminants.
The Fokker 100 Aircraft Operating Manual (AOM) contained a section for operating on contaminated runways. The section contained the CASA definition of contaminated runways and additional information on possible runway contamination. The section stated that a runway may also be considered contaminated in conditions including:
A runway with a smooth/slippery surface (rubber deposits / oil) or a recently resurfaced runway covered with a thin layer of water (less than 3mm) […] may have a considerably reduced friction (slippery wet runways).
In heavy rain showers even on runways with a good drainage.
The section also stated that:
The magnitude of the effects of runway contamination are determined in general by: […]
- The runway surface condition and texture, grooved or non-grooved runways;
- The weather conditions (cross wind, gust, actual precipitation);
- The aircraft configuration (flaps, reversers, autobrakes, speedbrakes)
Advice was sought from the operator on how flight crew were expected to assess if a runway was contaminated. The operator indicated that the flight crew should check NOTAM’s[18] prior to departure for any published runway unserviceability. During the flight, they should monitor the aerodrome weather information service (AWIS) broadcast, noting that the AWIS broadcast does not include any reference to standing water. There was also an expectation that the ARO strip inspection prior to the arrival would identify if the runway was contaminated and if so, contact the arriving aircraft. There was no guidance relating rainfall intensity to runway contamination.
Aircraft configuration selection
The configuration section of the AOM stated that:
Flaps 42 should be used when landing on contaminated runways or runways with reduced braking action.
The windshear section of the AOM encouraged flight crew to consider using flaps 25 for landing and increasing approach speed if weather conditions were such that a windshear may possibly exist, but a safe approach and landing was thought to be feasible. The manual also stated that considerations should be given to the increased landing distance as a result of the increased approach speed.
Approach briefing
The approach briefing section of the Flight Crew Operating Manual (FCOM) listed inclement weather and adverse runway conditions as elements to brief as required. In accordance with the manual, the approach briefing consisted of five modules; Charts, Terrain, Weather, Operational and Plus. With Plus being the section of the approach brief for the crew to identify any threats not previously discussed.
The ‘runway state’ was a line item within the Operational section of the briefing, however, there was no additional information provided on how to assess the runway state.
Regulator guidance
At the time of the occurrence, there was a Civil Aviation Advisory Publication (CAAP) 235-05 which had advisory information on landing distance. However, this did not reflect the latest FAA guidance on the potential contamination and reduction in braking performance resulting from active moderate or heavy precipitation on an ungrooved runway.
In October 2020, 10 months after the occurrence, CASA published an update to the CAAP 235-05 - New performance provisions for CAO 20.7.1B and CAO 20.7.4. Section 3 of the update, titled Landing Distance, included advice on landing in very wet conditions. Included was the information from, and a reference to, the FAA SAFO 19003 (discussed above) identifying moderate active precipitation and ungrooved runways as being risks to landing performance.
Related occurrences
In 2015, an Australian registered Boeing 737 landing at Christchurch, New Zealand, in wet conditions, did not decelerate as expected and stopped 5 m from the runway end. The ATSB investigation (AO-2015-046) found that the reduced braking effectiveness was likely as a result of water on the runway.
Relevant publications
In 2008, the ATSB published a two-part research report (AR-2008-018) titled Runway Excursions with the objective of analysing international and Australian trends in runway excursions. Part 1 of the report explored the contributing factors associated with runway excursions between 1998 and 2007. Water-affected and contaminated runways was one of the contributing factors identified.
In May 2009, the Flight Safety Foundation published a Runway Safety Initiative that provided practical guidance and tools for operators to lower the risk of runway excursions.
After touching down on runway 05 at Newman Airport the aircraft did not decelerate as expected. The captain, sensing the aircraft aquaplane, conducted the aquaplaning response technique and subsequently applied maximum reverse thrust, stopping the aircraft 70 m beyond the upwind runway threshold. This analysis will cover the speed at touchdown, the braking effectiveness, and the environmental conditions at touchdown; as well as the information available to the flight crew to conduct their threat assessment and the condition of the runway.
Landing speed, wind conditions and braking performance
The flight crew selected the approach speed based on the known environmental conditions. The selection was a correct application of the guidance for the forecast turbulence, due to the possibility of windshear conditions. The flaps 25 approach along with the additional mandated speed margins, due to the wind conditions, resulted in a higher approach airspeed than for a flaps 42 approach.
The final approach speed was flown as planned however, the aircraft did not slow after crossing the threshold and entering the flare. During this period, a higher groundspeed than airspeed was recorded indicating a possible unforecast tailwind component, which may have limited the ability to reduce the speed. A higher touchdown speed requires a longer stopping distance due to the additional energy to be dissipated by the deceleration devices. As a general rule, a 10 per cent increase in approach speed results in a 20 per cent increase in the required landing distance.
During the landing roll, after the captain (pilot flying) asked for assistance with applying the brakes, it is highly likely that the maximum manual braking effort was being applied. During this same period, the recorded deceleration was low, indicating that the braking effectiveness was reduced. The captain’s report of aquaplaning is consistent with this low deceleration and the directional oscillations recorded during the landing.
The crosswind conditions combined with the aquaplaning increased the difficulty of maintaining directional control. In accordance with the advice in the Aircraft Operating Manual in relation to aquaplaning response, the crew were limited in the amount of reverse thrust that could be applied as the priority was on maintaining the directional stability and keeping the aircraft on the centreline. Without the crosswind, it is likely that the captain could have engaged maximum reverse thrust much earlier in the landing roll, which would have significantly reduced the landing distance.
Given the magnitude of the runway overrun (70 m), it is highly likely that if either the landing speed had been reduced, the braking effectiveness had been normal or there had been less crosswind, the overrun would not have occurred.
Threat identification
During the approach briefing, the flight crew correctly identified the primary threat as the significant weather. However, their focus was primarily on the wind and the visibility. Despite the forecast for heavy rain obtained before the flight and the aerodrome weather information service providing observations of heavy rain occurring there was no consideration of the effect of the rainfall on the runway state or the braking performance.
The faster flaps 25 approach was selected to address the identified threat of possible windshear. However, this selection (compared to the standard flaps 42 approach) further increased the risks associated with reduced runway braking performance. The crosswind was discussed in relation to the selection of the runway but was not identified as possibly affecting the ability of the aircraft to brake effectively or reducing the drainage of water from the runway surface on the windward side.
The approach briefing procedure provided a prompt to discuss the runway state. However, there was no information available to the crew to enable them to identify the potential for a significant reduction in braking performance posed by the active moderate rainfall. As a result, had the crew identified and discussed the threat, the options for them to manage the threat were limited to their own judgement. Therefore, it is possible that even if the flight crew had identified the threat, they would have continued the approach. There was no information reasonably available to the crew to assist them to identify the runway as potentially water contaminated by the active rainfall.
Operator and regulator documentation
Network Aviation policy did not permit operations on contaminated runway however, flight crews were not provided with adequate information to identify all possible runway contaminated situations. At the time of the occurrence, the only information relevant to the conditions on the day within the operator’s document suite was advisory information in relation to heavy rain being a possible contaminant of the runway. There were no specific procedures to identify the rainfall intensity or relating to conducting approaches during active precipitation.
The United States Federal Aviation Administration (FAA) safety alert for flight operators (SAFO) provided a practical means to assess the potential for runway contaminations based solely on the type of runway surface (grooved or ungrooved) and the rain intensity at landing. Using the FAA document and guidance on rainfall intensity it would have been possible for the crew to determine that there was a potential for poor braking performance and take some mitigating action.
At the time of the occurrence, the lack of Civil Aviation Safety Authority (CASA) advisory information reflecting the FAA alert regarding the potential effect of active moderate or heavy rainfall on braking performance, reduced the likelihood that the operator would have the appropriate guidance for mitigating this hazard.
Runway condition
The flight crew and the aerodrome reporting officer (ARO) reported moderate rain at the time of the landing. The lack of grooving on the runway reduced the ability of water to drain from the runway surface. The FAA SAFO advised that moderate rain on an ungrooved runway can cause a significant reduction in braking performance. The heavy rain prior to the final approach and the ARO’s observations in relation to the water accumulation around the runway meant that drainage of water from the runway may have been slower than usual at the time of landing. The high crosswind at the time of landing would also have slowed the drainage of water on the windward side of the runway.
The runway friction measurements taken in 2019 had values below the recommended maintenance planning levels and some measurements below the minimum friction limits as specified by the Manual of Standards. Although still safe for operations, at the levels recorded, it would generally be expected that maintenance should be performed in the lower friction areas to ensure ongoing safe operation on the runway.
The water pooling observed a year after the occurrence may have been present at the time of the occurrence but would have been hard to identify during active precipitation.
Had there been additional maintenance performed on the runway, there would have been an increase in the overall friction of the runway. However, while an increase in friction may have affected the outcome on the day, it is not possible to conclusively state that the overrun would not have occurred.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the runway overrun involving VH-NHY at Newman Airport on 09 January 2020.
Contributing factors
The combination of the approach speed required by the prevailing wind conditions and the poor braking effectiveness in the wet conditions resulted in the aircraft overrunning the runway.
Other factors that increased risk
During the flight, the potential for the heavy or moderate rainfall to significantly impact the landing distance was not recognised by the flight crew and therefore not considered as a threat.
Despite technical examination of the runway identifying areas requiring maintenance to maintain the surface friction, no corrective action was taken.
The operator's documentation required crew to consider contamination of runways at the departure and destination airports. However, the provided definition and guidance did not include the means to identify water contamination from active rainfall. (Safety Issue)
CASA advisory publications did not include information regarding the potential for reduction in braking performance resulting from active moderate or heavy rainfall. (Safety Issue)
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The operator's documentation required crew to consider contamination of runways at the departure and destination airports. However, the provided definition and guidance did not include the means to identify water contamination from active rainfall.
Safety issue description: Civil Aviation Safety Authority (CASA) advisory publications did not include information regarding the potential for reduction in braking performance resulting from active rainfall.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action by Network Aviation
Network Aviation advised that they have taken the following proactive safety action in response to this occurrence:
Flight Crew experienced scenarios of potentially contaminated runway during the 2021 1A/1B cyclic training program.
Network Aviation have engaged with the aerodrome reporting officer to confirm reliability of aerodrome weather information service.
Runway overrun protection system has commenced implementation and fitment to the A320 fleet.
Flight Operations governance amended to provide enhanced and embedded F100/A320 Touchdown Zone scatter plot reporting to monitor runway excursion risk.
Implemented pre-cyclic quiz for all pilots - verifying knowledge of runway surface condition requirements
Qantas group and other airlines sharing consistent approaches to contaminated runways, ensuring aligned procedures.
Benchmarking and sharing Runway Excursion Risk flight data analysis program data across Qantas group to drive continuous improvement.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Network Aviation
flight recorder data
the involved flight crew
the duty aerodrome reporting officer and East Pilbara Shire council
aerodrome subject matter experts
Bureau of Meteorology.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Network Aviation
flight crew
East Pilbara shire council
Civil Aviation Safety Authority
Fokker
Dutch Safety Board
Submissions were received from:
Network Aviation
the flight crew
East Pilbara shire council
Civil Aviation Safety Authority
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Glossary
AFM Airplane flight manual
AOM Aircraft operating manual
ARO Aerodrome reporting officer
AWIS Aerodrome weather information service
BoM Bureau of Meteorology
CAAP Civil Aviation Advisory Publication
CAO Civil Aviation Order
CASA Civil Aviation Safety Authority
FAA United States Federal Aviation Administration
FAM Flight administration manual
FCOM Flight crew operations manual
FO First officer
ICAO International Civil Aviation Organization
PF Pilot flying
PM Pilot monitoring
RPT Regular public transport
SAFO Safety Alert for Flight Operators
VAPP Final approach speed
VREF Reference landing speed
WMO World Meteorological Organization
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 2 January 2020, at about 1415 Eastern Standard Time, the pilot of a Gippsland Aeronautics GA8 aircraft, operated by Air Fraser Island and registered VH-BNX, conducted a local scenic flight at Fraser Island, Queensland, with seven passengers on board. After the 13-minute flight, the aircraft returned to land on the same beach landing area it had taken off from.
During the approach, the pilot saw a vehicle moving close to the runway. To remain clear of the perceived vehicle hazard, the pilot opted to land about a third of the way down the marked runway. Shortly after the first touchdown, the aircraft became airborne again. The pilot reported that he had pulled back on the control column to raise the aircraft nose off the ground, in order to minimise the discomfort to passengers as the aircraft passed over holes in the sand.
After passing the holes, the aircraft landed and the pilot attempted to brake. However, the aircraft was still at speed as it approached the end of the runway, beyond which was a washout. As the aircraft overran the runway, the pilot reported raising the nose to lift the aircraft over the washout, concerned that the aircraft would flip if the nose wheel struck the water. Immediately beyond the washout, the aircraft pitched forwards heavily onto the nose landing gear, which collapsed. The propeller struck the sand and the aircraft came to a halt.
The aircraft sustained substantial damage, but there were no injuries to the pilot or passengers.
What the ATSB found
The pilot did not conduct a go-around despite several cues to do so, including sighting a vehicle near the runway and when becoming airborne again after the first touchdown. The aircraft subsequently landed with insufficient runway remaining to prevent a runway overrun. The overrun was onto a section of beach unsuitable for a landing roll due to a washout.
The pilot did not obtain passenger weights or use standard weights to calculate the aircraft weight and balance prior to the flight from which to assess the required landing distance.
Safety message
This accident is a reminder to pilots to be go-around minded. This is of particular importance when operating at a runway in conditions where the full available runway length is required for a safe landing and no obstacle-free overrun area exists.
The Flight Safety Foundation Approach-and-landing accident reduction tool kit Briefing note 6.1 – Being prepared to go around, stated that the importance of being go-around prepared and go-around minded must be emphasised because a go-around is not a frequent occurrence.
The investigation
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of findings that affect safety and possible safety actions.
The occurrence
On 2 January 2020, at about 1415 Eastern Standard Time,[1] the pilot of a Gippsland Aeronautics GA8 aircraft, operated by Air Fraser Island and registered VH-BNX, conducted a local scenic flight at Fraser Island, Queensland, with seven passengers on board. After a 13-minute flight, the aircraft approached Cornwell’s beach aeroplane landing area (ALA), from where it had taken off.
Cornwell’s ALA was located on the east coast of Fraser Island (Figure 1). The runway, which was on the beach, was 500 m long and marked with traffic cones. The wind was 5-10 kt from the east-north-east and the beach was busy, with vehicles on the beach and campers in the sand dunes. There were also vehicles parked on the edge of the clearway, which extended 100 m either end of the runway.
Figure 1: Fraser Island and Cornwell’s aeroplane landing area
Source: Google Earth, annotated by ATSB
As the pilot commenced a straight-in approach from the south, he communicated with ground crew via radio and was advised that all vehicles were stationary. As the aircraft neared the runway, the pilot saw a car moving close to the runway area. A ground crewmember tried to get the driver to stop and the car then changed direction and moved clear of the runway. To ensure the aircraft remained clear of the vehicle hazard, the pilot opted to move his aiming point further along the runway, and the aircraft touched down a third of the way down the marked runway and well beyond the runway threshold markers.
About half way along the runway, there were 10 cm-deep ‘melon holes’[2] in the sand. Video footage taken from inside the aircraft indicated that it touched down briefly, then became airborne again. The pilot reported that approaching the holes, he had extended flap and pulled back on the control column in an attempt to lift and hold the aircraft nose wheel off the ground, to minimise the discomfort to passengers. After passing the holes, the pilot reported that he lowered the nose and attempted to brake. The safety manager later paced out the distance from where the aircraft landed after passing the holes, and reported that approximately 100 m of runway remained.
The aircraft was still at speed as it approached the end of the runway. As the aircraft overran the runway, the pilot raised the nose to get the aircraft over a washout, concerned that it would flip if the nose wheel struck the water. Immediately beyond the washout, the aircraft pitched forwards heavily onto the nose landing gear, which collapsed. The propeller struck the sand and the aircraft came to a halt (Figure 2). The video footage showed that less than 5 seconds elapsed between the landing and when the aircraft stopped.
The aircraft sustained substantial damage. There were no injuries to the pilot or passengers. The pilot and front passenger were wearing four-point harnesses and rear passengers wore over-shoulder harnesses with lap sash seatbelt. The pilot reported he had verified that everyone was wearing their seatbelts and had headsets on so he could communicate with them before commencing engine start.
Figure 2: VH-BNX at the accident site
Source: Air Fraser Island
Context
Pilot qualifications and experience
The pilot held a commercial pilot licence (aeroplane) issued in July 2018, a single-engine aeroplane class rating, and a valid Class 1 medical certificate. He commenced training in beach operations at Air Fraser Island on 14 January 2019 and was employed as a pilot on 5 March 2019. Since then, he had accrued 300-350 hours in GA8 aircraft conducting beach operations.
Air Fraser Island pilots underwent beach operations flight checks every 90 days in accordance with their operations manual. The pilot’s last beach operations and 6-monthly route check was completed successfully on 18 October 2019. The flight included circuits, soft-field take-offs and landings, and emergency operations.
Aircraft information
The aircraft had 10,844.4 hours total time in service at the start of the accident day. The maintenance release (MR)[3] current on the day was issued on 30 December 2019 following a 100-hourly inspection. The aircraft had subsequently flown 6.7 hours and made 31 landings. No defects were recorded on the MR. The daily inspection certification on the MR had been signed for 2 January.
The chief engineer advised that the operator’s aircraft fleet generally made 200-300 landings every 100 hours and the safety manager stated that on a busy day, pilots would conduct 20 to 30 take-offs and landings. The number of landings per hours flown for VH-BNX was normal for Air Fraser Island’s operations. Nearly all the landings were soft- and short-field landings on beach runways. This high number of landings and salty, sandy environment had resulted in ongoing unscheduled maintenance of aircraft landing gear, particularly brakes.
Brakes
Unscheduled brake maintenance
Air Fraser Island’s chief engineer reported that unscheduled maintenance of the brake system consisted of replacing brake pads, discs, calliper o rings, bearings, master cylinders and undercarriage bushes. They found that when pilots have sand on their shoes and put their feet on the (brake) pedals, the sand drops on top of the master cylinders, eventually works its way down into the cylinders and wears out the o rings.
Sand in the master cylinders wearing the o rings can result in leakage of brake fluid and has the effect of making the brakes feel spongy. Pilots reported that when the brakes felt spongy on landing, they would pump the brake pedals a few times, and the pressure would return and the brakes would stop the aircraft effectively. In response to finding sand in the master cylinders, in November 2019, the aircraft operator commenced a program of replacing all the master cylinder and calliper o rings at every 100-hourly inspection. The chief engineer advised that the master cylinders, calliper o rings and brake pads on VH-BNX had been replaced during the 100-hourly inspection, 3 days before the accident.
Daily inspection
The Air Fraser Island operations manual, stipulated that in the pilots’ daily inspection of aircraft, special attention must be given to brakes. Pilots were required to check the brake disc rotor for cracking and corrosion, brake linings for wear and callipers to look for any signs of brake fluid seepage. The pilot of VH-BNX reported that company pilots checked the brake fluid and topped it up when needed, as part of the daily inspection.
Braking during the occurrence
The pilot reported that he attempted to brake when the aircraft was beyond the melon holes, but that the left brake felt spongy. Before the first flight of the day, he had conducted the daily inspection on the aircraft and had not found any issue with the brakes. He had also checked the brakes when at about 900 ft during the approach, by depressing the pedals, at which stage the brake pressure felt normal.
After the accident, the chief engineer tested the left brake by pushing the pedal with his hand and found that the brake was hard and did not find any defect with the brakes. The safety manager and chief pilot also inspected the tyre tracks in the sand from the accident landing. The left tyre track was different from the right, in which the tyre grooves were distinct. They assessed that the left tyre track was indicative of the left wheel having locked up and skidded across the surface of the sand. The nose wheel track was not very distinct, consistent with the pilot’s attempt at raising the aircraft nose.
Aeroplane landing areas
The company operations manual specified that beach runways were to be established in accordance with the Civil Aviation Safety Authority (CASA) Civil Aviation Advisory Publication (CAAP) 92-1(1) Guidelines for aeroplane landing areas. The CAAP recommended minimum physical characteristics of landing areas applicable to daytime operation of the GA8.
Runway length
The CAAP stated that ‘a runway length equal to or greater than that specified in the aeroplane’s flight manual or approved performance charts or certificate of airworthiness, for the prevailing conditions is required (increasing the length by an additional 15% is recommended when unfactored data is used).’
The pilots were required to use soft-field landing technique, as described in the company operations manual:
The pilot in command shall use sufficient braking to enable the aircraft to slow to a taxi speed as soon as possible after touchdown. Constant back pressure should be maintained on the control column whilst braking to relieve nose wheel pressure.
The landing technique described in the pilot operating handbook for the GA8 aircraft, was consistent with a short-field technique:
The aircraft approaches with idle power down to the 50 feet height point at the given airspeed appropriate to weight. After touch down maximum wheel braking is used to bring the aircraft to a stop.
From the performance charts in the pilot operating handbook, the take-off distance required was greater than the landing distance. The chief pilot reported that landing distance required was about two thirds of that required for the take-off roll. From the performance charts, the aircraft operator had derived a standard take-off ground roll distance required of 480 m. This was based on 30 ºC temperature, maximum take-off weight, nil wind, a ‘short dry grass or gravel’ runway surface and the recommended increase of 15 per cent as the data was unfactored. From the calculated distance, the ground crew were to mark out 500-metre-long runways where possible. However, the safety manager commented that if a runway length of 350-500 m was all that was available, the pilots could still operate on the runway but would take fewer passengers and/or less fuel.
The operations manual stipulated that pilots ‘must calculate the take-off and landing distance required for a flight considering take-off/landing distance available, aircraft weight, pressure/density height and obstacles.’ Additionally, the pilot must ensure that all passenger (and cargo) weights were calculated prior to loading the aircraft, using standard or actual passenger weights, but not a combination of the two.
The passenger manifest was completed after the accident. Standard weights were not used, but passengers later reported that they did not provide their weights to the ground crew when completing the manifest. The accuracy of the recorded weights was unknown. The aircraft take-off weight on the manifest was 1,767 kg, less than the maximum take-off weight of 1,814 kg.
Based on the power-off landing chart, at 30 °C, the manifest aircraft weight, nil wind and slope, short dry grass or gravel surface and without consideration of 50 ft obstacle clearance, the landing distance required was about 480 m and the landing roll required was 200 m. There was no published data for sand runways.
Runway ends
The CAAP further stated that ‘Both ends of a runway…should have approach and take-off areas clear of objects above a 5% slope for day [operations].’ The CAAP contained no recommendations or guidance regarding the suitability or nature of the ground under the approach and take-off areas similar to the requirement for obstacle-free areas above. The safety manager reported that the highest obstacle they needed to climb above on the beach were 5 m high tour buses. They used a clearway of at least 100 m at the end of the runways, marked with bollards to distinguish the clearway markers from the runway touchdown cones.
The clearways were used to ensure obstacle clearance and their surfaces were not intended to be used for take-off or landing ground roll. The safety manager advised that soft sand, pooling water, washouts and dips were all suitable in the clearway in accordance with the CAAP.
Comparison with certified aerodromes
Certified aerodromes are intended to accommodate aircraft with more than 30 passenger seats conducting air transport operations. As such, the requirements surrounding certified aerodromes are in excess of those for ALAs.
The International Civil Aviation Organization (ICAO) Annex 14: Aerodromes, stated that for non‑instrument runways less than 800 m (code 1 runway), there shall be a runway strip[4] beyond the runway end of a distance of at least 30 m. It also recommended that a runway end safety area[5] of at least 30 m should be provided at each end of the runway strip.
Similarly, the CASA Manual of Standards for Part 139 - Aerodromes indicated that, for certified aerodromes, a runway strip shall extend at least 30 m from the end of the runway. However, the standards did not require a non-instrument code 1 runway to have a runway end safety area. The runway strip requirement was to ensure, in the case of a runway excursion (overrun and veer-off), the aircraft had enough room to stop, reducing the risk of damage to an aircraft and injury to occupants.
Although these standards were not applicable for ALAs, in this occurrence, the pooling water at the end of the runway increased risk of aircraft damage and occupant injury in the event of a runway excursion.
In an investigation into an accident in 2018, where an aircraft overran the runway of an ALA and collided with a watercourse (AO-2018-025), the ATSB identified a safety issue that CAAP 92-1(1) did not have guidance for the inclusion of a safe runway overrun area at ALAs. The ATSB issued a safety recommendation to CASA in October 2019 to include guidance for the inclusion of runway end safety areas at ALAs in CAAP 92-1(1).
Cornwell’s aeroplane landing area
Cornwell’s runway used on the accident flight was 500 m long and 15 m wide, marked with touchdown cones, and 100 m clearways beyond either end, marked by bollards and a sign. It was a ‘high beach’ landing area, set towards the dunes and either side of the runway was hard sand. There was a length of about 50 m with melon holes mid-strip and an ankle-deep freshwater soak, or washout, at the northern end of the runway.
Earlier in the day, ground crew had driven up and down the strip, assessing that the melon holes did not pose undue risk. Other company pilots had also inspected the strip and landed there with no issues. Prior to the accident flight, the pilot had landed VH-BNX on the Cornwell’s runway with no passengers on board. On that landing, the aircraft stopped before the melon holes, using less than half the available runway distance.
The safety manager assessed that on the accident flight, the aircraft landed with less than 100 m runway remaining beyond the melon holes, which was insufficient distance to stop with the aircraft fully loaded, and the conditions on the day.
The pilot subsequently reported that he may have misidentified the end of the runway, mistaking the end-of-clearway bollards beyond the landing strip to be the end-of-runway cones. He further commented that at the time, he had thought there was ample distance remaining to stop, until he saw the washout.
Go-around procedures
The chief pilot and safety manager emphasised that because of the short-field (minimum length) landing areas and dynamic beach conditions, pilots were trained to conduct a go-around if safety could not be assured at any stage during approach or landing. The company operations manual specified both missed approach and go-around procedures (Figure 3). The chief pilot reported that pilots must conduct an orbit (missed approach procedure), if, during the approach, they saw anything that could encroach on the runway. In this case, he advised that the pilot should have conducted a 2-minute orbit and communicated with ground crew via radio to clear vehicles from the area.
The manual stated that the go-around procedure was to be flown ‘if the go-around is initiated during the final approach or landing phase.’
Figure 3: Extract from operations manual depicting missed approach and go-around procedures
Source: AIAC annotated by ATSB
Safety analysis
Fraser Island beaches posed a very dynamic aircraft operating environment. Potential hazards included vehicles, people, animals and changing tides and sand conditions. To mitigate and manage the hazards, the operator used runway markers, ground crew and reinforced the importance of, and pilot skills in, conducting go-arounds when safe landing could not be assured. Additionally, to enable better control of landing areas, the operator used runways of the minimum safe length for take-off and landing, which necessitated that pilots use short-field and soft-field techniques. This meant that both landing beyond the runway threshold and becoming airborne again during the landing phase, increased the risk of a runway overrun.
Furthermore, because there were few high obstacles on the beaches, going around was less likely to result in a collision than encountering unsuitable surfaces beyond the designated landing area. The pilot was proficient at conducting go-arounds and the reason he omitted to do so in this occurrence, could not be determined.
Although the aircraft was still on the beach during the runway overrun, the area beyond the runway contained a washout unsuitable for a landing roll. The pilot’s action in raising the aircraft nose prior to the washout likely prevented a more serious outcome.
The pilot reported that the left brake was spongy and that this had affected his ability to stop the aircraft. The aircraft operator also reported that there had been a history of brake issues due to the operating environment. However, the maintainer inspected the brakes after the accident and other than accident damage, could not reproduce a fault with the brakes. While the ATSB could not determine whether the brakes had been functioning correctly at the time of the accident, in any event, there was almost certainly insufficient runway remaining to stop given the aircraft weight and conditions.
The pilot subsequently reported that he may have mistaken the clearway bollards for the runway marker cones, thereby assessing that he had more stopping distance than actually remained. However, the bollards were deliberately different from the marker cones to mitigate against this misidentification. Additionally, the pilot had previously overflown the runway, which was the normal length used by the operator, and then landed on it, prior to the accident flight. Whether this misidentification contributed to the accident could not be determined.
The passenger manifest was completed after the accident. However, this was required to be completed prior to flight, as it included passenger weights from which to calculate aircraft take-off weight and assess take-off and landing distances.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The pilot did not conduct a go-around including when faced with a vehicle hazard, landing well beyond the runway threshold and becoming airborne again during the landing. This resulted in the aircraft landing with insufficient runway remaining and a runway overrun onto an area of the beach unsuitable for the landing roll.
The pilot did not obtain passenger weights or use standard weights to calculate the aircraft weight and balance prior to the flight from which to assess the required landing distance.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
pilot
ground crew
aircraft operator
aircraft maintainer
Civil Aviation Safety Authority.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the pilot, ground crewmember, aircraft operator, aircraft maintainer, aircraft manufacturer and the Civil Aviation Safety Authority.
Submissions were received from the aircraft manufacturer and pilot. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 23–24 December 2019, intermodal freight train 7MP5 was being operated by Pacific National, from West Kalgoorlie to Perth, Western Australia. The train was being operated as a driver only operation. Arc Infrastructure was the rail infrastructure manager for the network.
Following a scheduled driver change, 7MP5 departed West Merredin at 2207 on 23 December. A loaded grain train, 2K66, was travelling ahead of 7MP5. Train 2K66 was stopped at Jumperkine signal 4La to facilitate the movement of another freight train (3PM4) in the opposite direction on the adjacent track. To protect 2K66 from 7MP5, signal U45 was displaying a caution (yellow) aspect and signal 12L was displaying a stop (red, ‘at danger’) aspect.
At about 0156 on 24 December, 7MP5 passed signal U45 at caution and, at about 0159, travelling at about 72 km/h, passed signal 12L at stop (an event known as a signal passed at danger or SPAD). It then travelled for about 800 m before it collided at 0200 with the rear of 2K66 at about 41 km/h.
The locomotives and leading wagons on 7MP5 and the trailing wagon of 2K66 were substantially damaged in the collision. A significant amount of grain entered the lead locomotive cabin of 7MP5, and the driver of 7MP5 sustained fatal injuries.
After the collision, the third train, 3PM4, was permitted to retain its authority to enter Jumperkine on the adjacent track. Although this third train did not collide with the wreckage from the collision of 7MP5 and 2K66, there was a risk of a secondary collision.
What the ATSB found
On Arc Infrastructure’s network between Kalgoorlie and Perth, there was no automatic safety system to prevent a train from passing a signal at danger and overrunning its limit of authority, or reactively stopping a train after passing a signal at danger and overrunning its limits of authority. As such, the safeworking system was reliant on rail traffic crews observing and complying with displayed signal aspects. Although reliance on signal compliance has been central to the rail safety system in Australia for many years, it is fundamentally limited in situations where the driver is not fully attentive to the rail corridor or misperceives a signal. Human performance is inherently variable, and there are multiple reasons why a competent, well-trained driver may not correctly observe a signal.
After departing Tammin (at about 2341), 7MP5 travelled for over 2 hours and about 158 km past 33 consecutive unrestricted green signals until reaching the restricted yellow and red signals protecting 2K66 at Jumperkine. Recorded information showed that 7MP5 passed signal U45 at caution and then signal 12L at stop without the driver slowing or preparing to stop the train. The speed of 7MP5 was also not reduced in preparation for a 30 km/h temporary speed restriction on the section of track after signal 12L.
The ATSB concluded that, upon arrival at Jumperkine, the driver of 7MP5 was almost certainly unaware that they had passed signal 12L at stop and that 2K66 was stopped ahead. The driver did not commence emergency braking until the rear of 2K66 became visible on the track ahead, at which point it was too late to avoid a collision.
The ATSB found that both the signalling system at Jumperkine and the brakes of 7MP5 operated as designed. In addition, there was insufficient evidence to conclude that incapacitation, signal and sign visibility and/or distraction affected the driver’s performance. Rather, the recorded data and the nature of the accident sequence were strongly indicative of the driver’s performance being impaired by fatigue. More specifically, the ATSB found that, due to a combination of insufficient sleep in the 48 hours prior to the accident and operating in the window of the circadian low, the driver of 7MP5 was likely experiencing a level of fatigue known to adversely affect performance.
The locomotive vigilance system on board was designed to provide a visual alarm after 40 seconds without driver inputs and an auditory alarm after another 10 seconds without inputs, following which it would initiate emergency braking to stop the train. The system on 7MP5 operated as designed, although in the 35 minutes prior to passing signal 12L the driver’s response times to alarms became longer. Consistent with the known limitations of locomotive vigilance systems, the system on board 7MP5 did not identify when the driver was fatigued and not attentive to rail signals.
The 7MP5 driver’s shift pattern involved irregular working hours and they had often worked additional shifts on their rostered days off. However, prior to signing on for duty at 2120 on 23 December, the driver of 7MP5 had over 17 hours free of duty. Shiftwork will inherently increase the risk of fatigue, and the number and nature of the additional duties assigned to and undertaken by the driver increased their potential for fatigue. However, it could not be established that the pattern of shifts worked significantly contributed to the driver’s fatigue at the time of the accident beyond that associated with conducting tasks at 0200 in the morning.
Nevertheless, with regard to Pacific National’s fatigue management processes, the ATSB concluded the following factors increased risk:
Fatigue management procedures required train drivers to not work if they felt fatigued. This requirement primarily relied on drivers self-reporting if they felt fatigued, and there was no proactive assurance that drivers had obtained adequate sleep, including for higher fatigue risk situations. Self-reporting mechanisms were very seldom utilised, and the operator had not conducted surveys or used other audit mechanisms or processes to identify any perceived or actual barriers to drivers self-identifying fatigue.
The rostering and fatigue management system used the FAID biomathematical model of fatigue to assess the fatigue risks associated with train driver rosters, applying a threshold FAID score of 80 for driver only operations and 100 for other operations. The operator had not conducted analysis to determine that train drivers working rosters according to these thresholds were sufficiently rested to conduct driving duties.
The operator’s analysis of the comparative safety records for driver only operations and multi‑rail traffic crewed operations relied on incorrectly categorised safety incidents, and incorrectly concluded that there was no difference in the safety records of the 2 operational modes. This incorrect analysis resulted in a missed opportunity to review the risk controls for driver only operations SPAD and fatigue management.
Overall, the ATSB concluded that Pacific National had limited controls for managing the risk of signals passed at danger during driver only operations, including incidents associated with driver fatigue. The safety system relied on a single driver correctly observing and responding to signals at all times, including during the window of the circadian low (when fatigue risk is greatest).
The ATSB also considered the activities and processes of the rail infrastructure manager. As a courtesy, about 26 minutes prior to the collision, the network control officer (NCO) proactively advised the rail traffic crew of 2K66 that they would be brought to a stop at Jumperkine. Although 2K66’s rail traffic crew acknowledged receipt of this open channel communication, there was no requirement for the following driver of 7MP5 to acknowledge and repeat back the advice that they too would need to stop. As already noted, upon arrival at Jumperkine, the driver of 7MP5 was almost certainly unaware that train 2K66 was stopped ahead.
The ATSB concluded that defensive opportunities existed that could have been applied to potentially reduce the likelihood and/or consequence of a driver completely missed SPAD on the network. More specifically, the Arc Infrastructure practice of pathing a following train up to the same section of track occupied by a stopped train, coupled with no requirement for the NCO to communicate and confirm rail traffic crews were aware when approaching another stopped train, increased risk.
Although there was no automatic train protection or similar system, the network was equipped with a SPAD alarm system that provided visual and aural alerts to an NCO if a train passed a signal at stop. In the case of train 7MP5, it was very likely about 42 seconds after receiving a SPAD alarm before the NCO began calling the driver of 7MP5. The timing of this call (about 7 seconds after the driver had commenced emergency braking and 5 seconds before the collision) was not effective in communicating the need to stop the train in time to avoid the collision or reduce the speed of the train prior to the collision. In addition, the NCO’s call was not an emergency call and did not indicate a level of urgency.
The Arc Infrastructure safeworking procedures, in respect to rail traffic crews, required immediate action upon awareness of a SPAD or other overrun of authority. In contrast, the ATSB found that the rail infrastructure manager’s requirements for NCOs, although mandatory, were not required to be immediate. This was a significant point of divergence from the template Rail Industry Safety Standards Board (RISSB) rules and procedures, which the Arc Infrastructure rules and procedures were based on.
Following the collision, the rail traffic crew of 2K66 were aware that they had observed a bump in their train, but they were unaware of the overrun of the limit of authority immediately behind them by 7MP5. At the same time the NCO, aware of 7MP5 overrunning its limit of authority but unaware of a collision, was focussed on trying to make contact with the driver of 7MP5 to either confirm they had stopped or direct them to stop. There was no collision advice available to the NCO and the NCO was unaware of the collision. Accordingly, the NCO did not take action to stop train 3PM4 entering the same location, increasing the risk of a secondary collision involving train 3PM4 operating on the adjacent track.
Related to this response, the ATSB concluded that Arc Infrastructure’s procedures included no requirement for an NCO to make an emergency call and advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority. In addition, although RISSB’s procedures included a requirement for an NCO to immediately arrange to stop rail traffic that had overrun its limits of authority and other rail traffic that was at risk, it did not require the NCO to make an emergency call to advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority.
What has been done as a result
Immediately following the accident, the rolling stock operator Pacific National undertook the following proactive safety actions:
A risk assessment was undertaken to address new identified hazards and permit restart of operations.
A risk assessment and safety case was undertaken regarding night operations between 0001 and 0600, identifying additional interim controls that were implemented on driver only operated train services between Perth–Kalgoorlie and Port Augusta–Adelaide. These controls included:
addition of a second person in the cab between 0001 and 0600
a check-in process every 30–45 minutes if a service extended after 0001 due to out-of-course running
a requirement to maintain radio volume at audible levels.
Since this initial action was taken, Pacific National, as part of an enforceable voluntary undertaking (EVU) with the ONRSR, committed to:
engage a full-time fatigue risk manager and a full-time human factors specialist to develop an updated fatigue management standard and guideline in relation to fatigue-related hazards, the core principles of fatigue risk management, and how to develop a decision-making pathway for applying those principles so that rail freight operational risks can be better managed
procure training for drivers in relation to the updated fatigue management documents
engage a service provider to implement a physical health and wellbeing program for intermodal freight train drivers
host a rail freight safety conference for participants in the rail freight sector (including rail safety workers) to encourage and promote safety in the industry
convene a meeting with an accredited rail infrastructure manager to discuss signal visibility and location and review the procedures for train handling in locations in the vicinity of the accident site
trial driver advisory systems to support the driver in remaining vigilant and alert through the early detection of signals and obstructions to assist in the prevention of safety incidents such as proceed authority exceedance (PAE) and collision events, for which driver fatigue and distraction is a contributing factor.
The ONRSR has recorded this EVU status as ‘current’ on its website.
Arc Infrastructure, as rail infrastructure manager, also undertook the following proactive safety actions immediately following the accident:
The fleeting or automatic signal calling function within the Arc Infrastructure network control system was not to be used in the Avon Valley. Train routes had to be called as required manually by the NCO.
A process was introduced for network controllers requiring that where a train has, or must be, stopped, any following trains must, where possible, be held at the station in the rear and not be advanced until the stationary train has recommenced its journey.
A process was commenced requiring communications with train crews in the event a train has stopped ahead of a following train. Where it is necessary to hold trains in the Avon Valley, or a train had come to a stand due to unforeseen circumstances, the rail traffic crew of the first following train had to be advised over open channel radio of the circumstances and their limit of authority. Acknowledgment of this communication had to be confirmed by the train crew.
Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001, was revised on 3 February 2020. This revision included a requirement for the NCO to make an emergency radio call following rail traffic overrunning its limit of authority.
Since this initial action was taken, Arc Infrastructure, as part of an EVU with ONRSR, committed to:
installation of a specific SPAD audible alarm (to differentiate SPAD alarms from other alarms)
appointment of a network control technical trainer and assessor, with the role of providing relevant and practical training to NCO’s
develop a dedicated training facility to allow NCOs to undertake simulation or scenario-based training and assessment (including emergency incident response), with a requirement for all NCOs to undertake a minimum of 1 day simulation training each year
establish a SPAD Working Group. The working group was established in November 2020 and it provides a forum for industry collaboration and ongoing engagement between industry members on initiatives to reduce the risk of SPADs on the rail network and to share key learnings.
The ONRSR has recorded this EVU status as complete on its website.
Safety message
The ATSB’s SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported by industry. One of the current priorities is improving the management of fatigue. This accident highlights the consequences that can arise when train drivers perform their duties without sufficient sleep. Train drivers are reminded that there is a shared responsibility for managing the risks associated with fatigue under the Rail Safety National Law (RSNL). Such as, for drivers to effectively utilise the rest opportunity provided by rostered breaks, and to self-report if they have had less sleep than required to safely operate a train. Rail transport operators should promote an environment in which identification of fatigue concerns is encouraged and any barriers to fatigue reporting are examined and understood.
Multiple investigations have also identified problems with the use of a biomathematical model of fatigue (BMMF) as part of a fatigue risk management system (FRMS). Although a BMMF can play a very useful role, operators and other organisations need to ensure that they understand the model they use and how to apply it effectively within the context of their own FRMS. This includes using a systematic process to determine the most appropriate threshold scores for evaluating rosters.
Another of the current ATSB SafetyWatch priorities is encouraging the use of available technology to enhance safety. This accident reinforces learnings that common locomotive vigilance systems used in the rail industry are limited in their ability to identify and capture symptoms of fatigue or other human performance risks that do not involve complete incapacitation of a train driver. The ATSB encourages rolling stock operators, industry bodies and others to develop technological improvements to vigilance systems or other technologies to enhance the ability to identify when drivers are fatigued or otherwise inattentive.
In much of the Australian freight rail network, there is no automatic safety system to prevent a train from passing a signal at danger and overrunning its limit of authority, or reactively stopping a train after passing a signal at danger and overrunning its limits of authority. The ATSB encourages rail industry organisations to consider, develop and / or implement technical solutions that reduce the reliance on rail crews’ observance of signals as a single point of failure,[1] noting that the continual improvement of safety within the rail system is a shared responsibility between rolling stock operators and rail infrastructure managers.
Until automatic train protection or similar technology is viable, rail transport operators should ensure that the set of risk controls they have in place provides sufficient assurance to minimise the risk associated with a signals passed at danger (SPADs) or other overruns of authority. Although relevant to all types of operations, this need particularly applies to rolling stock operators conducting driver only operations. With regard to rail infrastructure managers, this responsibility involves considering (among other things) the pathing of trains under their control, the communication of information to affected drivers, and the processes in place to respond to a SPAD alarm or overrun of authority.
The occurrence
Overview
On 23–24 December 2019, intermodal freight train 7MP5, operated by Pacific National, was travelling from West Kalgoorlie to Perth, Western Australia (Figure 1). At about 0200[2] on 24 December at Jumperkine, the train overran its limit of authority and passed signal 12L at stop. Train 7MP5 continued without authority for about 800 m further and collided with the rear of a loaded Watco grain train 2K66, which was stopped at Jumperkine. The locomotive cabin of 7MP5 was damaged and the driver of 7MP5 sustained fatal injuries.
After the collision, a third train, Pacific National train 3PM4, was permitted to enter Jumperkine on an adjacent track. Although this third train did not collide with the wreckage from the collision of 7MP5 and 2K66, there was a risk of a secondary collision.
Figure 1: Kalgoorlie to Perth Arc Infrastructure network geography
The image shows the location and place names of locations relevant to this accident.
Source: ARA Railways of Australia Map 2014, annotated by ATSB
Events prior to departure
Train 7MP5 departed Melbourne, Victoria, towards West Kalgoorlie on 21 December 2019 as a multi-rail traffic crewed (2-driver) operation. After arrival into West Kalgoorlie on 23 December, 7MP5 changed to a driver only operation (DOO).[3] This operating mode was intended for the rest of the train’s journey towards Perth, which included a driver change at West Merredin.
At about 0340 on 23 December 2019, the driver involved in this accident booked off duty and began rostered rest at the West Merredin drivers’ barracks. The driver’s next rostered shift was scheduled to commence at 2120 on the same day for a different train (7SP5). The driver was subsequently advised that their assigned service was changed to 7MP5 with the same rostered start time.
Train 7MP5 arrived at West Merredin at about 2057. The driver taking over the service commenced duty at 2120. At about 2200, the driver contacted Pacific National Integrated Planning Services (IPS)[4] to advise that they had been waiting for 40 minutes for 7MP5 and questioned why they had been booked on so early. The IPS operator confirmed that 7MP5 was waiting at West Merredin. The driver advised that they must have missed the arrival of the train and thanked the IPS operator before heading towards the train to undertake the driver change. Further details regarding conversations between the driver and IPS are provided in the Train driver section.
West Merredin to Jumperkine
Following the driver change, at about 2207, 7MP5 departed West Merredin for Perth. The track between West Merredin and Avon Yard was single line, with dual line extending after Avon Yard towards Perth.
Train 7MP5 undertook crossing movements[5] with an opposing train at Doodlakine, Bungulla, and Tammin prior to reaching Avon Yard (Figure 1). The last communication between the network control officer (NCO) and the driver of 7MP5 was to advise of the planned crossing movement at Tammin at about 2324, with 7MP5 completing the crossing movement and departing Tammin at about 2341. A crossing movement involved the driver of 7MP5 operating the train in response to restricted signal aspects.[6] The last time that 7MP5 was brought to a stop with restricted signals was at Tammin.
After Tammin, 7MP5 passed 33 consecutive signals displaying unrestricted clear (green) aspects on the up[7] main line prior to reaching Jumperkine. Throughout the journey, the driver controlled the train’s speed and acknowledged the vigilance system[8] alerts, as well as communicated for roll‑by inspections[9] with train services 7GP1, 2PM6, and 2PM9 that were passed on the dual line track after Avon Yard towards Jumperkine. The last roll-by communication was with 2PM9 at about 0147 on 24 December.
At about 0114, 2K66 (also travelling towards Perth) passed through Toodyay West (Figure 1), about 28 km ahead of 7MP5. Both trains continued their journey towards Perth. Train 3PM4, at about 0124, departed Perth towards Jumperkine in the opposite direction on the adjacent down main line.
At about 0134, as 7MP5 was approaching Moondyne and 2K66 was approaching Jumperkine (Figure 1), the NCO called the rail traffic crew of 2K66 on the open channel[10] train control radio system to advise that 2K66 would be brought to a stop on the main line at Jumperkine to allow for the passage of 3PM4 on the adjacent track.[11] The crew of 2K66 acknowledged and confirmed their understanding of this advice. The driver of train 3PM4 recalled overhearing this open-channel communication at about the time they were departing the Perth freight terminal.
The driver of 7MP5 commenced braking for a 20 km/h temporary speed restriction (TSR) at Moondyne at about 0137, reaching the target speed at about 0139. Train 7MP5 entered the start of the TSR at 0141 and commenced accelerating back towards the normal track speed (80 km/h) at about 0145, after the entire train had passed through the TSR.
Train 2K66 came to a stop at about 0148 on the approach to signal 4La displaying a stop (red) aspect at Jumperkine (Figure 2). At about this time, 7MP5 was about 14.5 km behind 2K66 and approaching Jumperkine. To protect 2K66 from 7MP5, signal U45 was displaying a caution (yellow)[12] aspect and signal 12L was displaying a stop (red, ‘at danger’) aspect. Train 2K66 was stopped with its last wagon about 800 m after (or west of) signal 12L.
Figure 2: Arc Infrastructure signal system layout at Jumperkine
This image shows the signal identifications and track configuration at Jumperkine relevant to the accident. Included are the location where 2K66 was stopped, the signal aspects displayed for 7MP5, and the location of 30 km/h TSR after signal 12L.
Source: Arc Infrastructure, annotated by ATSB
At about 0152:54, while the locomotive speed of 7MP5 was about 84 km/h (track speed limit 80 km/h), the driver placed the locomotive throttle to idle to reduce speed. At this time, the train was about 4 km away from signal U45. Train 7MP5 continued towards signal U45, without a need for the driver to undertake any control changes that would have reset the locomotive vigilance time count. The driver continued acknowledging the vigilance system alerts by pressing the vigilance acknowledgement pushbutton when necessary.
Signal passed at danger
At about 0156:10, 7MP5 passed signal U45 (displaying a caution aspect) and proceeded at about 75 km/h, below the track speed limit of 80 km/h, towards the next signal, 12L (displaying a stop aspect) (Figure 2).
Soon after passing signal U45, 7MP5 passed a temporary speed restriction (TSR) ahead sign,[13] warning of a 30 km/h speed restriction 2,500 m ahead. The driver continued acknowledging the vigilance system alerts, however they did not undertake any actions to prepare the train for the approaching TSR. At about 0159:05,[14] and 3 seconds before signal 12L was likely visible, the driver acknowledged a vigilance system alert (for the last time) using the vigilance acknowledgement pushbutton.
Train 7MP5 passed Jumperkine signal 12L (Figure 2) at about 0159:24, travelling at about 72 km/h (and unprepared for the 30 km/h TSR). As a result of passing the signal when it was displaying a stop aspect, a ‘signal passed at danger’ (SPAD) alarm was generated at about 0159:25 in the Arc Infrastructure network control centre.
Collision with train 2K66
At about 0159:27 (about 3 seconds after passing signal 12L at danger), 7MP5 passed the 30 km/h TSR start sign[15] travelling at about 72 km/h. At about 0159:30, after entering the TSR location, 7MP5 passed over a set of points (‘11 points’, Figure 2). As the locomotive of 7MP5 passed over the points, the locomotive’s forward-facing camera recorded a clunking sound consistent with the normal sound of locomotive wheels passing over the points. Shortly after this sound, the driver made a service brake[16] application (Figure 3).
Figure 3: Overview of Jumperkine accident site landmarks and braking information
The image shows the track curvature and geography of the Jumperkine accident site. This includes graphics showing about where 7MP5 service and emergency brake applications were made as well as the location of signal 12L and train 2K66.
Source: Google Earth and Pacific National, annotated by the ATSB
The train’s speed gradually reduced as it travelled around a sweeping left and then right curve before a straight section of track (Figure 3). The rear of 2K66 did not come into view in the night‑time conditions until illuminated by the headlights of 7MP5 as the track straightened out (Figure 4). At this point (about 0200:00), the driver made an emergency brake[17] application (Figure 3). At this time, 7MP5 was travelling at about 59 km/h and was about 175 m from the rear of 2K66.
Figure 4: Forward-facing camera image from 7MP5
The image shows forward-facing vision from the lead locomotive of train 7MP5. The top image is about the time a line-of-sight opportunity existed to identify the rear of train 2K66. The bottom image is about the time that the headlights of train 7MP5 illuminated the rear of train 2K66 and shortly before the driver applied the emergency brake.
Source: Pacific National, annotated by the ATSB
At about 0200:07 (about 7 seconds after the emergency brake application and about 42 seconds after the SPAD alarm was generated in the network control centre), the Arc Infrastructure NCO commenced calling the driver of 7MP5 on the radio (stating ‘7MP5, control'). This initial call was about 5 seconds prior to the collision and the driver of 7MP5 never replied to this radio call or subsequent calls.[18]
At about 0200:12 (about 12 seconds after the emergency brake application), 7MP5 collided with the rear of 2K66 (Figure 5). Although the emergency brake application had decreased the train’s speed, the collision speed was about 41 km/h. The cabin of 7MP5’s lead locomotive (NR80) was damaged (Figure 5), and the driver sustained fatal injuries.
Damaged vehicles from 7MP5 and 2K66 came to rest away from the down main line track being used by 3PM4.
Figure 5: Accident site, lead locomotive of 7MP5 and last wagon of 2K66 post collision
The image shows damage to rolling stock from train 7MP5 and last wagon on train 2K66 post collision.
Source: Western Australia Police, annotated by the ATSB
Events post collision
At the time of the collision, the rail traffic crew of 2K66, unaware that 7MP5 had passed the signal directly behind them at stop, recalled that they felt a bump in their train. Although there was no direct alarm advising of a collision, the rail traffic crew did receive a train line (T/L) alarm.[19] In response to the T/L alarm, the crew observed that there had been no changes in the brake pipe pressures or flow rates of their train, and they began troubleshooting the alarm. One of the rail traffic crew went to inspect the trailing locomotive. Upon accessing the cab of the trailing locomotive, the crew member identified that a T/L alarm had also been generated without any other alarms that could assist their troubleshooting. The crew were confused by this information and discussed among themselves the possibility of a collision.
During this time the NCO, unaware of the collision, continued attempts to make contact with the driver of 7MP5. At about 0205:08, the NCO contacted the driver of 3PM4, which was approaching Jumperkine on the adjacent down track. The NCO, without advising that 7MP5 had passed a signal at stop, requested the driver of 3PM4 to get the attention of the driver of 7MP5 and request them to contact the NCO.
As 3PM4 entered Jumperkine, at about 0206:38, the rail traffic crew of 2K66 attempted to communicate to the driver of 3PM4 that something may have hit them from behind. However, this communication was not received or did not register with the driver of 3PM4.
At about 0207, as 3PM4 passed alongside 2K66, the driver of 3PM4 observed that 7MP5 had collided with the rear of 2K66. At about 0207:36, the driver of 3PM4 made an emergency call and reported the collision to the NCO.
Context
Network and infrastructure information
Track information
Arc Infrastructure was the rail infrastructure manager (RIM) for the rail infrastructure from West Kalgoorlie to Perth, including Jumperkine. The line is single bi-directional line between West Kalgoorlie and Avon Yard, where it changes to unidirectional double line towards Perth (including Jumperkine). The section of track between West Kalgoorlie and Perth forms part of the interstate main line.
The track through Jumperkine is mixed gauge comprising both standard gauge (1,435 mm) and narrow gauge (1,056 mm) using a common rail. Jumperkine contains a centre loop serviced by the up and down unidirectional double main line (Figure 6). The track consists of continuously welded rail secured to concrete sleepers by resilient fasteners and supported on ballast.
The up track between Avon Yard and Jumperkine (towards Perth) exhibits a mostly down gradient, varying between 1 in 3,875 and 1 in 210, with multiple left and right curves varying in radius between 400 m and 3,460 m.
The normal track speed approaching and through Jumperkine for a train configured like 7MP5 was 80 km/h. At the time of this accident, 2 additional temporary speed restrictions (TSRs) were in place on the approach to Jumperkine. These were both applied due to 2 separate track conditions that were being managed:
A 20 km/h TSR was applied on 31 October 2019 to the track turnout at the western end of Moondyne (about 20 km prior to Jumperkine).
A 30 km/h TSR was applied on 15 April 2019 to the track turnout at the eastern end of Jumperkine (Figure 6).
Figure 6: Jumperkine rail infrastructure layout
The image shows the track and signal infrastructure layout at Jumperkine, including the location of the TSR.
Source: Arc Infrastructure, annotated by the ATSB
Safeworking system
Safeworking systems are an integrated system of procedures and technology aimed at ensuring the safe operation and separation of rail traffic.
In May 2016, Brookfield Rail,[20] the predecessor to Arc Infrastructure, implemented the Network Safeworking Rules and Procedures as the safeworking system for its network. These network rules and procedures were aligned, with some variations, to the suite of Australian Network Rules and Procedures (ANRP). The ANRP was maintained and updated as required by the Rail Industry Safety Standards Board (RISSB) in collaboration with industry representatives.
The Arc Infrastructure Network Safeworking Rules and Procedures permitted 2 main safeworking methods:
train order working (TOW) – where rail traffic crews are verbally advised of their proceed authorities and its limits by the network control officer (NCO).
centralised traffic control system (CTC)[21] – where proceed authorities and their limits were communicated to rail traffic crews via line side signals, with some of these signals being controlled by the NCO from a centralised location.
The safeworking system in place between West Kalgoorlie and Jumperkine was CTC. The CTC system communicated proceed authorities, caution advice, and authority limits to rail traffic via coloured light signal aspects.
In the Arc Infrastructure CTC system context, local signal interlocking determined the exact signal to display based on the track occupancy status ahead for an intended train route. In addition, some of these signals required NCO input before they would display a proceed aspect. More specifically, the CTC system made use of 2 types of signals:
controlled absolute signals – where the NCO, based in a central location, was required to request the signal clear to a proceed aspect before the local signal interlocking could arrange to display a proceed signal aspect. These signals were generally at yards and crossing loops where points and multiple routes existed.
automatic absolute signals – where the NCO could not directly change the signal displayed, and whereby the signal would automatically clear to a proceed aspect as soon as the track occupancy status ahead was clear of other rail traffic. These signals were generally located in intermediate areas between crossing loops and prior to controlled absolute signals.
The Arc Infrastructure application of the CTC system was not equipped with any technical solutions or supervisory systems to prevent a train overrunning its authority, such as automatic train protection (ATP),[22] or to directly stop a train that had overrun its authority, such as automatic train stops.[23]
As discussed in the Signal passed at danger warning system section of this report, Arc Infrastructure’s network did include a signal passed at danger (SPAD) warning system, which provided an alarm to a network control officer (NCO) to alert them to a SPAD, and thereby the NCO could direct a rail traffic crew to stop a train.
At the time of the accident, the Arc Infrastructure risk register for managing SPAD or exceedance of limits of authority hazards identified the following controls:
the accredited safety management systems[24] of rolling stock operators accessing its network
SPAD incident investigations
safety interface agreements with rolling stock operators accessing its network
track access accreditation requirements for rail traffic crews operating on its network
driver route knowledge (managed by rolling stock operators accessing its network)
driver vigilance
driver situational awareness (via open channel radio communications)
NCO vigilance.
These controls placed a substantial reliance on a rolling stock operator’s safety management system, which includes train driver(s) observing signal aspects and controlling their train in compliance with the displayed signal aspect.
Signal information
Jumperkine signal arrangement
Rail traffic entering Jumperkine in the up direction was controlled by entry signal 12L (located at 41.738 km)[26] and its approach signal U45 (located at 45.935 km, or 4,197 m before signal 12L) (Figure 6). The TSR ahead sign was located about 1,430 m after signal U45 and the TSR start sign was located about 100 m after signal 12L.
Signal 12L was a controlled absolute colour light signal at the eastern up track entry into Jumperkine. The NCO operated this signal remotely from the Arc Infrastructure Metro Control Centre (see Safeworking system and Network control information sections for more information). Signal U45 was an automatic absolute colour light signal and was automatically controlled by the signal interlocking system in reaction to the status of signal 12L as well as the occupancy condition of the track section ahead.
Signals U45 and 12L were incandescent searchlight[27] style colour light signals, manufactured by McKenzie and Holland. This style of signal was capable of displaying green, yellow or red colour aspects. Generally, the term ‘proceed’ was associated with a signal displaying a clear (green) or caution (yellow) aspect, and the term ‘at stop’ or ‘at danger’ was used to refer to a signal displaying a stop (red) aspect (Figure 7). Caution (yellow) and stop (red) aspects were also collectively termed ‘restricted’ aspects, and clear (green) were collectively termed ‘unrestricted’ aspects.
Figure 7: Arc Infrastructure signal aspects
The image shows the colour light signal aspects and describes their intended communication to drivers.
Source: ATSB
A signal displaying a caution (yellow) aspect is advising the rail traffic crew that the next signal is displaying a stop or ‘at danger’ aspect. This notifies the rail traffic crew that their train must be brought to a stop prior to the next signal. Although the Arc Infrastructure Network Safeworking Rules and Procedures did not specify how close to a signal displaying an ‘at danger’ aspect a rail traffic crew must stop their train, Pacific National had specified a ‘hard and fast’ rule of 50 m within its SPAD Commandments document.
At the time of the accident, 2K66 occupied a track section directly ahead of Jumperkine signal 12L. As 7MP5 approached Jumperkine, the preceding signal U45 displayed a caution (yellow) aspect, and signal 12L displayed a red (stop) aspect. As such, the signalling system at Jumperkine operated as designed.
Signal sighting
The Arc Infrastructure signal sighting procedure specified the minimum time a signal shall be available for sighting by an approaching train was 8 seconds. For a train like 7MP5 travelling at 80 km/h, the track speed for this location, the signal must be visible on the approach from no less than 178 m.
The track approaching signal U45 at Jumperkine consists of a left curve which opens out into a straight section of track towards the signal. A review of the forward-facing camera footage from 7MP5 identified that signal U45, displaying a yellow caution aspect, came into view at about 400 m from behind foliage on the inside of the left curve (Figure 8). At track speed for freight train drivers (80 km/h), this provided about 18 seconds of signal sighting. The signal sighting for signal U45 was found to be compliant with Arc Infrastructure’s procedure for signal sighting.
Figure 8: Approach to signal U45
The image shows the track curvature towards signal U45 between Moondyne and Jumperkine, and an image of the first available sighting of signal U45 from 7MP5 (top left).
Source: Pacific National, and Google Earth, annotated by the ATSB
The speed of 7MP5 on the approach to signal U45 was about 76 km/h, providing about 19 seconds of sighting of the caution aspect prior to passing the signal. The ATSB did not identify any environmental factors that could have affected the driver’s ability to sight signal U45.
The track approaching signal 12L at Jumperkine consists of a left curve followed by a right curve. A review of the forward-facing camera footage from 7MP5 identified that signal 12L, displaying a red stop aspect, came into view at about 340 m from behind foliage on the inside of the right curve (Figure 9). At track speed for freight train drivers, this provided about 15 seconds of signal sighting. The signal sighting for signal 12L was found to be compliant with Arc Infrastructure’s procedure for signal sighting.
The speed of 7MP5 on the approach to signal 12L was about 72 km/h, providing about 17 seconds of sighting of the stop aspect prior to passing the signal. If 7MP5 had approached signal 12L compliant with the 30 km/h TSR, about 41 seconds of sighting would have been provided. The ATSB did not identify any environmental factors that could have affected the ability to sight signal 12L.
Figure 9: Approach to signal 12L
The image shows the track curvature towards controlled absolute signal 12L at Jumperkine, and an image of the first available sighting of signal 12L from 7MP5 (bottom right).
Source: Pacific National, and Google Earth, annotated by the ATSB
Signal 12L SPAD history
The ATSB requested the SPAD records for Jumperkine signal 12L from Arc Infrastructure. A review of these records identified 5 SPAD events during 2010–2012, with none prior to or after this time. The records for the 5 SPAD events noted that the majority were outside of the drivers’ control and related to the signal restoring as the train approached, with only one being likely related to driver anticipation. There were no records of any driver completely missed[28] SPADs.
The signal interlocking data[29] was analysed for the month preceding the accident. This sample of about 336 rail traffic movements through Jumperkine identified that about 98% of trains approached signal 12L at Jumperkine displaying a proceed aspect.
Communications systems
Arc Infrastructure utilised an ultra-high frequency (UHF) radio system for communications on its network between Kalgoorlie and Perth. The UHF radio system incorporated channels that were assigned to different network control areas as well as channels available for local communications.
The local communications channels were generally not monitored by NCOs. These channels were intended for local communications that did not require the NCO, such as between different rail traffic crews during roll-by inspections as well as between rail traffic crews and track maintenance workers.
The network control channels were monitored by the NCO assigned to that geographic portion of the rail network. These channels were designed to be open channel (‘party-line’)[30] communication systems so rail traffic crews and track maintenance workers could hear communications not directed to them and maintain awareness of activities close to their area of operation. Further information about NCO communications is provided in Communication protocols.
Environmental conditions
Information obtained from the Bureau of Meteorology (BoM) established that the weather near Jumperkine was clear in the period leading up to the accident, and there was no recorded rainfall.
Sunrise was at 0508 with astronomical twilight[31] commencing at 0328 and civil twilight[32] commencing at 0440. Moonrise in the waning crescent phase[33] was at about 0324, providing no reflected or natural light at Jumperkine at the time of the accident. The location of the accident, within the Walyunga National Park, meant there was no artificial lighting in the vicinity. As such, all information indicated it was dark at the time of the accident (Figure 10).
Figure 10: Train 7MP5 view of Jumperkine signal 12L
The image shows available lighting and environmental collisions at first sighting opportunity of Jumperkine signal 12L.
Source: Pacific National, annotated by the ATSB
Train information
Train 7MP5
General information
Train 7MP5 was a standard gauge Pacific National intermodal[34] freight service between Melbourne, Victoria and Perth, Western Australia. The train was 1,070 m in length, consisting of 2 NR class locomotives with 25 single and multi-platform wagons, and had a total weight of 1,958 t. A driver only operation (DOO) was in use for 7MP5 between West Kalgoorlie and Perth (Figure 1).
Train 7MP5 locomotives
The 2 locomotives hauling 7MP5, NR80 and NR59, entered service in 1997. The NR class locomotives were a standard gauge Cv40-9i model diesel electric locomotive manufactured by A. Goninan & Co Limited.
The in-cab communication equipment (ICE) radio fitted to the locomotives transmitted and received all selected frequencies within the locomotive cab. The driver’s last communication with an NCO via radio on the open-channel frequency occurred at about 2324, and no problems were noted with this communication. The driver’s last known communication with another rail traffic crew via radio on a local frequency (during a roll-by inspection) occurred at about 0147. The driver was required to maintain a listening watch of the open-channel frequency while operating the train. The volume setting of the radio in the cab at the time of the collision could not be determined.
The NR class locomotives were fitted with an event recorder and a forward-facing camera. The microphone for the forward-facing camera was installed with the braking system pneumatic control rack. Information from the event recorder and forward-facing camera from the train’s locomotives have been included in the report where relevant.
The locomotives of 7MP5 were not fitted with in-cab voice or video recording devices, nor was it required.
In regard to the braking system responses required for rolling stock operators accessing the Arc Infrastructure network, Arc Infrastructure general operating instructions specified that:
All trains operating on the Arc Infrastructure Rail Network must be capable of stopping within a distance of 2000 metres on a down gradient of 1 in 150, in order to comply with Arc Infrastructure's Rail Track Signals protection and signalling system.
The average gradient within the Jumperkine crossing loop (40 km to 41.7 km) was calculated to be about 1 in 340, a much flatter section of track than the 1 in 150 gradient specified by Arc Infrastructure.
Pacific National’s trains such as 7MP5 that travelled from Melbourne to Perth had to comply with the requirements of other rail infrastructure managers, including that of the Australian Rail Traffic Corporation (ARTC). In order to meet these requirements, a train such as 7MP5 on a relatively level gradient needed to meet the braking system response requirements outlined in Figure 11.
Figure 11: ARTC minimum full service braking requirement for train type MLF-115[35]
The image shows the minimum requirements for train brake performance on the ARTC rail network as specified for operations of trains closest to the mass and length of 7MP5.
Source: Graphed by ATSB from data contained within Draft Code of Practice for the DIRN – Volume 5: Rollingstock, Appendix A
Both Arc Infrastructure’s requirements and ARTC’s requirements contemplated a full service brake application rather than an emergency braking application. Event recorder data on 7MP5’s emergency braking system response prior to the collision was limited to a relatively small sample period (that is, recorded speed for about 11 seconds sampled once a second). Analysis of this data indicated that the train’s braking performance was better than that specified by both the Arc Infrastructure and ARTC requirements. However, there was insufficient data to reliably predict the full braking performance of the train had the collision not occurred.
Event recorder data showed that a service brake application was made when the train was approximately 720 m from the point of collision (at about 0159:30). In addition, an emergency brake application occurred about 167 m prior to the collision (at about 0200:00), when the train was travelling at about 58 km/h. If the train had been travelling at 30 km/h in compliance with the temporary speed restriction (TSR) when the emergency brake was applied, it was likely that the train would have avoided the collision or the speed of impact would have been significantly reduced.
The ATSB considered the effect on the consequence of this accident had the emergency brake been initiated earlier at key events. Noting the limitation of assumptions made,[36] it was estimated that the train’s emergency braking distance when travelling at about 72 km/h (the speed prior to the service brake application) was about 516 m. More specifically:
The distance from the first available sighting of signal 12L to the rear of 2K66 was about 1,200 m. The signal first became visible at about 0159:08 and the train was travelling at about 72 km/h. Had the emergency brake been applied immediately after this point, the train would very likely have stopped prior to colliding with the rear of 2K66.
The distance from signal 12L to the rear of 2K66 was about 800 m. The train passed the signal at 0159:24 and the train speed was at about 72 km/h. Had the emergency brake been applied immediately after this point, the train would likely have stopped prior to colliding with the rear of 2K66.
The distance between the 11 points and the rear of 2K66 was about 715 m. The train passed over the points at 0159:30 at a speed of about 72 km/h. Had the emergency brake been initiated immediately after this point, the train would likely have stopped before colliding with the rear of 2K66 or the speed of impact would have been significantly reduced.
Lead locomotive NR80 and trailing locomotive NR59 braking systems were inspected and tested post-accident. There were no anomalies identified from these inspections and tests that were found to have contributed to this accident.
For more explanation of train braking systems, refer to Appendix A – Train Braking Systems
Train 2K66
General information
Train 2K66 was a narrow gauge Watco bulk grain service between Koorda and Perth, Western Australia (Figure 1). The train’s length was 793 m and weight was 3,900 t. The train consisted of lead locomotive CBH10, trailing locomotive CBH04, and 52 CBHN class grain wagons. It was operated by a 2-person rail traffic crew.
Train 2K66 locomotives
The locomotives hauling 2K66, CBH10 and CBH04 entered service in 2012. These CBH class locomotives were a narrow gauge MP27CN model diesel electric locomotive manufactured by MotivePower Inc.
The CBH class locomotive was fitted with an event recorder and a forward-facing camera. The microphone for the forward-facing camera was installed within the driver’s cabin.
CBH class locomotives were fitted with a Q-Tron QES-III control system. The QES-III control system, among other tasks, monitored the locomotive’s operating parameters to ensure all systems were operating normally. In the event that the QES-III control system identified a potential abnormality or problem, it would, depending on the severity, generate either a message or alarm. These messages or alarms were then displayed to the driver on the computer display unit (CDU), located within the driver’s console. The locomotive’s CDU also displayed other operational parameters, such as locomotive speed, fuel levels, braking system pressures and flow rates, traction currents, and other operational measurements.
Train line fault alarm
One alarm included on the CDU was a train line (T/L) Alarm. This alarm is generated when a locomotive in the consist had at least one alarm active on its CDU.
At the time of the collision, a T/L alarm was generated on the CDU of lead locomotive CBH10, indicating to the rail traffic crew that the trailing locomotive had an alarm. The same alarm in trailing locomotive CBH04 was also found by the rail traffic crew to be active. However, the T/L alarm in the trailing locomotive was not accompanied by any other alarms to assist the rail traffic crew with diagnosis. This unexpected alarm response, coupled with being unaware of the overrun of authority limits by 7MP5, likely confounded the 2K66 rail traffic crew’s assessment as to what had happened.
Locomotive flow meter
One of the operational parameters the locomotive CDU displayed was the brake pipe flow rate. The brake pipe flow rate was a measurement of the air flow from the locomotive main air reservoir into the brake pipe. This measurement provided an indication of when and at what rate the train’s brake pipe was charged or attempting to be charged by the locomotive.
The brake pipe air flow measurement can provide warning that the brake pipe pressure has been affected, indicative of a leak or broken / ruptured brake pipe in the train, potentially related to a train separation, derailment, or collision.
Train 2K66 braking system response
At the time of the collision, 2K66 had a brake pipe pressure of about 331 kPa, when stopped at Jumperkine. This was consistent with the train’s automatic brake being fully applied. During and after the collision, the rail traffic crew did not detect a change in brake pipe pressure or brake pipe air flows, and none were identified in the locomotives’ event recorder data.
The ATSB determined that the brake pipe within the last wagon of 2K66 was likely crushed and sealed by the impact of 7MP5. Although there may have been some initial loss of brake pipe air pressure at the rear or the train, it was not significant enough to be recorded at the locomotives.
Train 2K66 visibility
The Arc Infrastructure Network Safeworking Rules and Procedures – Rail Traffic Lights and Markers, Rule Number 4005, described the lighting and marker requirements for the front and rear of trains operating within its network. Consistent with Rail Industry Safety Standards Board (RISSB) standards AS7531 Rolling Stock Standard – Lighting and Visibility, and AS7503.6 Rolling Stock Standard – Train Identification and Integrity, the Arc Infrastructure document required the rear of rail traffic to be identified by an end-of-train marker.
In normal main line train operations, the main purpose of the end-of-train marker was to enable a rail traffic crew to confirm that a train is complete. That is, a rail traffic crew undertaking examination of their train, or a roll-by examination of a passing train, could confirm that the last wagon/rail vehicle was fitted with an end-of-train marker, enabling a conclusion that the train being examined was complete. Due to the significant differences in braking performance between rail traffic and road traffic, the end-of-train marker should not be considered as a tail-light in the road traffic sense.
The Arc Infrastructure rule number 4005 required the end-of-train marker to be one or more clearly visible, steady or flashing red lights. In line with these requirements, the rear of 2K66 was fitted with an end-of-train marker that consisted of a white disk with 2 independently flashing red LED[37] marker lights. However, at the time of the collision, neither of the flashing red LED marker lights on 2K66 were operational (illuminated) as required for night operations.
The ATSB considered the effect that the non-operational end-of-train marker of 2K66 had on the accident. It is possible that, had the end-of-train marker been operational, the driver of 7MP5 may have identified a stopped train ahead earlier. However, due to the accident happening at night, coupled with the track curvature approaching the stopped train and multiple adjacent tracks (that the stopped train could have been perceived to be on), it is possible that the optical effects may not have enabled the driver to immediately identify the stopped train as being in their path. That is, after passing through the curve, and as the track straightened out, the driver may not have been able to identify that the stopped train was in their path until their headlights illuminated its rear wagon. This was about the same time that the emergency brake was recorded as being applied in this accident.
Train 3PM4
General information
Train 3PM4 was a standard gauge Pacific National intermodal freight service between Perth and Melbourne. The train was 691 m in length, consisting of 2 NR class locomotives with 36 single and multi-platform wagons, and had a total weight of 1,078 t. A DOO was in use for 3PM4 between Perth and West Kalgoorlie.
Site and wreckage information
Location
The accident occurred on the Arc Infrastructure network at Jumperkine, approximately 40 track kilometres east from Perth (Figure 1).
The damage to rail infrastructure was reported as minor, with environmental damage limited to grain spill and some diesel from 7MP5. The rolling stock damage was more significant and is described in the following sections.
Train 7MP5 damage and injuries
The resulting forces of the collision involving the lead locomotive (NR80) of 7MP5 and the rear of 2K66 did not compromise the survivable space available to the driver. However, the cabin of the locomotive was damaged, with a large amount of grain from the ruptured rear wagon of 2K66 entering the cabin (Figure 12).
Figure 12: Grain ingress to lead locomotive NR80 of 7MP5
The image shows accident site wreckage of train 7MP5 and train 2K66, including ingress of grain to the lead locomotive (NR80) of 7MP5.
Source: ATSB
The driver was found on the floor of the locomotive near the observer’s seat position on the non‑driving side of the cabin. The post-mortem examination concluded that the fatal injury to the driver was asphyxiation as a result of the locomotive cabin being filled with grain.
Analysis of the wreckage identified that the lead locomotive (NR80) brake handle was in the emergency position.
The rapid deceleration of the front of the train, coupled with the momentum of the trailing portion of the train, caused the trailing locomotive (NR59), empty crew van RZAY00283C, and loaded intermodal freight wagons RQGY34999Y and RRYY00037R to be derailed and substantially damaged. Likely due to the curvature of the track at the point of collision, the crew van and freight wagon debris came to rest on the southern side of the track, clear of the main line that 3PM4 was pathed towards (Figure 13).
Train 2K66 damage
The last grain wagon CBHN1221 of 2K66 was ruptured and substantially damaged. This last wagon was lifted from the trailing end during the collision with 7MP5. The collision also caused some minor damage to the trailing end of the penultimate grain wagon CBHN1172, when the 2 wagons came into contact above their couplers.
Train 3PM4 damage
The debris from the collision did not obstruct the path of 3PM4 on the down main line. As such, this train was not damaged (Figure 13).
Figure 13: Jumperkine accident site (overhead view)
The image shows the site and wreckage layout at Jumperkine.
Source: Western Australia Police, annotated by the ATSB
Network control information
Traffic control system
Jumperkine was in Arc Infrastructure’s eastern network control area, which encompassed Avon Yard to Canning Vale (Figure 1). The network control officer (NCO) responsible for this area was located at the Arc Infrastructure Metro Control Centre located at Midland (in Perth) and operated the CTC system using the proprietary Phoenix computer-based traffic control system (TCS). The TCS presented the track layout in a plan view on a series of contiguous display monitors (Figure 14), with numerous real time indications displayed for the information of the NCO. These indications included the location of trains, train identification information, points, signals, and some types of alarms.
Additionally, the TCS provided the NCO with several assistive features. One is the option of applying the fleeting feature to controlled absolute signals. When fleeting was applied to a controlled absolute signal (such as signal 12 L), the TCS automatically, as soon as the route ahead of the signal was available, issued the request to the interlocking to clear the fleeted signal. This essentially changed a controlled absolute signal into an automatic absolute signal, until the fleeting feature was removed. At the time of the accident, the TCS fleeting feature had been applied to signal 12L at Jumperkine.
The NCO, by operating the TCS system, was able to safely route rail traffic over a wide area of railway, aided by the signal interlocking safeguards built into the system. These signal interlocking safeguards were designed to keep safe separation between trains.
Signal passed at danger warning system
The TCS system was equipped to provide a reactive warning after a train passed a signal displaying a stop aspect (that is, a signal passed at danger or SPAD). This warning, known as a SPAD alarm, consisted of an audible alert accompanied with a visual dialog box that appeared on the NCO’s TCS screen (Figure 14). The dialog box typically included information about the train’s identification number, and the location and number of the signal.
The SPAD visual dialog box was not diagnostic about the type of SPAD or extent of exceedance. The visual dialogue box remained until the SPAD reason (from a set list) and an optional comment was recorded by the NCO and then the dialogue box was acknowledged. If a SPAD alarm was not attended to, the visual dialogue box would remain displayed and the auditory alert would remain on.
The ability of this reactive warning to contribute to the prevention of a more serious consequence (such as a collision) was reliant on how much time the NCO and train driver had before the train that had overrun its limit of authority reached a point of conflict.
Figure 14: TCS SPAD warning
The image shows a portion of the track layout including Jumperkine, and an inset image of the SPAD warning dialog box like that provided by the Phoenix TCS system.
Source: Arc Infrastructure, annotated by the ATSB
A SPAD alarm could be triggered for legitimate reasons, ranging from a rail traffic crew starting their trains and moving against a signal, to completely missing the signal while travelling at track speed, as was the case for the 24 December 2019 accident at Jumperkine. However, false SPAD alarms could also be triggered for normal operational reasons, such as for rail traffic that had been verbally authorised past a signal at stop and track/signal maintenance works, or due to signal system faults or telemetry system faults. Consequently, following the receipt of a SPAD alarm, an NCO in response would typically need to determine whether it was a legitimate SPAD alarm or a falsely triggered SPAD alarm. This assessment would likely involve the NCO undertaking various checks to eliminate the falsely triggered alarm sources, such as confirming that the SPAD alarm was not:
due to the NCO themselves verbally authorising the train to pass a signal at stop
a signal system fault, such as a track fault or loss of communications with the field equipment
related to a signal system power supply outage
triggered by maintenance works
due to an unknown/not obvious reason (not associated with a legitimate train movement).
After an NCO has confirmed that a falsely triggered SPAD was unlikely, they would typically treat the SPAD as a legitimate SPAD. This requires the NCO to action their responsibilities within the Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001, to deal with the matter.
The TCS did not provide a specific alarm or warning related to a collision.
Rules for responding to a signal passed at danger
The Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001, defined the operational process for managing rail traffic that had overrun its limits of authority. An overrun of a limit of authority was defined as occurring when rail traffic, without authority:
passed a signal at STOP (SPAD)
passed a sign that shows limit of authority
overran the limit of an occupancy authority
entered a block without the correct authority.
Arc Infrastructure’s rule 6001 was sourced from the Australian Network Rules and Procedures (ANRP) rule 6001. Both versions assigned responsibilities or required actions to the rail traffic crews and NCOs in relation an overrun of a limit of authority. Although the ANRP and Arc Infrastructure versions of rule 6001 made the responsibilities of the rail traffic crew and NCO mandatory, the Arc Infrastructure version did not require the immediate actioning of NCO responsibilities. The comparison of these responsibilities (with the key difference underlined) is described in Table 1.
Table 1: Rule 6001, NCO and Rail traffic crew responsibilities
Role
Arc Rule 6001 responsibilities
ANRP Rule 6001 responsibilities
Rail traffic crew
Rail traffic crews that have overrun a limit of authority must immediately:
stop their rail traffic, and
broadcast an emergency radio call where the rail traffic crew believes there is an immediate danger, and
take action to prevent a collision with other rail traffic, and
report overrun to NCO.
Rail traffic crews that have overrun a limit of authority must immediately:
stop their rail traffic, and
broadcast an emergency radio call, and
take action to prevent a collision with other rail traffic, and
report overrun to NCO.
Network control officer
The NCO must:
arrange to stop rail traffic that has overrun its limit of authority and has not stopped, and
arrange to stop other rail traffic movements that are at risk, and
notify protection officers at affected worksites, and
notify affected rail traffic crew to await further instructions, and
determine the method of working to be used to clear rail traffic, and
report overrun to network rail operations manager, and
report overrun to rolling stock operator’s representative, and
report overrun to other affected NCOs.
The NCO must immediately:
arrange to stop rail traffic that has overrun its limit of authority and has not stopped, and
arrange to stop and prevent other movements that are at risk, and
notify protection officers at affected worksites, and
notify affected rail traffic crew to await further instructions, and
determine the method of working to be used to clear rail traffic, and
report overrun to rail infrastructure manager’s representative, and
report overrun to rolling stock operator’s representative; and
if a controlled absolute signal has been passed, tell other affected NCO’s.
Common to both the Arc Infrastructure and the source ANRP rule 6001, there was no requirement for the NCO to broadcast an emergency call, either to rail traffic that had overrun its limit of authority or to ‘at risk’ trains when another nearby train had overrun its limit of authority. This responsibility was only assigned to the rail traffic crew.
The Arc Infrastructure risk register had also not specifically identified or considered the immediacy of NCO responses to a SPAD alarm as a potential risk mitigation for a collision. In addition, Arc Infrastructure had also not specified its performance criteria for NCO responses to SPAD alarms or had any system in place to monitor this performance.
The ATSB explored the NCO response times to SPAD alarms for completely missed SPADs, with the response time defined as the time between the SPAD alarm and a radio communication to the rail traffic crew regarding the SPAD (Figure 15). The response time taken by the NCO for the 24 December 2019 SPAD event at Jumperkine was about 42 seconds. Due to the limited availability of historical recordings[38] to confirm the SPAD alarm response times, only a small sample size (3 samples, including the Jumperkine accident) for Arc Infrastructure was obtained. The other 2 events had similar NCO response times to the Jumperkine accident. In all 3 of these events involving Arc Infrastructure, the NCO’s initial call to the train that had overrun its limit of authority was not an emergency call.
To provide comparison and increase the sample size, the review was extended to include another freight-based rail infrastructure manager’s network that used similar technology to trigger SPAD alarms. Almost all (16) of these 18 events involved response times of more than 30 seconds. The overall median response time for the 18 events on both networks (including the Jumperkine event) was 91 seconds. The timeliness with which NCOs had assessed the situation and determined collision risk potential prior to communicating with rail traffic crews in most of the events could not be determined.
Figure 15: NCO response comparison for completely missed SPAD
The image shows a comparison of NCO responses to completely missed SPADs for both Arc Infrastructure and a similar operation managed by another rail infrastructure manager.
Source: ATSB
The ATSB has investigated several occurrences involving SPAD events in recent years on different rail networks where the NCO provided an emergency call to the rail traffic crew of the train that overran its limit of authority and/or other rail traffic at risk. Examples include RO‑2013‑003 and RO-2021-007 involving freight trains and several RO-2017-010, RO-2017-012, RO-2017-015, RO-2018-001, RO-2018-002, RO-2019-009 and RO-2020-019 involving suburban passenger trains. NCO response times were provided in 4 of these reports (including for the 2 freight trains), ranging from 6 to 17 seconds with a median time of 9 seconds.
Network control officer responsibilities
Network control officers (NCOs) were responsible for the productivity, safety, and record keeping of rail operations within their assigned geographic area of the Arc Infrastructure network. These responsibilities were broken down into broad tasks, as shown in Table 2.Table 2.
Table 2: Network control officer (NCO) tasks
NCO Responsibility
NCO Tasks
Productivity
Plan, set priorities for, and manage the rail traffic and network availability to efficiently meet business and customer requirements. This includes:
issuance of movement authorities to rail traffic crews verbally via train order working safeworking systems, or via control of the CTC safeworking system
applying prioritisation decision making in line with guidelines
ensuring train consist information is correct, taking action to correct or report any incorrect train consist information
monitor rail traffic and seek advice from rail traffic crews in regards to any time lost on scheduled run times
monitor maintenance activities and seek advice from protection officers in regard to any delays related to scheduled hand back of work site possessions
maintaining and frequently updating anticipated rail traffic paths in relation to the progress of rail traffic currently operating, or anticipated to enter the network
initiating frequent advice of anticipated rail traffic arrival times to neighbouring control areas, rail infrastructure managers, and customers.
Safety
Ensure safe passage of rail traffic, and protection requested by rail safety workers is applied. This includes:
application of protection for track side rail safety workers, via train order working safeworking processes or with the application of blocks using the CTC safeworking system
reporting and responding to all actual and suspected safety breaches
reporting and responding to any failures, or emergencies
reporting and responding to any incidents / accidents
assisting with any testing of infrastructure equipment or facilities receiving maintenance attention
reporting and responding to rail traffic crews reporting fatigue to enable them to be brought to a stop
reporting signal failures/irregularities by verbally advising rail traffic crews and maintenance representatives
communicating with customers regarding any safety breaches, incidents, accidents or emergencies involving their rail traffic and rail traffic crews
applying processes to ensure completion of safety critical tasks prior to commencing a new task
reporting and communicating to rail traffic crews conditions affecting the network (e.g. temporary speed restrictions, level crossing equipment faults or deactivations)
obtain permission from neighbouring rail infrastructure managers and/or network control officers before authorising rail traffic to proceed to an area controlled by another NCO
taking action to slow down or reduce workload if the NCO believes fatigue or workloads are compromising their ability to make safe decisions.
Record Keeping
Maintain records and details of all protection applied, and details of rail traffic moving over the assigned network area. This includes recording:
the progress of each rail traffic movement
track closures, track out-of-service and conditions affecting the network
works for maintenance of track, communications, signalling and other infrastructure as necessary for the network
rail traffic crew names
train consist information, including any changes
consistent and detailed recording of information for the purpose of hand over to NCOs on subsequent shifts
signal failures/irregularities requiring repair
rail traffic delays to scheduled running, and/or delays in track possession hand back
safety breaches, incidents / accidents, and emergencies.
An NCO will typically prioritise these tasks to ensure that safety-critical tasks are conducted completely and correctly. At times, NCOs may employ tactics like not starting a new task until all safety-critical steps of the current task are complete. For example, an NCO may complete application of controlled signal blocking,[39] and annotating the train control diagrams,[40] before issuing authorities to rail traffic or workers on track. As such, an NCO’s response to new tasks or train control system alarms is largely dependent on what other tasks are underway, and the level of operational activity the NCO is exposed to at that time.
Communication protocols
The protocols for communication between Arc Infrastructure NCOs and rail traffic crews were described in the Arc Infrastructure Network Safeworking Rules and Procedures – Network Communications, Rule Number 2007. These protocols included the following requirements for open-channel communication:
communication must identify the receiver, such as by identifying the train number
the sender must not assume a message has been understood unless the receiver confirms it has been understood.
NCOs at times provided supplementary advice to rail traffic that they were approaching a location where they would be required to stop. However, this supplementary advice was provided as a courtesy as there was no mandatory requirement for its provision. As such, the overall system was reliant on rail traffic crews observing the displayed signal aspects and operating their trains accordingly.
At 0134 on 24 December, the NCO made an open-channel communication to provide supplemental advice to the rail traffic crew of 2K66. This communication identified 2K66 as the recipient of the advice, and the crew acknowledged that they understood they would be stopping at Jumperkine. The driver of 7MP5 did not acknowledge having overheard this communication, and nor was there any requirement for them to do so.
Emergency communication protocols
The Arc Infrastructure emergency communication protocols were also described within Arc Infrastructure Network Safeworking Rules and Procedures – Network Communications, Rule Number 2007. These protocols required that emergency communications:
had to start with ‘Emergency, Emergency, Emergency, this is…(reporter’s identification)’
when answered, the reporter had to provide details of the emergency and advice on whether emergency services are required
if not answered, the reporter had to repeat the emergency communication until answered
had to be given priority
had to be answered immediately by the intended recipient
if on an open-channel radio, other channel users had to stop transmission immediately if there was an emergency message being communicated.
In respect to an overrun of limits of authority or SPAD, the Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001 specified a requirement for an emergency communication (see Rules for responding to a signal passed at danger). The execution of this responsibility was assigned to the rail traffic crew; it did not also state a requirement for the NCO to initiate an emergency communication upon the receipt of a SPAD alarm. The NCO’s responsibilities following receipt of a SPAD alarm were limited to making contact with the rail traffic crew, and directing the rail traffic that had overrun its limit of authority to stop if they had not already stopped.
Network Control Officer information
The NCO responsible for the eastern control area at the time of the accident commenced their employment as an NCO with Arc Infrastructure’s predecessor (Brookfield Rail) in 2010. Personnel records showed that the NCO was awarded a certificate of competency for the eastern train control console in June 2010, and completed a certificate IV in rail network control (TLI42211) in February 2015.
Arc Infrastructure procedures required regular on-the-job observations[41] to assess compliance with the general responsibilities of a network controller procedure. On the job observations of the NCO involved in this accident, conducted in 2017, 2018 and 2019, did not identify any non‑compliances with the general responsibilities or functions of an NCO.
The NCO’s most recent rail safety worker health assessment (category 1) was on 29 January 2019, which found the NCO was fit for duty based on the standards described in the National Standards for Health Assessment of Rail Safety Workers. At interview, the NCO reported being in good health.
The Office of the National Rail Safety Regulator (ONRSR) organised for a post-accident drug and alcohol test of the NCO, which produced negative results (that is, no drugs or alcohol detected).
The NCO worked a rotating shift pattern, which included alternating sequences of 12-hour night shifts (1800-0600) and day shifts (0600-1800), followed by 3–5 days off. NCOs worked only day shifts in one sequence, and only night shifts in the alternating sequences. The NCO recalled that shift patterns varied between 3 and 5 shifts in length.
On the evening of the accident, the NCO was on their second consecutive night shift, having started at 1800. At the time of the accident, the NCO had been at work for about 8 hours.
ARC infrastructure advised that, at the time of the accident, NCOs were permitted to take rest breaks when required and that NCOs managed their own breaks to ensure the risk of fatigue was mitigated. ARC did not have records of the timing of rest breaks taken by NCOs.
When interviewed by the ATSB, the NCO stated that they were well rested prior to signing on for duty at 1800 on 24 December 2019 and they could not recall feeling tired on the evening of the accident. They recalled that it was a normal night shift, and that they were not particularly busy.
Network control officer actions
At the time that 7MP5 passed Jumperkine signal 12L at stop, the NCO was operating the CTC system for about 6 main line trains within their area of responsibility. The NCO recalled it being a normal work night without any signal faults or failures to manage, and that they did not feel busy or overwhelmed.
The Arc Infrastructure train control system (TCS) events log indicated that the NCO set a route for an unrelated shunt movement at about 0158:58, with an unrelated[42] ‘unknown train’ message generated at 0159:21. After this unrelated ‘unknown train’ message, at about 0159:25, the TCS events log recorded that a SPAD alarm was generated after 7MP5 passed Jumperkine signal 12L at stop.
There was no recorded data available to confirm the exact time that the SPAD alarm dialog box was displayed to the NCO, or in other words, that the TCS event log matched what was displayed to the NCO. The ATSB initiated a series of tests post-accident to determine the typical time taken from a SPAD event until the SPAD alarm dialog box displayed on the NCO’s TCS screen. These tests found the that the dialog box consistently displayed about 2 seconds after a SPAD was simulated at Jumperkine. As such, it is likely that at the time of this accident the SPAD alarm dialog box was displayed to the NCO in a similar timeframe.
The NCO recalled looking at the TCS screen when the SPAD alarm appeared. The NCO did not recall any tasks being undertaken that delayed their response and recalled trying to contact the driver of 7MP5 soon after observing the SPAD alarm. As previously noted, Arc Infrastructure had no explicit requirement for NCOs to take immediate action after a SPAD alarm.
Locomotive vigilance system information
Overview
Locomotive vigilance systems are safety devices that monitor the activity of train drivers and apply the train’s brakes (penalty brake application) if there is no activity detected in a specified period. The basic design of a vigilance system is a timed cycle of alerts consisting of an initial visual alert via a warning light, followed soon after by the addition of an audible alert. If neither alert is acknowledged by the driver via the vigilance acknowledgement pushbutton (Figure 16), the system initiates a penalty brake application, causing the train to stop. Thus, to continue movement and avoid the locomotive making a penalty brake application, the driver must press the vigilance acknowledgement pushbutton according to the vigilance system cycle alerts.
Modifications to the basic design include activity-based systems (also called task-linked systems) that also reset the vigilance system cycle whenever the driver interacts with the locomotive controls (such as braking and throttle changes). Other vigilance systems use a random-timing vigilance cycle, or a vigilance cycle where the interval between alerts decreases with faster train speeds.
Vigilance systems at Pacific National
The Pacific National Locomotive Vigilance Control Systems procedure stated that vigilance control systems were:
provided to assist locomotive drivers / train crews to remain alert at all times whilst a train is in motion, and as a defence against driver incapacity. This is to ensure that locomotive drivers / train crews may continue to respond to their operational duties to safely operate Pacific National trains.
This procedure, dated April 2009, also stated that most Pacific National locomotives were fitted with random-timing vigilance systems, and that the intention was to ensure all locomotives were fitted with random-cycle systems.
Pacific National’s safety management system listed vigilance systems as one of multiple risk controls for managing a compromise to train driver performance by fatigue, drugs and alcohol, and/or medical conditions. In the case of driver only operations (DOO), the safety management system listed vigilance systems as providing additional mitigation for these hazards due to a shorter vigilance alerting cycle (compared to the cycle used for other train operations).
Vigilance control system on board NR class locomotives
The vigilance system fitted to NR class locomotives (such as that fitted to lead locomotive NR80 of 7MP5) was an activity-based, fixed-cycle system. Various activity parameters were monitored to reset the vigilance system timer.
The rail traffic crew interface to the vigilance system fitted to the NR class locomotive included the vigilance acknowledgement pushbutton, a visual alert (warning light), and an audible alert device. Additionally, the locomotive monitoring screen also provided a visual alert with advice on the vigilance cycle countdown to an alert (Figure 16).
Figure 16: NR class locomotive vigilance system
The image shows the key in-cab components of an NR class locomotive vigilance system.
Source: Pacific National, annotated by the ATSB
The NR class locomotive vigilance system had 3 unique fixed cycle times available for selection with ‘Cycle A’ applicable for DOO. The length of cycle A times and alerts is described in Table 3. Cycle A was the most sensitive vigilance cycle programmed into the vigilance system, with other cycles (used for multi-rail traffic crewed operations) allowing for up to 90 seconds of inactivity before generating an alert (compared to 40 seconds for cycle A).
Table 3: NR Class Locomotive DOO cycle (cycle A) times
Vigilance Cycle A
Time
Cycle time (prior to visual alert)
40 seconds
Visual alert ONLY (warning light)
10 seconds
Visual and audible alert (warning light and audible alert)
10 seconds
Event recording analysis confirmed that lead locomotive NR80 of train 7MP5 was set to DOO cycle A. Post-accident testing and inspections of locomotive NR80 concluded that the vigilance system passed all functional tests.
The vigilance cycle time could be reset whenever a driver control input to the locomotive throttle, brakes and other controls was made. Driver control inputs made during the cycle time before a vigilance system visual alert was raised would reset the cycle time to 0 seconds, and therefore pre-emptively reset the visual alert before it displayed.
The ATSB noted that the NR class locomotive maintenance and operational manuals did not include any explanation of whether the vigilance acknowledgement pushbutton also provided an ability for a driver to pre-empt the vigilance system visual alerts (that is, reset the cycle time to 0 seconds before a visual alert appeared). To understand this, post-accident testing of another NR class locomotive was undertaken. This testing confirmed that the vigilance system visual alert could be pre-empted by pressing the vigilance acknowledgement pushbutton prior to the start of the visual alert. This reset the cycle time to 0 seconds and prevented a vigilance system visual alert from being generated. Additional testing confirmed that there were no observable limits to how many times the visual alert could be pre-emptively reset by using the vigilance acknowledgement pushbutton.
Train 7MP5 driver vigilance inputs
The driver’s vigilance acknowledgement pushbutton inputs for the lead locomotive of 7MP5 were recorded by the locomotive event recorder. The ATSB analysis of the driver vigilance acknowledgement pushbutton inputs for 7MP5 with the fixed vigilance alert cycle times showed that:
The data did not indicate that the driver was frequently pre-empting the visual alerts.[43]
At the start of the journey, the driver typically responded to the vigilance system alarm when it was in the visual alert only phase of the alerting cycle (that is, in the first 10 seconds of the alerting cycle).
In the 35 minutes prior to 7MP5 passing signal 12L at danger, the response times to the vigilance alarms became longer. During this time, most of the driver’s responses to the vigilance alarm occurred only after the audible alert activated.
For about 6 minutes prior to 7MP5 passing signal 12L at danger, the only recorded driver action was the operation of the vigilance acknowledgement pushbutton (Figure 17), with the last use of the pushbutton recorded at 0159:05. At about 0159:33, about 9 seconds after passing signal 12L, the driver made a service brake application, resetting the vigilance cycle timer.
Figure 17: Recorded data showing the driver of 7MP5’s vigilance acknowledgement pushbutton response time to vigilance demands
The image shows the vigilance acknowledgement pushbutton response times for the full shift of the driver of 7MP5. The grey portion of the graph indicates the vigilance system cycle time (up to 40 seconds), the yellow portion indicates the visual alert response time (up to 10 seconds), and the red portion indicates the visual and audible alert response time (up to 10 seconds). Note that the vigilance system cycle time resets undertaken by activity-based manipulation of locomotive controls, such as throttle, brakes, and horn, are not reflected in this graph.
Source: ATSB
Driver responses during a previous SPAD event
In August 2019, a Pacific National train with NR class locomotives and with DOO was involved in a SPAD event at Beckwith, Western Australia. A Pacific National internal safety investigation identified that the driver[44] was probably in ‘a state of sleep’ during the event and was not alert to their surroundings. The investigation found the driver continued to acknowledge alerts from the activity-based, fixed-cycle vigilance system. The investigation report noted that, in the minutes prior to the SPAD, the driver only responded to the vigilance system after the audible alerts activated, rather than responding to the visual only alerts. The investigation recommended a number of corrective actions, such as:
adopt a variable (random) vigilance cycle for all locomotives
consider changing the vigilance acknowledgement system to require a combination of actions to acknowledge vigilance alerts
consider introduction of drowsiness detection technology[45] in main line locomotives, similar to equipment which was already operating in Pacific National light vehicles.
Pacific National had considered and undertaken some work to progress these recommendations. However, the recommendations that PN assessed as reasonable and practicable had not yet reached implementation at the time of the 24 December 2019 accident at Jumperkine.
Limitations on vigilance systems
Previous safety investigations have noted that vigilance device reset can occur during a period of acute fatigue. The following excerpt from the National Transportation Safety Board report on an accident at Macdona, Texas, 28 June 2004[46] describes this phenomenon:
(That the train driver) could have remained sufficiently alert to make train control inputs and yet be unable to respond to vitally important signal indications may be explained by the fact that making such inputs and manipulating the alerter (vigilance system) are highly practiced, nearly reflexive, motor responses that require only lower level cognitive effort. During the engineer‘s [train driver’s] transition from wakefulness into the normal perceptual disengagement of unintended sleep, his capacity for information processing would have been severely compromised. Thus, he could have been able to continue the reflexive control activities while being unable to perform the higher level cognitive tasks of extrapolating information from the signal indications…
Research on the limitations of locomotive vigilance systems is described in Appendix B – Research on locomotive vigilance system limitations In summary, because train drivers often habituate to vigilance systems and respond to alerts without conscious thought, vigilance systems in their present form have limited capacity to be effective controls for ensuring drivers are alert and attentive to the rail environment.
Train driver information
Qualifications and experience
The driver of 7MP5 was an experienced train driver who had worked for other rail transport operators in New Zealand and Australia. The driver relocated to Australia in 2010 to take up a train driver role with another operator in Western Australia before starting with Pacific National in Western Australia in 2014.
The driver held route competency[47] for the section of track at Jumperkine. The driver’s roster recorded regular journeys, in both directions, over the section of track at Jumperkine in the 3 months prior to the accident. Accordingly, the driver would have been familiar with the temporary speed restrictions located at Moondyne and Jumperkine.
Medical information
The driver’s most recent rail safety worker health assessment (category 1) was on 22 May 2019, which found the driver was fit for duty based on the standards described in the National Standards for Health Assessment of Rail Safety Workers (NSHARSW). The driver’s partner described them as in good health and fitness. The driver did not drink alcohol or coffee, and the only hot beverages they consumed did not contain a high level of caffeine.
During the category 1 health assessment, the driver reported no difficulty maintaining alertness during normal activities.[48] The driver indicated they had not experienced choking or interrupted breathing while asleep. The driver advised the physician that they had previously been diagnosed with sleep apnoea, however this was resolved with surgery 15 years prior to the examination. Based on these responses, and because the driver did not meet criteria[49] relating to body mass index or neck circumference, the driver was not referred for a sleep study to assess the probability of sleep apnoea.
In their most recent health assessment, the driver identified that they had hearing aids. The hearing assessment conducted as part of the health assessment was undertaken without the use of hearing aids, and the driver was recorded as meeting the prescribed hearing level standards defined in NSHARSW. The NSHARSW required safety-critical workers who had hearing aids to also undergo an evaluation of their ability to hear speech in noise or quiet. There were no records provided of these additional tests being undertaken.
The driver of 7MP5 was not wearing hearing aids at the time of the accident. Since the driver had been able to hear and communicate earlier in their journey, the ATSB assessed that this was unlikely to have affected the driver’s ability to hear any transmitted radio calls.
Post-mortem examination undertaken on behalf of the West Australian Coroner did not detect any traces of alcohol or other drugs. The cause of death was established as asphyxia from the ingestion of grain.
Recent history
Observations about alertness and wellbeing
The driver’s partner recalled that the driver would normally sleep about 8 hours a day, usually between about 2100 to 0600, when the driver was not working or did not have other commitments. The driver was reported to sleep soundly in such situations and did not take long to fall asleep at night. The partner also told the ATSB that the driver was known to be able to nap during the day, and would often nap at about 1400 prior to the start of a night shift (sometimes achieving a couple of hours sleep).
The driver’s partner reported that, in the weeks leading up to the accident, the driver appeared very tired. The partner said the driver had frequently mentioned concerns about their roster and the impact it was having on their ability to sleep through between shifts at times, and that they were tired when they woke up. The driver’s partner was concerned about this tiredness and encouraged the driver to take sick leave on 21 December 2019. The partner recalled that this leave day was taken only because of the driver’s tiredness and the driver had not been unwell or injured. Pacific National documentation recorded the leave day as casual sick leave without a certificate, with no other information recorded. One of the driver’s friends also recalled the driver describing being exhausted from work in the period around the time of the accident. Other than the sick leave taken on 21 December, the driver had not taken any personal leave or annual leave during October to December 2019.
The driver was known to undertake many additional or overtime shifts (that is, shifts additional to or different to that assigned in their planned roster). The Pacific National investigation report into the Jumperkine accident involving 7MP5 reported that the driver had often requested overtime. The driver’s partner recalled that the driver regularly filled in for other drivers and was reluctant to refuse requests to take an additional duty when the operator was short of available drivers. One of the driver’s colleagues said the driver did a lot of additional shifts, and recalled the driver saying they felt guilty if they refused taking on additional shifts when asked.
The driver’s partner reported that the driver was often involved in volunteer activities when not conducting work duties.
Roster information
Pacific National provided copies of the driver’s weekly planned working rosters, as well as records of the actual hours the driver worked during October to December 2019. The planned shifts and actual hours of work for the driver in December 2019 is illustrated in Table 4, and a detailed description of the 10 days prior to the accident is shown in Table 5.
The ATSB reviewed the driver’s roster during October to December 2019 and compared their planned and actual shifts to rules described in Pacific National documentation (see Rostering practices at Pacific National). Observations about the drivers’ planned and actual (worked) rosters included:
The driver worked shifts on 11 of the 24 rostered days off (RDOs) allocated to them in the roster.
The driver’s actual roster did not include an average of 2 RDOs per week in either October, November or December.
The driver worked a maximum 49.5 hours in a 7-day period, and there were several other instances when the driver worked more than 40 hours in a 7-day period.
The driver’s roster included several ‘quick returns’ where less than 11 hours interval between shifts was provided.
The additional shifts also increased the variability of shift timing. For example, when the driver worked 17 and 18 December, instead of taking the allocated RDOs, this created a shift pattern of a night shift, an afternoon shift, a morning shift and then an early morning start.
Otherwise, the driver’s rosters were generally consistent with the prescribed rules, and there were no violations of rules relating to maximum consecutive shifts, maximum shift length, minimum rest opportunity or maximum FAID scores (see Pacific National use of biomathematical models of fatigue).
Table 4: Working (planned) roster and actual hours worked by the driver of 7MP5 in December 2019
Date
1 Dec
2 Dec
3 Dec
4 Dec
5 Dec
6 Dec
7 Dec
Planned
RDO
0600-1400
0600-1400
0800-1536
1710-2330
2050-0310
Actual
RDO
0600-1400
0600-1400
0800-1536
1830-0050
2050-0358
Date
8 Dec
9 Dec
10 Dec
11 Dec
12 Dec
13 Dec
14 Dec
Planned
0330-1200
0900-1700
RDO
RDO
RDO
2200-0630
2000-0400
Actual
0330-1200
0600-1400
RDO
RDO
RDO
2200-0630
2000-0400
Date
15 Dec
16 Dec
17 Dec
18 Dec
19 Dec
20 Dec
21 Dec
Planned
2000-0400
RDO
RDO
0700-1200
2335-0635
1400-2230
Actual
2000-0354
1955-0232
1230-1747
0700-1159
0300-1028[1]
SICK
Date
22 Dec
23 Dec
Planned
2030-0340
2120-0430
Actual
2030-0337
2120-0337
Source: Information provided by Pacific National summarised and tabulated by ATSB
[1] This shift was the same service that was originally scheduled to commence 3 hours earlier (that is, 2335–0635 starting 19 December).
Table 5: Recent duty times for driver of 7MP5
Date
Work activity
Duty start
Duty end
Duty time
Time free (of duty)
13 Dec 2019
Shunting, Perth
2200
0630
8.5 hours
13.5 hours
14 Dec 2019
Shunting, Perth
2000
0400
8.0 hours
16.0 hours
15 Dec 2019
Shunting, Perth
2000
0354
7.9 hours
>24 hours
16 Dec 2019
Off duty (after finishing at 0354)
17 Dec 2019
Additional shift, DOO train from Perth to West Merredin
1955
0232
6.6 hours
10.0 hours
18 Dec 2019
Additional shift, drive car from West Merredin to Perth
1230
1747
5.3 hours
13.2 hours
19 Dec 2019
Additional shift, drive car from Perth to West Merredin
0700
1159
5.0 hours
15.0 hours
20 Dec 2019
Additional shift, DOO train from West Merredin to Perth
0300
1028
7.5 hours
>24 hours
21 Dec 2019
Off duty (sick leave)
22 Dec 2019
DOO train from Perth to West Merredin
2030
0337
7.1 hours
17.7 hours
23 Dec 2019
DOO train from West Merredin to Perth
2120
Source: Information provided by Pacific National summarised and tabulated by ATSB
Rest opportunity and probable sleep in the days prior to the accident
Having taken sick leave (reportedly due to tiredness) on 21 December, there was a 58-hour period off duty between the end of the driver’s shift on 20 December and the start of their shift at 2030 on 22 December. After finishing work at 0337 on the morning of 23 December, the driver had about 18 hours off duty before starting work that evening at 2120.
The ATSB collected information from the driver’s mobile phone and other sources to understand how the driver utilised these periods free of duty, in terms of when the driver was awake and when they had opportunity to sleep.[50] The mobile phone records showed times when the driver was almost certainly awake (such as sending messages, making and receiving phone calls, and visiting web pages). It was not possible to determine how the driver utilised the times they were not using their phone and thus to identify the exact duration of sleep.
Table 6: Timeline showing times worked, sleep opportunity, and phone use by the driver of 7MP5 in day prior to the accident
Note: Times worked by driver of 7MP5 are shown as ‘W’, times of probable rest opportunity are shown as ‘S’, and times identified as active phone use are shown as ‘A’.
A timeline (Table 6) was established for recorded instances of mobile phone activity, duty time, and sleep opportunity for this period. The ATSB determined that:
The driver had an opportunity for about 8 hours sleep from 2130 on 21 December until 0530 on 22 December.
The driver’s partner recalled that the driver undertook various volunteer activities during the morning and early afternoon of 22 December. They had lunch with the driver sometime after 1400 on 22 December, and after that they went for a walk together. The partner recalled that, later in the afternoon the driver retired to rest, although they did not recall the timing or duration of this rest.
Mobile phone records did not detect any active phone use for 4 hours from about 1450 to 1840 that afternoon (which probably included the post-lunch walk). The driver normally left home for work about 1 hour prior to their sign on time.
In summary, it is likely that the driver obtained a normal amount of sleep on the night of 21 December. It is possible that the driver also obtained some additional sleep on the afternoon of 22 December before commencing duty in Perth at 2030 that evening, but the duration of any sleep period could not be reliably determined.
Following the end of their shift at 0337 on 23 December, the driver had 17.7 hours off duty at the barracks in Merredin before starting work at 2120 for a second consecutive night shift that evening. The driver’s partner recalled that the driver had indicated that Merredin was one of their preferred barracks’ locations. In addition:
One Pacific National driver advised that the barracks in Merredin were well appointed, as they had good light and temperature control and the beds were comfortable.
Another Pacific National driver advised that, at the same time that the driver of 7MP5 was at Merredin barracks, things were normal with nothing unusual in the barracks that would have made sleeping difficult.
The driver’s mobile phone records showed that they used their mobile phone many times during the off-duty period at Merredin. After the driver finished work on the morning of 23 December, the first recorded phone use was a text message sent by the driver at 0844. Assuming a minimum 45‑minute period to begin sleeping after finishing work at 0337, this indicates that the driver had a sleeping opportunity of about 4.3 hours. The actual sleep obtained may have been less, as it is unknown for how long the driver was awake before commencing sleep or before sending the text message.
After this time, mobile phone records showed the driver was awake at times including 0910, 1030, 1150, 1240, 1300, 1330, 1410, 1610, 1840 and 2000 (with relatively constant use from 2000 until they commenced duty at 2120).[51] Phone calls at 1300 and 2000 were probably work related, and the other phone use was probably non-work related. There was no record of the driver visiting internet pages, nor any outgoing phone call or text message from the driver’s mobile phone, after 2200 on 23 December.[52]
The ATSB considered the likelihood that the driver obtained some sleep during the afternoon of 23 December. Recorded information showed the driver’s mobile phone use ceased for about 2 hours during 2 separate periods (commencing at 1410 and 1610), and it is possible the driver obtained sleep during 1 or more of these periods or at other stages with smaller breaks between recorded phone use. There was no evidence available to determine the extent of any actual sleep obtained during these periods.
The ATSB notes that the types of mobile phone activity detected at 1610, 1840 and 2000 were self-initiated (accessing email, sending a text message and making a phone call), which indicates that the driver had been awake for a time before using the phone.[53] Additionally, if the driver attempted to nap after being awake at 1610, 1840 and 2000, this would have been at a time of day when most people have the lowest propensity to sleep (Bes and others 2009).
In summary, the sleep on the morning of 23 December was significantly shorter than was normal for the driver during non-work periods. The ATSB could not establish to the required level of certainty whether the driver napped on the afternoon of 23 December. Any naps that were achieved were probably of less restorative value than night-time sleep. If the driver did not achieve any rest during the napping opportunities, then at the time of the accident they would have been awake for over 17 hours, having slept no more than about 4 hours in the previous 24 hours.
Events prior to departure from Merredin on 23 December 2019
At about 2000, the driver involved in this accident called the Pacific National Integrated Planning Services (IPS). At this time, phone voice recordings at the IPS logged that the driver asked if their assigned train (7SP5) was on time (with their duty period scheduled to commenced at 2120). The IPS operator advised that they had an estimate of 2259, noting that the IPS operator with a more accurate update was busy on another call. The driver acknowledged this advice, laughing and remarking that ‘at least’ the train was arriving the same day. The driver requested a half-hour warning call from IPS before the start of their shift.
Shortly after, at about 2004, the IPS operator called the driver back and advised that 7SP5 was ‘really late’, and that 7MP5, retaining the same rostered start time of 2120, had been allocated to the driver instead. The driver, without providing any reason, advised that they were happy to wait for the originally scheduled train (7SP5). The IPS operator explained that there were no other drivers available, with the only thing changing for the driver being the train number, not their rostered start time. The IPS operator asked if this was ‘okay’, and the driver (without giving any reason) replied’not really, but anyhow I’ll take it’.
Train 7MP5 had stopped at West Merredin platform at about 2057. In preparation for the driver change with the incoming driver, the driver commenced their rostered shift at 2120 and proceeded to the eastern end of the West Merredin platform (Figure 1). At about 2200, the driver called IPS, likely in a location that they could not see the train, reporting that they had been waiting for 40 minutes for 7MP5 and questioned why they had been booked on so early for it. The IPS operator confirmed that 7MP5 was waiting at West Merredin. At this time, the driver realised and advised the IPS operator that they must have missed the arrival of the train.
The ATSB considered a plausible explanation for the driver’s conduct when interacting with IPS was that they wanted additional rest time ahead of the journey to Perth. There was also a small remunerative benefit for additional time in barracks for the driver. Ultimately, the ATSB was unable to determine the reasons for the driver’s conduct when interacting with IPS. The driver did not report any reasons for their concerns to the IPS operator or provide clear advice that they were not fit to commence work at 2200.
Fatigue risk management
Pacific National fatigue risk management program
Pacific National managed its fatigue related risks using a fatigue risk management program, as required by the Rail Safety National Law (WA). The Pacific National Fatigue Risk Management Standard stated that the operator used a ‘risk-based approach’ for managing fatigue risk. The standard described the overall structure of Pacific National’s fatigue management as comprising:
health assessments to ensure workers were fit for their assigned tasks
rostering rules and scheduling practices that sought to reduce the potential for fatigue (which included the use of a biomathematical model of fatigue or BMMF when designing rosters and varying existing rosters)
fatigue self-reporting practices such that workers would self-report if they felt fatigued
recording and investigation of fatigue events, and continuous improvement of fatigue management systems.
The Pacific National Fatigue Risk Management Standard specified that each work area must develop a fatigue risk profile that identified relevant fatigue hazards and applicable controls. At the time of the accident, there was no fatigue risk profile applicable to the intermodal freight operations in Western Australia.
Rostering practices at Pacific National
The operator maintained a master roster that described the general structure of expected shifts for a work group. Working rosters were developed at least 9 days before the start of each working week, and described the actual shifts each driver was expected to work.
Train driver rosters were developed to ensure rosters complied with rules in the relevant enterprise agreement (EA), as well as rules designed to reduce fatigue risk. The EA applicable to drivers at the Perth depot was the Pacific National Intermodal Train Crew Enterprise Agreement 2017.
Rostering rules within the EA included:
a limit of 9 hours for driver only shifts, with a 12-hour maximum for all shifts
a minimum of 12 hours between shifts while resting at home, which could be reduced to 11 hours with consultation
a minimum of 10 hours between shifts when away from home for driver only operations (DOO) (whereas for multi-rail traffic crewed operations the minimum rest between shifts at a rest location was 10 hours after shifts terminating between 0400 and 2200, and 8 hours after shifts terminating at other times)
a maximum of 11 consecutive shifts, inclusive of sick days (after which train crew were required to take a rest day)
non-peak[54] master rosters were to average 38 hours and peak master rosters were to average 40 hours per week.
The EA provided additional rostering requirements for DOO, stating that, where possible, driver only shifts should include:
shift start times held constant over a run of consecutive shifts
shift start times which move in a forward direction
other work types to break up sequential driver only shifts.
Pacific National advised in correspondence to the ATSB that the following rules were also used when developing rosters:
Master rosters were developed to achieve an average of 2 RDOs per week. Working rosters were developed to achieve an average of 2 RDOs per week, and labour planners would conduct a weekly count of RDOs.
The roster would group like shifts together to enable consistent workflow rather than alternating from days to nights then to afternoons.
Pacific National used the FAID BMMF during roster development. This is described in more detail in Pacific National use of Biomathematical Models of Fatigue.
Provision and use of rest breaks
The EA provided an entitlement for drivers to take a 30-minute paid meal/rest break between the third and fifth hour of a DOO journey. Pacific National training material further stated that:
The [personal needs break] will help the driver remain more alert and reduce the possibility of an incident due to fatigue.
The DOO driver should arrange the location and time of the [personal needs break] with the Network Controller prior to departure where possible; to allow the Network Controller to plan other movements around the DOO train to reduce delays to other services. Where it is not possible to arrange the [personal needs break] prior to departure, the DOO driver and the Network Controller should both agree on the location and time of the [personal needs break] as early as possible. DOO drivers are entitled to additional breaks where they find it necessary, such as a toilet break.
There was no evidence that the driver of 7MP5 attempted to arrange a rest break with the Arc infrastructure NCO. The accident occurred in the fourth hour of the driver’s shift and, had the accident not occurred, the train could have arrived at Perth prior to or shortly after the fifth hour of the driver’s shift.
One Pacific National driver who conducted DOO told the ATSB that, although drivers were entitled to a rest break during a shift, they did not know of any drivers who did so. This driver said this was partly because shifts were often not long enough to take breaks, and also partly because of perceived pressure not to inconvenience network control. The driver identified that shift scheduling, and hence the start time of the oncoming driver at the next shift change, did not incorporate the timing of a rest break. The driver also stated that, if required, a driver could contact network control at any stage to arrange a rest break.
Pacific National advised the ATSB that it did not collect records of driver utilisation of the rest provisions for DOO, and nor had the operator undertaken any reviews or audits of the utilisation of these breaks.
Start times worked by Pacific National drivers
The ATSB observed that the shifts worked by the driver of 7MP5 often included irregular start times. Another Pacific National driver also noted that there was little consistency in shift start times, and that the roster was often backwards rotating. That driver said that they were not able to develop a ‘genuine sleep pattern’ working under the roster. They highlighted an example involving a day shift, followed by a series of days off, followed by a night shift. They reported that they found it very difficult to sleep in to prepare for the night shift.
The ATSB obtained the rosters worked by all 30 drivers working from the Perth freight terminal between October and December 2019. The rosters showed that other drivers also occasionally worked shift patterns with irregular start times. For example, drivers worked the following patterns of start times:
The ATSB conducted a review of the available research literature dealing with irregular working rosters and their influence on fatigue, summarised in Appendix C – Research on irregular roster patterns and fatigue risk. In summary, there is insufficient research on irregular working patterns to determine if they cause an increased risk of fatigue compared to other shift patterns such as consistent night shifts.
Fatigue events and fatigue assessments
The Pacific National Fatigue Risk Management Standard required workers to always present to work in a fit and rested manner, and report to their manager any instances of feeling tired or fatigued before, during or after work. The standard also required that managers investigate and record all fatigue reports, and update fatigue risk controls as necessary.
A total of 15 fatigue events were self-reported by Pacific National employees in the 5-year period prior to the 24 December 2019 accident involving 7MP5. None of these reports were from Western Australia operations, and none related to the driver of 7MP5.
Pacific National also used a Safe Worker Assessment Tool (SWAT) to conduct a structured assessment of drivers who may be experiencing fatigue. Procedures required that a SWAT be completed whenever a worker:
exceeded a FAID threshold [see Use of FAID threshold values]
exceeded hours of work limits
felt fatigued, or if supervisors or co-workers were concerned about the worker’s fatigue
was driving a Pacific National light vehicle fitted with drowsiness detection technology system[55] and the system detected a distraction or drowsiness event.
The SWAT procedure used a traffic-light style assessment of fatigue risks and symptoms. Table 7 shows the categories used to assess fatigue risk in this tool.
Table 7: Safe worker assessment tool questions and categories
Question/Category
AMBER fatigue risk
RED fatigue risk
FAID score
80-99
>99
Perceived fatigue
Feeling okay, less than fresh, a little tired
Feeling tired or drowsy, difficult to concentrate, having trouble staying awake
Sleep in previous 24 hours
Slept but did not obtain their ideal amount of sleep
Did not sleep
Sleep quality (previous 24 hours)
Average
Poor
Signs and symptoms of fatigue
1 or 2 minor symptoms
Some symptoms. Can include microsleeps or a recorded drowsiness event detected by in‑vehicle monitoring technology
Source: ATSB, based on Pacific National procedural documents
The procedures specified that main line train drivers who returned any red fatigue risks could not drive a vehicle or operate a train alone.
Other than SWAT assessments when rostering limits were exceeded, there was no requirement for rostering personnel to ask about a driver’s alertness or sleep, or any requirement to check on a driver’s alertness during the course of train journeys.
There were no records of any SWAT reports associated with the driver of 7MP5. There were 47 SWAT reports provided by Pacific National applicable to operations between Kalgoorlie and Perth from December 2017 and 2019. All of these 47 SWAT reports were related to the assessment of potential distraction[56] or drowsiness[57] events identified by Pacific National’s light vehicle (car) drowsiness detection technology system.
Pacific National reported that it had not conducted any reviews of the effectiveness of its fatigue self-reporting system, such as surveys of train drivers about their willingness to self-disclose if they felt tired.
Fatigue training and education
Pacific National had established training for workers engaged in shiftwork to support their ability to identify and manage fatigue. Objectives of this training included instruction on the causes of fatigue, fatigue symptoms, the consequences of fatigue on safety, and the implementation of fatigue management strategies in line with Pacific National’s policy.
Information presented in the training included that:
Employees were expected to prepare and recover from shifts, and to manage non-work related tasks to minimise fatigue.
Adequate sleep quantity and quality was required for safe working, and that a sleep loss of 1 to 2 hours in a single night typically caused impaired performance and alertness. The training did not identify how much sleep was typically required.
Workers had a responsibility to monitor fatigue at work, and to report fatigue events. The training included some guidance about self-reporting fatigue events, encouraging participants to self-report being tired to their supervisor. The training said that after a self-report a SWAT assessment would be conducted before any further work was undertaken, and that additional controls or restrictions may be applied to manage risk.
The driver of 7MP5 completed the fatigue training a few weeks before the accident, and achieved a score of 100%.
Pacific National use of biomathematical models of fatigue
Overview of models
A biomathematical model of fatigue (BMMF) uses mathematical algorithms to predict the effect of different patterns of work on measures such as subjective fatigue or sleep. Different BMMFs make different assumptions about sleep and fatigue and use different inputs and produce different outputs to provide a fatigue measure. Each available model has different limitations in its use. In particular, the models are based on group-averaged data, and it is widely agreed that the models are not well suited for predicting a specific individual’s level of fatigue. In addition, none of the models consider all of the factors that can influence fatigue. The models are designed to be one element of a system for evaluating and comparing work rosters (see Civil Aviation Safety Authority 2014, Dawson and others 2011, Gander and others 2011, Independent Transport Safety Regulator 2010).
Pacific National used the FAID[58] BMMF to conduct assessments of rosters. FAID uses hours of work (start time and end time) as its inputs, and produces a score based on an algorithm that considers the effects of the length of the duty periods, time of day of the duty periods and the amount of work over the previous 7 days (Roach and others 2004). The more recent the duty period, the more effect the duty period has on the resulting score. The higher the score then the higher the potential for fatigue.
The developers of FAID stated that the model ‘assigns a recovery value to time away from work based on the amount of sleep that is likely to be obtained in non-work periods, depending on their length and the time of day that they occur’ (Roach and others 2004). Dawson and colleagues (2011) noted that FAID does not predict fatigue per se but rather predicts a sleep opportunity, demonstrating only that the organisation has provided employees with an adequate opportunity to sleep, producing a work-related fatigue (FAID) score.
FAID user documentation stated that a 5-day work schedule of shifts from:
0900–1700 produced a FAID score of 41
0600–1600 produced a FAID score of 79
2300–0700 produced a FAID score of 97.
Describing the level of performance impairment associated with high FAID scores, FAID user documentation stated that:
A study by Dawson and Reid indicates that FAID scores between 80 and 100 (high fatigue likelihood) are comparable to the level of fatigue-related impairment after 21-24 hours of continuous sleep deprivation (Dawson & Reid, 1997). This result was observed when the sleep deprivation started at 8 a.m. on a Monday, following a standard working week and weekend break.
In addition, FAID user documentation stated scores of 40–80 were broadly consistent with a safe system of work. However, the threshold for deciding the acceptability of a roster needed to be set by the operator based on a fatigue hazard assessment, taking into account the fatigue-related hazards specific to the role or task, and determining the acceptable level of fatigue tolerance for that role or task. Without this assessment, the FAID program defaulted to a fatigue tolerance level of 80.
Pacific National use of FAID
The Pacific National rostering system calculated the FAID scores for each shift, and provided an updated FAID score for new future shifts when shifts were added or varied. The FAID score allocated to each shift was the peak FAID score for the shift. The system included a highlighting function that indicated to rostering personnel when FAID scores exceeded programmed thresholds, or when other criteria were breached. Pacific National advised the ATSB the following FAID thresholds were applicable:
DOO main line operations had a soft limit of 60 and a hard limit of 80.
DOO terminal operations had a soft limit of 70 and a hard limit of 80.
Multi-rail traffic crewed operations had a soft limit of 80 and a hard limit of 100.
There were no documented procedures that described how rostering personnel used and interpreted FAID scores. Pacific National advised the ATSB that if a planned shift exceeded a soft limit, then rostering personnel would also consider the impacts of late running and extended shifts, and rostering personnel would not schedule a shift that breached hard fatigue limits. Pacific National stated that, in practice, rostering personnel were unlikely to identify a fatigue-related problem with a planned shift unless a FAID threshold was exceeded.
The driver of 7MP5’s FAID scores for the 10 days prior to the 24 December accident included a highest peak FAID score of 68 on 20 December. The predicted peak FAID score for the night of the accident was 56 at about 0420.
Pacific National provided the ATSB with records from 1 October to 28 December 2019 of the actual hours worked by all the drivers at the Perth depot, and the associated FAID score for each shift. Table 8 shows the distribution of FAID scores for relevant shifts, according to the threshold values described by Pacific National.
The maximum FAID score was 95 for all shifts. The maximum DOO FAID score was 86. The ATSB did not establish the circumstances of this exceedance of the DOO FAID threshold, with possible reasons including shift extension due to unplanned or emergency events. The FAID exceedance was not related to the driver of 7MP5.
Table 8: Summary of FAID peak score distributions by number of shifts during October to December 2019
Multi-rail crewed, main line (n=240)
DOO, main line (n=428)
Shunting [1] (n=293)
FAID > 80
16 (6.7%)
1 (0.2%)
7 (2.4%)
FAID > 70
40 (16.7%)
13 (3.0%)
35 (11.9%)
FAID > 60
89 (37.1%)
69 (16.1%)
79 (30.0%)
[1] Shunting is the movement of trains or rail vehicles within rail yards and terminals for the purpose of marshalling trains or altering their consist. Pacific National records did not indicate the crew composition of shunting shifts. ATSB investigator experience is that shunting operations are typically conducted with 1 driver in the train.
Development and review of FAID threshold values
In late 2013 the ATSB published an investigation into a multiple SPAD event at Hurlstone Park, New South Wales, on 30 January 2013, involving a Pacific National bulk service using 2-driver crew.[59] The investigation identified the following safety issue:
Pacific National's fatigue management system is over-reliant on the use of a bio-mathematical model to predict individual fatigue risk, being based principally on rostered work hours without due consideration to higher level fatigue risk management strategies.[60]
The report also stated:
An organisation using FAID to assess its fatigue risk must first conduct a fatigue hazard assessment, taking into account the fatigue-related hazards specific to the role or task, and determining the acceptable level of fatigue tolerance for that role or task. Without this assessment, the FAID program defaults to a Fatigue Tolerance Level (FTL) of 80. When using the default FTL of 80, scores between 70 and 80 would be considered to be in the FAID Yellow Condition, and scores over 80 would be considered to be in the FAID Red Condition. Pacific National was unable to produce evidence of having conducted such a fatigue hazard assessment for driver, trainee driver or trainer driver roles. Further, based on available evidence, Pacific National’s analysis of the suitability of the rosters appeared to rely solely on the FAID score…
In response to the safety issue, the rolling stock operator advised at that time:
Pacific National is in the process of releasing an updated Fatigue Management Standard to meet the requirements of Regulation 29 of the National Law. Pacific National Bulk rail will consider the appropriate use of these bio-mathematical tools as part of the fatigue risk management review process.
The ATSB acknowledges that Pacific National undertook work to improve its fatigue management processes since 2013. However, with regard to the determination of FAID threshold scores, Pacific National advised the ATSB during the Jumperkine investigation that there were no records showing how the threshold values utilised for assessing its rail traffic crew rosters were set, and nor were there any records of reviews or studies validating the thresholds.
The use of FAID scores of 80 and 100 as thresholds for evaluating rosters is a common practice within the rail industry, and has previously been described in other ATSB investigations.[61] Regarding the widespread adoption of ‘standard’ thresholds when using BMMFs, Dawson and others (2017) noted:
If we look at how ‘safe’ thresholds have been developed, we can see that they were introduced quite quickly into [Biomathematical Modelling] software tools as either in-built features, default settings or part of the user manual and guidance materials. Arguably, embedding these in the software or guidance materials resulted in an artificial reification of these thresholds. In practice, these thresholds were, at best ‘guesstimates…
…It is worth noting that the data sets on which these thresholds are based are often narrow in scope and of limited generalizability. Moreover, there has been little attempt to develop post-implementation surveillance of the appropriateness of thresholds within specific organizations…
Based on a decade of experience with [FAID] in Australia… we have observed that the initial benchmarking values adopted in one setting were often uncritically recommended by developers and vendors and adopted in other workplace settings and industries without reflection – especially by end-users and, to a limited extent, by some regulators. For example, initial ‘expert’ recommendations from the FAID developers to permit all working time arrangements under a score of FAID80 (for rail engineers in some state jurisdictions), FAID100 (for some rail engineers in other state jurisdictions…, were quickly adopted by other industries (and their regulators) with very little discussion of the very different risk ecologies associated with demonstrably different tasks, workplaces and risk profiles. Unfortunately, pre-existing thresholds based on ‘expert’ opinion – even when developed for other organizations or industries – often provided a greater degree of perceived legal defensibility for regulators and organizations than that afforded by de novo organizational risk assessments.
The ATSB notes that FAID scores (and the scores from any BMMF) need to be interpreted with caution. The Independent Transport Safety Regulator of New South Wales (2010) stated that, due to various factors associated with the model, ‘a FAID score of less than 80 does not mean that a work schedule is acceptable or that a person is not impaired at a level that could affect safety’. In addition, the US Federal Railroad Administration (2010) concluded that in some situations FAID scores between 70 and 80 can be associated with ‘extreme fatigue’.
Other contextual information relevant to fatigue
Underload and monotony
Although the task of freight train driving is complex and often demanding, it sometimes also involves long periods in which the driver is not called upon to significantly interact with the train controls. In such circumstances, the driver’s task can be categorised as monotonous and involving very low level of task demands (also called ‘underload’).
Extended periods of low task-demands can have a negative effect on vigilance and attention, leading to an increased safety risk. Research shows a disproportionate amount of fatigue-related road accidents occur on highways or other ‘low demand’ environments (Williamson and others, 2011). Simulated road research has shown that monotonous road conditions such as straight roads or repetitive roadside scenery are associated with more frequent dangerous driving behaviours (Tiffault and Beregon 2003). As summarised by Larue and colleagues (2011):
A lack of visual, motor or cognitive stimuli can alter the ability to sustain vigilance. Drivers experience vigilance decrement[62] more frequently in monotonous environments, especially when driving on highways at night…Monotony related crashes occur mainly on highways (predictable, straight lanes) at night. This can be explained by the fact that a hypovigilant driver is unable to react on time (or react at all) to critical events such as going off the road. This occurs rapidly and thirty minutes of monotonous driving has been shown to be enough to induce vigilance impairment.
Both performing a monotonous task and driving in a monotonous environment have consequences on the driver’s ability to drive. Indeed under such conditions the driver may quickly lose the motivation to perform the task and then become less vigilant. …Driving performance is most seriously affected by short episodes of sleep occurring when the individual tried to stay awake, episodes called microsleeps.[63] However, decrement in performance occurs during reduced level of vigilance without microsleeps…
Monotonous driving conditions have been found to increase fatigue risk, independent of the effect of sleep restrictions, and similar results have been shown for laboratory visual tracking tasks. Interventions that target monotony by increasing arousal have been shown to reduce the effects of fatigue (Williamson and others 2011).
When drivers are fatigued, they will have even greater difficulty maintaining attention and alertness in low demand situations, and will respond more slowly to hazards, with one researcher arguing that the vigilance decrement is the strongest effect of fatigue (Dinges 1995). A fatigued driver will have a lower baseline level of attention and vigilance performance, and will therefore be more vulnerable to the effects of monotony.
Summarising the effects of monotony and underload on train driving, the Transportation Safety Board of Canada[64] stated:
• Low-workload and monotonous tasks can lead to increases in feelings of sleepiness and tiredness, as this reduces the individual's arousal levels. In particular, long periods with minimal control inputs can lead to passive fatigue. If an individual is already fatigued, low workload with minimal inputs could exacerbate the perception of that fatigue.
• Reductions in workload and arousal levels may lead to corresponding reductions in vigilance. Vigilance is associated with states of sufficient alertness to monitor the environment effectively, with a particular emphasis on scanning for potentially dangerous stimuli.
Workload associated with the operation of 7MP5
In the direction that 7MP5 approached Jumperkine, the track had a mostly down gradient, varying in slope between 1 in 3,875 and 1 in 210, with multiple left and right curves varying in radius between 400 m and 3,460 m. An experienced driver over this section of track explained that, depending on the length and weight of a train, these curves could have a slowing effect on some trains (that is, counteracting against the down gradient). This driver added that, if the signals were green, a driver operating on this section would not be busy, perhaps with the throttle in idle or, if needed, small durations of throttle or dynamic brake to manage the train’s speed when required. This driver said that they tended to ‘relax a bit’ through this section if they were encountering green signals.
Early in the 7MP5 driver’s shift, the driver encountered some restricted signals when undertaking crossing movements with opposing trains at Doodlakine, Bungulla and Tammin (Figure 1). After the last crossing movement at Tammin (at about 2341), 7MP5 travelled for over 2 hours and about 158 km past 33 consecutive unrestricted green signals until reaching the restricted yellow and red signals protecting 2K66 at Jumperkine (Figure 18).
Figure 18: Train 7MP5 signal aspects between West Merredin and Jumperkine
The image shows a graph of the signal aspects* likely encountered by 7MP5 between West Merredin and Jumperkine, versus time at track kilometrage. Note* Signal aspects between Merredin and Cunderdin are estimated based on TCS data and expected signal system behaviour. Signal aspects between Cunderdin and Jumperkine were confirmed from forward-facing camera footage from 7MP5.
Source: ATSB
Information from 7MP5’s locomotive event recorder (Figure 19) showed that, at about 0152:54, the driver moved the throttle to idle to manage the train’s speed with reference to the track limit speed of 80 km/h. After the throttle was moved to idle, the train speed was somewhat constant, although did slow slightly approaching Jumperkine. The recorded locomotive driver control changes after the throttle was moved to idle were limited to the operation of the vigilance acknowledgement pushbutton, with most of these actions occurring after an audible alert (see also Train 7MP5 driver vigilance inputs section).[65]
Figure 19: Train 7MP5 lead locomotive NR80 event recorder data from 0151 until 0201
The image shows a sample of the recorded event data from the lead locomotive (NR80) of 7MP5. The data shows that at 0152 the driver moved the throttle to idle, after this point until passing signal 12L at Jumperkine, the driver’s tasks were limited to acknowledging the vigilance system alerts.
Source: Pacific National data, graphed and annotated by the ATSB
In summary, the driver of 7MP5 encountered predominantly unrestricted green signals and, in the closing minutes of their journey, the driver’s task demands for control inputs lowered. This situation was consistent with advice from another driver experienced on this section of track.
Other train driver actions approaching Jumperkine
Train 7MP5 passed signal U45 approaching Jumperkine while that signal was displaying a caution (yellow) aspect. The caution aspect displayed by signal U45 should have informed the driver that the next signal, signal 12L (4,197 m past signal U45), was at stop, and that the train was required to be managed so that it could be stopped prior to this signal. Accordingly, the driver should have commenced slowing the train significantly in advance of signal 12L. However, the train remained at about the track limit speed (80 km/h) approaching and passing the signal.
Additionally, about 1,430 m after passing signal U45, 7MP5 passed a temporary speed restriction (TSR) ahead sign warning of a 30 km/h speed restriction ahead. This should have reminded the driver that there was a TSR ahead that the train needed to be prepared for. The location of the TSR (about 100 m past signal 12 L) was such that the driver needed to start slowing the train a significant distance before reaching signal 12L.
The driver had successfully slowed the train to comply with a 20 km/h TSR at Moondyne, returning the train to normal track speed (80 km/h) at about 0145. In comparison with the driver’s actions in relation to the TSR at Moondyne, the driver could have been expected to have commenced slowing their train at Jumperkine at about 1,800 m past signal U45. The driver did not make any attempt to stop or slow 7MP5 between signals U45 and 12L. The only recorded interactions between the driver and the locomotive controls during this time was the acknowledgement of vigilance system alerts via the driver’s vigilance acknowledgement pushbutton.
Effects of fatigue on train driver performance
Fatigue impairs the ability to perform simple and complex tasks. An extensive body of research has shown that fatigue negatively affects decision making, reaction time, memory, and information processing (see Lim and Dinges, 2010). A review by Williamson and colleagues (2011) summarised that, in transport and other operational contexts, sleep loss leads to impaired performance and accidents.
Research has noted that in railway operations, fatigue is associated with performance impairment such as slowed reaction time to safety alarms (Hildebrandt and others 1974) and reduced conformance with operating requirements, including heavy brake applications and maximum speed exceedances (Dorrian and others 2007). Fatigue has been identified as a contributing factor to numerous major rail accidents, and fatigue has been shown to significantly increase the likelihood of a human-factors rail accident (Raslear and others 2013, Rudin-Brown and others 2019).
Karrer and colleagues (2005) describe the phenomenon of ‘driving without awareness’, where a driver remains seated upright with eyes open but is not attentive to the road environment and not able to react to hazardous situations. This phenomenon, which has also been described as ‘highway hypnosis’ and ‘driving without attention mode’, has been attributed to conditions including underlying fatigue, the monotony of the driving task, and the automatization of driving due to highly practiced or highly predictable road conditions.
Some researchers describe this phenomenon as a precursor event to falling asleep, and as a ‘drowsy interval between waking and sleeping’ (Briest and others 2006). Briest and others used video analysis techniques to identify instances of driving without awareness, and observed that this often preceded or accompanied subjects experiencing microsleep events, and that driving without awareness was associated with fatigue-related changes in blinking behaviour. An alternative explanation for driving without awareness is that the phenomenon reflects a state where the driving task becomes highly automated and attention is not allocated to the road environment. These explanations cite the common experience of reaching a familiar destination and having no recollection of the drive (Charlton and Starkey 2011).
Pacific National driver only operations and SPAD risk controls
Application of driver only operations
The traditional rail traffic crew composition for freight trains is 2 people, with a primary driver mainly responsible for operating locomotive controls and another person (commonly a driver but sometimes another qualified person) responsible for cross-calling[66] signals as well as other support duties.
Driver only operations (DOO) involve the use of only one train driver. The implication is that the tasks otherwise conducted by, or shared with, the second person must either be performed by the primary driver or not performed at all. Therefore, supporting and reminding tasks, such as cross‑calling signals, are no longer possible.
Pacific National has operated main line DOO services between Kalgoorlie and Perth since 2003, and it also operated DOO services in Queensland and South Australia. The ATSB requested details of the risk assessment and change management documentation conducted prior to the commencement of DOO services between Kalgoorlie and Perth. However Pacific National advised that, due to the time elapsed since commencing these operations, no records could be found.
Appendix D – Additional contextual information about Driver only operations provides additional information about research and statistics of the safety of DOO.
Driver only operations SPAD prevention controls
The Pacific National main line risk assessment described the risk controls used in the Pacific National safety management system. This included the risk controls applied to manage the hazards of collision or derailment due to an overrun of limits of authority (with a SPAD being one type of overrun of limit of authority). A sub-table in the risk assessment described the additional risk controls for the same hazards for DOO. Table 9 shows the ‘hazard/risk causes’ for collisions and derailment due to overrun of limits of authority identified by Pacific National, and their associated risk controls.
Table 9: Pacific National overrun of limits of authority (SPAD) risk controls
Hazard
Risk controls
Additional DOO controls
Driver performance compromised by fatigue, drug and alcohol, or medical condition
Vigilance system
Health assessments
Drug and alcohol testing
FAID (threshold 100)
Rostering rules
Suitable barracks
Shorter vigilance cycle
Lower FAID threshold (80)
Greater minimum break times
Extended time driving train compromises performance because of the required high concentration
Rostering rules
Driver rotation
Shift limits when working with trainee drivers
Shorter maximum shift times. 30-minute break between third and fifth hour
Driver has insufficient knowledge to identify end of authority
Route certification
Competency assessment
Network signal system
Network rules
Automatic train protection (Queensland only)
Driver does not take appropriate action to comply with network rules and PN procedures
Competency assessment
Incident investigation
Performance management
Data logger downloads and review
Driver is distracted by other activities
SPAD management procedures
Defensive driving strategies
Competency assessments
Incident investigation
Performance management
Source: ATSB, based on Pacific National risk management documents
As shown in the table, the Pacific National risk register for DOO identified additional hazards associated with the train driver having their performance compromised (including due to fatigue) and specified additional risk control measures, including a shorter vigilance system alert cycle, amended rostering rules, and a lower FAID threshold.
Pacific National procedures for managing the risk of SPAD were described in its SPAD Prevention Management Standard, which stated (among other requirements) that all rail traffic crew were responsible for:
• active identification of all signal aspects and cross calling all signals regularly and routinely
• ensuring that each person involved in the safe operation of the train has recognised and understood the signal aspects.
The Pacific National SPAD Commandments procedure stated that one of the ‘hard and fast rules’ for reducing SPAD risk was ‘Call and Cross call ALL signals’.
Neither the Pacific National SPAD Commandments nor the SPAD Prevention Management procedures made specific mention of DOO. The Pacific National briefing package for DOO stated that, consistent with the procedural requirements for other operations, DOO drivers were required to call the aspect of all signals en route. The document further stated:
Although there may not be any other person in the locomotive cab, it is strongly recommended that a DOO driver verbally acknowledge a signal to provide an active recognition that the signal has been sighted, and its meaning is clearly understood.
The DOO risk controls (in the main line risk assessment for overruns of limit of authority) did not explicitly consider the hazards associated with the reliance on the single driver for observing and complying with signals for main line DOO operations.
The investigation was not able to establish whether the driver of 7MP5 was verbally calling out signals on the day of the accident (or would normally call out signals while conducting DOO).
Safety performance of driver only operations
In November 2017, Pacific National produced a statistical report titled ‘Safety and Train Performance Review’ that examined the safety performance of Pacific National DOO and multi-rail traffic crewed train services between January 2015 and July 2017. The report compared the safety records of DOO against multi-rail traffic crewed operations on various types of occurrences, and concluded there was no evidence to suggest that DOO had more safety-related occurrences.
One of the types of occurrences examined was SPADs due to driver error. In correspondence to the ATSB, Pacific National identified that 4 SPAD events that had been identified as multi-rail traffic crew in its initial analysis were in fact DOO. Pacific National was unable to determine the crew configuration of 3 additional SPADs. As such, the analysis presented in the Pacific National review document underestimated the SPAD rate of DOO and overestimated the rate for multi-rail traffic crew services. When the data was corrected, it indicated that the SPAD rate for DOO was almost twice the rate for multi-rail-traffic crewed operations (Table 10).
Table 10: DOO and multi-rail traffic crew SPAD rate comparison[67],[68]
Type of operation
SPADs
Million km
SPAD per million km
DOO – Western Australia and South Australia
6
1.6
3.8
Multi-crew – Western Australia and South Australia
11
14.9
0.7
Multi-crew – Australia excluding Queensland
101
49.7
2.0
Source: ATSB, based on information provided by Pacific National
Additional statistical analysis conducted by the ATSB using the revised SPAD events showed that the SPAD rate for DOO in Western Australia and South Australia was significantly[69] greater than the rate for multi-rail traffic crew operations in those states. The difference in SPAD rates for DOO in Western Australia and South Australia compared to multi-rail traffic crewed operations in all mainland states except Queensland was not statistically significant, probably due to the small sample for DOO.
The rail infrastructure manager, Arc Infrastructure, in respect to DOO train services undertaken on its network, did have processes for when DOO drivers exited the cab of their locomotive / train. However, Arc Infrastructure did not identify any changed or additional risks to the safety of its network, or make any specific requirements of its customers, with respect to DOO train services operating on its network.
Related occurrences
Overview of running line collisions
The Office of the National Rail Safety Regulator (ONRSR) Rail Safety Report publicationbetween 2015[70] and 2020reported the following instances of running line collisions within Australia (Table 10). These running line collision statistics include track maintenance vehicle collisions and light rail vehicles/trams, as well as a series of collision contributors that were unrelated to the Jumperkine accident. To normalise this information with the events related to this accident, the ATSB reviewed the ONRSR rail safety report data and identified which of these running line collisions had a pre-cursor SPAD event, and which ones were directly related to heavy rail operations like that involved in this accident (Table 11). As evidenced in the table, there were no other such collisions during the period from July 2015 through to June 2020.
Table 11: ONRSR reported running line collisions between trains and rolling stock
Year
Running line collisions
Heavy rail collisions[1]
Collisions involving SPADs[2]
2015 – 2016
6
3
0
2016 – 2017
4
2
0
2017 – 2018
6
4
0
2018 – 2019
4
3
0
2019 – 2020
4
3
1[3]
Source: ONRSR Rail Safety Report, and the ATSB.
[1] ONRSR running line collisions excluding collisions involving light rail vehicles / trams, road rail vehicles, and track maintenance vehicles. [2] Heavy rail collisions which included pre-cursor signals passed at danger events. [3] Relates to the accident at Jumperkine.
ONRSR normalised its running line collision statistics with the kilometres travelled in Australia. This analysis reported that there had been a downward trend, with overall collision rates dropping from about 0.04 per million train kilometres in 2015 to less than 0.02 per million train kilometres in 2020.
The ATSB reviewed Australia wide ATSB investigation reports between 1997 and 2019 as well as Pacific National and Arc Infrastructure Western Australia based investigation reports between 2015 and 2019. This review sought to identify investigations into other completely missed SPADs, as well as main line near misses and collisions involving rolling stock. Due to the extent of this sample, the review filtered investigations that identified similar safety factors and themes to the Jumperkine accident. The occurrences are discussed under the following sections:
collisions without a pre-cursor SPAD
collisions with a pre-cursor SPAD
SPADs on the Arc Infrastructure network
other potentially related SPADs without a collision.
Collisions without a pre-cursor SPAD
The ATSB identified 2 investigations for this category, which relate to 2 train-to-train collisions occurring in South Australia and New South Wales. These investigations were undertaken by the ATSB.
Yass Junction, New South Wales on 9 December 2010[71]
At about 0153 on 9 December 2010, bulk grain train 3234N passed signal YJ20 at the western end of Yass Junction, New South Wales. The signal was displaying a 'Calling on/Low speed’ aspect.[72] Train 3234N proceeded at low speed, but subsequently collided with the rear end of another bulk grain train 8922N, which was stationary on the main line.
The ATSB found that the driver of 3234N, on receiving a ‘Calling on/Low speed’ signal aspect, proceeded at a speed greater than the required speed to enable the train to stop, ‘within half the distance of clear line that is visible ahead’, as prescribed by the operational rules. The driver was aware that the operational rules stipulated that the ‘block ahead may be occupied or obstructed’ but did not expect that 8922N was stationary on the track so close ahead. As the driver of 3234N approached 8922N, a combination of track curvature, embankments and the effective illumination of the train’s headlight initially obscured their view of the stopped train. When the driver finally saw the rear of 8922N, they immediately made an emergency brake application, but was unable to stop the train before it collided with 8922N.
The ATSB found that the speed of the train (being too fast for the prevailing conditions), was the primary factor in the Yass Junction collision. In addition, even though NCOs were not required to provide ‘close quarters’ information, the driver had expected to be told by the NCO if a train was stopped ahead (likely influenced by previous experiences where this information had been provided).
At about 0730 on 31 March 2015, intermodal freight train 2MP9 passed No. 1 signal at the southern end of the Mile End crossing loop (South Australia). The signal was displaying a 'Calling on/Low speed’ aspect. Train 2MP9 proceeded at low speed, but subsequently collided with the rear end of intermodal freight train 2MP1, which was stationary on the main line.
The ATSB found that the driver of 2MP9, on receiving a ‘Calling on/Low speed’ signal aspect, proceeded at a speed not greater than 25 km/h, but was unable to stop the train ‘within half the distance the line ahead was clear’, as prescribed by the operational rules. The driver was aware that the operational rules stipulated that the ‘block ahead may be occupied or obstructed’ but did not expect that 2MP1 was stationary on the track so close ahead. As the driver approached 2MP1, some stumpy vegetation and a low fence initially obscured their view of the empty flat wagons at the rear of the train. When the driver finally saw the rear of 2MP1, they immediately made an emergency brake application, but was unable to stop the train before it collided with 2MP1.
The ATSB report included the following 2 safety issues:
The practice of pathing a following train onto a line occupied by a preceding train, when an alternate route was available and not obstructed, presented an elevated level of risk.
The practice of pathing a following train onto the same line occupied by a preceding train, without pre-warning the driver regarding the train ahead, presented an elevated level of risk.
In response to the safety issues, the rail infrastructure manager (Australian Rail Track Corporation) advised it would issue a notice to control centres advising ‘that when operationally possible maximum use of available and suitable infrastructure should be made available while optimising train running’.
Collisions with a pre-cursor SPAD
The ATSB identified 2 investigations for this category, which relate to 2 train-to-train collisions occurring in South Australia and New South Wales. These investigations were undertaken by the ATSB.
Beresfield, New South Wales on 23 October 1997[74]
On 23 October 1997, at 0632, coal train DR396 collided with the rear of another coal train (MT304). The collision occurred in clear conditions, adjacent to the western end of Beresfield railway station. Both of the rail traffic crew of DR396 were seriously injured, and there were injuries to 2 other people at the station. The 3 locomotives and first 10 coal wagons of DR396 were derailed, as were the 3 rear wagons of MT304. Wreckage blocked both coal roads and adjacent main lines. Beresfield station and associated structures also suffered extensive damage. Considerable disruption to passenger and freight operations resulted from the accident.
Train DR396 was on a journey from Port Waratah to Drayton, and the rail traffic crew reported that they observed clear (green) signals throughout this journey. At the time of the collision signal C113.0 was showing a caution indication and signal C112.2 was showing stop. Recorded data from DR396 showed no significant change to the progress of the train as it passed signals C113.0 and C112.2. Emergency braking was applied by the driver about 370 m prior to impact, consistent with first sighting the rear wagon of MT304. The predicted stopping distance required by DR396 was 579 m. There were no defences in place with the capability to warn the crew of DR396 of signals missed, or to arrest the progress of the train on passing a stop signal.
The investigation found the circumstances of the accident were consistent with the crew of DR396 not complying with caution and stop signal aspects protecting the stationary MT304. Reduced driver alertness, associated with work related fatigue, was found to be a significant factor in the events leading to the collision. The report noted that it was unlikely that the driver was asleep, but it was probable that that they were experiencing some form of reduced alertness such that they were able to perform simple or familiar tasks (such as operating the vigilance control) but were incapable of responding quickly to more critical tasks and situations.
This investigation also found that the locomotive vigilance system was ineffective in detecting reduced levels of alertness. It also found that the safe progress of the train relied on a system intolerant of human error, depending entirely on the rail traffic crew observing and correctly responding to track signal indications.
At approximately 0105 on 11 October 2011, empty ore train 1901S passed signal 13 displaying a stop aspect at Dry Creek Junction in South Australia. Train 1901S subsequently collided with loaded grain train 5132S, which was travelling in the opposite direction and traversing the turnout at Dry Creek Junction to enter the Dry Creek North Yard. The collision was at low speed and there was no injury to the train crew of either train. There was significant damage to the crew cab of the lead locomotive of 1901S and to the grain wagons of 5132S that were struck during the collision.
The ATSB determined that the SPAD of signal 13 was a result of the driver-in-training and co‑driver (supervising driver) of 1901S becoming distracted during the approach to the preceding signal, 135, which was displaying a caution aspect indicating that signal 13 ahead was at stop.
The investigation revealed that a combination of individual actions and systemic issues contributed to the collision. The driver’s limited route knowledge, combined with an expectation of a clear run through the area, probably influenced the driver not observing signal 135 at caution. The supervising driver was completing an administrative task that diverted their attention away from the primary task of supervising the actions of the driver-in-training.
While fatigue impairment was not considered a contributing factor in this occurrence, the process for assessing driver rosters for relay operations relied excessively on a score produced by a biomathematical model (FAID), and the operator had limited mechanisms in place to ensure drivers received an adequate quantity and quality of sleep during relay operations.
SPADs on the Arc Infrastructure network
Overview
Following the fatal accident at Jumperkine on 24 December 2019, Arc Infrastructure commissioned a review of its network SPAD data for 2010–2019. This review identified that there were 976 recorded SPADs during this period. Overall, 660 SPADs (68%) were attributable to rail infrastructure manager irregularities (including 535 where the signal restored as train approached), 260 (27%) attributable to rail traffic crew error, and 49 (5%) related to rolling stock movement (such as a rollback or shunting operations within rail operator yards). With reference to SPADs attributable to rail traffic crew error, recorded SPAD subtypes included:
11 driver completely missed (about 1.1 % of overall total of 976)[76]
220 driver misjudged (23% of overall total of 976)
29 (3%) limit of authority missed by train crew.[77]
The SPADs attributable to rail traffic crew error were distributed over 5 rail transport operators.
The review noted that the driver misjudged category was frequently used but for most of those SPADs the distance exceeded was not recorded. In addition, there were 12 driver misjudged SPADs where the exceedance distance was 50 to 500 m.
One of the conclusions of the review was that data associated with SPAD events was not systematically collected and analysed, limiting the ability of the review team to develop an accurate understanding of the rail infrastructure manager’s SPAD risk profile. The review also noted that there were ‘a number of significant SPADs’ attributable to rail traffic crew error where the driver had no intention of stopping until advised by the network control officer (NCO). Such SPADs included a SPAD in December 2016 (exceedance by about 1,650 m, involving another operator) and a SPAD in March 2017 (exceedance by 3,000 m, involving Pacific National at Darrine, discussed below). The review also noted another ‘serious incident’ SPAD event at Moondyne resulted in a train stopping about 120 m from the rear of another train (discussed below).
Moondyne, Western Australia, on 16 September 2016
At about 0546 on 16 September 2016, freight train 3MP5 passed signal 12L displaying a stop aspect at Moondyne, Western Australia. The train was operated by Pacific National as a driver only operation (DOO). The SPAD event was not investigated by the ATSB. The following information was obtained from the Pacific National investigation report (and other sources where noted).
Train 3MP5 was following another freight train (5426) on the route from Merredin to Perth. Train 3MP5 was brought to a stop at signal U66 (showing a stop aspect) as 5426 was being brought to a stop ahead. After about 13 minutes, when the rear of 5426 vacated the overlap of signal 12L, signal U66 changed to caution and 3MP5 departed towards signal 12L.
Approaching signal 12L, 3PM5 reached a maximum speed of about 58 km/h. About the time the driver sighted signal 12L displaying a stop aspect, the driver applied the emergency brake, and the train passed the signal at about 39 km/h. The train stopped about 160–180 m past the signal, which was about 100–120 m to the rear of 5426.
Given that the driver noticed the stop aspect and commenced braking prior to passing the signal, this event was a ‘driver misjudged’ SPAD rather than a completely missed SPAD.
The Pacific National report concluded that the ‘root cause’ of the event was the driver not complying with the operator’s SPAD Prevention Management Standard when operating the train in a safety-critical zone as it approached Moondyne. Other notable aspects in the report included:
The driver was originally scheduled to commence their shift at West Merredin at 2315 but this was subsequently rescheduled to 0135. The driver had 15 hours off duty at Merredin but reported that they had difficulties sleeping at the accommodation at West Merredin. They also reported that they felt tired and misjudged the location of the signal. The operator’s report concluded that there was insufficient evidence to conclude that the SPAD was due to fatigue.
There was fog in the Avon Valley prior to the SPAD, however there were no reports to the NCO regarding the fog. A review of the locomotive forward-facing camera footage showed signal 12L at Moondyne was visible from the cab of the locomotive at a distance of approximately 450 m.
The driver reported that they were not aware that they were following 5426 until after the SPAD and they came to a stop behind the stationary train ahead.
The rail infrastructure manager, Brookfield Rail, routinely queued trains one signal behind preceding trains. (The Brookfield Rail investigation report also noted that the rail infrastructure manager accepted that trains will occasionally have a SPAD but that there were built-in safety margins to mitigate the risk of collision as a result.)
Darrine, Western Australia, on 1 March 2017
At about 2206 on 1 March 2017, freight train 2SP7 passed signal 2L displaying a stop aspect at Darrine, Western Australia. The train was operated by Pacific National as a driver only operation (DOO). The SPAD event was not investigated by the ATSB. The following information was obtained from the Pacific National investigation report (and other sources where noted).
A speed restriction of 60 km/h was in place over signal 2L, and the train passed the signal at 48 km/h. At the time, the driver was conducting a roll-by inspection of another train (and therefore not looking for the signal aspect).
The driver was not aware they had passed signal 2L at stop until notified by the Arc Infrastructure NCO. The train was stopped about 2,800 m past the signal.
The investigation concluded that the ‘root cause’ was that the driver did not have the train under sufficient control when it entered the safety critical zone. The driver commenced their shift at 1910 and reported no issues with fatigue during the investigation.
Based on the available information received, the ATSB was not able to confirm the response time of the NCO to the SPAD alarm. The ATSB was able to confirm that the initial radio call to the driver was not an emergency call.
Beckwith, Western Australia on 14 August 2019
At about 0610 on 14 August 2019, freight train 3PM7 passed signal 2R displaying a stop aspect at Beckwith Loop, Western Australia. The train was operated by Pacific National as a driver only operation (DOO). The SPAD event was not investigated by the ATSB. The following information was obtained from the Pacific National investigation report (and other sources where noted).
The train passed the previous signal (D466) displaying a caution aspect at 95 km/h and then signal 2R at stop at 104 km/h. The driver was not aware they had passed signal 2R at stop until notified by the Arc Infrastructure NCO. Information from Arc Infrastructure indicated that the NCO contacted the driver 31 seconds after the SPAD (with no emergency call broadcast). The Pacific National report indicated that the NCO’s call prompted an emergency brake application. with train 3PM7 passing signal 2R by approximately 1,605 m. It was reported that train 3PM7 came to a stand about 895 m from the lead locomotive of stationary bulk ore train 3036.
The investigation concluded that the ‘root cause’ was that the driver of 3PM7 failed to adhere to defensive driving strategies to allow them to stop prior to passing signal 2R as a result of being unaware of their surroundings. The report also identified the following contributing factors:
The driver was in a state of sleep leading up to and during the SPAD event. The driver had about 35 hours free of duty at home (Merredin) before commencing the shift. The driver’s shift was scheduled to commence at 0055 and they were contacted by IPS at 2320 with a revised start time of 0230. They subsequently fell back to sleep and woke up at 0230. The driver reported that they had not rested well due to various factors. Soon after the SPAD, the driver reported to IPS that they ‘must have dozed off’.
The driver was able to acknowledge the locomotive vigilance system while being in a state of sleep. The driver acknowledged the vigilance system at least 8 times via vigilance acknowledgement pushbutton operation and throttle manipulation when both audible and visual alarms were active (50 to 60 second period) between Koolyanobbing East and Beckwith in Western Australia.
A number of safety recommendations were identified by Pacific National in relation to this investigation, including the consideration of some engineering controls related to locomotive‑based fatigue detection and vigilance systems. At the time of the Jumperkine accident (4 months later), Pacific National was progressing the accepted recommendations and actions.
Other potentially related SPADs without collision
The ATSB identified 4 other investigations with potential relevance to the current investigation, although the list was not intended to be exhaustive. The investigations included 3 completely missed SPADs (where a significant overrun past the signal or a very near miss had occurred) and 1 driver misjudged SPAD. The ATSB investigated occurrences were in Queensland and New South Wales.
Fisherman Islands, Queensland on 20 September 2004[78]
At about 0738 on 20 September 2004, 8868 was nearing the end of its journey from Rockhampton to the Brisbane port of Fisherman Islands when it passed signal FS66 showing a stop aspect. The passing of this signal at stop circumvented the initial phase of the level crossing protection and the train passed through the Pritchard Road level crossing before the boom gates were in the horizontal position. There were no injuries or damage as a result of this incident.
The driver noticed cars on the level crossing ahead and then noticed that signal 8868 was at stop when about 15 m from the signal and then applied emergency braking when at 48 km/h. The train stopped about 175 m past the signal (and 74 m beyond the level crossing). At that time, no SPAD alarm was provided to the relevant NCO for that signal. The area coordinator, who received a SPAD alarm, did not advise the driver or the NCO of the alarm.
The ATSB found that the driver of 8868 had a maximum of 4.5 hours sleep between shifts and was fatigued and probably experiencing microsleep episodes on the approach to signal FS66. The locomotive vigilance control system was ineffective in maintaining the driver’s vigilance. Additionally, it was found that there were no secondary protection measures to guard against such errors in a driver only operation.
At about 0750 on 11 March 2008, a Pacific National freight train 2WB3, travelling from Newcastle to Brisbane passed the Gloucester outer home signal at stop. The Australian Rail Traffic Corporation (ARTC) was the rail infrastructure manager.
At the time of the SPAD, the distant signal was at caution and the outer home signal was at stop. The rail traffic crew (driver and tutor driver) reported that visibility was reduced to 100–150 m in fog. When they sighted the distant signal at caution, they realised that they needed to slow down and the driver made a service brake application. The speed did not reduce quickly enough and the driver made an emergency brake application. At about that time, the rail traffic crew sighted the outer home signal about 100 m away. The train passed the signal at about 45 km/h and stopped about 140 m past the signal.
The NCO received a SPAD alarm (with visual and auditory alert) when 2WB3 passed the outer home signal at stop. About 22 seconds later, they received a phone call from a track worker about another matter and dealt with that matter. About 3 minutes after the SPAD alarm, the NCO received a call from the train crew advising of the SPAD. The NCO reported in interview that because 2WB3 was (only) occupying the track circuit beyond the outer home signal that they ‘knew’ it was stationary. The NCO also said that if the next track circuit beyond the home signal had showed as occupied then they would have initiated a call to the driver of train.
A contributing factor to the SPAD was insufficient sighting distance of the distant signal and outer home signal. One of the other findings in the ATSB report was the following safety issue:
ARTC procedures for managing limit of authority over-runs by trains appear to be inconsistent with the applicable network rule as they do not mandate an immediate emergency call from the train control centre to the train crew as the first response.
Hurlstone Park, New South Wales, on 30 January 2013[80]
At about 0229 on 30 January 2013, a Pacific National freight train 9837, travelling from Nowra to Orange, passed signals SM109G and SM115G at stop between Dulwich Hill and Hurlstone Park in Sydney.
The ATSB found that the train crew did not take action in response to the aspects of 3 consecutive signals, resulting in the passing of 2 of those signals at stop without authority. It was found that the more senior co-driver had inadvertently fallen asleep on the approach to these signals. The trainee driver, in a reduced state of alertness, missed the first signal at caution, and the next signal at stop. It was found that likely due to an expectation that they would not have to stop at the incident location the more senior co-driver had probably relaxed and inadvertently fallen asleep on the approach to these signals. The network control officer broadcast an emergency message to the train crew after the first SPAD, with no response from the train crew. The trainee driver applied the brakes once the train passed the final signal at stop upon realising this signal applied to their train.
The investigation report stated that the available evidence indicated the driver was responding as required to the activation of the vigilance system, and that it was plausible that the trainee driver continued to respond to the vigilance system requirements in a reduced state of alertness, as had been implicated in other SPAD events.
A number of Pacific National’s policies and procedures were examined to determine if any area of the management or training of the train crew contributed to the incident. Fatigue management, and in particular over-reliance on the use of biomathematical model scores used to roster train crew, was one area where a need for improvement was identified (see also Development and review of FAID threshold values). The ATSB also concluded that Pacific National’s SPAD strategy focused on individual crew actions and the costs of SPADs, rather than developing integrated error-tolerant systems of work with regard for the broader systemic issues known to contribute to SPAD events.
On the 1 March 2019, at 0504 local time, Pacific National (PN) grain train 5KC3 passed signal 04‑26 at stop at Wagga Wagga, New South Wales, while on a journey from Ararat, Victoria to Cootamundra, New South Wales. The train continued its journey north, passed another 2 signals at stop and through a set of points in Wagga Wagga yard. The train was stopped after the NCO contacted the train crew by radio and informed them of the SPAD events. Train 5KC3 was a multi‑rail traffic crewed operation.
Another train, 4BM9, had departed Bomen and was heading towards Wagga Wagga to cross 5KC3 about the same time that 5KC3 passed the signals at stop. After 5KC3 passed the up direction starting signal for the Wagga Wagga to Bomen section, it was heading into a potential collision with 4BM9. The 2 trains were around 2.5 km apart by the time they were both brought to a stand.
This investigation was conducted by the Office of Transport Safety Investigation on behalf of the ATSB and discontinued on 20 April 2021. However, at the time the discontinuation was published, the ATSB reported a number of factors:
The rail traffic crew of 5KC3 commenced their shifts at about 2000 the previous evening and their recent shifts were not regarded as being outside the normal rostering parameters for the operator.
The crew of 5KC3 did not react to the signal aspects within Wagga Wagga yard limits that were set at first to caution and then stop. The reason for the crew of 5KC3 not responding to the signal indications could not be conclusively determined.
The data logger of the leading locomotive of 5KC3 indicated the driver was successfully responding to the demands of the locomotive vigilance control system.
There was no evidence that either of the rail traffic crew of 5KC3 were affected by a medical or other health episode.
Neither of the crew members could recall their journey beyond the southern entrance to Wagga Wagga yard limits until the notification of the SPAD events by the NCO.
The reasons for the rail traffic crew not responding to the signals may have been determined if the driver’s cab was fitted with an inward-facing camera recording of the actions of the rail traffic crew.
The contributing factors to this SPAD highlight the need for a positive train control system to provide additional control in the prevention of SPAD events and their subsequent consequences.
During the Jumperkine investigation, the ATSB sought additional information from ARTC, the rail infrastructure manager associated with the Wagga Wagga event. Based on this information, the response time of the NCO to the initial SPAD alarm was estimated to be 66 seconds, and the initial call to the rail traffic crew was not an emergency call. The rail infrastructure manager’s procedures on its New South Wales network for an NCO’s response to a train overrunning its limit of authority were similar to those of Arc Infrastructure (that is, there was no requirement to 'immediately’ stop the train that had overrun its authority and no requirement for the NCO to make an emergency radio call).[82]
Information available to the investigation
The lead locomotive on 2K66 was fitted with an event recorder and a forward-facing camera. The microphone for the forward-facing camera was installed within the driver’s cabin. The ATSB investigation was greatly assisted by the availability of in-cab audio recording from the lead locomotive of 2K66. The in-cab audio recordings from the lead locomotive of 2K66 supported the written statements from the train crew, which in isolation, may have been considered controversial. This provided efficiencies in the evidence collection phase and removed the necessity for the train crew of 2K66 to be subjected to a formal ATSB interview.
Audio and video recording technology was not installed in the cab of the lead locomotive 7MP5. Although there was no requirement for such technology, had such technology been in place, its use may have enhanced the ability of the investigation to better understand the actions and state of the driver in the period leading up to the collision. Such technology would also have improved efficiencies in the analysis phases of this investigation.
In October 2021, ONRSR introduced a policy proposal that each passenger and freight train operating on the main line must be fitted with an in-cab audio and video recorder in the driver’s cab of the controlling locomotive. This proposal was endorsed by the Infrastructure Transport Ministers Meeting (ITMM)[83] in December 2021.
In December 2022, Ministers noted proposed legislation to require installation of audio and video cameras in driver cabs. Ministers also noted the desire to limit the circumstances under which ‘live-feed’ style recordings would be permitted to genuine emergencies only, and for the inclusion of reporting requirements. Ministers tasked ONRSR to work with unions, operators, and jurisdictions to settle any remaining changes to the proposed legislation. Agreement on the outstanding issues has not yet been reached.
The ATSB acknowledges the difficulties that rail transport operators, ONRSR, and rail safety worker representatives have had in working towards the implementation of this policy proposal. Given the significant benefits of in-cab recordings for rail safety investigations, the ATSB encourages ITM members, ONRSR, rail transport operators and representatives of rail safety workers to negotiate solutions and protections that will enable implementation of this policy proposal.
Safety analysis
Introduction
On 24 December 2019 at about 0159, Pacific National freight train 7MP5 passed absolute entry signal 12L into Jumperkine at stop (red aspect) and continued into a section of track that was occupied by train 2K66. Following this, at about 0200, 7MP5 collided with the rear of Watco grain train 2K66.
As 7MP5 passed signal U45 at caution (yellow aspect) and then approached signal 12L at stop, the train was operated within the limits of the track speed (80 km/h). The train was not slowed to enable a stop at signal 12L, and was not slowed for a 30 km/h temporary speed restriction (TSR) that was in place at points about 100 m past signal 12L.
Soon after passing signal 12L at stop, 7MP5 passed over a set of points that were the location of the TSR. Shortly after passing the points, which likely produced a noticeable noise and movement in the locomotive cabin, a service brake application was made. The extent of this service brake application was only likely to slow the train rather than bring it to a stop. Slowly decelerating, 7MP5 proceeded towards the stopped 2K66 ahead.
At about 0200:00, the rear of 2K66 was illuminated by 7MP5’s headlights. At about this time, while 7MP5 was travelling at 59 km/h, the driver of 7MP5 engaged the train’s emergency braking system. The braking system likely worked as designed and reduced the speed of 7MP5. However, about 12 seconds later, 7MP5 collided with the rear of 2K66 at about 41 km/h, and the collision impact was still sufficient to rupture the grain wagon at the rear of 2K66. Grain spilled from the grain wagon and filled the cabin of the lead locomotive of 7MP5. The driver of 7MP5 received fatal injuries.
In summary, in the minutes before the collision 7MP5 had passed signal U45 at caution and (4,197 m later) signal 12L at stop while travelling within the limits of normal track speed. The driver had also not slowed in preparation for the TSR section, which the driver was familiar with and was appropriately marked by a trackside advanced warning sign. The investigation found there were no technical faults with the trackside infrastructure or the train.
Consequently, this analysis considers reasons an experienced train driver passed a red signal and did not commence braking until it was too late to prevent the collision and the risk controls in place to manage the risk of such a collision. The analysis also considers the operation of the safeworking system that authorised 7MP5 up to the section of track occupied by a stationary train, as well as the Arc Infrastructure overrun of limits of authority processes.
Factors affecting train driver performance
Introduction
Train driving is a specialised task that involves conducting routine, frequently practiced tasks in a largely automatic manner (at a skill-based level) with occasional conscious checks on performance. In addition, it relies on well-developed safe-working and route knowledge, particularly the location of signals and the sequence in which they function. Instead of simply responding to each signal in isolation (as is largely the case with road vehicle drivers), train drivers are required to anticipate the state of future signals based on the signal aspects of the preceding signals and other relevant information.
The cognitive requirements of train driving include the successful retrieval of route information from long-term memory, as well as vigilant attention to the rail environment. The US Federal Railroad Administration (Multer and others 2019) identified that common cognitive problems associated with signal passed at danger (SPAD) events include:
Perception and understanding of the railway environment are driven by expectations, resulting in potential for error if expectations are violated.
Cognitive processes are vulnerable to distractions, both from external events and ‘internal’ mind wandering.
Fatigue can increase susceptibility to distraction, and affect judgement and decision making.
In this case, the driver of 7MP5 made no attempt to slow the train after passing signal U45 and when approaching Jumperkine signal 12L. The train driver initially only made a service brake application to slow the train upon arrival at the TSR, which was associated with auditory and tactile cues as the locomotive ran over the associated set of points. As such, the evidence available to the investigation indicated that the driver did not notice the restricted signal aspects and detect a requirement to stop, or notice the TSR ahead sign and a requirement to slow the train. The driver likely only identified the overrun of their limit of authority when they noticed 2K66 on the track ahead, by which time it was too late to stop.
The ATSB considered several factors that may have affected the performance of the driver, including incapacitation, signal visibility, distraction, expectancy and fatigue.
Driver incapacitation
Information recorded by 7MP5’s event recorder showed that the driver continued to interact with the locomotive vigilance system during the approach to Jumperkine. In addition, the driver promptly initiated a service brake application in response to the cues of running over the points, and promptly initiated an emergency brake application at the time that the rear of 2K66 became visible. These actions indicated that the driver was not completely or significantly incapacitated by a medical event or other cause.
Signal and sign visibility
Although it was dark at the time, there was no evidence that conditions outside the cab of the locomotive affected the visibility of the signals or TSR warning signs. The available signal sighting and location of warning signs were aligned with the related Arc Infrastructure standards.
Distraction
One possible explanation for the missed signals during the approach to Jumperkine was that the driver’s attention was distracted by events outside the locomotive or with other tasks for an extended period of time. When train drivers are distracted, they are more likely to miss important information, and distraction has been associated with previous accidents and incidents involving missed red signals.
However, there was no evidence of any event or task that distracted the driver during the approach to Jumperkine. In particular, there was no evidence of any problems with the serviceability of the train and its systems, and the workload associated with the train driving task on the approach to Jumperkine was relatively low. In addition, there was no record that the driver was engaged in any communications via radio or on their phone in the period prior to passing signals U45 and 12L entering Jumperkine.
Onboard, in-cab recording technology was not installed in 7MP5, nor was there any requirement for such technology. Had such information been available it would have enhanced the ability of the investigation to understand the events inside the train cab during the period leading up to the collision.
Expectancy
Expectations are based on past experience and other sources of information. They strongly influence where a person will search for information and what they will search for (Wickens and McCarley 2008), and they also influence the perception of information (Wickens and others 2013). In simple terms, people are more likely to see what they expect to see, and less likely to see what they do not expect to see.
Due to the performance characteristics of long and heavy trains, freight train drivers proactively manage train energy using the train brakes and throttle. Rather than reactively slowing and accelerating the vehicle based on the immediately observable environment, a train driver will frequently utilise route knowledge stored in long-term memory to anticipate the route ahead and thus the appropriate train handling technique. As such, train driving is a task in which the operator is frequently thinking about future events, and thus is particularly affected by expectations.
Train drivers form expectations for signal aspects based on long-term memory of that location. As described by Moray and others (2017):
If a driver has almost always driven over a stretch of track in which the signals show a green aspect, his long-term expectations will predict that to be the case again.
This phenomenon, where a driver has a low expectancy for encountering a restricted aspect due to prior experience of mainly proceed aspects in previous journeys, has been implicated in previous SPAD incidents and accidents.[84]
The driver of 7MP5 was very familiar with the journey from West Merredin to Perth. ATSB analysis of the signal interlocking data sampled for the month preceding the accident showed that drivers rarely encountered a red aspect at Jumperkine signal 12L. It is likely that prior to commencing the journey to Perth, the driver had a low expectancy of stopping at Jumperkine.
Train drivers’ expectancies for signal aspects are also formed by information perceived during a train journey. This can be described in terms of a short-term mental model of the rail track the driver is utilising, with the signals encountered en route shaping the driver’s expectancy of other rail traffic and thus the probability of encountering restricted signals. Prior to reaching the restricted caution and stop signals at Jumperkine, 7MP5 travelled about 150 km and passed 33 signals sequentially with unrestricted green aspects. Drivers typically receive sequential green signals during journeys when no other rail traffic is ahead of them, and the driver may have formed a belief that this was the situation on the morning of the accident. Had the driver received a restricted signal sometime before approaching Jumperkine, even if it had subsequently cleared, this may have shifted the driver’s expectation such that they anticipated a higher likelihood of further restrictive signals. As it was, the sequence of unrestricted green signals probably contributed to the driver forming an expectation that upcoming signals, including U45 and 12L at Jumperkine, would also be green.
There was an open-channel communication between the NCO and the rail traffic crew of train 2K66 about 2K66 being bought to a stop at Jumperkine. This communication provided an opportunity for the driver of 7MP5 to identify that 2K66 would be stopped at Jumperkine, and thus form an expectancy of encountering restrictive signals when approaching that location. The ATSB could not determine why this advice was not effective for alerting the driver to a requirement to stop (see Driver awareness of 2K66 for further discussion), although notes that a radio call directly to the driver requiring a response would have provided more assurance that the driver understood the situation (see Pathing options and provision of traffic advice to drivers).
In summary, the driver of 7MP5 probably had a low expectancy of encountering a red signal at Jumperkine because of prior experiences at that location, and because of the consecutive green signals encountered during the journey. This low level of expectancy potentially increased the likelihood of the driver not detecting the yellow (caution) aspect in signal U45 and the red (stop) aspect in signal 12L.
Fatigue
Symptoms of fatigue
Although the ATSB could not directly observe the driver’s alertness during the journey, recorded information from the locomotive event recorder provided some indications. There were no recorded brake applications during the approach to signal 12L (which was red), or for the TSR shorty after 12L. This data indicates that the driver was not attending to the rail environment, or did not notice important changes or cues in the rail environment. Degradation of visual attention and the perception of important information is a known effect of fatigue.[85]
The locomotive data also showed that for about 7 minutes prior to the driver’s service brake application when they became aware of their arrival at the TSR, the only recorded driver actions were to acknowledge vigilance alarms. Towards the end of the journey, the driver began responding more slowly to the vigilance alarms, with most of these responses likely triggered by the audible alert. Slowing reaction times is also a well-established symptom of fatigue.
Overall, the evidence indicates the driver remained able to complete simple, routine tasks such as responding to vigilance alarms, but was potentially operating in such a degraded state that they were unable to identify and respond to the unexpected signals at U45 and 12L and the TSR warning signs. This pattern of behaviour is indicative of the driver being in a near-sleep state consistent with the phenomenon of ‘driving without awareness’.
Recent sleep
A common source of fatigue is restriction in the quantity and/or quality of recent sleep periods. Most people need at least 7–8 hours of sleep each day to achieve optimum levels of alertness and performance (Watson and others 2015). Research has shown that obtaining less than 5 hours sleep in the previous 24 hours, and less than 12 hours sleep in the previous 48 hours, is associated with significant performance decrements (Dawson and McCulloch 2005, Dawson and others 2021). Other research suggests a slightly stricter threshold, noting that 5–6 hours sleep in the previous 24 hours is problematic (Dawson and others 2021, Williamson and others 2011). A significant amount of research has also shown that a person’s performance starts to decline after 16–18 hours of extended wakefulness (Dawson and others 2021).
Witnesses told the ATSB that the driver reported being tired in the weeks prior to the accident, and the sick leave taken by the driver on 21 December was reported to be associated with tiredness. It is possible that the driver was experiencing chronic problems with fatigue, but based on the available information the ATSB was not able to confirm whether this was the case.
On the evening of 21 December, the driver had an opportunity for a normal amount of sleep (8 hours) before waking at about 0530 on 22 December. The driver may have also obtained some additional sleep (or nap) on the afternoon of 22 December, prior to commencing work at 2030 that evening. The extent to which the sleep prior to commencing duty on 22 December enabled the driver to overcome their reported tiredness could not be determined.
After finishing work at 0337 on 23 December, the driver had 17.7 hours off duty before starting work at 2120 on the night of the accident. Although this off-duty period provided a significant opportunity for the driver to sleep, most of it was outside of the normal sleep period (consistent with many shiftwork rosters). The driver was awake at 0844, providing a maximum sleep opportunity of about 4.3 hours until that time. The driver may also have obtained some additional sleep (or nap) during the afternoon of 23 December.
Any naps that were achieved on the afternoons of 22 and 23 December were probably of less restorative value than night-time sleep. If the driver did not achieve any sleep during the napping opportunities on 23 December, then at the time of the accident they would have been awake for over 17 hours.
There are significant differences between individuals in terms of how much sleep they obtain in general as well as in a particular situation. Research has shown that, on average, train drivers obtained significantly less total sleep during rest periods when the rest period began at about 0400 (about 6 hours) compared to when their rest periods begin in the afternoon or evening (Roach and others 2003). A biomathematical model of fatigue (BMMF) known as FAID Quantum (available since 2016) estimates the amount of sleep obtained during rest periods based on multiple research studies.[86] Given the driver’s roster, the model estimated that an average person would have obtained about 6.5 hours sleep during the rest period on 23 December (with 6.25 hours of this obtained from about 0437 onwards and the remainder in the evening).
Ultimately, based on the available information, it was not possible to determine exactly how much sleep the driver obtained in the 24 hours and 48 hours prior to the accident. The ATSB concluded that the driver probably obtained about 4 hours sleep on the morning of 23 December and potentially an additional 1–2 hours sleep during the afternoon of 23 December. In addition, in the 48-hour period up to the accident on 24 December (at 0200), the driver probably obtained 3.5 hours sleep (up to 0530 on 22 December) and potentially an additional 2 hours sleep during the afternoon of 22 December. Therefore, the driver had probably obtained about 5–6 hours sleep in the 24 hours prior to the accident, and about 10.5–11.5 hours sleep in the 48 hours prior to the accident. It is possible the driver obtained less sleep, and it is also possible but unlikely that the driver obtained more sleep.
Time of day
Human beings are typically most alert (and least fatigued) during the day, and least alert at night. This reflects the daily (circadian) cycle of sleep and wake. Work during the so-called ‘window of circadian low’ is widely understood as increasing the risk of fatigue-related errors. Similarly, rest opportunities at times outside the window of circadian low typically provide a poorer opportunity for restorative sleep.
The International Civil Aviation Organization (2015) defined the window of circadian low as:
Time in the circadian body clock cycle when fatigue and sleepiness are greatest and people are least able to do mental or physical work. The WOCL occurs around the time of the daily low point in core body temperature - usually around 0200-0600 when a person is fully adapted to the local time zone. However, there is individual variability in the exact timing of the WOCL.[87]
The ICAO document further stated that peaks in sleepiness were ‘…different in people who are morning types (whose circadian rhythms and preferred sleep times are earlier than average) and evening types (whose circadian rhythms and preferred sleep times are later than average).’ Given that the driver was normally reported to awaken at about 0600, it is likely that a time of 0200 would have been associated with their normal window of circadian low.
The driver’s journey from Merredin to Perth was planned between 2207 and 0400, thus spanning the window of the circadian low. More specifically, the accident occurred at a time (0200) when the circadian component of fatigue exposure was relatively high.
Workload
Sustained periods of high workload can increase the likelihood of fatigue. Alternatively, as described in Other contextual information relevant to fatigue, sustained periods of low workload can exacerbate the effects of fatigue.
The geometry of the rail corridor for the section of rail track approaching Jumperkine probably provided a low level of task-related workload for train drivers when the signals were mainly green, such as on the night of the accident. Low workload and monotony on the night of the accident therefore increased the risk of the driver experiencing fatigue due to other factors.
Summary
Overall, there was insufficient evidence to conclude that incapacitation, signal and sign visibility and/or distraction affected the driver’s performance. Rather, the recorded data and the nature of the accident sequence were strongly indicative of the driver’s performance being impaired by fatigue. More specifically, the ATSB found that, due to a combination of insufficient sleep in the 48 hours prior to the accident and operating in the window of the circadian low, the driver of 7MP5 was likely experiencing a level of fatigue known to adversely affect performance. This fatigue almost certainly contributed to the driver not identifying and responding to signals U45 and 12L, and ultimately the overrun of authority and collision with 2K66 at Jumperkine at 0200 on 24 December.
Factors exacerbating the extent of fatigue on this occasion included the low workload or monotonous nature of the driving task in the minutes leading up to the SPAD and then collision. In addition, it is noted that the driver had not undertaken a rest break since commencing duty at 2120. The driver may also have not fully recovered from a period of being reportedly tired prior to commencing the shifts on 22 and 23 December.
As well as leading to a low workload situation, the extended period of 33 unrestricted green signals prior to reaching signals U45 and 12L, together with signal 12L’s normal setting being a proceed aspect, may have created a high level of expectancy that the signals would have been unrestricted. However, the extent to which this expectancy contributed to the driver’s reduced state of alertness, or the non-detection of the signal aspects, could not be reliably determined.
The ATSB notes that there was no requirement for the train to be fitted with in-cab voice or video recording devices. Had such technology been in use it would have enhanced the ability of the investigation to understand the actions and state of the driver, as well as better understand the quality of radio communications received by the driver in the locomotive cabin.
Effectiveness of the vigilance system
The driver of 7MP5 continued to respond to the vigilance system’s acknowledgement demands throughout the journey. Even though the driver’s response times slowed towards the end of the journey, consistent with the effects of fatigue, the vigilance system did not generate a penalty brake application. In this instance, the vigilance system was not effective at preventing the driver’s reduced level of alertness from leading to a collision. This outcome is consistent with the known limitations of vigilance systems and the development of other similar accidents.
The vigilance system fitted to NR class locomotives was an activity-based, fixed-cycle system. This system allowed the driver to pre-empt the visual alerts by resetting the cycle time using the vigilance acknowledgement pushbutton. There was also no limit to how many times the cycle time could be reset pre-emptively by the vigilance acknowledgement pushbutton. However, there was no evidence that the driver was regularly pre-empting the vigilance alerts prior to the collision on this occasion. Rather, as already discussed, towards the end of the journey the driver began responding more slowly to the vigilance alarm. The ATSB did not identify that either the fixed alerting cycle or ability to pre-empt the alert were contributory to the development of the accident.
The ATSB notes that the fundamental design of vigilance systems means that they detect some types of driver activity, and this is a limited approximation of alertness and attention. Regardless of whether vigilance systems use fixed-cycle or variable-cycle alerts, or if they are activity-based, the ability of drivers to respond to vigilance systems while not effectively attending to the driving task is a fundamental limitation of the technology.
Following a SPAD incident at Beckwith, Western Australia, in August 2019, the operator identified similar issues with the effectiveness of vigilance systems. The operator recommended changes including modifying the vigilance system technology to require alternate modes of response, such as a combination of actions that the driver must perform to reset the vigilance cycle. The ATSB is not aware of any research showing the effectiveness of such technology, but in principle it may reduce the likelihood of drivers responding to vigilance alerts in a highly automated way. The ATSB encourages operators, industry bodies and others to develop technological improvements to vigilance systems or other technologies to enhance the ability to identify when drivers are fatigued or otherwise inattentive.
In particular, the ATSB observed that, during the development of this accident, the train driver responded to the vigilance system alerts more slowly with the driver responding to mainly the audible vigilance alerts in the 35 minutes prior to the collision. The ATSB believes this pattern is indicative of fatigue and suggests that future improvements to vigilance system technology could include automatically identifying such patterns to prompt additional intervention.
In summary, consistent with the known limitations of locomotive vigilance systems, the system on board train 7MP5 did not identify when the driver was experiencing a level of fatigue known to adversely affect performance and not be attentive to rail signals.
Fatigue risk management of rail traffic crew
Roster worked by the driver of 7MP5
As noted in Factors affecting train driver performance, the driver was probably experiencing a level of fatigue known to adversely affect performance during the journey from Merredin to Perth, and had reportedly been tired in the weeks before the accident. As such, the ATSB considered the risk controls used by Pacific National to reduce the likelihood of its drivers experiencing fatigue while operating trains.
It is noted that shiftwork is an inevitable part of commercial transport, and irregular working hours are a common feature of rail scheduling. Overall, night shifts will generally have a negative effect on a person’s amount of sleep, sleepiness and performance (Akerstedt and Wright 2009, Sallinen and Kecklund 2010). The primary reason is that people are generally adapted to a normal sleep‑wake cycle (with sleep at night), and a night shift forces people to work and sleep at the physiologically least suitable times of day.
Pacific National designed rosters for train drivers according to rules that were intended to ensure drivers had sufficient rest prior to commencing shifts. In general, the rostering rules provided significant rest opportunities to drivers and were consistent with industry practice for fatigue management.
Records showed that the driver of 7MP5 regularly worked on their rostered days off (RDOs), missing about half the planned RDOs in the 3 months prior to the accident. The effect of the additional shifts was an inevitable increase to the hours worked by the driver over the planned roster, and thus a potential reduction in the opportunity to obtain recuperative sleep. The additional shifts also increased the variability of shift timing, which was not consistent with the operator’s intention to provide stable shift patterns.
Overall, the roster worked by the driver was not ideal. However, although these factors had the potential to increase any fatigue experienced by the driver of 7MP5 in the weeks prior to the accident, the available evidence did not indicate that the driver’s roster was necessarily unsafe. The duty periods were generally a duration of 8 hours or less, and the roster typically provided an interval between shifts for the average person to obtain sufficient rest, although often not at the most suitable time of day (as is inherently the case with shiftwork). The driver had significant time off duty in the days prior to the accident, albeit with the use of a sick day on 21 December. They then had 17.7 hours free of duty prior to starting work on the night of the accident.
In summary, shiftwork will inherently increase the risk of fatigue, and the number and nature of the additional duties assigned to and undertaken by the driver increased the potential for fatigue. However, it could not be established that the pattern of shifts worked significantly contributed to the driver’s fatigue at the time of the accident beyond that associated with conducting tasks at 0200 in the morning.
The effects of shift patterns on sleep and fatigue are subject to individual variability, and it is possible that the driver of 7MP5 was more susceptible to these effects than the average person in the weeks leading up to the accident. The adequacy of shift patterns for reducing fatigue risk is also based on assumptions about how rest opportunities will be used, and it is possible that the driver may have engaged in activities while not working that contributed to fatigue in the weeks before the accident.
Fatigue reporting systems and proactive assurance of fitness for duty
The Pacific National fatigue risk management system placed an emphasis on drivers’ responsibility for ensuring they were alert when commencing driving duties. Drivers were expected to identify if they were unfit to perform duties, and self-report fatigue problems either at the start of their shift or during their shift.
Because the driver had recently been provided fatigue training and had worked in the rail industry for a number of years, it is likely they were broadly aware of the effects of fatigue on performance. However, the driver did not report that they were experiencing fatigue or had restricted sleep prior to commencing their shift on the evening of 23 December. Several factors may have contributed to this decision:
The driver may not have known the extent that their performance was affected by fatigue. Research has shown that people will generally underestimate their level of fatigue (Battelle Memorial Institute 1998), including underestimating the impact of several days of sleep restriction (Banks and Dinges 2007). Some research has also shown that people overestimate the amount of sleep they obtain (Lauderdale and others 2008, Jackson and others 2018).
Due to the variation in alertness associated with circadian factors, it is likely that the driver was more alert when they signed on for work at 2120 compared to later in their shift.
Even if the driver had identified that they were experiencing a level of fatigue (or would likely experience a level of fatigue), they may have perceived implicit pressures that prevented self‑disclosure of that impairment. The driver had previously reported feeling as though they would be letting people down if they did not take additional shifts, and was probably aware that sourcing a replacement driver to run a train from West Merredin (in rural Western Australia) in the days before Christmas would be disruptive for the operator.
The operator’s fatigue management training did not emphasise the amount of sleep typically required each day for an average person to maximise alertness and performance.
Once the journey commenced, the likelihood of the driver self-reporting that they were impaired due to fatigue potentially declined further. There would have been an additional operational burden associated with stopping the train to arrange a replacement driver, or even to some extent to request a rest break. There may also have been perceived difficulties associated with self‑disclosing fatigue after having commenced a journey.
Ultimately, the ATSB could not establish what the driver knew about their potential fatigue impairment prior to and during the journey to Perth. Nonetheless, the events preceding the accident highlight both the importance of train drivers enacting their shared responsibility to self‑disclose when they have had restricted sleep or otherwise at increased fatigue risk, and the importance of multi-layered fatigue risk management systems that do not extensively rely on self‑disclosure. The ATSB also notes that there were at least 2 previous SPAD events on the same network involving Pacific National trains conducting driver only operations (DOO) during 2016–2019 where drivers reported, after the event, difficulties with recent sleep and tiredness.
Although fatigue self-reporting was the primary mechanism for identifying real-time fatigue problems, there were very few instances of Pacific National drivers self-reporting fatigue in the years prior to the accident. Several explanations may account for this, including:
drivers did not identify signs or symptoms of fatigue, and did not identify instances where they had insufficient sleep prior to commencing duty
drivers identified fatigue-related impairment and removed themselves from duty using other mechanisms, such as taking sick leave.
fatigued drivers were unwilling to self-report and instead presented for, or continued with, their duty.
Concerns about self-reporting fatigue are commonly perceived among train crew in the rail industry (for example, Fitness and Naweed 2017). The topic is not restricted to any particular operator, and has been discussed in other ATSB reports into rail and aviation occurrences.[88]
Although it was not possible to determine the exact reasons that Pacific National drivers seldomly self-reported problems with fatigue, the absence of fatigue reports was an indication that the systems that supported train drivers to identify and manage fatigue were not operating effectively. Given the importance of self-reporting within the fatigue management system, Pacific National could have taken steps to review the use of the self-reporting systems in order to identify perceived or actual barriers to drivers self-identifying fatigue problems. However, the operator had not undertaken any audits, driver surveys or other types of reviews for this purpose.
In addition, Pacific National had limited other processes in place to provide assurance that drivers had obtained adequate sleep during times off duty and were not operating trains while fatigued when working their rostered shifts. There was no routine questioning of drivers to proactively identify potential restricted sleep or fatigue-related problems unless a driver self-identified they were fatigued, another person raised concerns about a driver’s fatigue or alertness, or the driver’s roster exceeded FAID limits or other rostering rules. Passively assuming that personnel have conducted an accurate self-assessment of their fatigue or alertness level provides limited assurance that the risk associated with shiftwork rosters has been adequately managed.
Although proactively seeking assurance from drivers may not be considered necessary in all situations, it would be appropriate in situations where drivers had more potential to be at higher fatigue risk. Examples would include undertaking a significant number of additional shifts, conducting operations such as DOO on night shift, and potentially also if they have recently undertaken sick leave.
In summary, Pacific National's fatigue management procedures required train drivers to not work if they felt fatigued. This requirement primarily relied on drivers self-reporting if they felt fatigued, and there was no proactive assurance that drivers had obtained adequate sleep, including for higher fatigue risk situations. Self-reporting mechanisms were very seldom utilised and Pacific National had not conducted surveys or used other audit mechanisms or processes to identify any perceived or actual barriers to drivers self-identifying fatigue.
In the case of the Jumperkine accident, it was not possible to determine to what extent the driver was aware that they were experiencing the effects of fatigue, or were likely to experience such effects given their limited sleep. It was also not possible to reliably determine whether factors such as perceived pressure to complete the journey to Perth would have affected how the driver would have responded to proactive questioning about their recent sleep or alertness on the day of the accident. Consequently, there was insufficient evidence to determine whether limitations to the effectiveness of fatigue self-reporting systems, and the absence of proactive assurance of driver alertness, were contributory to the fatigue experienced by the driver of 7MP5. Nevertheless, improving these processes will reduce the risk of fatigue and the likelihood of future fatigue-related occurrences.
Use of FAID scores
The Pacific National fatigue risk management system included the use of the FAID biomathematical model of fatigue (BMMF) to evaluate planned shifts, to evaluate new and modified shifts, and to inform self-assessments of fatigue. The operator used threshold peak FAID scores of 80 for driver only operations (DOO) shifts, permitting scores of up to FAID 100 for other operations. When shifts were compliant with the relevant enterprise agreement (EA) rostering rules, rostering personnel relied on FAID scores to identify fatigue risks, and additional checks would not be made to determine roster fatigue risk when FAID scores were less than 80 for DOO. Train drivers sometimes worked shifts with predicted FAID scores above 80, although this was infrequent.
It is probable that the FAID thresholds used by Pacific National reflected a default to standard practice within the rail industry, which probably originate from guidance provided when FAID was first introduced. The ATSB reiterates analysis of Dawson and others (2017) which highlighted that these commonly used thresholds were initially developed as ‘guestimates’ and were not based on large-scale research. Consistent with the recommendations of the FAID developer, where operators apply FAID thresholds to evaluate rosters, this should be based on a documented assessment of the appropriateness of those thresholds for the planned operations. Operators should also undertake validation that, when employees work rosters designed according to set thresholds, they achieve adequate levels of rest.
Pacific National could not provide evidence of analysis of the appropriateness of its FAID thresholds or validation of the rest achieved by drivers based on using these thresholds. As such, the ATSB found that Pacific National’s rostering and fatigue management system had not conducted analysis to determine that train drivers working rosters according to its specified thresholds were sufficiently rested to conduct driving duties.
The ATSB notes that this problem was previously discussed in another ATSB investigation involving Pacific National (RO-2013-003). In addition, similar problems have also been identified with other transport operators in ATSB investigations (for example, RO-2019-018[89] and AO‑2009‑072).[90] Accordingly, together with assurance of the effectiveness of fatigue reporting, the application of appropriate thresholds when using a BMMF is another important lesson for all transport operators.
Use of technical solutions to manage SPAD risk
The defences-in-depth approach to safety seeks to ensure that major, catastrophic risks are controlled by multiple-overlapping forms of risk controls. Administrative controls, such as procedural rules, provide the weakest form of protection against the likelihood and consequence of individual actions by frontline personnel that increase risk. In contrast, technical solutions or engineering controls will generally provide more assurance that the risk associated with individual actions can be managed effectively.
The safeworking system for rail traffic between Merredin and Perth was primarily reliant on train drivers correctly observing and responding to rail signals to prevent an overrun of their limit of authority. Although reliance on signal compliance has been central to the rail safety system in Australia for many years, it is fundamentally limited in situations where the driver is not fully attentive to the rail corridor or misperceives a signal. Existing risk controls focus on ensuring train drivers remain alert and able to identify signals, however there will always be some instances when drivers mistakenly proceed through signals at stop. Human performance is inherently variable, and there are multiple reasons why a competent, well-trained driver may not correctly observe a signal – with fatigue being one of these reasons. The number of driver completely missed SPAD events on Australian railways each year is evidence of this inherent vulnerability to error.
In recent decades, rail safety investigations in the United States and Canada have made observations about the limitations of reliance on signal observance, and the importance of technical solutions or engineering controls to prevent SPADs or prevent collisions following SPADs. Since December 2020, and following many recommendations made by the National Transportation Safety Board (NTSB), all Class 1 railways in the United States have implemented fail-safe engineering controls, collectively known as positive train control.[91] These systems utilise a combination of train-borne and track-side technologies to prevent specific forms of accidents (such as train-to-train collisions, overspeed derailments, incursions into work zone limits, and movements through a switch left in the wrong position). As noted by the Transportation Safety Board of Canada (2022):
A positive train controls system (addresses) the risk of crews misinterpreting or not following signal indications by automatically intervening to slow or stop a train in the event that an operating crew does not respond appropriately to a signal displayed in the field. A fully functioning system (also offers) a physical fail-safe defence against operating crew errors that are influenced by fatigue.
In the Australian freight rail network, there is no obligation to implement positive train control / automatic train protection style systems. At this time, there is very low coverage of these systems, and no such system existed on the track section between Perth and Kalgoorlie. The same situation also applies on some suburban rail networks in Australia. The ATSB encourages rail industry organisations to consider, develop and / or implement technical solutions that reduce the reliance on rail crews’ observance of signals as a single point of failure, noting that the continual improvement of safety within the rail system is a shared responsibility between rolling stock operators and rail infrastructure managers.
The following sections discuss Pacific National and Arc Infrastructure’s risk controls for managing SPAD risk between Perth and Kalgoorlie, given the absence of technical solutions (for example, automatic train protection). As noted in later sections, the train control system (TCS) did have a SPAD alarm, a reactive or recovery risk control that could reduce the potential consequences of a SPAD. However, processes associated with this risk control reduced its potential effectiveness.
Pacific National risk controls for reducing the risk of SPADs
Overview
As already noted, the safeworking system for rail traffic between Merredin and Perth was primarily reliant on train drivers correctly observing and responding to rail signals to prevent an overrun of their limit of authority. As such, the rolling stock operator’s risk controls in place sought to reduce the likelihood of SPADs by ensuring train drivers were familiar, alert and attentive to the rail environment, including through the use of onboard vigilance systems and the fatigue risk management system.
Limitations of preventive fatigue management
Key to Pacific National’s risk controls for ensuring drivers were able to remain alert during train journeys (and therefore avoid SPADs) was the fatigue risk management system. Rostering processes provided opportunity for sleep prior to the driver’s journey to Perth, however the driver probably did not obtain sufficient sleep on this occasion and (as already discussed) their performance was impaired during the accident journey. As such, this accident illustrates that driver fatigue can develop through many different mechanisms, including those outside of an operator’s control.
Due to the variable nature of individual circumstances, it is likely that over a sufficiently large number of shifts there will always be instances where drivers have not achieved enough sleep prior to commencing work, regardless of the rostering rules applied. The risk of fatigue is inherently greater for operations conducted at night, particularly during the window of circadian low. Due to circadian patterns of sleep and alertness, drivers conducting night journeys will experience lower levels of alertness and will typically find it much more difficult to obtain restorative sleep during the day.
The safe management of fatigue in this situation required the driver to not drive on the night of the accident, having probably not had sufficient sleep for work, or to seek additional mitigators (such as a rest break). The rolling stock operator’s fatigue risk management system included procedures requiring drivers to self-report if they were fatigued, however (as already discussed) there was limited assurance that this process would be effective. With the driver commencing the journey while likely experiencing a level of fatigue known to adversely influence performance, it was no longer possible to rely on the driver for adequate levels of attention and alertness. The safety system therefore relied on systems on board the train or within trackside or network infrastructure to ensure the safe journey.
Pacific National documentation included the onboard locomotive vigilance system as one of the risk controls for mitigating against driver performance being compromised by fatigue and leading to a SPAD. As summarised in Effectiveness of the vigilance system, the effectiveness of locomotive vigilance systems for assuring driver attention, or for preventing fatigue-related impairment other than complete incapacitation, is inherently limited.
Risk management for driver only operations
The Pacific National operational model for its rail operations between Perth and Kalgoorlie included the use of driver only operations (DOO), including at night and during the window of circadian low. DOO involved significant differences to the hazards from multi-rail traffic crewed operations, both in terms of the management of fatigue risks and the ability to prevent, detect and manage the consequences of driver errors.
Multi-rail traffic crewed operations present opportunities for fatigue management that are not possible in DOO journeys. As a preventative control for fatigue-related errors, train drivers can share duties along the journey, facilitating rest breaks and reducing time on task. The second crew member can help identify the signs and symptoms of fatigue, increasing the likelihood of the primary driver either having a break from the driving task, or utilising another form of fatigue countermeasure.
In addition, error management controls appliable to multi-rail traffic crewed operations include the requirement for the rail traffic crew to conduct cross-checking of each signal, reducing the likelihood that a signal will be missed or misread. The second driver can also remind the primary driver of the aspect of the preceding signal, helping reduce the risk of errors where the primary driver misperceives or forgets the previous signal. Although these procedural controls are imperfect and rely on the second driver actively engaging in the train driving task, they afford multiple opportunities to correctly observe rail signals and minimise the risk of one driver experiencing fatigue. Driver completely missed SPADs and (occasionally) collisions do still occur in multi-rail traffic crewed operations, but overall the risk is reduced through the use of procedural controls.
The Pacific National fatigue risk management system sought to reduce the likelihood of driver fatigue during DOO journeys by including greater restrictions on working hours, such as shorter shift times and longer breaks between shifts, more restrictive FAID thresholds, and reduced vigilance system cycle times. However, there were no risk controls that mitigated the risk associated with a fatigued (or otherwise inattentive) driver missing or misperceiving signals. A single-person operation cannot facilitate a cross check or reminding process. DOO operations are therefore reliant on a single driver confirming and remembering rail signals; in other words, they are a single point of failure system. The operator’s safety management system did not explicitly identify the absence of cross-checking or reminding as a potential for greater risk during DOO, and there were no additional controls that met that function.
Analysis of driver only operations safety records
Pacific National had analysed the safety records for DOO and multi-rail traffic crewed operations and concluded there was no evidence of higher incident rates for DOO. However, this analysis included incorrectly categorised safety incidents. When the safety incidents were categorised correctly, the data indicated a higher SPAD rate for DOO journeys.
Had Pacific National correctly identified the higher rate of SPAD for DOO, this should have prompted a review of DOO risk management and the inclusion of additional risk controls for these operations. In other words, the incorrect categorisation resulted in a missed opportunity to review the risk controls for DOO SPAD and fatigue management.
Summary
Among the risk controls identified by the operator to manage the risk of a train driver not attending to rail signals was a vigilance system, which was unlikely to effectively reduce the risk in the case of driver fatigue. Although, the fatigue management system provided rest opportunity to train drivers prior to DOO shifts, there were residual risks of driver fatigue, particularly during the window of the circadian low.
Without any technical solutions or engineering controls that assured rail traffic separation, or detected when a driver was fatigued and not attentive to the rail environment, the safety management system for Pacific National DOO relied on the single driver being attentive to rail signals for safe operations: this was a single point of failure safety system. In situations when the driver was fatigued or inattentive for other reasons, there were no risk controls in place that would identify driver inattention or prevent inattention from leading to a major accident.
In summary, the ATSB found that Pacific National had limited controls for managing the risk of signals passed at danger during driver only operations, including incidents associated with driver fatigue. The safety system relied on a single driver correctly observing and responding to signals at all times, including during the window of the circadian low (when fatigue risk is greatest).
Arc Infrastructure risk controls for managing the risk of SPADs
Overview
As noted in Use of technical solutions to manage SPAD risk, the safeworking system for rail traffic between Merredin and Perth was primarily reliant on train drivers correctly observing and responding to rail signals to prevent an overrun of their limit of authority. However, there were various risk controls that the rail infrastructure manager used, and others that also could have been used, to minimise the risk associated with driver completely missed SPADs. Prior to discussing such risk controls, this section briefly discussed the extent to which the driver of 7MP5 was aware of the location of train 2K66.
Driver awareness of 2K66
As described in the section on Expectancy, the driver of 7MP5 probably had a low level expectation of encountering a restrictive aspect signal approaching Jumperkine, based on prior experiences at that location and because of the 33 consecutive green signals encountered during the journey.
The driver maintained their train at about 72 km/h after passing signal 12L at stop and did not commence braking until about 8 seconds and about 160 m after passing the signal. The timing of this brake application was shortly after the train passed over a set of points. The ATSB considered the audible clunking sound triggered by passing over the points likely stirred the driver into a more alert state. The driver’s recognition of the points also likely alerted them to their location and arrival at the TSR location at Jumperkine.
At this time the driver’s initial braking application was limited to a service brake application. The use of service brake was consistent with the train driver attempting to reduce the speed of their train. The most likely explanation for this action was that the driver identified their arrival at Jumperkine, then recalled the long-standing temporary speed restriction and attempted to comply with it by slowing the train.
This initial service brake application was not consistent with the driver intending to stop the train after passing the signal at stop, or to stop before train (2K66) shortly ahead. That is, had the train driver known or recalled 2K66 was stopped at Jumperkine, even if signal 12L was missed, the expected response upon identifying their location at Jumperkine would have been to stop the train.
ATSB analysis showed that application of the train’s emergency brake at this time may have prevented the collision, and if not, almost certainly would have reduced the impact forces. The driver of 7MP5 applied the emergency brake about 175 m before the collision. This emergency brake application coincided with the rear of 2K66 coming into view around a left curve. This set of evidence indicates that the driver of 7MP5 was reacting to what was seen, further supporting a summary of the analysis above that the train driver was almost certainly not aware that signal 12L was at stop and that 2K66 was stopped ahead when they arrived at Jumperkine.
In summary, the ATSB found that, upon arrival at Jumperkine, the driver of train 7MP5 was almost certainly unaware that they had passed signal 12L at stop (red) and that train 2K66 was stopped at Jumperkine. The driver did not commence emergency braking until the rear of 2K66 became visible on the track ahead, at which point it was too late to avoid a collision.
Pathing options and provision of traffic advice to drivers
In order to comply with a work directive and facilitate the movement of train 3PM4 on the up track past 2K66 on the down track, the NCO stopped 2K66 at Jumperkine. At this time, 7MP5 was pathed towards the stopped 2K66. Although not without risks of their own, defensive opportunities existed that could have been considered to potentially reduce the likelihood and/or consequence of a driver completely missed SPAD involving 7MP5. These opportunities included:
defensive pathing of 7MP5 towards the un-occupied middle road at Jumperkine (proactive but not optimal as it created a risk of derailment if the train exceeded the turn out points speed limit)
stopping 7MP5 at the previous controlled absolute signal at Moondyne about 18 km away from signal 12L (provided more time to execute overrun of the limits of authority process if a SPAD occurred at Moondyne)
the NCO directly communicating with 7MP5 and confirming receipt of advice from the driver that there was a stopped train ahead (proactively providing traffic information and confirming awareness to reduce the likelihood of a SPAD).
Although such potential defensive operational options were available, there were no Arc Infrastructure operational processes, rules, or guidance requiring these options to be considered or applied by NCOs. As a result, reliance on drivers responding to displayed signal aspects became even more critical to control the risk of collision when trains were closely routed towards stopped trains.
In addition to the displayed signal aspects, at the time of the accident a defensive opportunity existed where drivers could gain supplementary situational knowledge of what was happening around them from listening to open channel communications between NCOs and other rail traffic crews. In the case of 2K66, the NCO did proactively communicate to the rail traffic crew that they would be brought to a stop at Jumperkine. Although 2K66’s rail traffic crew acknowledged receipt of this open channel communication, there was no requirement for the following driver of 7MP5 to acknowledge and repeat back the advice that they too would need to stop. In the absence of a repeat-back confirmation from the driver of 7MP5, the NCO was unaware whether the driver had received and/or understood the open-channel communication.
The NCO’s proactive open channel communication was heard by other rail traffic crews. In the absence of recorded sound within the cab of 7MP5, the ATSB could not confirm if the open channel communication was received by 7MP5’s radio and heard by the driver of 7MP5. The driver was required to listen out for communications on the open channel and there was no obvious reason why the driver would have turned the volume of the radio down or been distracted by other radio communications or tasks at the time. However, without a specific communication directed to the driver of the 7MP5 to inform them that they would also be required to stop behind 2K66, and confirm their receipt of this message, there was no assurance that the driver understood the situation.
Additionally, there was also the potential that the driver heard the communication between the NCO and the crew of 2K66 and then did not later recall it when approaching or after arriving at Jumperkine. Remembering information about the stopped train and anticipating signals to slow the train would require prospective memory (Loukopoulos and others 2009). Prospective memory refers to an intention to perform an action at a later time, and a delay between forming the intention and acting on it. It is known to be vulnerable to failure and has been associated with many incidents in aviation and other work domains (Dismukes 2012). Conditions that increase this vulnerability include the delay between the intention to do a task and the execution of the task being filled with other activities, an interruption to a task sequence, and the cues or prompts to retrieve the intention from memory not being explicit (Dismukes 2012). In the case of train 7MP5, the driver probably did not have any strong cues or prompts for recalling the presence of the train ahead. In addition, there was a significant delay between the radio call to 2K66 (0134) and 7MP5’s arrival at Jumperkine (0159).
In previous ATSB investigations, findings have been made about the absence of pre-warning advice of stopped trains to rail traffic crews, in particular collisions at Mile End, South Australia, in March 2015, and at Yass, New South Wales, in December 2010. The trains instigating the collision in both of these accidents proceeded into sections of track occupied by stopped trains, without knowledge of the stopped train ahead. Although these trains were authorised via low speed / calling on signals, with administrative rules that were not observed, the drivers operated their trains without awareness that there was actually a train stopped ahead of them. Due to local environmental circumstances, upon sighting the stopped train ahead neither of the rail traffic crews could stop their trains before a collision.
In summary, in the case of the Jumperkine accident, defensive opportunities existed that could have been applied to potentially reduce the likelihood and/or consequence of a driver completely missed SPAD. More specifically, the Arc Infrastructure practice of pathing a following train up to the same section of track occupied by a stopped train, coupled with no requirement for the NCO to communicate and confirm rail traffic crews were aware when approaching another stopped train, increased risk.
In this instance, it is probable that due to the effects of fatigue, the driver of train 7MP5 was not attending to rail signals at Jumperkine. In addition, there was insufficient evidence to determine if the driver had heard and attended to radio calls from the NCO when approaching Jumperkine. Given this context, there was insufficient evidence to determine whether the pathing of 7MP5 up to the section of track occupied by train 2K66 and no direct advice to the driver of 7MP5 was contributory to the development of the accident. Stated alternatively, it is possible that the collision could have still occurred even if additional defensive opportunities had been utilised.
Response to SPAD alarm
Introduction
Train 7MP5 passed signal 12L at about 0159:24 and a SPAD alarm was recorded by the train control system (TCS) alarm log file at about 0159:25. The time the SPAD alarm was displayed to the NCO was not recorded. However, based on simulations, it is very likely that it was displayed about the same time.
At about the time that the emergency brake commenced application on 7MP5 (0200:00), 34 seconds had elapsed since the SPAD alarm was very likely displayed to the NCO. The timing of the NCO’s initial attempt to contact the driver of 7MP5 was 0200:07, which was very likely about 42 seconds after it was displayed to the NCO. The NCO’s initial call was also about 5 seconds prior to the collision (0200:12) and 12 seconds after the driver had already applied the emergency brake.
There are 2 key aspects of the NCO response that require further discussion: the response time and the type of response.
Response time
A range of factors can influence the time it takes to respond to an alarm or similar situation. For example, Stanton and others (2008) discussed the model of alarm initiated activity (AIA), which includes a number of stages: observation (detection of the alarm), acceptance, analysis (assessment and prioritisation), investigation (of the underlying reasons), correction (implementing the response), monitoring (the effectiveness of the response), and resetting (or extinguishing the alarm).[92] Each of these phases adds to the total response time, with the analysis and investigation phases involving more complexity and often contributing most to the overall time. A range of different factors can influence the time taken in each phase, including the way the alarm system is designed, and the expectancies and workload of the person involved.
Stanton and Baber (2008) discussed the specific case of the collision at Ladbroke Grove in the United Kingdom between 2 passenger trains. They noted that the official inquiry questioned why it had taken 18 seconds for the NCO (known as a ‘signaller’) from the onset of the SPAD alarm to implement an action (in this case switching the next signal for the train that exceeded its authority to stop). Using a critical path analysis technique, the authors modelled an expected response time of about 19 seconds for such a response. Stanton and Baber also noted that expectancy could play a key role in such events, with the signaller involved in the Ladbrook Grove accident stating that in every other SPAD they had been involved with the train had stopped within the overlap, and that in this case they initially monitored the situation expecting the train to stop.[93]
The alarm system, task and context involved in the Ladbrook Grove accident was different to the Jumperkine accident, and it is difficult to extrapolate an expected response time from Stanton and Bader’s analysis. However, based on the system described, it appeared that the task of locating the alarm message and interpreting that message would probably have been simpler in the Jumperkine accident.[94] Nevertheless, due to a range of potential factors, there are likely to be significant differences between NCOs in responding to any particular situation, and significant differences between a particular NCO’s responses to similar situations.
As with most types of SPAD alarm systems, the Arc Infrastructure SPAD alarm included an auditory tone as well as a visual dialogue box. The NCO recalled looking at the TCS screen when the SPAD alarm appeared and attempting to contact the driver soon after noticing the SPAD alarm. Although it is known that NCOs may prioritise making safe existing safety-critical tasks before actioning new tasks like responding to SPAD alarms, the ATSB could not determine if the NCO had any other high priority tasks at the time or the nature of any specific contextual reasons for the 42-second response time taken by the NCO. However, it is noted that the response time in this case was not unusual (relative to available response times to 2 other driver completely missed SPADs on the same network and others on a network with a similar system). In addition, as discussed in the next section, the rail infrastructure manager’s processes did not explicitly require an immediate response.
Type of response
Considerations about the effectiveness of the NCO response time need to allow time for the NCO to verbally communicate the essential information via radio, the driver to understand the information and determine the required response, the time to initiate the braking action, and the time for the emergency brake application propagation.[95] The overall time to achieve braking action following the start of an NCO radio call will not be immediate, and could vary significantly depending on several factors.
The initial radio call from the NCO to the driver of 7MP5 only included the train number and a request for the driver to contact the NCO, with no urgency attached and no emergency call. Accordingly, it could have taken several seconds for the driver to respond to the NCO’s radio call and then the nature of the problem to be conveyed by the NCO. The driver’s response to the initial call may have been delayed if they were busy with other tasks, still experiencing the effects of fatigue, or experienced a significant degree of surprise regarding the situation. In addition, as already discussed, the volume setting of the radio in the locomotive could not be determined, although the driver was required to be maintaining a listening watch.
Given these types of aspects, it is clear that an initial radio call from an NCO to a driver that is an emergency call to stop the train is very likely to significantly reduce the time to stop a train compared to a standard call. Again it is noted that the type of NCO response in this case was not unusual relative to that used in other SPADs on the same network referred to in this report and, as discussed later, the rail infrastructure manager’s processes did not explicitly require an emergency call. In contrast, the ATSB is aware through previous investigations of prompt, emergency calls by NCOs to drivers of trains that have exceeded their authority on multiple other networks, many of which played an important role in reducing the risk associated with those SPAD events.
Potential influence of the NCO response
As already noted, the NCO’s initial call to the driver occurred after the driver had already applied the emergency brake. Therefore, the call was too late to have any influence on the consequences of the accident.
The ATSB considered the extent to which an earlier response by the NCO to the SPAD alarm could have had on the outcome. However, such an analysis was complicated by a number of factors:
There was limited information available to determine what would be regarded as a reasonable response time or a normal response time range for an NCO on this type of system (assuming the NCO was required to and intending to provide an immediate or high-priority response). A person’s overall response time varies significantly depending on a range of factors, including workload, focus of attention, expectations, the salience of the event or hazard, and the complexity of the response (Wickens and McCarely 2008, Wickens and others 2013). In addition, response times are not normally distributed, and consequently design standards in some contexts are based on an 85th or similar percentile response rather than a median or mean response time.
As already discussed, the type of NCO radio call will also have an influence on a driver’s response time. An emergency call will very likely be more effective than a standard radio call, but there can be variations in exactly how either type of radio call is delivered that could influence a driver’s response.
There was uncertainty regarding how quickly the driver would have responded to a radio call, particularly given their state of alertness. Although it is very likely that a response to an emergency call would have been quicker than a standard radio call, there may still have been some delay. It is noted that the driver appeared to respond promptly when applying a service brake application to the stimulus of running over the points. However, the extent to which a radio call would have had the same effect as this stimulus is unclear.
There was uncertainty regarding the actual deceleration rate being achieved by the train. Although the available recorded data indicated that the train’s braking performance was better than the applicable requirements, the actual braking system response could not be determined with certainty.
There was uncertainty regarding what speed would have resulted in significantly less serious consequences.
The ATSB notes that the median response time for an NCO to make an emergency call in 4 other occurrences it has investigated with known NCO response times (and emergency calls) on other networks was 9 seconds (ranging from 6 to 17 seconds). If an emergency call was made within 9 seconds and emergency braking commenced within 12 seconds of the SPAD alarm on this occasion, then it is likely that the train would have stopped prior to the collision or a collision would have resulted in only minor consequences. However, for the reasons stated above, there is uncertainty whether such an overall response time could have reasonably been achieved on this occasion and also some uncertainty regarding the effects of slower responses times.
Although determining the influence of different response times in this case was difficult, this accident has shown that response times to SPAD alarms need to be quicker than 42 seconds to effectively reduce collision risk, depending on the separation between the signal and the end of a train or other hazard ahead.
Summary
In summary, after the Arc Infrastructure train control system generated a signal passed at danger (SPAD) alarm when train 7MP5 passed signal 12L at stop (red), it was very likely about 42 seconds after receiving the alarm before the NCO began calling the driver of 7MP5. The timing of this call was not effective in communicating the need to stop the train in time to avoid the collision or reduce the speed of the train prior to the collision. In addition, the NCO’s call was not an emergency call and did not indicate a level of urgency. Even if the NCO had made an emergency call rather than a normal call to the driver, a significantly faster response time would have been required to have had a meaningful influence on the consequences of the accident.
SPAD alarm response processes
The SPAD alarm functionality within Arc Infrastructure’s train control system was a reactive or recovery risk control, in place to minimise the consequences of a train passing a signal at stop and overrunning its limits of authority. Given that there were no technical solutions or engineering controls in place to automatically prevent a train from overrunning its limits of authority (or automatically stop a train that had overrun its limits of authority), the SPAD alarm had a potentially important role in minimising the consequences of a driver completely missed SPAD. However, the success of a SPAD alarm at preventing a more serious consequence following an overrun of the limits of authority was reliant on both the time available before a train reaches a point of conflict, and the immediacy and nature of both the NCO and rail traffic crew response.
The Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001, in respect to rail traffic crews, required immediate action upon awareness of an authority overrun. In contrast, the rail infrastructure manager’s requirements for NCOs, although mandatory, were not required to be immediate. This was a significant point of divergence from the template Rail Industry Rail Industry Safety Standards Board (RISSB) Australian Network Rules and Procedures Rule 6001, which the Arc Infrastructure Rule 6001 was based on.
In addition to not explicitly requiring an immediate response, the rail infrastructure manager’s procedures with respect to its NCOs also did not explicitly require an emergency radio call in response to a SPAD alarm. More broadly, Arc Infrastructure had also not specified its performance criteria for NCO responses to SPAD alarms or had any system in place to monitor this performance. Overall, this situation was consistent with the potential importance of SPAD alarms not being appropriately recognised within the rail infrastructure manager’s safety management system. In particular, its risk register had not specifically identified or considered the immediacy of NCO responses to a SPAD alarm as a potential risk mitigation for a collision.
In summary, the Arc Infrastructure processes for the management of rail traffic overrunning its limits of authority were reliant on the immediate actions of the rail traffic crew and did not explicitly require immediate actions from the NCO. This situation increased the risk of driver completely missed SPAD events, particularly in cases where the rail traffic crew’s awareness or capacity was potentially compromised.
Post SPAD actions
After 7MP5 proceeded past signal 12L at danger, the NCO and rail traffic crew were required to action their responsibilities of the Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001. These requirements included the rail traffic crew who had overrun their limit of authority broadcasting an emergency radio call if they believed there was an immediate danger (to other rail traffic or other parties). The RISSB Australian Network Rules and Procedures and Arc Infrastructure versions of Rule 6001 included a similar requirement.
In contrast, although the NCO was required by the Arc Infrastructure rule to arrange to stop rail traffic that had overrun its limits of authority and other rail traffic movements that were at risk, there was no explicit requirement to broadcast an emergency radio call (or to do this immediately). The RISSB rule also included no explicit requirement for an emergency radio call, although it did require the NCO to ‘immediately’ arrange to stop rail traffic.
Relying only on rail traffic crew to broadcast an emergency call has obvious limitations. In the case of a driver completely missed SPAD, the driver of the train that has overrun its authority has no awareness of the SPAD. Therefore, they have no awareness of the need to make such an emergency radio call until they become aware of the situation. For example, the driver of 7MP5 only became aware of the situation shortly before the collision, too late to prevent the collision or reduce the severity of its consequences.
In addition, other rail traffic crews will often not be aware of the situation prior to a collision or, in many cases, after a collision. For example, no other rail traffic crews had any awareness of the SPAD involving 7MP5 prior to the collision. After the collision, the rail traffic crew of 2K66 were aware that they had observed a bump in their train that coincided with a locomotive train line fault alarm. However, due to the absence of an emergency call, the crew of 2K66 were unaware of the overrun of the limit of authority immediately behind them by 7MP5. While the crew of 2K66 were suspicious of a collision, the normal brake pipe and brake pipe flow rates observed at that time coupled with the rarity of main line collisions likely focused their attention on troubleshooting the source of the locomotive train line fault alarm within their trailing locomotive.
At the same time the NCO, aware of 7MP5 overrunning its limit of authority but unaware of a collision, was focussed, as required by Rule 6001, on trying to contact the driver of 7MP5 to either confirm they had stopped or direct them to stop. The NCO made 5 attempts to make direct contact with the driver of 7MP5 (with no emergency call or explanation of the situation) before requesting the crew of an approaching train, 3PM4, to try to make contact with 7MP5. In the absence of any collision advice, the NCO, was unaware of the collision between trains 7MP5 and 2K66, and did not appear to consider 3PM4 to be at risk entering Jumperkine adjacent to the location of trains 7MP5 and 2K66.
Overall, the rail traffic crew of 2K66 and the NCO were in possession of partial information. This partial information, if shared between the rail traffic crew of 2K66 and the NCO, could have enabled the NCO to become aware of the collision and identify the risk to 3PM4. Rather than waiting to understand the full nature of the situation, a more effective approach would be to require an NCO to make an emergency call to all affected rail traffic in any situation where a known SPAD has occurred.
In summary, although the NCO received a SPAD alarm involving 7MP5 passing signal 12L at stop, there was no collision advice available to the NCO and the NCO was unaware of the train's collision with the stationary train 2K66. Accordingly, the NCO did not take action to stop train 3PM4 entering the same location, increasing the risk of a secondary collision involving 3PM4 operating on the adjacent track.
More broadly, Arc Infrastructure’s procedures included no requirement for an NCO to make an emergency call and advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority. In addition, although RISSB’s procedures required an NCO to ‘immediately’ stop other rail traffic, they did not explicitly require the use of an emergency call.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the collision of freight train 7MP5 into train 2K66 at Jumperkine, Western Australia, on 24 December 2019.
Contributing factors
Train 7MP5 passed absolute entry signal 12L into Jumperkine at stop (red aspect) and continued into a section of track that was occupied by train 2K66.
Due to a combination of insufficient sleep in the 48 hours prior to the accident and operating in the window of the circadian low, the driver of 7MP5 was likely experiencing a level of fatigue known to adversely affect performance.
Consistent with the known limitations of locomotive vigilance systems, the system on board train 7MP5 did not identify when the driver was fatigued and not attentive to rail signals.
Pacific National had limited controls for managing the risk of signals passed at danger during driver only operations, including incidents associated with driver fatigue. The safety system relied on a single driver correctly observing and responding to signals at all times, including during the window of the circadian low (when fatigue risk is greatest). (Safety issue)
Upon arrival at Jumperkine, the driver of train 7MP5 was almost certainly unaware that they had passed signal 12L at stop (red) and that train 2K66 was stopped at Jumperkine. The driver did not commence emergency braking until the rear of 2K66 became visible on the track ahead, at which point it was too late to avoid a collision.
Other factors that increased risk
Pacific National's fatigue management procedures required train drivers to not work if they felt fatigued. This requirement primarily relied on drivers self-reporting if they felt fatigued, and there was no proactive assurance that drivers had obtained adequate sleep, including for higher fatigue risk situations. Self-reporting mechanisms were very seldom utilised and Pacific National had not conducted surveys or used other audit mechanisms or processes to identify any perceived or actual barriers to drivers self‑identifying fatigue. (Safety issue)
Pacific National’s rostering and fatigue management system used the FAID biomathematical model of fatigue to assess the fatigue risks associated with train driver rosters, applying a threshold FAID score of 80 for driver only operations and 100 for other operations. The operator had not conducted analysis to determine that train drivers working rosters according to these thresholds were sufficiently rested to conduct driving duties. (Safety issue)
Pacific National analysis of the comparative safety records for driver only and multi-rail traffic crewed operations relied on incorrectly categorised safety incidents, and incorrectly concluded that there was no difference in the safety records of the 2 operational modes. This incorrect analysis resulted in a missed opportunity to review the risk controls for driver only operations SPAD and fatigue management.
The Arc Infrastructure practice of pathing a following train up to the same section of track occupied by a stopped train, coupled with no requirement for the network control officer (NCO) to communicate and confirm rail traffic crews were aware when approaching another stopped train, increased risk. (Safety issue)
After the Arc Infrastructure train control system generated a signal passed at danger (SPAD) alarm when train 7MP5 passed signal 12L at stop (red), it was very likely about 42 seconds after receiving the alarm before the network control officer (NCO) began calling the driver of 7MP5. The timing of this call was not effective in communicating the need to stop the train in time to avoid the collision or reduce the speed of the train prior to the collision. In addition, the NCO’s call was not an emergency call and did not indicate a level of urgency.
The Arc Infrastructure processes for the management of rail traffic overrunning its limits of authority were reliant on the immediate actions of the rail traffic crew and did not explicitly require immediate actions from the network control officer (NCO). This situation increased the risk of driver completely missed signal passed at danger (SPAD) events, particularly in cases where the rail traffic crew’s awareness or capacity was potentially compromised. (Safety issue)
Although the network control officer (NCO) received a signal passed at danger (SPAD) alarm involving 7MP5 passing signal 12L at stop, there was no collision advice available to the NCO and the NCO was unaware of the train's collision with the stationary train 2K66. Accordingly, the NCO did not take action to stop train 3PM4 entering the same location, increasing the risk of a secondary collision involving 3PM4 operating on the adjacent track.
Arc Infrastructure’s procedures included no requirement for a network control officer (NCO) to make an emergency call and advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority. (Safety issue)
Although the Rail Industry Safety and Standards Board Australian Network Rules and Procedures (ANRP) product, and its replacement the National Rules Framework, included a requirement for a network control officer (NCO) to immediately arrange to stop rail traffic that had overrun its limits of authority and other rail traffic that was at risk, it did not require the NCO to make an emergency call to advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority.
Other findings
The speed of train 7MP5 was not reduced to comply with the 30 km/h temporary speed restriction (TSR) located at Jumperkine.
The braking systems of train 7MP5 likely worked as designed.
Train 7MP5 was not fitted with in-cab voice or video recording devices, nor was there any requirement for such devices. Had such technology been in use it would have enhanced the ability of the investigation to understand the actions and state of the driver in the period leading up to the collision.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Pacific National’s rostering and fatigue management system used the FAID biomathematical model of fatigue to assess the fatigue risks associated with train driver rosters, applying a threshold FAID score of 80 for driver only operations and 100 for other operations. The operator had not conducted analysis to determine that train drivers working rosters according to these thresholds were sufficiently rested to conduct driving duties.
Safety issue description: Pacific National's fatigue management procedures required train drivers to not work if they felt fatigued. This requirement primarily relied on drivers self-reporting if they felt fatigued, and there was no proactive assurance that drivers had obtained adequate sleep, including for higher fatigue risk situations. Self-reporting mechanisms were very seldom utilised and Pacific National had not conducted surveys or used other audit mechanisms or processes to identify any perceived or actual barriers to drivers self-identifying fatigue.
Pacific National limited risk controls for driver only operations
Safety issue description: Pacific National had limited controls for managing the risk of signals passed at danger during driver only operations, including incidents associated with driver fatigue. The safety system relied on a single driver correctly observing and responding to signals at all times, including during the window of the circadian low (when fatigue risk is greatest).
Arc Infrastructure network control procedures – stopping advice
Safety issue description: The Arc Infrastructure practice of pathing a following train up to the same section of track occupied by a stopped train, coupled with no requirement for the network control officer (NCO) to communicate and confirm rail traffic crews were aware when approaching another stopped train, increased risk.
Arc Infrastructure network control procedures for an immediate response to a SPAD
Safety issue description: The Arc Infrastructure processes for the management of rail traffic overrunning its limits of authority were reliant on the immediate actions of the rail traffic crew and did not explicitly require immediate actions from the network control officer (NCO). This situation increased the risk of driver completely missed signal passed at danger (SPAD) events, particularly in cases where the rail traffic crew’s awareness or capacity was potentially compromised.
Arc Infrastructure network control procedures for an emergency call following a SPAD
Safety issue description: Arc Infrastructure’s procedures included no requirement for a network control officer (NCO) to make an emergency call and advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action undertaken by Pacific National
Following the accident, Pacific National offered an enforceable voluntary undertaking (EVU) to the Office of the National Rail Safety Regulator (ONRSR) in April 2023, which was accepted by ONRSR in May 2023, and varied in October 2023. Commitments in the EVU included:
engage a full-time fatigue risk manager and a full-time human factors specialist to develop an updated fatigue management standard and guideline in relation to fatigue-related hazards, the core principles of fatigue risk management, and how to develop a decision-making pathway for applying those principles so that rail freight operational risks can be better managed
procure training for train drivers in relation to updated fatigue management documents
engage a services provider to implement a physical health and wellbeing program for intermodal freight train drivers
host a rail freight safety conference for participants in the rail freight sector (including rail safety workers) to encourage and promote safety in the industry
convene a meeting with an accredited rail infrastructure manager to discuss signal visibility and review the procedures for train handling in the vicinity of the accident site
trial driver advisory systems to support the driver in remaining vigilant and alert through the early detection of signals and obstructions to assist in the prevention of safety incidents such as proceed authority exceedance (PAE) and collision events, for which driver fatigue and distraction is a contributing factor. Additionally, it will participate as an observer in a similar trial being conducted in the United Kingdom.
Additional details of the Pacific National EVU can be found on the ONRSR website.
Additional safety action undertaken by Arc Infrastructure
Following the accident, Arc Infrastructure offered an enforceable voluntary undertaking (EVU) to the Office of the National Rail Safety Regulator (ONRSR) in June 2022, which was accepted by ONRSR in June 2022. Commitments in the EVU included:
work with the owner of Arc Infrastructure’s train control system (TCS) to install a SPAD specific audible alarm (to differentiate SPAD alarms from other TCS alarms)
appoint (on 4 January 2022) a network control technical trainer and assessor, with the role of providing relevant and practical training to NCOs
upon the introduction of its new TCS, develop a dedicated training facility to allow NCOs to undertake simulation or scenario-based training and assessment (including emergency incident response), with a requirement for all NCOs to undertake a minimum of 1 day simulation training each year.
establish a SPAD Working Group. The working group was established in November 2020 and it provides a forum for industry collaboration and ongoing engagement between industry members on initiatives to reduce the risk of SPADs on the rail network and to share key learnings.
Additional details of the Arc Infrastructure EVU can be found on the ONRSR website.
Additional safety action undertaken by the Rail Industry Safety and Standards Board
In relation to the safety factors for this accident, the RISSB has advised that it intends to undertake a number of activities, including:
a development group was established in December 2023 to develop a code of practice to assist rail transport operators implementing driver only operation to so far as is reasonably practicable (SFAIRP).
the development of a code of practice to address vigilance timing cycles
finalise and publish Australian Standard (AS) 7531 Rollingstock Lighting and Visibility
It also advised that it had recorded a change request for RISSB Degraded Operation Rule 4[100] for consideration of the ATSB investigation findings at the next scheduled review of this product.
RISSB advised that these activities will be incorporated into the RISSB work plan for 2024 and 2025.
Glossary
CTC
Abbreviated term for 'centralised traffic control'. A safeworking system of remotely controlling the points and signals at a number of locations from a centralised control room.
Down
Identification of the track or train direction of travel. In respect to Jumperkine, Down refers to rail traffic travelling away from Perth.
DOO
Driver only operation is where one rail safety worker has the responsibility for the control, operations and procedures of a train.
ONRSR
The Office of the National Rail Safety Regulator. Administered and enforced compliance with the Rail Safety National Law and Regulations.
Mixed gauge
In the Arc Infrastructure context at this location track that is constructed with a mixture of both standard gauge (1435 mm) and narrow gauge (1067 mm) widths utilising a common rail.
NCO
Network control officer, a competent worker who authorises, and may issue, occupancy authorities, and who manages rail traffic paths to ensure safe and efficient transit of rail traffic in the network. The competent worker may also be referred to as a train controller, network controller or signaller.
Rail infrastructure
Defined in RSNL as facilities that are necessary to enable a railway to operate, and includes:
railway tracks and associated railway track structures
service roads, signalling systems, communications systems, rolling stock control systems, train control systems and data management systems
notices and signs
electrical power supply and electric traction systems
associated buildings, workshops, depots and yards
plant, machinery and equipment,
but does not include—
rolling stock
any facility, or facility of a class, that is prescribed by the national regulations not to be rail infrastructure.
RIM
Rail infrastructure Manager. Defined in RSNL as a person that has effective management and control of rail infrastructure.
RISSB
Rail Industry Safety and Standards Board. Responsible for the provision of standards, codes of practice, guidelines, rules, safety data and analysis for the Australian rail industry.
Rolling stock
Defined in the RSNL as a vehicle that operates on or uses a railway, and includes a locomotive, carriage, rail car, rail motor, light rail vehicle, train, tram, light inspection vehicle, self propelled infrastructure maintenance vehicle, trolley, wagon or monorail vehicle, but does not include a vehicle designed to operate both on and off a railway when the vehicle is not operating on a railway
RSNL
Rail Safety National Law, as administered by ONRSR.
RSO
Rolling Stock Operator. Defined in RSNL as a person who has effective control and management of the operation or movement of rolling stock on rail infrastructure for a railway, but does not include a person by reason only that the person drives the rolling stock or controls the network or the network signals.
RTO
Rail transport operator. Defined within the RSNL as either a rail infrastructure manager, rolling stock operators, or both.
Running Line
Defined in the RSNL as a railway track used primarily for the through movement of trains.
Siding
Defined in the RSNL as a portion of railway track, connected by points to a running line or another siding, on which rolling stock can be placed clear of the running line.
SFAIRP
So far as is reasonably practicable
SMS
Safety management system. A systematic approach to rail safety aligned to the requirements of RSNL.
SPAD
Signal passed at danger. Defined as unauthorised passing of a signal displaying a stop aspect.
Up
Identification of the track or train direction of travel. In respect to Jumperkine, Up refers to rail traffic travelling towards Perth.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
event recorders and front of train camera from 7MP5
rail traffic crews of 2K66 and 3PM4
Pacific National management representatives
Pacific National
Arc Infrastructure
network control officer
rolling stock operator of train 2K66
Western Australia Police Service
SCT Logistics
Office of the National Rail Safety Regulator
Australian Rail Track Corporation
workplace health and safety regulator
health assessment service provider
Services Australia
mobile phone service providers.
References
Akerstedt T and Wright KP (2009) ‘Sleep loss and fatigue in shift work and shift work disorder’, Sleep Medicine Clinics, 4:257-271.
Australian Rail Operations Unit (AROU) (November 2002), Draft Code of Practice for the DIRN – Volume 5: Rollingstock standard.
Banks S and Dinges DF (2007) ‘Behavioral and physiological consequences of sleep restriction’, Journal of Clinical Sleep Medicine, 3:519-528.
Battelle Memorial Institute (1998) An overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, United States Federal Aviation Administration.
Bes F, Jobert M and Schulz H (2009) ‘Modeling napping, post-lunch dip, and other variations in human sleep propensity’, Sleep, 32:392-398.
Blaivas AJ, Patel R, Hom D, Antigua K and Ashtyani H (2007) ‘Quantifying microsleep to help assess subjective sleepiness’, Sleep Medicine, 8:156-159.
Briest S, Karrer K and Schleicher R (2006) ‘Driving without awareness: Examination of the phenomenon’, Vision in Vehicles XI, 89-141.
Chang AM, Aeschbach D, Duffy JF and Czeisler CA (2015) ‘Evening use of light-emitting eReaders negatively affects sleep, circadian timing, and next-morning alertness’, Proceedings of the National Academy of Sciences, 112:1232-1237.
Charlton SG and Starkey NJ (2011) ‘Driving without awareness: The effects of practice and automaticity on attention and driving’, Transportation research part F: traffic psychology and behaviour, 14:456-471.
Dawson D, Darwent D and Roach GD (2017) ‘How should a bio-mathematical model be used within a fatigue risk management system to determine whether or not a working time arrangement is safe?’, Accident Analysis & Prevention, 99:469-473.
Dawson D and McCulloch K (2005) ‘Managing fatigue: It’s about sleep’, Sleep Medicine Reviews, 9:365-380.
Dawson D, Noy YI, Härmä M, Åkerstedt T and Belenky G (2011) ‘Modelling fatigue and the use of fatigue models in work settings’, Accident Analysis & Prevention, 43:549-564.
Dawson D and Reid K (1997) ‘Fatigue, alcohol and performance impairment’, Nature, 388:235-235.
Dawson D, Sprajcer M and Thomas M (2021) ‘How much sleep do you need? A comprehensive review of fatigue related impairment and the capacity to work or drive safely’, Accident Analysis and Prevention, 151:105955.
Dinges DF (1995) ‘An overview of sleepiness and accidents’, Journal of Sleep Research, 4:4-14.
Dismukes RK (2012) ‘Prospective memory in workplace and everyday situations’, Current Directions in Psychological Science, 21:215–220.
Dorrian J, Chapman J, Bowditch L, Balfe N and Naweed A (2022) ‘A survey of train driver schedules, sleep, wellbeing, and driving performance in Australia and New Zealand’, Scientific Reports, 12:3956.
Dorrian J, Roach GD, Fletcher A and Dawson D (2007) ‘Simulated train driving: Fatigue, self-awareness and cognitive disengagement’, Applied Ergonomics, 38:155-166.
Dunn NJ and Soccolich S (2023), The fatigue and safety of locomotive engineers and conductors, Technical Report DOT/FRA/ORD-23/17, US Department of Transportation, Federal Railroad Administration.
Federal Railroad Administration (2010) Procedures for validation and calibration of human fatigue models: The fatigue audit InterDyne tool, Technical Report DOT/FRA/ORD-10/14, US Department of Transportation.
Ferguson SA, Baker AA, Lamond N, Kennaway DJ and Dawson D (2010) ‘Sleep in a live-in mining operation: the influence of start times and restricted non-work activities’, Applied Ergonomics, 42:71-75.
Ferguson SA, Kennaway DJ, Baker A, Lamond N and Dawson D (2012) ‘Sleep and circadian rhythms in mining operators: limited evidence of adaptation to night shifts‘, Applied Ergonomics, 43:695-701.
Härmä M (2006) ‘Workhours in relation to work stress, recovery and health’, Scandinavian Journal of Work, Environment & Health, 32:502-514.
Haworth N, Regan M and Larsson T (1998) Investigation into Effectiveness of Driver Vigilance Control Systems on Locomotives – Research Undertaken for FreightCorp, Monash University Accident Research Centre.
Hertig-Godeschalk A, Skorucak J, Malafeev A, Achermann P, Mathis J and Schreier DR (2020) ‘Microsleep episodes in the borderland between wakefulness and sleep’, Sleep, 43: zsz163.
Hildebrandt G, Rohmert W and Rutenfranz J (1974), 12 and 24 h rhythms in error frequency of locomotive drivers and the influence of tiredness, International Journal of Chronobiology, 2:175‑180.
ICF Incorporated (2015) Evaluation of single crew risks: Comparative risk assessment, Report prepared for the Association of American Railroads.
Independent Transport Safety Regulator (2010) Transport Safety Alert 34 - Use of bio-mathematical models in managing risks of human fatigue in the workplace.
Independent Transport Safety and Reliability Regulator (2006) Driver safety systems, Discussion Paper.
International Civil Aviation Organization (2016) Fatigue management guide for airline operators, second edition.
Jackson CL, Patel SR, Jackson WB 2nd, Lutsey PL and Redline S (2018) ‘Agreement between self-reported and objectively measured sleep duration among white, black, Hispanic, and Chinese adults in the United States: Multi-Ethnic Study of Atherosclerosis’, Sleep, 41(6).
Karrer K, Briest S, Vohringer-Khunt T, Baumgarten T and Schleicher R (2005) ‘Driving without awareness’, in G Underwood (ed) Traffic and Transport Psychology: Theory and Application, Elsevier, Oxford.
Larue GS, Rakotonirainy A and Pettitt AN (2011) ‘Driving performance impairments due to hypovigilance on monotonous roads’, Accident Analysis & Prevention, 43 pp.2037-2046.
Lauderdale DS, Knutson KL, Yan LL, Liu K, and Rathouz PJ (2008) ‘Self-reported and measured sleep duration: how similar are they?’, Epidemiology, 19:838–845.
Lim J and Dinges DF (2010) ‘A meta-analysis of the impact of short-term sleep deprivation on cognitive variables’, Psychological Bulletin, 136:375-389.
Loukopoulos LD, Dismukes RK and Barshi, I (2009) ‘The perils of multitasking’, AeroSafety World, 4(8):18-23.
Moray N, Groeger J and Stanton N (2017) ‘Quantitative modelling in cognitive ergonomics: predicting signals passed at danger’, Ergonomics, 60:206-220.
Multer J, Rudich R and Yearwood K (1998), Human factors guidelines for locomotive cabs, Technical Report DOT-VNTSC-FRA-98-8, US Department of Transportation, Federal Railroad Administration.
Multer J, Safar H, Roth E and France M (2019) Why do passenger trains pass stop signals? A systems view, Technical Report DOT/FRA/ORD-19/19, US Department of Transportation, Federal Railroad Administration.
Naweed A and Balakrishnan F (2013) Safety case for driver only operations: Qualitative analysis and real world observations, report prepared for the CRC for Rail Innovation.
Naweed A, Every D, Balakrishnan G and Dorrian J (2014) ‘One is the loneliest number: exploring the role of the second driver in Australian rail operations’, Ergonomics Abstracts, 1:1-8.
Naweed A, Balakrishnan G and Dorrian J (2018) ‘Going solo: hierarchical task analysis of the second driver in “two-up” (multi-person) freight rail operations’, Applied ergonomics, 70.202-231.
Oliver Wyman (2015) Analysis of North American freight rail single-person crews: Safety and economics, Report prepared for the Association of American Railroads.
Raslear TG, Gertler J and DiFiore A (2013) ‘Work schedules, sleep, fatigue, and accidents in the US railroad industry’ Fatigue: Biomedicine, Health & Behavior, 1:99-115.
Roach GD, Fletcher A and Dawson D (2004) ‘A model to predict work -related fatigue based on hours of work’, Aviation, Space, and Environmental Medicine, 75:61-69.
Roach GD, Reid KJ and Dawson D (2003) ‘The amount of sleep obtained by locomotive engineers: Effects of break duration and time of break onset’, Occupational and Environmental Medicine, 60:e17.
Rudin-Brown, CM, Harris, S and Rosberg, A (2019) ‘How shift scheduling practices contribute to fatigue amongst freight rail operating employees: Findings from Canadian accident investigations‘, Accident Analysis & Prevention, 12:664-69.
Rudin-Brown, CM and Rosberg, A (2021) ‘Applying principles of fatigue science to accident investigation: Transportation Safety Board of Canada (TSB) fatigue investigation methodology’, Chronobiology International, 38:296-300.
Sallinen, M and Kecklund, G (2010) ‘Shift work, sleep, and sleepiness—differences between shift schedules and systems’, Scandinavian journal of work, environment & health, 36:121–133.
Stanton, N and Baber, C (2008) 'Modelling of human alarm handling response times: a case study of the Ladbroke Grove rail accident in the UK', Ergonomics, 51:423-440.
Stein C, Liu A, Brown DA and Porch A (2019) Monitoring engineer fatigue (MEFA), Technical Report DOT/FRA/ORD-19/48, US Department of Transportation, Federal Railroad Administration.
Thiffault, P and Bergeron, J (2003), ‘Monotony of road environment and driver fatigue: a simulator study’, Accident Analysis & Prevention, 35:381-391.
Transportation Safety Board of Canada (2022) TSB Recommendation R22-04 (Enhanced train control for key routes).
Tucker P and Folkard S (2012) Working time, health and safety: A research synthesis paper, Background Report to the International Labour Office for the ILO Tripartite Meeting of Experts on Working time Arrangements, Geneva: International Labour Office.
Watson NF, Badr MS, Belenky G, Bliwise DL, Buxton OM, Buysse D, Dinges DF, Gangwisch J, Grandner MA, Kushida C, Malhotra RK, Martin JL, Patel SR, Quan SF, Tasali E (2015) ‘Joint consensus statement of the American Academy of Sleep Medicine and Sleep Research Society on the recommended amount of sleep for a healthy adult: methodology and discussion’, Journal of Clinical Sleep Medicine, 11:931-952.
Whitlock A (2002) Driver vigilance devices: Systems review, Report No. 03 T024 QUIN 22, Rail Safety Standards Board, London.
Wickens CD, Hollands JG, Banbury S and Parasuraman R (2013) Engineering psychology and human performance, 4th edition, Pearson Boston, MA.
Wickens CD and McCarley JS (2008) Applied attention theory, CRC Press, Boca Raton, FL.
Williamson A, Lombardi DA, Folkard S, Stutts J, Courtney TK and Connor JL (2011) ‘The link between fatigue and safety’, Accident Analysis and Prevention, 43:498–515.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the rail traffic crew of train 2K66
the network control officer
Pacific National
Arc Infrastructure
Watco (the operator of train 2K66)
the Office of the National Rail Safety Regulator (ONRSR)
the Rail Industry Safety and Standards Board (RISSB).
Submissions were received from the following directly involved parties:
Pacific National
Arc Infrastructure
ONRSR
RISSB.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Train Braking Systems
Dynamic brake
The dynamic brake, independent brake, and automatic brake are sub-systems of the train’s overall braking system.
Dynamic braking is a locomotive braking function present in diesel-electric and electric drive locomotives. It is not a substitute for the train’s air braking but is a supplementary system that provides an additional means of speed control. A benefit of dynamic braking is to reduce the wear and heat generated by the friction style train braking equipment used by the independent and automatic braking sub-systems.
Dynamic braking uses the locomotive electrical traction motors as generators, converting the kinetic energy of a moving train into electrical energy. The electrical energy generated is dissipated into fan cooled electrical resistor banks. Increasing or decreasing the amount of electrical resistance in the resistor banks varies the load on the traction motor generator, which applies a corresponding resistance/braking effect on the rotating locomotive wheels.
Independent brake
The independent brake solely controls air brakes within the locomotive(s) and works independently of a train’s other braking control systems. The locomotive brakes are applied when the locomotive brake cylinder pressure is increased. This pressure can be increased or decreased via the driver’s independent brake control handle.
Automatic brake
The automatic brake controls the air brakes in the entire train, including the locomotive(s). An application of the automatic brake applies the locomotive(s) brakes by increasing locomotive brake cylinder pressure (similar to control via the independent brake system). The automatic brake simultaneously triggers the application of the train’s wagon brakes by reducing the air pressure within the train’s brake pipe. Maximum wagon braking effort is achieved when the brake pipe pressure is reduced to about 350 kPa, and wagon brakes are released when the brake pipe is charged to about 500 kPa.
The driver can vary the train’s braking effort by operating the locomotive’s automatic brake control handle. Brake pipe air pressure is reduced at the service rate for normal braking applications, or at the greater emergency rate when an emergency brake application is made. The driver also has a ‘bail-off’ feature whereby they can suppress the braking action of the locomotive(s) following an automatic brake application, therefore enabling only the wagon brakes to stop the train.
Train-line emergency brake application
In the event that the train’s brake pipe is broken or ruptured following a train separation, derailment, or collision, the train’s wagon and locomotive brakes are automatically applied at the emergency rate. This safety feature of the automatic brake is also known as a train-line emergency brake application.
To detect train separations, locomotives are fitted with braking control systems designed (among other control purposes) to detect the rapid reduction of the train’s brake pipe pressure. In the event that a rapid reduction of brake pipe pressure is detected, the braking control systems enable the locomotive(s) emergency braking systems to remove the locomotive drive and provide a faster braking response to bring the train to a stop. These additional emergency braking system actions can include:
faster exhaustion of brake pipe air pressure towards 0 kPa via the locomotive’s brake control valves
removal of the brake pipe charging source (compressor output) from attempting to re-charge the train’s brake pipe
application of the locomotive brake
de-energization of the locomotive traction power via the pneumatic control switch/power knockout switch (PCS)
Appendix B – Research on locomotive vigilance system limitations
The Rail Industry Safety and Standards Board (RISSB) standard AS 7511 Onboard Train Protection Systems identified vigilance systems as a partial control against ‘failures’ relating to the task of train driving or supervising the rail corridor. The standard describes vigilance systems as being:
Effective at stopping the train and disabling traction power when it detects that driver has not performed a linked task or responded to a Vigilance alert. Drivers say it can wake them up.
There is widespread understanding within the rail industry that although vigilance systems are a useful control for detecting complete driver incapacitation, they are fundamentally limited for managing other forms of inattentiveness, particularly a low level of alertness. AS7511 provided a summary of the main limitations of vigilance systems, noting that:
[A] Driver can be doing linked tasks or responding to vigilance alerts from vigilance but not be alert, vigilant or attending to the tasks of driving a train or supervising the rail corridor. There is a time period during which driver response is not being monitored (timing cycle).
Analysis by the US Federal Railroad Administration (Multer and others 1998) helps explain this limitation, and how it is inherent in the way vigilance systems work:
The use of devices to detect physical activity determines if the engineer[102] is awake. However, true vigilance requires mental attention to the task. Wakefulness is a necessary, but not sufficient, condition for ensuring vigilance. Current vigilance devices set up four possible conditions. First, the device can detect activity and the engineer's attention is on the task. Second, the device does not detect activity, but the engineer is attending to the task. Third, the device can detect activity, but the engineer is not attending to the task. Fourth, the device does not detect activity and the engineer is not attending to the job.
The potential for habitual and automatic responding to vigilance alarms is a known limitation to vigilance systems, with regulators and industry bodies making similar conclusions about the limitations of vigilance devices:
The US Federal Railroad Administration (Stein and others 2019) summarised that although vigilance detection devices can identify when drivers are physically disengaged, if drivers are mentally disengaged but physically engaged using automatic behaviour then this scenario will not be identified.
The New South Wales Independent Transport Safety and Reliability Regulator (ITSRR 2006) noted that drivers may respond automatically to vigilance demands, and that drivers may pre-empt the vigilance alarms.
The UK Rail Safety and Standards Board (Whitlock 2002) summarised that ‘drivers are reported to respond to these types of vigilance devices in an automatic manner as a result of becoming used to their temporal spacing (habituation) or anticipating their action (prediction). Habituation and prediction can significantly reduce the effectiveness of traditional vigilance devices’.
There have been numerous examples where fatigued, distracted or otherwise inattentive drivers were still able to respond to vigilance system alerts prior to derailment and collision accidents:
Collision at Sugar Valley, Georgia USA, 1990: The US National Transportation Safety Board (NTSB) report[103] found that the onboard vigilance detection system ‘was so easily reset that it could be done by a reflex action without conscious thought’.
Collision at Beresfield, NSW, 1997 (see alsoCollisions with a pre-cursor SPAD: This investigation found that ‘Operating a train vigilance control was a task that would have been simple and automatic to the crew of DR396…The vigilance control system was ineffective in detecting reduced levels of alertness’. This investigation suggested that fixed-time alerting cycles were inferior for monitoring and assuring vigilance, compared to random intervals.
Collision at Macdona, Texas, 2004: The NTSB report[104] identified that the engineer (driver) was able to respond to the vigilance device (called ‘alerter’ in the US), despite probably being impaired by fatigue. The report stated ‘That the engineer could have remained sufficiently alert to make train control inputs and yet be unable to respond to vitally important signal indications may be explained by the fact that making such inputs and manipulating the alerter are highly practiced, nearly reflexive, motor responses that require only lower level cognitive effort…[The engineer] could have been able to continue the reflexive control activities while being unable to perform the higher level cognitive tasks of extrapolating information from the signal indications.’
Derailment at Benalla, Victoria, 2006: This ATSB investigation[105] found that the driver and co‑driver were probably in a state of degraded alertness prior to the accident, and that ‘The fixed time base vigilance system installed on (the locomotive) was possibly ineffective in ensuring an adequate level of driver alertness.’
Uncontrolled run-back at Cumbria, UK, 2010: This UK Rail Accident Investigation Branch (RAIB) report[106] found ‘… the driver acted less frequently to control their train but more frequently to cancel warnings from the driver’s vigilance device and the automatic warning system. Cancelling frequent warnings is known to become habitual, particularly with reduced alertness and monotony.’
There are consistent themes in these accidents, where drivers were able to respond to vigilance alarms and prevent penalty brake applications while not being sufficiently alert or attentive, due to habitual or automatic responding to the alarms. Pressing a vigilance acknowledgement pushbutton is very simple and drivers can respond to vigilance alarms without much thought or attention. On many freight train journeys, a driver may travel over long stretches of geographically uncomplicated track where their most frequent ‘task’ is acknowledging the vigilance alarm. This situation can further habituate the driver to the vigilance alarm and reduce the amount of attention allocated to responding.
After the Beresfield accident in 1997, the Monash University Accident Research Centre reviewed in-cab vigilance devices on board Freight Corp trains (Haworth and others 1998). Using interviews and in-cab videos, this study found:
The current Vigilance Control System can be operated in a largely automatic manner and does not require conscious attention or vigilance to respond to the system.
The study observed examples of automatic responding to vigilance demands, and described anecdotes such as drivers returning from work pressing an imaginary pushbutton in their car, or pressing an imaginary pushbutton on their partner while they slept.
The Monash University study of Freight Corp vigilance systems identified 2 potential design features that may have been contributory to the drivers’ automatic responding to the vigilance warnings:
Pre-emption of warnings: The study found that ‘One of the main contributors to the automaticity of the current [vigilance system] is the ability of drivers to respond prior to the presentation of the light. The drivers have developed a strategy of pre-emption which removes the requirement of looking at the light…the pre-emption response was found to be an extremely strong pattern of behaviours.’’
Fixed cycle lengths: The study stated that ’major contributor to the automaticity of the current [vigilance system] is the fixed cycle length…this fixed interval is a fundamental flaw because it allows pre-emption to be a successful strategy for performing the task’.
In theory, pre-emption of the vigilance alert may reduce the effectiveness of the system as it allows the pushbutton press to become wholly divorced from the demands of the vigilance system. If the driver is continually pressing the vigilance acknowledgement pushbutton prior to the vigilance alert, the driver may never be alerted when the system detects inactivity. AS 7511 required vigilance systems allow a maximum of one pre-emption of the vigilance cycle, stating that:
At the request of the [Rail Transport Operator], the vigilance system shall allow up to one pre-emption in the pre-alert phase of the vigilance cycle. Subsequent pre-emptions will be ignored until the vigilance cycle is reset by another means.
A pre-emption is the [driver] using one of the manual acknowledgement options before the alert (the pre-alert phase). This requirement limits [drivers] in building up a pattern of acknowledgement that can be carried without conscious thought (habituation). One pre-emption feature is available in some long-distance passenger rolling stock for the [driver] to use when approaching and stopping at a station.
The ATSB is not aware of any research comparing the sensitivity of vigilance systems that allow drivers to pre-empt warnings versus systems that do not allow pre-emption.
A report by ITSRR (2006) argued that varying the timing of vigilance demand cycles may not address the issue of drivers automatically acknowledging the alarm, since the automaticity was in response to the vigilance prompts rather than the constant prompting cycle. However, there is also no known research that empirically tested the effectiveness of fixed versus random interval cycles for vigilance devices.
Appendix C – Research on irregular roster patterns and fatigue risk
Irregular working hours are a common feature of rail scheduling. One plausible hypothesis is that irregular, unpredictable shift schedules contribute to fatigue risk because they interfere with the development and maintenance of a ‘sleep pattern’. Rail investigations by the Canadian Transportation Safety Board have identified ‘sporadic disruptions to normal sleeping patterns’ as factors associated with the development of several major accidents (Rudin-Brown and others 2019).
Dorrian and colleagues (2022) surveyed 751 train drivers from Australia and New Zealand, and found that over half reported that their shift patterns were either irregular or very irregular. This study found that workers with irregular and variable shift patterns tended to have less sleep on workdays, with greater variation in sleep lengths. As shown in Figure 20, irregular shift patterns were strongly associated with poorer self-reported sleep quality, and more frequent feelings of tiredness (Figure 20).
Figure 20: Research findings from Dorrian and others (2022), showing self-reported sleep and tiredness of train drivers
Note: From Dorrian and others (2022). Vertical axes show perceptions of sleep amounts (left) and tiredness (right), split by schedule regularity (horizontal axis).
The Federal Railroad Administration (FRA) reported on a survey of over 9,000 train drivers in the US (Dunn and Soccolich 2023). This survey found that drivers regularly experienced irregular shift patterns. Over 90% reported 2 or more changes from day to night shifts each week, and over 60% reported day-to-day variation in start time of 8 hours or more.
The research conducted by the FRA included questions to measure self-reported fatigue. Analysis showed that irregular shift patterns were strongly associated with self-reported fatigue, for example showing that workers who reported very irregular working hours were 2.3 times more likely to be ‘highly fatigued’ than those who conducted the majority of their work during the day. When the drivers were asked which factors contributed most to fatigue at work, irregular working hours was the most commonly identified factor, nominated by over 80% of drivers.
Although some research indicates a link between irregular rosters and fatigue, an alternative hypothesis is that shiftworkers’ sleep and alertness does not adapt to the timing of work and therefore there is no such thing as an idiosyncratic ‘sleep pattern’ formed by the timing of recent shifts. In support of this, research has shown that most people will generally not adapt their sleep‑wake cycle while on night shifts (Tucker and Folkard 2012). Ferguson and others (2010, 2012) examined roster patterns in a mining environment with day shifts followed by night shifts. The amount of sleep did not increase over the week of night shifts, and various measures indicated that the workers’ sleep-wake cycles did not adapt during the week of night shifts.
Other research has shown that rapidly rotating shift schedules were associated with more sleep and greater levels of alertness than schedules that required workers to conduct consecutive night shifts (Harma 2006). This indicates that rapidly changing schedules presented a lower cost, in terms of fatigue risk, compared to working more shifts at night (with a more consistent ‘sleep pattern’).
To date, there has been limited systematic research evaluating the effects of irregular schedules of sleep and fatigue. Sallinen and Kecklund (2010) noted that:
…It is not possible to conclude whether irregular shift systems are worse than regular ones, although the general impression of the studies is that individuals having irregular work schedules may be at higher risk of developing cumulative sleep loss and excessive work-related sleepiness. In addition, the shortage of controlled intervention studies makes it difficult to provide recommendations on how irregular shift systems should be designed to reduce sleep loss and severe sleepiness.
The ATSB concluded that the evaluation described by Sallinen and Kecklund is probably still representative of the current state of research on irregular shift patterns, and that there is not sufficient evidence to conclude that irregular shift patterns produces a significant independent risk factor for the development of fatigue.
Appendix D – Additional contextual information about driver only operations
Research into driver only operations
Naweed and others (2013; 2014) conducted interviews with Australian freight and passenger drivers, and conducted cab-ride observations of freight and passenger driver only operations (DOO) and multi-rail traffic crew services. Observations from multi-rail traffic crewed main line driving operations showed that both drivers shared responsibility for calling out and confirming signs and signals, and the researchers noted that this:
…points to the function of the second driver as one that may increase vigilance, safety and tolerance to error, but raises additional questions of whether it would be a necessity or a desirable feature of mainline driving.
The research was qualitative in nature, meaning there was no quantitative comparison of the safety of DOO compared to multi-rail traffic crewed operations.
Freight drivers tended to perceive that having multiple rail traffic crew on board was beneficial for safety, partly because the second driver provided a second pair of eyes for observing signals and other important tasks. Comments recorded in this research included:
• ’If it’s yellow light, slow down. Are you going to put the brakes on [primary driver], put the [expletive] brakes on! So there’s prompts and stuff.’
• ‘[The second driver] can actually see some of the signals before you do.’
• ’It never hurts to have more than one pair of eyes.’
The research also identified that some drivers perceived that the presence of a second driver could also have a negative effect on safety, because of conflict between drivers and because of the potential of the second driver to distract the primary driver.
More recent research (Naweed and others 2018) supported these findings, noting:
Other than the running brake test and monitoring/response to warning/safety systems, the second driver was involved in every arm of tasks associated with achieving the goal of driving on the mainline. These included monitoring of train condition and integrity, reviewing and tracking other trains, reviewing and updating weather conditions (Task 3.7), maintaining vigil of the external environment (Task 3.8), communicating with the controller (Task 3.9), and the Shift Coordinator (Task 3.10). Additionally, the second driver was involved in 20 of the 26 review and update location sub tasks (77%), two of which were performed independently.
International assessment of driver only safety
In 2016, the United States Federal Railroad Administration (FRA) issued a Notice of Proposed Rulemaking (81 FR 13917) which outlined regulations that would require a minimum of 2 rail traffic crew members for US railroad operations, with some exceptions. In proposing these regulations, the FRA noted that due to an absence of high-quality incident data it could not ‘provide reliable or conclusive statistical data to suggest whether one-person rail traffic crew operations are generally safer or less safe than multiple-person rail traffic crew operations’.
Although not able to demonstrate an increase in accident risk through data, the FRA proposal cited several reports indicating potential risks associated with single driver operations, including the following relating to fatigue:
…it appears that a railroad considering a one-person train crew operation should consider whether the crew member is likely to be fatigued. In a railroad's safety analysis, prior to implementing a one-person operation, it would be prudent for the railroad to consider what redundancy backstops have been implemented in case the crew member falls asleep on the job. If FRA needed to review and approve an operation with less than two crew members, the agency would be looking to see if the railroad implemented strategies for reducing railroad worker fatigue, such as improving the predictability of schedules, considering the time of day it permits one-person train crews to operate, and educating workers about human fatigue and sleep disorders. This study could help provide a railroad with some ideas for reducing fatigue in its train crew members.
A report in submission to this proposed rule included analysis using publicly available data comparing the safety of DOO and multi-person rail traffic crew operations in the United States, showing no significant safety differences between the 2 modes of operation (Oliver Wyman 2015). The same report also included analysis of incident rates in the United States (where rail freight was primarily conducted with 2 drivers) and comparable European jurisdictions that primarily used DOO. The analysis found that European operations were typically as safe or safer than those in the United States. Significantly, all European operations examined in this analysis utilised a form of positive train control or similar.
Another report in submission to the proposed rulemaking analysed the risk of specific accident causes in US main line freight operations (ICF Incorporated 2015). The analysis determined that there were almost no differences between the safety of DOO and 2-person operations in rail networks where positive train control was fully implemented.
In 2019, the FRA withdrew the notice of proposed rulemaking for rail traffic crew requirements, stating ‘no regulation of train crew staffing is necessary or appropriate for railroad operations to be conducted safely at this time.’ In December 2020, the FRA announced the full implementation of positive train control across the United States freight network.
There is infrequent coverage of positive train control or automatic train protection systems upon the Australian freight rail network, and therefore the observations made in relation to other jurisdictions about the impact of DOO may not be applicable to the Australian network. The ATSB is not aware of any research that has evaluated the safety record of freight rail networks using DOO without positive train control or automatic train protection systems.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
[1] Wherever possible, such technical solutions should also be interoperable across different networks. See the National Transport Commissions National Rail Action Plan regarding standardisation and interoperability of systems.
[2] All time references in this report are local time (Western Standard Time).
[3] Driver only operation: a train crewing configuration where a single driver operated the train without the presence or assistance of any other onboard personnel.
[4] Integrated Planning Services: a section of Pacific National that provided real-time management of its trains as they transited across Australia. This included the real-time monitoring of drivers’ work hours in line with the fatigue management system requirements and the progress of its train services.
[5] Crossing movement: a movement that allows trains travelling in opposite directions on single tracks to pass each other at a station or crossing loop.
[6] A caution (yellow) or a stop (red) signal aspect.
[7] Up and down: identification of the track direction of travel. In respect to Jumperkine, up refers to rail traffic travelling towards Perth, and down refers to rail traffic travelling away from Perth.
[8] Vigilance system: a system that will react by directly initiating an emergency brake application if an acknowledgment input is not received within a specified time increment. Inputs occurred via the driver pressing the vigilance acknowledgement pushbutton. The system also reset if the driver made some types of driver control inputs. See Locomotive vigilance system information for details on the vigilance system used on 7MP5’s locomotives.
[9] Roll-by inspection: a visual inspection of a train to identify equipment, loading security or other defects or failure while the train is moving.
[10] Open channel: radio communications can be received by other train crews and track workers in the area of operations.
[11] At the time of the collision, due to reduced track clearances, Arc Infrastructure had in effect a work directive prohibiting the crossing of narrow gauge up rail services (such as 2K66) with standard gauge down rail services (such as 3PM4) between Jumperkine and Midland.
[12] Caution: an aspect that advises the driver that the next signal may be red (or at danger), requiring the train to stop. In the Arc Infrastructure context it is indicated by a single yellow aspect.
[13] Temporary speed restriction ahead signs are diamond shaped with a yellow background and a horizontal black stripe. This sign is placed 2,500 m before a temporary speed restriction start sign. Placed below the ahead sign is a maximum speed sign displaying the maximum speed permitted for the restricted area.
[14] Events were derived from multiple sources that were not automatically time synchronised. These sources were manually synchronised post-accident by the ATSB using events common to the sources. As a result of this, there may be slight variances in the times reported throughout this report.
[15] Temporary speed restriction start signs are circular shaped with a yellow background with a horizontal black stripe. This sign is placed 50 m before the area covered by a temporary speed restriction. Placed below the temporary speed restriction start sign is a maximum speed sign displaying the maximum speed permitted for the restricted area. The temporary speed restriction start sign at Jumperkine indicated the start of the 30 km/h speed restricted location.
[16] Service brake: a brake application of the automatic brake in the normal operating mode, without using the full service or emergency positions. Such an application is intended to slow the train but not stop it.
[17] Emergency brake: maximum brake application made when a train must be stopped in the minimum distance possible, initiated by the driver or other crew member, or by a fault in the brake system such as rupture to the brake pipe or air hoses becoming disconnected.
[18] The NCO made similar radio calls to 7MP5 at 0200:21, 0200:53, 0202:39 and 0204:32.
[19] In the context of the CBH class locomotive, this alarm is generated if a trailing locomotive in the consist had at least one alarm active on its Computer Display Unit. The type of alarm that triggered the T/L Alarm is diagnosed from the trailing locomotive which was the source of the alarm.
[20] Brookfield Rail was rebranded to Arc Infrastructure on 17 July 2017.
[21] Centralised traffic control system: a system of remotely controlling the points and signals at a number of interlocked stations, junctions and crossing loops in automatic signalling areas, from a centralised control room or signal box.
[22] Automatic train protection (ATP): involves the installation of technology on the trains themselves and the tracks (trackside). The ATP technology transmits information from the trackside equipment to the train that supervises train speed, target speed, and enforces braking when necessary to prevent derailments and SPAD occurrences.
[23] Automatic train stops: a train stop system involves a trip cock on the vehicle and a trip arm located trackside that directly initiates an emergency brake application from the trip cock coming into contact with the trip arm. The trip arm is located adjacent to the signal, and the lever arm elevates when the signal is displaying a red aspect and returns horizontal when the signal clears.
[24] As accredited by the Office of the National Rail Safety Regulator (ONRSR).
[25] The overlap of a signal is an extension of a track circuit beyond a stop signal to provide a margin of safety beyond that signal. The overlap must be unoccupied and free of opposing signal locking before the signal is permitted to show a proceed aspect.
[26] These distances refer to track kilometres from Perth.
[27] Searchlight: a colour light signal that can display red, yellow and green aspects from a single optical assembly by placing separate coloured lenses in front of a single lamp.
[28] Driver completely missed SPAD: where no attempt has been made to bring a train to a stand before the signal at danger and the train has proceeded into the next section or block without authority. The driver has not realised that the train has passed a signal at danger until a more serious event results, or the driver is stopped by network control communication, the next signal, or by other external intervention.
[29] The signal interlocking data was derived from a proprietary microprocessor-based logic controller specifically designed for railway fail-safe applications. The system provided all the interlocking functions between points, signals and conflicting train routes. The system processed all the field inputs and drives the outputs interfacing with designated field equipment while simultaneously maintaining a log of the various commands and the state of the input/output field equipment.
[30] Party-line: a communication system where multiple subscribers are connected to the same communication channel.
[31] Geoscience Australia defined the ending of astronomical twilight as the instant in the evening when the centre of the sun is at a depression angle of 18° below an ideal horizon. At this time, the illumination due to scattered light from the sun is less than that from starlight and other natural light sources in the sky.
[32] Geoscience Australia defined the ending of civil twilight as the instant in the evening when the centre of the sun is at a depression angle of 6° below an ideal horizon. At this time, in the absence of moonlight, artificial lighting or adverse atmospheric conditions, the illumination is such that large objects may be seen but no detail is discernible. The brightest stars and planets can be seen, and for navigation purposes at sea the sea horizon is clearly defined.
[33] The waning crescent phase is an intermediary phase between the third quarter and the new moon (when the moon is almost invisible).
[34] Intermodal freight transport involves the transportation of freight in an intermodal container or vehicle, using multiple modes of transportation, without any handling of the freight itself when changing modes.
[35] Medium freight train, about 680 m in length, and 1,500 t.
[36] The braking performance requirements contemplated a full service brake application. An example of a pure full service brake application of train 7MP5 was not available. Instead, the emergency brake application response for 7MP5 was used for braking response estimates. Note that these estimates assume that:
the mass of the train is uniformly distributed throughout the length of the train
the gradient is constant over the entire braking distance
the train deceleration due to the brake application is constant
the track is straight (no curves) over the entire braking distance
there is no delay in propagation of brake application
other forces such as friction, wind, adhesion, and rail head contaminants effecting adhesion have been ignored.
Given these assumptions, there are likely variances between these estimates and what may have happened at the time of the collision.
[37] Light emitting diode: a semiconductor device that emits a bright light when current flows through it.
[38] Details of one of these events is provided in Beckwith, Western Australia on 14 August 2019. The other event occurred after the Jumperkine accident and involved a different rolling stock operator.
[39] Controlled signal blocking: a method used by qualified workers to carry out work on track using controlled signals set and kept at stop.
[40] Train control diagram: a diagram, also known as a Train Control Graph, showing operational information for a train control area.
[41] On-the-job observations were undertaken to observe the network control officer’s compliance with the general responsibilities of a network controller procedure, and any other day-to-day function.
[42] Relates to a shunt movement of another train at another location (Forrestfield), within the NCO’s area of control of the Arc Infrastructure network .
[43] Driver pre-emption of alarms is displayed in Figure 16,as the grey time-up period that does not progress to a visual alert.
[44] The driver involved in the August 2019 Beckwith SPAD event was not involved in the 24 December 2019 accident at Jumperkine.
[45] Drowsiness detection technology involves in-vehicle equipment which monitors metrics such as head position and eye closure, and generates in-vehicle and/or back-to-base alerts when fatigue symptoms are detected.
[46] NTSB.Railroad Accident Report NTSB/RAR-06/03, Collision of Union Pacific Railroad Train MHOTU-23 with BNSF Railway Company Train MEAP-TUL-126-D with subsequent derailment and hazardous materials release, Macdona, Texas, June 28, 2004
[47] Assessed as competent over the route and current to drive the route.
[48] The category 1 rail safety worker health assessment included the Epworth Sleepiness Scale, which asks respondents to rate the likelihood they would fall asleep in common situations (such as watching TV). The driver indicated they would never fall asleep in any of the situations described by the questionnaire.
[49] The National Standard for Health Assessment of Rail Safety Workers (2017), published by the National Transport Commission, specified that a worker should undergo a sleep study if they had a history of loud snoring or sleep apnoea events, had a body mass index (BMI) over 40, or had a BMI over 35 and type 2 diabetes or high blood pressure.
[50] The term ‘sleep opportunity’ is distinct from the amount of sleep obtained. Sleep opportunity in the context of this report’s analysis of the driver’s recent history refers to periods the driver was not on duty and no other data indicated they were awake. The actual sleep obtained by the driver was probably less than the sleep opportunity.
[51] Times were rounded to the nearest 10 minutes.
[52] Phone records indicated that the driver’s mobile phone received a text message at 2356 and an email at 0037. It is not known whether the driver reviewed these messages in the period prior to the accident. There were limitations in mobile phone coverage along the route.
[53] Use of artificially-lit devices can negatively affect sleep quality, quantity and alertness (Chang and others 2014). If the driver had attempted to rest between these periods of phone use, the duration and quality of the sleep may have been negatively affected by the light exposure from the mobile phone.
[54] In the context of rostering, ‘peak’ and ‘non-peak’ described different times of year, with the ‘peak’ period being 1 October to 31 December.
[55] The drowsiness detection technology fitted to the Pacific National light vehicles was provided by the Guardian system supplied by Seeing Machines and it was a non-invasive driver alertness and drowsiness warning system. This system was configured to provide in-cab and back-to-base alerts and data if it detected signs of driver fatigue or distraction.
[56] Distraction in this context is when the vehicle is exceeding 30 km/h and the driver’s head is not pointed in the forward-facing direction, with eyes not focussed on the road ahead for a period greater than 4 seconds.
[57] Drowsiness in this context is when the vehicle is exceeding 30 km/h and the driver’s eyes are closed for a period greater than 1.5 seconds.
[58] FAID was initially known as ‘Fatigue Audit InterDyne’. It was subsequently renamed the Fatigue Analysis Tool by InterDynamics.
[62] Vigilance decrement in this context is the deterioration in the ability to remain vigilant for critical signals with time, as indicated by a decline in the rate of the correct detection of signals.
[63] A microsleep is a sleep event with very short duration. There is no generally accepted definition of microsleep (Hertig-Godeschalk and others, 2020). Blaivas and others (2007) describe microsleeps as ranging from 3 to 15 seconds.
[64] TSB Railway Investigation Report R14V0215, Main-track derailment Canadian National Railway Train Q19771-09, Kwinitsa, British Columbia, 15 November 2014
[65] The last recorded braking applications were moving dynamic brake from notch 4 to 6 at about 0149:20 and then to notch 0 at about 0150:10.
[66] Cross-calling is a formal 2-way in-cab communication process, where rail traffic crew verify verbally that each other has recognised and understood displayed signal aspects.
[67] To replicate this analysis with more recent data, the ATSB requested similar data from Pacific National for 2018 and 2019. However, Pacific National was not able to obtain kilometres travelled data for each operation type to do a comparison of rates.
[68] The number of SPADs per km travelled is a limited indicator of the safety performance of train systems. This rate does not account for the exposure of drivers to restricted signals.
[69] The term statistical significance indicates the probability there was no true difference between variables, after accounting for random variation. The ATSB has applied a conventional threshold (alpha) of 0.05, meaning for a test to be statistically significant there was less than 5% probability of there being no true difference.
[70] ONRSR Rail Safety data for Western Australia was not included until Western Australia joined the ONRSR on 2 November 2015.
[72] Calling on/Low speed signal: subsidiary signal that, when showing a ‘proceed’ indication, authorises the driver to proceed under control into a section of line that may be obstructed at any point.
[76] The ATSB reviewed and accuracy checked completely missed SPAD records from the ONRSR notifiable occurrence data between November 2015 and December 2019. From this, the ATSB identified a similar completely missed SPAD rate to the Arc Infrastructure’s review.
[77] This category refers to an overrun of limits of an authority, where the authority limits are not communicated by signal indication and the rail traffic crew did not recognise the overrun.
[82] In June 2019, following this Wagga Wagga occurrence, the rail infrastructure manager amended its procedures to require an emergency response from the NCO for rail traffic that had exceeded its limits of authority (SPAD).
[83] The Infrastructure and Transport Ministers' Meetings provide a forum for inter-governmental collaboration, decision-making and progressing priorities of national importance. The meetings facilitate work with the Commonwealth, state, territory and local governments to drive national reforms that improve the safety and productivity of Australia's transport and infrastructure systems.
[85] For a review of the effects of fatigue on cognitive performance see Lim and Dinges (2010). For a useful summary see also Rudin-Brown and Rosberg (2021).
[86] FAID Quantum is a different BMMF to the normal FAID (Standard) BMMF. It is available from the same provider as FAID.
[87] The Office of the National Rail Safety Regulator (ONRSR) Fatigue Risk Management Guideline (2022) essentially provided the same definition, sourced from the ICAO document. It also noted that the exact timing could vary due to individual differences, time of year, light exposure and time zone.
[93] In the Ladbrook Grove accident, the train control system presented several different alarm messages and changes on a map display that progressively indicated the train’s position from 5 seconds after the SPAD alarm.
[94] For example, in the Ladbroke Grove accident, the train control system presented all alarm messages on a different screen to the map display.
[95] In this context, the brake application propagation is the time from when the driver physically applies the emergency brake until maximum braking effort is applied on each wagon.
[96] The ATSB is satisfied that the corrective action identified by Pacific National will reduce the risk of this safety issue. This ATSB determination is unrelated to the status of the EVU with ONRSR (see ONRSR website for EVU status details).
[97] A controlled automatic signal operating as an automatic signal is said to be operating in ‘fleeting mode’. Refer to Traffic control system section for more details.
[98] Section of main line between Avon Yard and Millendon (Figure 1).
[99] In the Jumperkine context, this would be the previous controlled absolute signal to Jumperkine signal 12L, which would be signal 4L at Moondyne, about 21 km away.
[100] This rule has superseded the RISSB Australian Network Rules and Procedures (ANRP) rule 6001.
[101] Sanding is used in train operations to improve adhesion or traction in both braking and traction.
[102] Within the US rail system the term ‘engineer’ is used to describe the primary locomotive driver
[103] NTSB Railroad Accident Report NTSB/RAR-91/02, Collision and derailment of Norfolk Southern train 188 with Norfolk Southern train G-38 at Sugar Valley, Georgia, August 9, 1990
[104] NTSB.Railroad Accident Report NTSB/RAR-06/03, Collision of Union Pacific Railroad Train MHOTU-23 with BNSF Railway Company Train MEAP-TUL-126-D with subsequent derailment and hazardous materials release, Macdona, Texas, June 28, 2004
[105] ATSB rail occurrence investigation report 2006005, Derailment of train 5MB7 at Benalla, Victoria, 2 June 2006
[106] RAIB Rail Accident Report 15/2011, Uncontrolled freight train run-back between Shap and Tebay, Cumbria, 17 August 2010
Preliminary report
Report release date: 06/04/2020
The occurrence
Overview
At about 0200[1] on 24 December 2019, freight train 7MP5 (operated by Pacific National) collided with the rear of a loaded grain train 2K66 (operated by Watco) at Jumperkine, Western Australia (WA) (Figure 1). The locomotive cabin of 7MP5 was damaged with a significant amount of grain entering the locomotive cabin. The driver of train 7MP5 sustained fatal injuries.
Figure 1: Kalgoorlie to Perth Arc Infrastructure network geography
The image shows the location and place names of locations relevant to this accident.
Source: ARA Railways of Australia Map 2014, annotated by ATSB.
Sequence of events
At about 0340 on the 23 December 2019, the Pacific National driver involved in this accident booked off duty for his rostered rest at the Merredin drivers barracks. The driver’s next rostered shift was scheduled to commence later on the 23 December 2019 at 2120. Whilst there had been a change to the assigned train, the driver’s actual shift start time remained in line with his previously scheduled start time.
The driver commenced his rostered shift at 2120 and proceeded to West Merredin (Figure 1) to do a crew change with the driver on the incoming train 7MP5. Following the crew change, the new driver and train 7MP5 departed West Merredin and continued towards Perth at about 2207. Train 7MP5 travelled between West Merredin and Jumperkine, with the driver acknowledging the vigilance system[2] alerts as well as communicating with other train services.
At about 0114 on the 24 December 2019, train 2K66 (also travelling towards Perth) was about 28 km ahead of train 7MP5 as it passed through Toodyay West (Figure 1). Both trains continued their journey towards Perth. About 34 minutes later, Train 2K66, came to a stop on the approach to signal 4La displaying a red, stop aspect at Jumperkine (Figure 2). At about this time, 7MP5 was about 14.5 km behind 2K66 and approaching Jumperkine.
Figure 2: Moondyne to Jumperkine Arc Infrastructure signal system layout
This image shows the signal identifications and track configuration between Moondyne and Jumperkine relevant to the accident. As well as location where train 2K66 was stopped, the signal aspects displayed for train 7MP5, and location of 30 km/h temporary speed restriction after signal 12L.
Source: Arc Infrastructure, annotated by ATSB.
Train 7MP5 passed signal U45 at caution[3] (yellow aspect) at about 0156 and proceeded towards the next signal 12L at Jumperkine (Figure 2). At this time, Jumperkine 12L signal was at danger[4], displaying a red aspect as train 2K66 was stopped with its last wagon about 800 m after this signal (Figure 2).
Soon after passing signal U45, train 7MP5 passed a Temporary Speed Restriction Ahead sign[5] warning of a 30 km/h speed restriction 2,500 m ahead. The driver of 7MP5 continued towards Jumperkine, without undertaking any driver control changes that would have reset vigilance time count. The driver was acknowledging the vigilance system alerts and resetting the vigilance time count via the driver’s push button when necessary. Shortly before signal 12L was likely visible, the driver acknowledged the last vigilance system alert via the driver’s push button. About 21 seconds later, train 7MP5 passed Jumperkine signal 12L at danger (Figure 2), travelling at about 72 km/h. This resulted in a ‘Signal Passed at Danger’ (SPAD) alarm being generated in the ARC Infrastructure network control centre.
Train 7MP5 continued at a speed of about 72 km/h for about 3 seconds where it passed the Temporary Speed Restriction Start Sign[6] and entered the start of 30 km/h speed restricted location. About 3 seconds after entering the speed restricted location, a service brake[7] application was made. The train’s speed gradually reduced as it travelled around a sweeping left hand curve and onto a straight section of track (Figure 3). It is likely that the rear of train 2K66 came into view at about this point, and about 28 seconds after the service brake application, an emergency brake[8] application was made. At this point 7MP5 was travelling at about 59 km/h and was about 175 m from the rear of train 2K66.
Figure 3: Overview of Jumperkine accident site landmarks and braking information.
The image shows the track curvature and geography of the Jumperkine accident site. This includes graphics showing about where service and emergency brake applications were made as well as location of 12L signal and train 2K66. An inset photo shows the night time vision through the curve.
Source: Google Earth and Pacific National, Annotated by the ATSB.
Shortly before the collision, the Arc Infrastructure network controller[9] had commenced calling the driver of 7MP5 on the radio. However, the driver of 7MP5 never replied to the radio calls from the network control officer.
At about 0200, about 13 seconds after the emergency brake application, train 7MP5 collided with the rear of train 2K66. While train speed had further reduced following the emergency brake application, the collision speed was still above 40 km/h (Figure 4). The lead locomotive cabin (NR80) was damaged with a significant amount of grain entering the locomotive cabin. The driver sustained fatal injuries.
Additionally, wagon CBHN 1221 on 2K66, the trailing locomotive of 7MP5 (NR59) and the empty crew van of 7MP5 all sustained substantial damage as a result of the collision.
Figure 4: Accident site, lead locomotive of 7MP5 and last wagon of 2K66 post collision.
The image shows damage to lead locomotive of 7MP5 (NR80) and last wagon on 2K66 (CBHN 1221) post collision.
Source: WA Police and ATSB, Annotated by the ATSB.
Context
Train information
Train 7MP5
Train 7MP5 was a Pacific National intermodal freight service between Melbourne, Victoria and Perth, WA. The train was 1,070 m in length consisting of two NR class locomotives with 25 single and multi-platform wagons and a train weight of 1,958 tonne. A driver only operation[10] was in use for train 7MP5 between West Kalgoorlie, and Perth, WA (Figure 1).
Train 2K66
Train 2K66 was a Watco bulk grain service between Koorda and Perth, WA (Figure 1). The train was 793 m long consisting of two CBH class locomotives and 52 CBHN class grain wagons for a train weight of 3,900 tonne. Train 2K66 was operated by two train crew.
Track information
Arc Infrastructure operated and managed the rail infrastructure from West Kalgoorlie towards Perth, including the Jumperkine accident site. The safeworking system in place between West Kalgoorlie and the Jumperkine accident site was centralised traffic control.[11]
Safety action
Since this accident, as rolling stock operator Pacific National have taken the following proactive safety actions:
Risk assessment undertaken to address new identified hazards and permit restart of operations.
Risk assessment undertaken regarding operations between 0001 and 0600, identifying additional controls such as implementation of second person in cab, check in process every 30-45 minutes if services extend after 0001 due to out of course running, and requirement to maintain radio volume at audible levels.
Arc Infrastructure as rail infrastructure manager, have also instigated the following proactive safety actions:
The fleeting or automatic signal calling function within the Arc Infrastructure network control system is not to be used in the Avon Valley. Train routes must be called as required manually by the network controller.
Introduction of a process for network controllers requiring that where a train has, or must be, stopped, any following trains must, where possible, be held at the station in the rear and not be advanced until the stationary train has recommenced its journey.
Commencement of a process requiring communications with train crews in the event a train has stopped ahead of a following train. Where it is necessary to hold trains in the Avon Valley, or a train has come to a stand due to unforeseen circumstances, the first following train must be advised over open channel radio of the circumstances and what their limit of authority is. Acknowledgment of this communication must be confirmed by the train crew.
Further investigation
To date, the ATSB has:
Gathered and undertaken preliminary analysis on:
all locomotive event recordings
all forward facing locomotive video recordings
network control voice recordings
Jumperkine and Moondyne signal interlocking event recordings
West Kalgoorlie to Jumperkine train control system replays.
Gathered information about the train, locomotives, rail infrastructure, operational records, employment records, health assessment records, and operational procedures.
The investigation is continuing and will include:
Review and examination of the functionality of locomotive braking control and vigilance systems.
Further analysis of the event recordings and video recordings.
Review of driver only operation risk controls related to collision and authority exceedance (SPAD) hazards.
Review of controls associated with the management of human performance.
Review of factors that can affect human performance, such as fatigue, rostering, health and fitness, as well as other factors, including the post-mortem and toxicology analysis of the driver.
A final report will be released at the conclusion of the investigation. Should a critical safety issue be identified during the course of the investigation, the ATSB will immediately notify relevant parties so appropriate safety action can be taken.
The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this preliminary report. As such, no analysis or findings are included.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 3 December 2019, a de Havilland Canada DHC-8-202 (Dash 8) aircraft registered VH-ZZA departed Darwin Airport, Northern Territory to conduct aerial work. During the early stages of the climb, the flight crew heard a loud bang. There were no issues with systems or controllability, so the flight was continued without further incident. Subsequent inspections of the aircraft revealed the number 2 blade collar on the right propeller was missing. There was also damage on the number 1 blade and the ice shield on the fuselage. Removal of the ice shield revealed that the fuselage had been penetrated in two places.
What the ATSB found
The ATSB identified that the propeller blade collars on the number 2 and number 3 blades were last repaired in the field, having been found loose. Following this occurrence, both blades were examined. There was evidence of inadequate cleaning/preparation on the number 2 blade shank, and the collar on the number 3 blade was loose due to adhesive remaining from a prior repair.
Based on those observations, it was likely that issues with surface preparation during field repairs resulted in a lack of adhesion between the number 2 blade and its collar, allowing it to separate in flight. The blade collar then struck the number 1 blade, accelerating the fragments of the collar forcefully into the aircraft's fuselage.
What has been done as a result
As a result of this occurrence, the operator released an engineering notice requiring the entire blade assembly to be replaced in the event of a loose or cracked blade collar. If a serviceable blade assembly was not available, collars were to be replaced in consultation with the relevant Technical Services Engineer, and in strict accordance with the component maintenance manual.
Safety message
Due to constraints on equipment, time, and experience, field repairs can be a source of added risk to an aircraft. To minimise risk, maintenance manuals should be closely followed when conducting field repairs, and operators should consider alternatives such as replacement over repair whenever practical.
This occurrence also illustrates that in‑flight damage may not always be apparent to flight crew and the risks posed by incorrect attribution. Serious consideration should be given to terminating the flight following any unexplained abnormal indication.
The investigation
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.
The occurrence
On 3 December 2019, a de Havilland Canada DHC-8-202 (Dash 8) aircraft, registered VH‑ZZA (ZZA) and operated by Cobham Aviation Services Australia (Cobham), departed Darwin Airport, Northern Territory shortly before 1200 Central Standard Time[1] to conduct aerial work. At 1200, on climb between 1,000 and 2,000 ft above mean sea level, the flight crew heard a loud bang. One crewmember saw something fly past the window, and assumed a birdstrike had occurred. There were no issues with controllability and all systems were functioning normally, so the crew elected to continue with the mission.
The aircraft landed without further incident, but an engineering inspection subsequently found damage to the right propeller and to the ice shield on the right side of the fuselage. Subsequent removal of the ice shield revealed that the fuselage had been penetrated in two places (Figure 1).
Figure 1: Fuselage penetration
Source: Cobham
The right propeller showed signs of damage on the leading edge of the number 1 blade, and the number 2 blade collar was missing. Cobham’s engineering team reported that the collar had separated from the number 2 blade and struck the number 1 blade. No pieces of the collar were found and there were no other components missing from the aircraft that could have damaged the fuselage.
Context
Blade collar design
The blade collar was a plastic component fixed to each propeller blade to improve aerodynamic performance. The two halves of the collar, such as those shown in Figure 2, were screwed together and secured to the blade shank by an adhesive. The two approved adhesives for installation were RTV157 and PR-1826 Class B.
Figure 2: Blade collar halves
Source: Cobham Aviation Service Australia
In 2015, the blade manufacturer, Collins Aerospace, released an updated design for the blade collar as the original design was not dimensionally stable, which prevented consistent bonding with the blade. This in turn caused a number of collars to separate from the blade shank during service. The new design was only to be installed using RTV157 adhesive.
To reduce the potential loss of adhesion, Collins Aerospace also released Action Item D9274‑AI07499 on October 3, 2019. This item added the use of primer SS4004P during the collar bonding operation.
Propeller maintenance history
An overhauled Hamilton Sundstrand 14SF propeller was fitted to the right engine of ZZA in 2016. The blade collars were the original design, as the updated collars were unavailable. On 2 March 2018, the number 2 and number 3 blade collars were found to be loose. Cobham’s engineering team inspected and refitted both collars in a field repair, as the updated blade collars had limited availability.
Nine days later, on 11 March 2018, the number 2 blade collar was found to have moved around the blade, indicating it had de-bonded. Cobham subsequently replaced it with the updated collar design in another field repair. At this time, the use of primer had not yet been included in the component maintenance manual. There was no further maintenance performed on either the number 2 or number 3 blades, and prior to the incident they were last inspected on 15 October 2019.
Post-occurrence inspection
Following the collar separation, the number 2 blade was sent to Cobham’s propeller repair vendor for examination. The number 3 blade was also sent for examination because it had last been repaired at the same time as the number 2 blade.
While the number 2 blade collar was never recovered, the impression left in the remaining adhesive indicated that the collar had been abraded prior to installation, as required. The adhesive remaining on the blade was RTV157, the correct type for the updated collar design. The vendor also noted, however that:
The remaining adhesive was easily peeled from the blade shank, indicating poor adhesion.
The vendor determined that this was most likely due to insufficient surface preparation/cleaning prior to adhesion. Figure 3 shows the adhesive being peeled off the number 2 blade shank where the separated collar was previously attached.
Figure 3: RTV157 adhesive being peeled off the number 2 blade shank
Source: Propeller repair vendor
The number 3 blade collar was the original design, so both adhesives were permitted. The rear half was securely bonded to the blade with PR-1826, however the front half had been re-attached with RTV157. PR-1826 still coated the blade shank and the vendor reported no adhesion between the different adhesives. As a result, the front collar half was loose.
The component maintenance manual required old adhesive to be removed from the blade shank before a collar was re-attached.
Similar occurrences
A search of the ATSB’s database found similar occurrences involving blade collar separation from the same propeller type fitted to Dash 8 aircraft:
In 2003, a Dash 8 experienced an in-flight blade collar separation shortly after take-off from Sydney, New South Wales. The subsequent examination revealed that the adhesive used had been contaminated. The source of the contamination could not be identified. The same operator experienced another collar separation in 2004. Subsequent inspections on the rest of the fleet indicated five other aircraft with at least one loose blade collar. As a result, the operator initiated a repetitive collar inspection regime on their fleet.
ATSB occurrence 201203474
In 2012, on final approach into Port Macquarie Airport, New South Wales, the flight crew of a Dash 8 heard an impact noise on the left side of the aircraft. Engineering later determined that a blade collar had separated from the left propeller before striking a blade and then the engine nacelle. No potential reason for collar separation was provided to the ATSB.
Internationally, de Havilland Canada identified one occurrence in which the fuselage of a DHC-8 aircraft may have been penetrated by collar fragments. In October 2011, a post-flight inspection of a DHC-8-314 revealed part of a blade cuff missing, along with damage to one of the propeller blades and two holes in the fuselage. While no debris was found, it was concluded that fragments of the collar or attaching hardware likely struck the blade and was propelled into the fuselage.
Analysis
The adhesive remaining on the number 2 blade was not well bonded to the blade shank, likely due to problems with the preparation/cleaning of the bonding surfaces prior to adhesion. The lack of adhesion between the collar and blade shank resulted in the collar becoming loose and separating in flight. Similar problems were observed on the number 3 blade, where adhesive from a previous field repair prevented adequate bonding between the blade and collar.
The number 2 blade collar was the only component found missing from the aircraft during the post‑flight inspection. Given that the number 1 blade was also damaged, it follows that the number 1 blade accelerated the detached collar fragments into the fuselage with sufficient force to penetrate it. This appears to be consistent with a previous occurrence, where it was determined that fragments of blade collar likely struck a propeller blade, accelerating them into the fuselage.
This incident illustrates that component failure and in‑flight damage may not always be apparent to flight crew, and there are potential risks in incorrectly attributing the cause of events such as a loud bang. As such, serious consideration should be given to terminating the flight following any unexplained abnormal indication, especially if it occurs in proximity to a suitable airport.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the propeller blade collar failure of a de Havilland DHC-8-202, registered VH-ZZA, that occurred near Darwin, Northern Territory, on 3 December 2019.
Contributing factors
When the number 2 blade collar was replaced, there was a lack of adhesion between the collar and blade, likely due to improper preparation of the bonding surfaces. This resulted in the collar debonding and separating in flight.
The detached number 2 propeller blade collar struck the number 1 propeller blade. This accelerated collar fragments into the aircraft's fuselage with sufficient force to penetrate it.
Safety issues and actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Safety action by Cobham Aviation Services Australia
As a result of this occurrence, Cobham released an engineering notice in March 2020 requiring the entire blade assembly to be replaced in the event of a loose or cracked blade collar. If a serviceable blade assembly was not available, Cobham required collars to be replaced in consultation with the relevant Technical Services Engineer and emphasised that all preparation instructions from the component maintenance manual were to be observed during the repair.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Cobham Aviation Services Australia
the propeller repair vendor
Collins Aerospace
De Havilland Canada.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the flight crew
Cobham Aviation Services Australia
De Havilland Canada
Collins Aerospace
the propeller repair vendor
the Civil Aviation Safety Authority
the Transportation Safety Board of Canada.
Submissions were received from:
the flight crew
Cobham Aviation Services Australia
Collins Aerospace.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
![Figure 11: ARTC minimum full service braking requirement for train type MLF-115[35]](/sites/default/files/inline-images/RO-2019-022%20Figure%2011.jpg)
