At about 1600 on 23 November 2019, three locomotive drivers signed on at the Bordertown siding, to prepare train 2122S for a journey to Adelaide, South Australia. Train 2122S moved out from the siding and onto the Bordertown crossing loop, where a driver detached the two locomotives so they could conduct a run-around movement and reattached the locomotives to the other end of the train consist.
As the locomotives started the run-around movement, the unattended wagons started to roll back towards the siding. The wagons rolled over a level crossing (which operated automatically as designed), bounced over a derailer (signalling infrastructure on the rail) and continued back into the Bordertown siding.
A driver who was still in the siding, observed the unattended rolling freight wagons, so ran alongside and commenced applying the handbrake on one of the wagons. The runaway wagons slowed and came to a stop, having rolled unattended for about 1,425 m. The wagons stopped about 47 m from the end of the siding, a road and level crossing.
There was only minor damage to the derailer, associated rodding and slight misalignment of sleepers.
What the ATSB found
The ATSB found that while detaching the locomotives, the brake pipe air taps were closed by the driver on ground uncoupling the wagons before a full application of the train air brakes by the driver in the lead locomotive. This prevented further reduction of brake pipe air pressure, so the wagon brakes did not fully apply. In addition, handbrakes were not applied to any wagons. Once the locomotives were detached, the lack of air brakes and handbrakes allowed the wagons to roll away on the descending grade.
While not contributing to the incident, the ATSB also found that the device (a baulk) installed at the siding for restraining runaway wagons was likely insufficient to restrain runaway wagons under some conditions.
What has been done as a result
Bowmans Rail issued a safety alert requiring uncoupled wagons to have all air exhausted and handbrakes applied when left unattended. The alert also reinforced that all procedures must be adhered to when coupling and uncoupling rollingstock. Additionally, Bowmans Rail have communicated the findings of their investigation and their expectations to train crew, as well as consulted on improvements planned for its Bordertown shunting processes.
The Australian Rail Track Corporation (ARTC) has installed an arrestor bed on the track at the Bordertown dead end, with further works to the arrestor bed planned in October 2020.
Safety message
This incident highlights how omitting a procedural step may result in over-reliance on remaining protective measures. In this case, the non-application of handbrakes increased reliance on the full application of wagon air brakes to prevent a runaway. However, a slight out of sequence implementation of the air brake process resulted in only partial application of the wagon air brakes and the subsequent runaway of unattended wagons. It is essential that all procedural steps are undertaken when uncoupling wagons for run-around movements.
The occurrence
At about 1600[1] on 23 November 2019, three locomotive drivers signed on for work at Bordertown, South Australia and proceeded to the Bordertown rail siding to prepare and operate train 2122S to Adelaide, South Australia.
To prepare for the journey to Adelaide, the crew needed to pull the train (two locomotives and 30 wagons) from the siding and onto the Bordertown crossing loop (Figure 1, green arrow). They then needed to detach the two locomotives and conduct a run-around movement (Figure 1, blue arrows), so the locomotives could be reattach to the other end of the train consist.
Figure 1: Intended train movement
Train 2122S moved out of siding and onto the crossing loop (green arrow). Locomotives detached for a run-around movement so they could be attached to the other end of the train consist (blue arrows).
Source: ARTC, modified and annotated by ATSB for clarity.
Driver 1, at the controls of the lead locomotive, contacted Australian Rail Track Corporation (ARTC) network control and obtained authority to enter the interstate rail network at the Bordertown crossing loop. Driver 2 was positioned in the cab of the trailing locomotive. Driver 3 took the siding motor vehicle, drove out to Crecoona Terrace and manually activated the level crossing equipment as train 2122S exited the siding and moved towards the loop track.
Driver 3 observed train 2122S as it exited the siding (green arrow in Figure 1) and deactivated the level crossing equipment as the train cleared the level crossing, then advised Driver 1 when the train was on the crossing loop and entirely past Signal 5. After the train stopped (green train symbol in Figure 1), Driver 3 travelled back to the siding to return the motor vehicle.
Driver 2 alighted from the cab of the trailing locomotive to uncouple the wagons from the locomotives. Driver 2 contacted Driver 1 by radio to verify that the train brakes had been applied. Driver 1 confirmed this action, so Driver 2 shut the brake pipe air taps between the trailing locomotive and the lead wagon, uncoupled the locomotive from this wagon, and then climbed back into the cab of the trailing locomotive. Driver 1 recalled that an initial brake application had been made to stop the train before being contacted by Driver 2, before moving the brake into a full service position just after responding to Driver 2.
At about 1620, the ARTC network controller cleared Signal 14 and Driver 1 commenced the run-around sequence by moving the locomotives towards Signal 14 and then out onto the main line (Figure 2, blue arrow). At about the same time, the unattended wagons had begun rolling back towards the siding. As the wagons rolled past Signal 5, the network controller received a signal passed at danger (SPAD) alarm. The wagons continued to roll, passing over the Crecoona Terrace level crossing (which operated automatically as designed). The ATSB calculated the runaway speed as having increased from about 12 km/h to about 18 km/h as the lead wagon traversed the track circuits between Signal 5 and Signal 1 (Figure 2), a distance of about 257 m (refer to Appendix A). The wagons then bounced over the derailer[2] and continued back into the Bordertown siding (Figure 2, green arrow). Note: Derailers are usually directional. That is, they are designed to protect the main line by derailing a runaway vehicle exiting a siding. In this case, the wagons were moving away from the main line, so were travelling in the opposite direction for which the derailer was designed and was therefore ineffective at derailing the wagons.
Figure 2: Unattended wagons roll back into the siding
The locomotives start the run-around movement by moving out onto the main line (blue arrow). The unattended wagons roll back, pass over the level crossing, bounce over the derailer and continue back into the siding (green arrow).
Source: ARTC, modified and annotated by ATSB for clarity.
Driver 3 had returned the motor vehicle to the siding and was walking towards the station platform to wait for train 2122S to collect him when it departed for Adelaide. The driver observed the unattended freight wagons rolling towards him. As the wagons reached him, the driver ran alongside and commenced applying the handbrake on one of the wagons. The runaway wagons slowed and came to a stop as the handbrake was being applied to this wagon. This driver then exhausted the brake pipe air at the last wagon, which applied the brakes to the remainder of the runaway wagons.
At about the same time, the ARTC network controller had contacted Driver 1 and queried the status of train 2122S, noting that it appeared that the wagons had rolled back into the siding. Driver 1 contacted Driver 3 who advised the loaded freight wagons had rolled into the siding and come to a stop before the baulk[3] at the end of the siding (Figure 2).
In total, the wagons of train 2122S had rolled unattended for about 1,425 m, stopping about 47 m from the end of the siding, immediately before the North Terrace level crossing.
There was only minor damage to the derailer, associated rodding and slight misalignment of sleepers.
Bordertown is located on the interstate rail network about 250 km south-east of Adelaide (Figure 3). The track consisted of a bi-directional main line and crossing loop, with a dead end siding extending from the crossing loop. The main line, crossing loop and dead end siding was owned and operated by the Australian Rail Track Corporation (ARTC).
Figure 3: Location
Image shows the rail corridors within South Australia with the location of Bordertown in relation to Adelaide.
The Bordertown crossing loop sits on a gradient of about 1 in 100 (1per cent). The siding track (about 1,460 m in length) continues at this gradient for about 500 m before gradually transitioning to level track for the final 500 m.
Train and rollingstock
Bowmans Rail was the owner and operator of freight train 2122S. The train consisted of two locomotives (GL111 leading and EL63 trailing) hauling 30 wagons. The total train length was about 502 m, and weighed about 1,488 tonnes. There was no evidence to suggest any fault or deficiency in rolling stock condition.
Train crew
Three Bowmans Rail locomotive drivers were crewing train 2122S. All drivers were requested to undertake a breath and drug test following the accident. The tests returned a negative result for each driver.
Driver 1 was an advanced trainee with about 5 years’ experience. Driver 2 had about 16 years’ experience and Driver 3 had about 11 years’ experience. All drivers held current driver and shunt competencies, and medical assessments.
Driver 1 had worked the Bordertown shunt movement a number of times previously as the ground person, however, this was the first time working the shunt at the controls of the lead locomotive.
Recorded data
Wagon brakes apply as brake pipe pressure is reduced. For a full brake pipe application, brake pipe air pressure typically needs to reduce to about 350 kPa throughout the entire train.
In this case, the locomotive data log[4] shows that when bringing train 2122S to a stop in the crossing loop, the brake pipe pressure started to reduce (aligning to time zero in Figure 4) at a constant rate for about 19 seconds (from 508 kPa to 413 kPa), until about 4 seconds after the lead locomotive had stopped (Figure 4). After this time, brake pipe pressure reduced rapidly over about 5 seconds to 330 kPa. Brake pipe pressure remained at 330 kPa for about 8 seconds before brake pipe pressure was restored to about 503 kPa (Figure 4).
Figure 4: Locomotive data
Locomotive data showing initial brake application as train 2122S came to a stop. Brake pipe pressure reduces further before full pipe pressure is restored.Note that time scale is relative time from initial brake application.
Source: ATSB
Bordertown operational procedures
A basic shunting principle is to ensure unattended wagons are secured and brakes applied, so as to prevent any unintended movement. Bowmans Rail procedure OP 2.56 - Shunting at Bordertown (dated 16th May 2018) stated the following:
Once the Train crew has stopped the movement on the crossing loop, a full brake pipe application is made and the locomotive is detached from the train consist. The approved ETM [end-of train marker] is placed into the rear knuckle pin, and the train pipe hose hung up on the receptacle provided. Sufficient handbrakes shall also be applied to prevent wagon movement.
Both Driver 1 and Driver 2 reported that they were aware of this procedure and made correct communication with respect to this requirement.
In this case, as the train slowed to a stop in the crossing loop, Driver 2 alighted from the trailing locomotive to uncouple the wagons. The two drivers recalled at interview that Driver 2 had sought verification that a full service application had been made of the train air brakes and Driver 1 had provided an affirmative response. Driver 2 then closed both brake pipe air taps between the trailing locomotive and the wagons, disconnected the brake pipe hoses, and uncoupled the wagons. The wagon air taps then remained closed, so any remaining air in the wagon brake pipe would have been sustained (referred to as having bottled the brake pipe air).
Driver 2 did not apply any handbrakes to the front wagons before boarding the locomotive for the run-around movement. Post-incident interviews suggested that it had become a practice for this crew to omit the step of applying handbrakes when undertaking a run-around movement at Bordertown. The reason provided was that if the ground person applied handbrakes at the uncoupled end, then they would be required to walk the length of the train to release the handbrakes once the locomotives had been coupled at the other end. Experience had shown that the wagons would remain stationary under full application of the train brake without the need to apply handbrakes. Not applying handbrakes saved time and expedited the run-around process in preparation for the journey to Adelaide.
Bowmans Rail provided a third driver for their Bordertown operations. This was primarily to assist with shunting movements and the manual operation of the level crossing. Post-incident interviews suggested that in the past, after reinstating the level crossing, the third driver would walk to the rear of the train and prepare it for reattaching the locomotives. For some drivers, this would include opening the brake pipe air tap. While the intention may have been to expedite reconnection, the act of opening the brake pipe air tap also exhausted the brake pipe, ensuring all wagon brakes were applied.
A recent addition to the Bordertown siding was the provision of a road vehicle. Bowmans Rail advised that the intent was for drivers to use the vehicle for transport to and from their accommodation (for recovery rest). It was not intended for the vehicle to be used while undertaking shunting or the run-around movement at Bordertown. In this case, the train crew used the vehicle while facilitating the run-around movement. After reinstating the level crossing, Driver 3 returned the road vehicle to the siding rather than attending the rear of the train in preparation for reconnecting the locomotives. Consequently, there was no opportunity to apply handbrakes or to exhaust the brake pipe at the rear of the train.
Runaway protection
ARTC guideline ETH-00-01 - Buffer Stops and Restraining Devices for Dead End Tracks outlined a range of restraining devices intended to protect people and property from an over-run at a dead end track. Where an over-run has the potential to cause significant damage or injury, then the restraining device must have the capacity to stop the rail vehicle/s. For example, at Bordertown, the dead end track was immediately adjacent a road and level crossing. An over-run at this location has the potential to injure people, so a restraining device is required to stop a runaway vehicle such as occurred on 23 November 2019.
The guideline used gradient and distance of a potential runaway to determine the approximate speed that the restraining device may need to contain. In this case, the track gradient was about 1 in 100 (1per cent) for about 500 m before levelling out over about 500 m with the final 500 m being level grade. The guideline suggest that a runaway wagon might reach in excess of 26 km/h due to a 1 per cent grade in excess of 300 m. However, a runaway wagon at this location would likely slow to some extent on the level section of track before reaching the dead end.
The restraining device installed at Bordertown was a Baulk, defined in the guideline as a rectangular piece of hardwood timber of approximately 300 by 200 mm, bolted to the track (Figure 5). The guideline stated that a baulk is suitable for runaway speeds up to 1.5 km/h, is primarily just a marker that provides little resistance, and would probably require further devices to arrest a runaway.
Figure 5: Bordertown siding runaway protection
Restraining device installed at Bordertown. A rectangular piece of hardwood timber of approximately 300 by 200 mm, bolted to the track, known as a baulk.
Bowmans Rail procedure Shunting at Bordertown required a full brake pipe application and the application of handbrakes to prevent movement of unattended wagons.
In this case, the locomotive data log shows that brake pipe air pressure did not reduce below 350 kPa (full brake pipe application) until about 8 seconds after the train had stopped in the crossing loop. However, 4 seconds after the lead locomotive stopped, there was a rapid reduction of pipe pressure from 413 to 330 kPa over about 5 seconds. It is possible that this was due the pipe pressure reduction being applied to a smaller volume of air, suggesting that Driver 2 had isolated the brake pipes at this point. As such, it is likely that while Driver 1 and 2 communicated with respect to verifying a full brake pipe application, Driver 2 closed the brake pipe air taps before the full service application of the train brake had propagated through to the rake of wagons. The bottled brake pipe air meant that the brake pipe air pressure was maintained at the level existing at the time the taps were closed, which was above 350 kPa. Since full service pressure had not been achieved, the wagon brakes had not fully applied.
Both Driver 1 and Driver 2 were aware of the procedure requiring full brake pipe application prior to detaching the locomotives and communication was made with respect to this requirement, but their action implementing the requirement occurred out of sequence. That is, Driver 1 confirmed full brake application while in the process of moving the brake handle, rather than at the completion of the full brake application. Driver 2 interpreted the response as having completed the full brake application, so closed the taps and detached the locomotives. The consequence was a partial application of the train brakes within the wagons rather than a full application.
As it was Driver 1’s first time working the Bordertown shunt at the controls of the lead locomotive, it is likely that the miscommunication between the two drivers was a result of the changed work dynamic, rather than a lack of training.
In addition, handbrakes were not applied to any wagons. With only partial application of the wagon air brakes and no handbrakes applied, there was insufficient braking force to prevent the wagons from rolling away on the descending grade.
Although handbrakes were a known part of the procedure, not applying handbrakes during the run-around at Bordertown had become a common practice for this crew, as it saved time and had not caused any issues in the past. Further, since Driver 3 needed to return the siding motor vehicle used to position at the level crossing as the train entered and stopped on the loop track, the driver was not in a position to apply handbrakes to the rear wagons. In addition, while not part of the procedure, the use of the motor vehicle meant that the driver was also not available to apply wagon brakes by opening the air tap and exhausting brake pipe air from the rear of the train.
Runaway protection
The restraining device installed at Bordertown was a Baulk, specified as suitable for runaway speeds up to 1.5 km/h (ARTC guideline).
In this case, the runaway speed was calculated as having increased to about 18 km/h before the wagons bounced over the derailer and continued rolling down to the level section of the siding track. The level grade, the likely partial application of wagon brakes and Driver 3’s application of a handbrake, stopped the wagons about 47 m from the baulk (Figure 6). With less braking applied, it is likely that the free-rolling wagons would have travelled further, reaching the Baulk at a speed faster than 1.5 km/h.
The Australian Rail Track Corporation (ARTC) guideline states that a baulk is primarily just a marker that provides little resistance, and would probably require further devices to arrest a runaway. The configuration at Bordertown was likely insufficient for restraining the potential speed and momentum of runaway wagons, which may subsequently encroach on a road and level crossing.
Runaway wagons stopped about 40 m from the baulk. The image illustrates how wagons that might roll to the end of the track may encroach on the road and level crossing.
Source: ATSB
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the runaway of wagons on the descending grade after disconnecting the locomotives to conduct a run-around movement at the Bordertown siding on 23 November 2019.
Contributing factors
The locomotive driver confirmed a full brake pipe application, via radio communication, while moving the brake handle rather than after the full application had been made. This resulted in the ground person closing the brake pipe air taps prematurely, preventing further reduction of brake pipe air pressure. Consequently, the wagon brakes did not fully apply.
Handbrakes had not been applied to any wagons before detaching the locomotives. The non-application of handbrakes had become a practice when undertaking run-around movements at Bordertown. With the insufficient air brake application, the lack of handbrakes resulted in the wagons rolling away on the descending grade.
Other factors that increased risk
The restraining device installed on the Bordertown siding track prior to the road and level crossing, was likely insufficient under some conditions, for restraining the speed and momentum of runaway wagons.
Safety actions
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.
Safety action by Bowmans Rail
Bowmans Rail issued a safety alert on 24 November 2019, advising of the incident that had occurred at Bordertown on 23 November 2019. The alert stated that the following action was to be undertaken:
All unattended wagons are to have all air exhausted from them when uncoupled
The appropriate amount of hand brakes are to be applied to wagons when required
Three step protection procedures are to be adhered to when coupling and uncoupling rollingstock.
Air taps on unattended wagons are not to be left closed until all air has been exhausted from wagons.
Since the initial safety alert, Bowmans Rail has taken the following additional proactive safety actions:
The completion of staff toolbox briefings on the findings and outcomes of its internal investigation.
The provision of additional staff briefings on its expectations and processes with respect to securing rollingstock and locomotives.
The completion of a review triggered by the incident, of its operational risk assessment for Bordertown operations. This review identified a need to evaluate and amend, in consultation with train crews, the processes within the Bowmans Rail procedure OP 2.56 - Shunting at Bordertown. The outcome of the review was planned for incorporation into a revised version of the OP 2.56 - Shunting at Bordertown procedure prior to the resumption of its Bordertown operations in mid-late 2020.
Safety action bythe Australian Rail Track Corporation
The Australian Rail Track Corporation has installed an arrestor bed on the track at the Bordertown dead end. ARTC has further works planned in October 2020 to complete the arrestor bed with a graded slope as per ARTC ETH-00-01 Buffer Stops and Restraining Devices for Dead End Tracks – Appendix C.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Bowmans Rail
Australian Rail Track Corporation
Train crew
recorded data from the locomotive data log.
References
ARTC guideline ETH-00-01 - Buffer Stops and Restraining Devices for Dead End Tracks (dated 2 July 2012)
Bowmans Rail procedure OP 2.56 - Shunting at Bordertown (dated 16th May 2018)
RISSB Glossary of Railway Terminology
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Bowmans Rail
Australian Rail Track Corporation
Office of the National Rail Safety Regulator
the train crew.
Submissions were received from:
Australian Rail Track Corporation.
Office of the National Rail Safety Regulator
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Speed calculations
The signalling infrastructure at Bordertown utilises track circuits to detect rail vehicles as they occupy defined sections of track. The wagons from train 2122S were uncoupled while occupying track A5T (Figure 7). As the unattended wagons rolled back into the siding (Figure 7, green arrow), the lead axle of the lead wagon sequentially occupied tracks 7AT, 296T, 9T and A1T.
Figure 7: Bordertown track numbers
Illustration showing track circuit numbers occupied as the unattended wagons rolled back into the siding.
Source: ATSB
A signalling event logger recorded the times at which each track was detected as occupied. This time coincided with the wagon’s lead axle transitioning the junction between two track circuits, providing the time duration that the lead axle had occupied a specific track. Knowing the duration the lead axle occupied the track and the length of the track (measured onsite) allowed for calculating the average speed the lead axle travelled as it traversed each track circuit.
Table 1: Calculated speed as lead wagon passed between Signal 5 and Signal 1
Track circuit
Track length (m)
Duration (sec)
Calculated speed (km/h)
7AT
125.0 m
37.1 sec
12.1 km/h
296T
27.0 m
7.0 sec
13.9 km/h
9T
105.7 m
20.1 sec
18.9 km/h
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the ATSB to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation. The statement is published as a report in accordance with section 25 of the TSI Act, capturing information from the investigation up to the time of discontinuance.
Overview of the investigation
The ATSB commenced an investigation into an engine pod strike involving a Singapore Airlines Cargo Boeing 747-412F freighter, registered 9V-SFO, which occurred at Sydney Airport on 28 November 2019.
The flight crew were conducting an approach to runway 34L at night. The automatic terminal information service (ATIS) stated the wind was 040° at 15 kt (crosswind of 12 kt), and the latest weather observation reported the wind as 040° at 22 kt with gusts up to 32 kt. The flight crew stated they briefed for the threat of strong, gusty crosswinds. The captain was the pilot handling for the landing.
During the approach, the flight crew recalled experiencing moderate turbulence and undershoot shear below 300 ft. When passing 200 ft, the airspeed rapidly trended below the minimum approach speed, the first officer called ‘speed’ and the captain recovered the target speed.
As the aircraft entered the flare it drifted right of centreline, followed by a sudden uncommanded roll to the left. In response, the flight crew initiated a rejected landing manoeuvre, during which the number 1 engine pod struck the ground. After a second approach, the aircraft landed without further incident.
Engineering inspections identified damage to the number 1 engine fan cowl and thrust reverser skin panel. Following maintenance action, the aircraft returned to Singapore where it underwent further inspections. As a result, damage to the number 1 engine main gear box was identified as being beyond the serviceable limit and the engine was removed from service.
As part of its investigation, the ATSB:
interviewed the flight crew and examined their training records
analysed recorded data from the aircraft’s flight data recorder (FDR) and cockpit voice recorder (CVR)
reviewed Boeing’s flight data analysis and other documents
reviewed air traffic control recordings
examined engineering reports, documents, manuals and correspondence relating to the operator’s Boeing 747 operation
reviewed Bureau of Meteorology (BoM) weather forecasts and analysis
conducted significant analysis of potential wake turbulence
reviewed data related to the 2020 low-level windshear alert system trial at Sydney Airport
reviewed other investigations and references where similar themes had been explored.
Analysis of recorded data indicated that the aircraft was responding correctly to flight control inputs made by the pilot flying and that the inputs were appropriate for the environmental conditions. Research and analysis undertaken by the ATSB demonstrated that wake turbulence was not a factor.
Prior to the occurrence no windshear was forecast, broadcast by air traffic controllers, or detected by aircraft or ground systems. However, during the approach, the aircraft was affected by moderate undershoot shear and wind gusts during the landing. About 4 minutes after the occurrence, a Boeing 737 landed on runway 34R. That flight crew advised air traffic controllers they lost about 15 kt of airspeed during the flare due to moderate undershoot shear. Controllers subsequently broadcast to all aircraft there was moderate undershoot shear on runway 34R.
Following the incident, Singapore Airlines made minor procedural changes and enhanced its simulator training program by requiring demonstrated competency in all crosswind landing techniques.
Low-level windshear alerting systems
At low altitudes (below 1,000 ft) during critical stages of landing and take-off, windshear can present a significant hazard to aircraft. Low-level turbulence and windshear can be caused by many processes; however, regardless of the cause, a well-designed low-level windshear alerting system is capable of detecting operationally-significant windshear and turbulence in near real time.
In 2001, there was a windshear event involving a Boeing 737 at Brisbane Airport (ATSB investigation 200100213). The ATSB recommended that BoM expedite the development, testing, and installation of advanced weather radar systems to detect hazardous windshear in high-risk airport terminal areas. In response, the BoM advised that it would continue to derive the maximum operational utility from existing and future Doppler radar systems, as the cost of specialised radar systems was high and they were not fully suitable for general weather work. Additionally, BoM advised it would maintain knowledge of international research and development of experimental low-level windshear alert systems.
In 2007, there was a micro-burst event involving a Boeing 747 at Sydney Airport (ATSB investigation AO-2007-001). The investigation raised a safety issue, which stated that there was no ground-based automatic low-level windshear warning system at Sydney Airport. At that time, BoM and Airservices Australia initiated scoping activities and a proposed system was identified. A risk assessment identified that, with existing controls (including onboard windshear detection systems), the risk level was within the broadly acceptable range.
In 2013, meetings were held with industry to discuss the proposed solution. The airline participants agreed that unexpectedly encountering windshear did not pose a significant threat to aviation at Sydney Airport. The substantial expense of the proposed system, and environmental challenges associated with siting additional anemometers required by that system, were noted. Overall, it was concluded that the benefits of continuing with the proposed system were not sufficient to justify the cost at that time.
In 2020, Sydney Airport identified that the cost of a light detection and ranging (LIDAR) system had reduced significantly and did not have the same environmental impact. A LIDAR working group was established involving Sydney Airport, BoM, Airservices Australia, airlines and a pilot’s union to consider the implementation of the system, particularly given the benefits over other systems. In general, a ground-based LIDAR system is much better at detecting turbulence in clear air, whereas onboard systems are more effective for turbulence within detectable precipitation, such as rain. BoM advised the ATSB:
Scanning doppler lidar is able to observe turbulence in the atmosphere at smaller scales than is possible with existing anemometer and wind profiler assets at Sydney. As a result, automated alerts derived from the lidar data are able to capture transient and small scale turbulent features that are, by design, not typically represented in current aeronautical meteorology products such as the TAF and WS Warning. Integrating lidar observations into the turbulence forecast process for Sydney airport is therefore likely to result in improved turbulence and low level wind shear forecast quality.
A trial of a low-level windshear alerting system using a scanning doppler LIDAR system was conducted at Sydney Airport. The trial proved the effectiveness of the system to enhance awareness of turbulence and low-level wind shear when it occurs, and the working group is now considering implementation issues.
The ATSB strongly encourages the use of LIDAR systems at airports such as Sydney Airport where turbulence-related events have been known to occur.
Reasons for the discontinuation
Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any new systemic safety issues or important safety lessons. Consequently, the ATSB has discontinued this investigation.
The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.
On 20 October 2019, an I.C.P. Savannah aircraft, recreational registration 19-7429, collided with terrain near the Emkaytee aerodrome, Northern Territory. The pilot was fatally injured.
In response to this accident, Recreational Aviation Australia (RAAus) commenced an investigation. As part of its investigation, RAAus requested technical assistance from the ATSB.
The ATSB initiated an investigation under the Transport Safety Investigation Act 2003 and assisted RAAus by downloading flight data from the aircraft’s Dynon Electronic Flight Instrument System (EFIS) The Dynon EFIS was successfully downloaded. However, the data logging functionality of the device was not enabled. No flight data was retrieved from the device.
With the completion of the examinations and data recovery, the ATSB has concluded its involvement in the investigation of this accident. Any enquiries relating to the accident investigations should be directed to RAAus at: www.raa.asn.au
On 10 November 2019, a Fokker F28 Mk0100 (F100) aircraft, registered VH-UQN, was on final approach at night to runway 33 at Rockhampton Airport, Queensland. The aircraft was slightly high on the approach profile when smoke haze from nearby bushfires reduced the visibility on approach, obscuring the vertical approach lighting.
At about 400 ft above ground level, the aircraft encountered moderate turbulence affecting the aircraft’s approach profile. At about 300 ft, the airspeed reduced below the minimum approach speed and the pilot flying encountered increased resistance in the thrust levers while trying to recover airspeed. After a short period, the pilot forced the thrust levers to the desired setting. The aircraft’s engines responded, airspeed increased accordingly, and the aircraft landed safely.
What the ATSB found
The ATSB found that, when on final approach, the flight crew encountered reduced visibility and moderate turbulence from a bushfire, which added uncertainty and the late identification of a high approach profile. While attempting to regain the correct profile, the airspeed reduced below the minimum allowable speed, activating the automatic flight envelope protection or alpha mode before the aircraft started to accelerate. The flight crew were unaware of the alpha mode activation.
The operator’s initial type qualification training for the F100 aircraft and cyclic training did not adequately prepare the operator’s pilots to identify and respond to alpha mode activations during critical phases of flight. The ATSB further identified that the aircraft’s rate of descent exceeded the operator’s stabilised approach criteria for a short period during the approach; however, it was also identified that there was no permissible exceedance criteria in the stabilised approach criteria for transient exceedances.
There was an 8-day delay in reporting the incident to the ATSB. It was identified that the operator’s recently-installed internal safety reporting system provided warnings that adequately reflected the urgency of reporting, but contained a visual display peculiarity that subtlety concealed reportable matters, resulting in the report being unprocessed for 6 days.
The ATSB also identified that the acting safety systems manager was unable to effectively conduct the role due to limited experience in the role, increased workload, and remote working conditions during this time. This, along with other key changes, limited the operator’s capacity to provide effective safety assurance.
What has been done as a result
The operator issued an operations notice to pilots, which included guidance on the dangers of low thrust and low airspeed situations during performance decreasing conditions. The notice also provided greater guidance about the activation of alpha mode within its fleet. The operator updated its cyclic simulator training to include alpha mode activation scenarios and developed alternative procedures for pilots when encountering alpha mode activations.
Further, the operator proactively implemented an update to its safety reporting system that highlighted reportable matters by removing lesser priority indicators. It further introduced a statistical reporting tool to monitor the above system enhancement to ensure ATSB reporting obligations were measured and appropriately reported. In addition, it finalised the internal safety manual and standard operating procedures, developed a position handover checklist, and reviewed its company policy manual to detail the formal delegation of duties relating to key safety post holder positions.
Safety message
Flight crew awareness of automatic flight protections and their subsequent effect is paramount to the safe operation of passenger transport flights. Effective initial and cyclic training, and assessments in these systems, is important to ensure that pilots respond appropriately to these situations during critical phases of flight.
Operators are reminded that effective change management is an essential part of any safety management system. Changes to key safety management systems, key post holder positions, and the procedures and processes that support systems and personnel, need to be carefully managed in order to operate a robust and effective safety management system.
The occurrence
On 10 November 2019, a Fokker F28 Mk0100 (F100) aircraft, registered VH-UQN, was being operated by Alliance Airlines on a regular public transport flight from Brisbane to Rockhampton, Queensland. The flight crew had conducted a Brisbane to Rockhampton return flight earlier in the day, which was uneventful, and the weather was favourable with light winds. Bushfires had started to the north-east of Rockhampton Airport; however, the smoke associated with the fires did not have any effect on the earlier flight.
The aircraft had departed Brisbane for the third sector of the day at about 1857 Eastern Standard Time[1] and was scheduled to arrive at Rockhampton at 2000. The first officer (FO) was designated as the pilot flying and the captain was the pilot monitoring.[2] There were no weather concerns apart from smoke haze, which had worsened across south-east Queensland.
The flight crew reported that the flight was uneventful while en route to Rockhampton. Prior to descent, they conducted a standard briefing, which included the speeds required for the approach and the threat of reduced visibility due to smoke. Nearing Rockhampton, they were directed by air traffic control to conduct a standard instrument arrival procedure[3] from the south-east onto runway 33[4] at Rockhampton Airport (Figure 1).
Figure 1: Approach track to Rockhampton Airport
Source: Google Earth, annotated by the ATSB
Once established on final approach for runway 33, the FO recalled disconnecting the autopilot at about 700 ft. At about 560 ft above ground level, the meteorological minima[5] of the instrument approach, the flight crew recalled that the aircraft was maintaining the correct approach profile and speed, and noted that an additional spot fire could be seen about 1 km to the north-west of the airport. As they continued, smoke was observed to drift across the approach path due to a north‑westerly wind change. Descending below 560 ft, the weather conditions and visibility began to deteriorate.
The flight crew reported that the slant visibility[6] to the runway began to reduce, and smoke discoloured the precision approach path indicator (PAPI)[7] lights from their usual red/white appearance, to an orange colour. The FO indicated that they were unable to discern any vertical guidance from the PAPI. At about 400 ft, the aircraft was also affected by light to moderate convective turbulence from the nearby bushfire.
As the PAPI discolouration cleared, the FO recalled seeing one red light on the PAPI, indicating that the aircraft was slightly high on its approach path. In response, the FO reduced the aircraft’s pitch attitude and reduced the thrust by overriding the autothrottle system. The aircraft then encountered a downdraft, which further increased the rate of descent and decreased airspeed.
At about 300 ft, the captain observed the airspeed trending towards the minimum allowable airspeed (VMA). The FO recalled attempting to increase thrust to recover the reducing airspeed, at which time they encountered stiff thrust lever resistance. The FO reported that, about 2 seconds after encountering the thrust lever resistance, the captain called ‘speed’.[8] The FO responded by informing the captain that the thrust levers were ‘stuck’. Shortly after, the captain called ‘speed’ a second time. The captain recalled considering taking over and conducting a go-around, however, noticed that the aircraft airspeed was below VMA. Due to the aircraft position, the unknown reason for the blocked thrust levers and reduced stall margin, the captain did not command a go-around.
Due to the resistance to the advancement of the thrust levers, it took a few more seconds before the FO was able to forcibly move the thrust levers forward to the desired setting. The FO recalled that airspeed increased, the thrust lever resistance reduced, and a normal landing was safely carried out at about 1958.
The flight crew discussed the incident after engine shutdown. As part of their troubleshooting of the incident, they did not believe that an alpha mode activation[9] had occurred due to the activation prior to VMA -5 kt. They could not recall any other indication on the flight deck that alerted them to the possible activation of alpha mode during the approach.
The captain grounded the aircraft and contacted maintenance watch to organise engineering assistance from Brisbane. An engineer arrived the next morning and examined the aircraft systems, however, could not identify any technical fault with the aircraft. As a precaution, the engineer disabled the aircraft’s autothrottle system in accordance with approved maintenance procedures. The aircraft was released to service and operated back to Brisbane for further testing.
The captain held an Air Transport Pilot (Aeroplane) Licence and was appropriately qualified to conduct the flight. The captain also had an engineering background and had previously worked domestically for a number of airlines, before joining the operator in 2016. The captain had about 5,270 hours total time, with about 1,726 hours on the aircraft type, and was familiar with Rockhampton Airport, having operated there routinely for a number of years.
The first officer (FO) also held an Air Transport Pilot (Aeroplane) Licence, was appropriately qualified, and had extensive airline and charter experience both domestically and internationally. Having returned from expatriate international airline operations as a captain on Boeing 767, 757 and 777 aircraft, the FO worked for the operator for about 18 months prior to the incident, and had accumulated about 20,709 hours total time, with about 890 hours on type.
Training
General information
Civil aviation safety regulations require pilots to undergo regular assessment of skills and knowledge in particular operational areas to ensure competency. Proficiency checks assist in combatting the normal degradation of critical skills over time and serve as an important opportunity for operators to standardise and educate flight crew about recent operational changes, safety information, organisational guidelines and provide education on specific subjects. Most passenger transport operators satisfy this requirement by flight crew participation in an approved training and checking system called flight crew cyclic training. This training occurs numerous times a year and at set intervals.
All of the operator’s flight crew were required to complete initial type qualification training on the F100 before progressing to cyclic training and proficiency program assessments.
Alpha mode protections were covered in the operator’s initial type qualification training by all flight crew. However, at the time of the incident, ongoing cyclic training did not include alpha mode protection proficiency training or assessment. Both flight crew reported that the initial training received covered only the alpha mode activation and thrust increase and did not identify other aspects such as the sensation of blocked thrust levers.
The operator stated that, at the time of the occurrence, the training provided in the initial type rating was that recommended by the aircraft manufacturer. The type certificate holder advised that there was no obligation for them to create a flight crew training syllabus with associated training schedules for initial type training, nor for recurrent proficiency training. For that reason, such a flight crew training syllabus had not been issued. The type certificate holder further advised that, at the request of the operator after the occurrence, they had provided a recommended procedure for the demonstration of alpha mode for training purposes, although this was not specifically intended for critical phases of flight.
Captain
The captain completed initial type training on 5 May 2017 with the required element of alpha mode protection completed at that time. The captain’s last cyclic training assessment was conducted on 9 August 2019 and indicated a satisfactory-above satisfactory skill level, and good technical knowledge and skills. A further line check conducted on 3 September 2019 also supported the cyclic training results.
The captain recalled that there had been no further training in alpha mode, and expressed concern that there was no standard call or crew resource management process in place for flight crew to communicate the activation and resolution of an alpha mode activation.
First officer
The FO conducted initial type training on the F100 and was assessed as competent on 28 June 2018. Part of this training required satisfactory assessment of the element relating to alpha mode protection. The FO reported that the initial simulation demonstration in respect to alpha mode was conducted at about 5,000 ft, which was considerably different to experiencing it on approach to land at night in turbulence.
Cyclic training was undertaken on 12 May 2019, with results of this assessment indicating an above satisfactory skill level with very good technical knowledge and skill. A line check conducted on 30 July 2019 further supported the results of the cyclic training.
Recent history
Both flight crew were based in Brisbane and the operator reported that their individual rosters provided them with sufficient sleep opportunity in the nights prior to the incident. They both reported having a normal amount of sleep leading up to the incident. The FO reported being on 4 days of leave before working the day prior, and both flight crew reported being fully alert on the flight. The captain also reported not noticing any impact on the FO’s alertness during the flight.
Aircraft information
General
The Fokker F28 Mk0100 (F100) is a low-wing, twin-engine, medium-size, short-range, jet aircraft used by several regional carriers in Australia. It is powered by 2 Rolls-Royce RB.183 TAY medium by-pass, rear mounted turbofans. As of 28 June 2021, 24 F100 aircraft were in service with the operator.
Post-incident engineering testing
During initial troubleshooting at Rockhampton, the engineer concluded that the report of blocked thrust levers occurred when the autothrottle system (ATS) was engaged and that no fault codes or system reliability issues were identified.
After an uneventful return flight to Brisbane, further testing on the aircraft systems was conducted. This testing revealed no evidence of any malfunction within the alpha mode system, and further review of recorded flight data by the manufacturer revealed that the alpha mode functioned correctly. In addition, testing of the dynamic rods, which can introduce a stuck thrust lever sensation, was carried out as a part of the system troubleshooting and a resistance anomaly was identified through fault codes that displayed on the automatic flight control and augmentation system (AFCAS) maintenance panel. The engineer replaced the flight augmentation computer as a precaution and, after multiple system checks, returned the aircraft to service. Further testing of the dynamic rods by the operator identified a technical anomaly, however, this was not considered a factor in the incident.
Automatic flight control and augmentation system
System overview
The aircraft was fitted with an AFCAS that received information from the flight management system, and other flight and navigation data systems. It monitors the aircraft configuration, engines and other aircraft systems. The AFCAS integrates this data and displays the information to the pilots on the aircraft state and reference airspeeds and provides guidance on aircraft flight profile and navigation. The AFCAS also provides a number of aircraft flight envelope protection features, which includes minimum speed protection.
Minimum speed protection
The minimum speed protection system was based on an automatically calculated minimal allowable airspeed (VMA). The VMA is calculated by the AFCAS and is dependent on the aircraft weight, flap settings, flight phase and altitude information. In flight, VMA is displayed as the top of the amber strip located on the primary flight display speed scale (Figure 2). Minimum speed protection consists of 3 sub-system elements; the most relevant to this incident being the VMA protection and alpha modes.
Figure 2: Minimum allowable airspeed on the primary flight display
Source: Operator, annotated by the ATSB
VMA protection
The AFCAS does not accept speed selections below VMA, and aircraft speed deceleration to less than VMA is prevented by the AFCAS using either elevator or thrust control. The aircraft manufacturer identified limitations in this protection, stating that:
VMA protection may be not adequate in conditions of strong turbulence or during fast decelerations.
For those identified conditions, alpha mode then provides low speed protection.
Vertical speed indicator
Vertical speed is displayed on the right side of the primary flight display and is indicated in a positive and negative scale by an electronic needle indication with an abbreviated number display (Figure 2) in hundreds of feet per minute. The scale deflection does not have identified values, rather, it relies on flight crew knowledge to interpret the smaller dot above and below the level indicator as 500 ft/min marks, and larger scale marked in 1,000 ft increments. The abbreviated number display adjusts in increments of 100 ft/min, but only identifies the rate of decent in hundredths of the displayed rate. For example, 700 ft/min is identified as 7 on the abbreviated display.
Alpha mode
Alpha mode was designed to protect the aircraft from an aerodynamic stall[10] by automatically applying a controlled escalation of engine thrust to increase aircraft airspeed to VMA, or the selected airspeed set by the flight crew, whichever is higher. This potentially prevents the aircraft from entering a low speed, high angle of attack[11] state, where it would be vulnerable to loss of control.
The F100 Aircraft Operations Manual, section 1.18.4, stated that one of the system behaviours on activation of alpha mode was a thrust limit change to take-off/go-around (TOGA) thrust.
Indication is provided to flight crew on the flight deck through the primary flight display (Figure 2), the thrust limit change displays the climb (CLB) indication in the top left of the flight display from a green CLB to a white CLB.
Alpha mode activation will occur for a number of flight conditions, including, but not limited to, if the aircraft’s airspeed drops 5 kt below 1.3 times the stall speed in a given configuration. However, alpha mode activation could occur at higher speeds if the aircraft is subject to an increasing load factor,[12] fast decelerations at low thrust settings, or in conditions that may exacerbate these factors, such as atmospheric turbulence. For the incident flight, the aircraft type certificate holder indicated the VMA varied between 131–132 kt.
The ATS increases thrust by a deliberately controlled increase (forward movement) in the throttle lever position. The amount of thrust required is dependent on the aircraft’s airspeed increasing to VMA or the selected airspeed, whichever is higher, and could increase thrust up to the TOGA setting. The increased thrust will increase airspeed, potentially preventing the aircraft from slowing to the point of stall. The ATS controls the increased thrust to the engines through the dynamic rods.
Dynamic rods
The F100 is fitted with mechanical/electrical connecting rods joining the thrust levers and the thrust control cable system, known as dynamic rods (Figure 3). The dynamic rods are fitted with switches, which activate allowing normal pilot input on the thrust levers to override the ATS by opening the autothrottle engage clutches. When alpha mode is active, these switches are deactivated and the thrust levers may appear rigid, requiring significant effort to move them.
The system is designed to prevent flight crew from reducing thrust further during a low-speed event, thereby potentially providing protection against a low-speed loss of control. However, the increased thrust lever force required also affects the normal operation of the thrust lever to increase thrust.
Figure 3: Dynamic rods schematic
Source: Operator, annotated by the ATSB
The dynamic rod behaviour under alpha mode was specific to the operator’s F100 fleet. The Fokker F28 Mk070 (F70) series, also operated by the operator, was also fitted with alpha mode but did not have the dynamic rod feature. A modification was available to remove the dynamic rod behaviour in the F100; however, this had not been incorporated into any of the operator’s F100 fleet at the time of the incident. The operator reported that it had considered incorporating the modification across the Fokker fleet, but this was not achievable due to part availability and cost.
Thrust lever resistance
At the time of the incident, The F100 Aircraft Operations Manual provided a caution regarding the thrust level resistance experienced when the aircraft was in alpha mode as:
CAUTION:
The force override switches are de-activated during alpha mode operation and if, at this moment, the pilot attempts to manually advance the thrust levers to speed up engine response, he experiences heavy override forces which may give the impression that the thrust levers are blocked. Although not recommended, ATS can be overridden by holding the ATS disconnect buttons [on the thrust levers] depressed and advancing the thrust levers until the speed is above VMA and the alpha mode is deactivated.
If significant force is applied to the thrust levers while alpha mode is active, the pilot could advance the thrust levers by overpowering independent slip clutches within the system. However, this does not deactivate alpha mode, but does manually increase the thrust. When the aircraft regains airspeed to VMA or the selected speed set by the flight crew, alpha mode will deactivate. This restores the dynamic rod switches to normal functionality, and the increased thrust lever force will no longer be experienced by the pilot.
Approach stability
The stabilised approach concept is identified by the International Civil Aviation Organization as a set of criteria to maintain a stable approach speed, descent rate, vertical flight path, and configuration to the landing touchdown point to reduce the occurrence of controlled flight into terrain. The operator’s stabilised approach criteria, detailed in the Operations Policy and Procedures Manual – Standard operating procedures, stated:
All flights must be stabilized by 1,000 feet above airport elevation in instrument meteorological conditions (IMC) and 500 feet above airport elevation in visual meteorological conditions (VMC).
The approach is stabilized when all of the following criteria are met.
-the aircraft is on the correct flight path;
-only small changes in heading/pitch are required to maintain correct flight path;
-the aircraft speed is not more than VREF + 20 knots indicated airspeed and not less than VREF;
-the aircraft is in the landing configuration;
-sink rate is no greater than 1,000 feet per minute; if an approach requires a sink rate of greater than 1,000 feet per minute, a special briefing should be conducted;
-power setting is appropriate for the aircraft configuration and is not below the minimum power for approach as defined by the aircraft operating manual;
-all briefings and checklist have been conducted;
-specific types of approaches are stabilized if they also fulfil the following
-instrument landing system (ILS) approaches must be flown within one dot of the glideslope and localizer
-a Category II or Category III (ILS) approach must be flown within the expanded localizer band
-unique approach procedures or abnormal conditions requiring a deviation from the above elements of a stabilized approach require a special briefing.
An approach that becomes unstabilzed below 1,000 feet above airport elevation in IMC or below 500 feet above airport elevation in VMC requires an immediate go-round.
The ATSB reviewed the manuals of a number of Australian domestic and international carriers and identified that it was common for these operators to provide exceedance limitations in their procedures to allow flight crew discretion to momentarily exceed a part of the stabilised approach criteria during an attempt to correct the transient exceedance.
When discussing the concepts and terms associated with a stabilised approach, the International Civil Aviation Organization (International Civil Aviation Organization, 2015) noted that ‘normal bracketing corrections’ or momentary exceedances from pre-determined stabilised approach criteria was acceptable in some circumstances. For example:
Upon establishing visual contact with the runway environment, the pilot should be able to continue to a safe landing using normal bracketing corrections, or, if unable, should perform a missed approach.
These corrections relate to bank angle, rate of descent, and power management. Considering the operating limitations stated in the aircraft’s approved flight manual, the recommended ranges of acceptable momentary exceedances to stabilised approach criteria were:
course guidance variation depending on the approach type
maximum bank angle of 30º if specified in the approved operating manual used by the pilot
± 300 ft/min deviation in rate of descent
permissible power range if specified in the approved operating manual
momentary overshoots made necessary by atmospheric conditions.
At the time of the incident, the operator did not have a policy regarding momentary exceedances.
Recorded information
General information
VH-UQN was fitted with a flight data recorder (FDR) and cockpit voice recorder (CVR). Upon returning to Brisbane, the operator downloaded, and analysed the FDR data using flight data analysis program software. The ATSB reviewed this data, along with FDR analysis conducted by the aircraft type certificate holder, and this is summarised below.
Due to the extended period from the incident and it being reported to the ATSB, the CVR record of the flight had been overwritten. As such, the investigation was not able to verify the timeline of flight crew communications, which may have provided additional information.
Flight path and thrust data
At about 800 ft on descent on final approach, an airspeed of 137 kt was selected by the flight crew. The landing gear had been extended and the flaps were in the landing configuration. Flight data indicated the aircraft was stable at that time with a rate of descent (RoD) of about 750 ft/min, a pitch attitude of 1° nose down, and thrust lever angle (TLA) of 37°.
At about 630 ft, the autopilot was disconnected.
At about 550 ft, the aircraft was pitched to about 3° nose down and the RoD increased to about 1,100 ft/min, with a TLA of 33° and an airspeed of 138 kt.
At about 490 ft, the aircraft was pitched to about 2° nose down with a RoD of about 1,200 ft/min. The thrust levers indicated ‘OVERRIDE’ on the FDR data, as the auto throttle servo motors were not engaged, meaning the AFCAS could not reposition the thrust levers. However, the position of the thrust levers was still changing with a TLA of 29°. The airspeed had increased to 139 kt.
At about 450 ft, the thrust levers were reduced to 21° TLA and the aircraft was pitched to about 3° nose down.
Between about 400 ft and 300 ft, the TLA was further reduced to 17° and the pitch attitude maintained at 3° nose down as the RoD increased to a maximum of 1,270 ft/min.
At about 250 ft, the airspeed fell below V
At 203 ft, the airspeed had reached its lowest recorded reading of 127 kt, about 27 kt above the stall speed. The FDR data indicated TOGA limit activation, triggering the minimum speed protection of alpha mode and the ATS increased the thrust over a period of about 7 seconds to recover airspeed.
The aircraft speed accelerated above VMA, about 3 seconds after alpha mode activation at about 165 ft. The aircraft made a normal landing.
Approach stability
The operator’s flight data analysis software triggered 2 high RoD events during the approach at 586 ft and the second at 371 ft (Figure 4).
Figure 4: Flight path trajectory for VH-UQN at Rockhampton
Source: ADI occurrence flight summary, annotated by the ATSB
Data for the initial stages of the approach indicated that the aircraft was relatively stable until about 600 ft, when the aircraft’s rate of decent began to increase past 1,000 ft/min. At about 370 ft, a maximum descent rate of 1,270 ft/min was recorded as the airspeed reduced to 135 kt. This added instability to the approach, however, the descent rate was not sustained above 1,200 ft/min for greater than 6 seconds. The flight crew did not consider the momentary increases in RoD as leading to an unstable approach requiring a go-around.
Speed reduction below VMA
The FDR data indicated that, at 0957:55, the aircraft’s airspeed reduced below the VMA of 132 kt and continued to reduce to the lowest recorded speed of 127 kt about 3 seconds later, about 5 kt below VMA. The activation of alpha mode increased thrust, and airspeed increased above VMA about 3 seconds later.
The F100 Aircraft Operations Manual, section 1.18.04 (Version 11, Issue 3 Page 2) detailed a caution relating to the activation of alpha mode with low thrust settings:
CAUTION:
When ATS engages as a result of alpha mode activation with the engines spooled down or in case of a high deceleration rate, the speed may fall well below VMA before the aircraft starts to accelerate.
Meteorological information
Forecast conditions
Prior to departure, the flight crew reviewed the operator’s pre-flight briefing documents and accessed the weather forecasts from the national aeronautical information processing system[13] on an iPad. The Bureau of Meteorology graphical area forecast for Rockhampton indicated reduced visibility down to 4,000 m in isolated smoke with moderate turbulence below 10,000 ft in thermals. Low-level, the grid-point wind and temperature forecast indicated a wind strength of about 15 kt from the south-south-east, changing to a north-westerly at about 10 kt. The forecast en route conditions were consistent with the flight crew’s recollections on the day.
Actual weather conditions
Prior to landing at Rockhampton, the flight crew obtained the local weather from the automatic terminal information service,[14] which indicated visibility of 5,000 m in smoke. The flight crew further stated that 3,600 m was the minimum visibility required for landing. They reported that the flight conditions on previous sectors that day had been affected by reduced visibility from smoke haze over most of south-east Queensland.
The flight crew reported no significant turbulence at higher altitudes. However, on final approach, they reported that the turbulence increased as the aircraft descended, and continued until after the approach minima where moderate turbulence was experienced. The captain described moderate turbulence as being ‘physically moved around in your seat’ with fluctuating airspeed and vertical speed indications on the aircraft instrumentation.
Bushfires and visibility
Heightened bushfire activity had been present for a number of weeks across south-east Queensland. Some effects such as reduced visibility from smoke, remained an ongoing challenge for aircraft operators during that time.
The flight crew reported sighting a number of bushfires in the vicinity of the airport. One was located about 1 km to the north-west of the airport, with further larger fires to the south-west as they approached Rockhampton. As the flight crew made their final approach to land, the north‑westerly wind strengthened with an associated wind change, and localised smoke began drifting across the runway.
The flight crew recalled that, as the aircraft descended through about 1,400 ft, the effects of increasing wind were felt, and approaching about 560 ft, slant visibility began to deteriorate with smoke discolouring the precision approach path indicator (PAPI). The flight crew stated that they received reduced vertical visual cues on approach to the runway, however, the runway lights remained visible throughout the entire approach.
Convective turbulence
Convective turbulence can be described as rising warm or hot air creating unstable atmospheric conditions. It can be created by the normal heating of air over the earth’s surface or by the hot air from a bushfire or combustion process. Heated air is less dense than the cooler air around it and rises. Cooler air will rush in underneath to fill this void also producing wind changes and air turbulence. These updrafts of hot air and downdrafts of cooler air can produce gusty fluctuations in vertical and horizontal air masses, causing in-flight turbulence.
Airport information
Precision approach path indicators
Rockhampton Airport was equipped with precision approach path indicators (PAPI), which are an array of lights located beside the runway providing visual reference and vertical guidance to pilots up to 20 NM (37 km) from the runway at night, right down to landing (Figure 5).
The PAPI lights are normally located abeam the 1,500 ft runway markers and are characterised by 4 high intensity light beams with coloured filters. Dependent on the aircraft’s vertical profile, the pilot would see either red or white lights. A normal 3° approach path would be identified by equal numbers of red and white lights. If the aircraft was below the glideslope, there would be more red lights than white, and above glideslope, more white lights than red would be displayed.
The PAPI light display is susceptible to the line-of-sight limitations of distance and visibility. The presence of smoke is likely to discolour the light array and make distinguishing colour from red to white difficult (Aeronautical Research Labratories, 1981).
Figure 5: PAPI light indications
Source: ATSB
Safety management systems
High and low-capacity regular public transport operator certificate holders in Australia are required to manage the safety of their operations on a day-to-day basis. Part of this responsibility falls within a safety management system (SMS), which requires a systemic approach to setting policy and safety objectives, to manage safety risk, provide safety assurance, and to communicate safety outcomes within the organisation.
Safety assurance is one key component of an SMS and relies upon the systematic monitoring and measurement of the operator’s safety performance and evaluating safety management processes and practices. Safety assurance provides demonstrable safety outcomes from the SMS and enables benchmarking to provide verifiable organisational performance to an acceptable level of safety.
Organisations experience change due to a number of factors such as business improvements that may result in changes to internal systems and processes or procedures. As stated by the International Civil Aviation Organization (2018), these changes may:
…affect the effectiveness of existing safety risk controls. In addition, new hazards and related safety risks may be inadvertently introduced into an operation when change occurs. Hazards should be identified and related safety risks assessed and controlled as defined in the organization’s existing hazard identification or SRM [safety risk management] procedures.
Organisational information
Safety occurrence reporting
Reporting process
The operator’s safety department was responsible for the reporting of regulatory and safety related information to government departments such as the Civil Aviation Safety Authority (CASA) and ATSB. In the instance of an ATSB immediately or routine reportable matter,[15] defined under the Transport Safety Investigation Act 2003 and Regulations (2003), a responsible person who had knowledge of the reportable matter was to provide a written report to the ATSB within 72 hours from the time of the occurrence.
Incident and accident reports were submitted electronically through the operator’s reporting system and reviewed by the safety department. Occurrence data collected under the reporting system was used to identify developing trends and to provide safety management oversight of the airline’s operations. The reports were then distributed to subject matter experts in different departments for feedback and validation. Once validated, the safety department consolidated the departmental responses and then provided an organisational response to CASA and the ATSB.
This incident was reported through the safety reporting system by the captain 2 days after, on 12 November 2019. However, the report was overlooked within the reporting system until 16 November 2019. The ATSB received the report from the operator on 19 November 2019, 9 days after the incident.
Changes to the safety occurrence reporting system
A new safety reporting system was implemented in June 2019, as the operator transitioned safety management system software providers to a new supplier. The web-based system was designed to provide safety management support for airlines and other aviation organisations. The SSM described the new system as a:
…fairly intuitive and accountable system where nothing could be purposely hidden or changed within the system unless the change was recorded and justified.
One unique element of the system was the electronic tracking of occurrences and reports as they were reported online through the safety systems portal. Once logged, each occurrence had a unique identifier and started a virtual 72-hour countdown timer (Figure 7) to track the assessment, validation, and reporting of each occurrence. Primarily, this was to ensure safety assurance action within the prescribed period of an ATSB reportable matter.
The timer initially appeared yellow and then progressively changed to red indicating the time remaining for the submission of the written report to the ATSB. Once completely red, the report was overdue to the ATSB. The countdown timer offered a dashboard review screen where multiple occurrences could be reviewed in a date-based order.
Figure 6: Safety management reporting system 72-hour countdown timer
Source: Operator
When a report had been submitted to the ATSB, the timer was removed. However, for reports that did not require notification to the ATSB, the timer remained and appeared red until it had been validated. The operator indicated that these reports could potentially take several days to validate. As such, multiple reports with red timers would be visible on the dashboard. However, if a report was submitted late, as was the case for this incident, the report would appear in the list below other reports that had already been processed. With this setup, there was no obvious indication that a late report had not been submitted and was outstanding for ATSB reporting.
Another key element of the introduction of the web-based safety reporting system was that this enabled safety reporting from employees using mobile platforms such as crew iPads, thus enhancing the timeliness and ease of reporting.
Changes in internal processes
The SSM identified that any change to a key system introduces risk. The introduction of the new reporting system required significant redevelopment of organisational process, manuals and supporting guidance documents. Some of these changes were yet to be fully implemented into the internal safety systems standard operating procedures at the time of the incident. One such procedure was related to the operator’s process for providing further information to external requests received from the ATSB and CASA.
Part of the introduction also included educating staff on the new system and required changes to work practices. This included dissemination of information, the briefing of operational departments, and staff education on changes to internal manuals and documented processes. During this time, the SSM and the ASSM had been employed for a period of less than 6 months and were responsible for the implementation of much of this work to support the new safety reporting system changes.
Key safety post holder positions
Safety systems manager
The safety systems manager (SSM) began working with the operator in July 2019 and was responsible for the day-to-day management of the SMS as well as the safety reporting system. They were also responsible for the implementation and integration of the new safety reporting system, and the procedures and supporting guidance documentation. At the time of the incident, the SSM was on leave for 3 weeks and was not contactable. The SSM role was passed on to the acting SSM (ASSM).
Acting safety systems manager
The ASSM started with the operator in June 2019, in the substantiative position of safety and quality manager. This position entailed responsibility for dangerous goods, work health and safety, environment, and emergency response. The ASSM was also identified by CASA as an alternate postholder for the SSM position and provided support to the SSM position when required.
The ASSM stated that there was an expectation that extra duties would be accommodated by staff, in addition to their existing duties. Therefore, during the period as ASSM, they were still required to conduct their normal role in addition to the tasks of the SSM. The ASSM reported that part of their substantive role required travel to remote mine sites to conduct audits. They advised that they had travelled from Brisbane to Adelaide for the week of the handover from the SSM and then travelled to a north-western Australian mine site for 4 days, which had intermittent internet access and mobile phone coverage.
Handover of safety systems manager role
On 1 November 2019, the SSM sent an email to internal staff, notifying them that the ASSM would be acting in the position until 21 November 2019. CASA was also advised by the SSM of the same absence.
The SSM recalled that there was no formal handover or training undertaken for the acting role, and that a brief discussion was held relating to the internal operating procedure of checking the safety reporting system every 12 hours. The ASSM also recalled not receiving a formal handover, however, recalled receiving an email with a number of tasks to complete shortly before departing for the 4-day audit.
The SSM was unaware that the ASSM was planning to be away travelling during the time required to fulfil the role of ASSM. The SSM also remarked that, while not against company policy, this situation was most likely not optimal as the ASSM role required access to a computer, and a reliable internet and phone connection to work effectively while remotely based.
Changes in key positions
Prior to the incident, the SSM had been in the role for about 5 months before going on leave and passing the role to the ASSM. The ASSM had been in their substantive role for about 6 months before acting in the role of SSM as an alternate post holder. This was the first time the ASSM had conducted this role.
The overall quality manager was reported to have been in the position for a couple of years and the general manager was reported to have been in that position for about 20 months.
Organisational and role assimilation
Successful integration of a new staff member into an organisation is referred to as organisational assimilation and it consists of a number of factors including learning how to interact with new co-workers, understanding organisational norms, adjustment of the employee’s expectations around involvement in the organisation and adaption to the new role (Myer & Oetzel, 2003). New employees may adapt their expectations of the new role based on their previous experiences.
Both organisational and role assimilation is dependent on the individual’s previous experiences and how different they find the new role and the organisation. Generally, the longer the employee has been with the organisation, then the greater the time the employee has to adjust their expectations of the role, to conform to the requirements of the organisation.
Likewise, the time taken by an employee to assimilate into a new role and organisation, while substantial, cannot be quantified. This remains subject to the individual’s ability to make sense of
the new role and organisation (Weick, 1995) and relies on their will and ability to adapt in order to attain the required competency.
Related occurrences
Perceived thrust levers being stuck during alpha mode
In 2009, another Australian operator of Fokker 100 aircraft had an event during the base leg of an approach. The crew reported that when they attempted to increase thrust, they found that the thrust levers appeared to be blocked. After about 5 seconds, they were able to push the thrust levers forward, using a much greater force than normal to overcome the autothrottle system, by which time the airspeed had decreased to VMA. Subsequent investigation by the operator identified no technical problems with the aircraft.
As a result of the event, that operator developed educational material to support cyclic training, specifically covering alpha mode indications and thrust lever blockage.
In 2014, the same operator had a different operational occurrence in which the crew correctly recognised an alpha mode activation. Further information was then also provided to the operator’s crew on specific combinations of automation modes likely to result in the activation of the alpha mode function.
The other Australian operator subsequently advised the ATSB that this information about alpha mode activation was incorporated into its initial Fokker 100 pilot type rating ground school training material as well as its recurrent ground and simulator training.
On 25 June 2013, the flight crew of an Airbus A320-232 aircraft were conducting an instrument landing system approach with autoland training at Sydney Airport, New South Wales. During the approach, the training captain (pilot flying) disconnected the autothrust system by retarding the thrust levers to the IDLE STOP and asked the FO to assess the effect on the proposed approach. After briefly referring to the Quick Reference Handbook, the flight crew extended the landing gear and wing flap and finalised the pre-landing checklist. The flight crew then became involved in a discussion about the requirements in the handbook for the proposed approach.
With engine thrust at idle and the aircraft in a high drag configuration, the airspeed quickly reduced to below the minimum approach speed. The captain was in the process of applying thrust when the aircraft’s alpha-floor protection system activated. TOGA thrust was automatically commanded by this system and the flight crew conducted a missed approach.
The ATSB found that, during an autoland training exercise with the autothrust disengaged, both pilots were distracted by their consideration of a training scenario. As a result, they did not identify the airspeed reducing below the target approach speed in sufficient time to prevent activation of the aircraft’s alpha-floor protection system.
On 7 September 2013, an Airbus A320 aircraft, was on descent into Auckland, New Zealand via a required navigation performance approach to runway 23 Left. During the later stages of their descent, the flight crew managed the aircraft speed to meet an air traffic control request and according to applicable company speed restrictions.
The auto-flight system sequenced to final approach mode passing about 4,200 ft, but exited final approach mode when the flight crew subsequently levelled the aircraft approaching 3,000 ft. The flight crew levelled the aircraft to reduce speed to comply with a company speed restriction of 210 kt maximum below 3,000 ft. Having slowed sufficiently, subsequent manipulation of the auto‑flight system resulted in the inadvertent engagement of open climb mode, which resulted in an increase in engine thrust and aircraft acceleration.
Attempting to avoid exceeding the limiting speed applicable to the existing aircraft configuration, the captain retarded the thrust levers to the idle stop, inadvertently disconnecting the auto-thrust system. The flight crew resumed the approach, unaware that the auto-thrust system was disconnected, and therefore no longer controlling aircraft speed. As the aircraft continued to decelerate, soon after the final stage of flap was selected for landing, the flight management guidance system generated a low energy warning. As the flight crew was responding to the low‑energy warning, alpha-floor auto-thrust mode engaged. The flight crew accelerated the aircraft to approach speed using manual thrust control and was able to continue the approach for an uneventful landing.
The operator made findings with respect to flight crew communication, aircraft energy state monitoring, wider automation management and mode awareness issues, and the procedures governing the reinstatement of aircraft control following intervention by the pilot not flying. The operator also found that there may be some commonly held misunderstandings with respect to some aspects of the instrument approach procedures.
While on final approach to runway 33 at Rockhampton Airport, the aircraft became slightly high on approach. Attempted corrections by the first officer (FO) to regain the approach path resulted in the aircraft entering a low speed/low thrust configuration, which activated the alpha mode protection. In response, the flight crew attempted to increase thrust, but the thrust levers appeared to be ‘blocked’. The FO forcibly moved the thrust levers and the aircraft was subsequently landed safely.
A post-flight engineering assessment found no evidence to indicate a technical problem, or failure of any of the mechanical components in the system, which may have led to the blocked thrust levers or inadvertent activation of alpha mode.
This analysis will consider the circumstances that preceded the incident, including weather, visibility, flight crew training, and stability of the approach. Changes to key safety management reporting systems and safety personnel, as well as post-incident circumstances such as organisational delays and the management of safety reporting, will also be discussed.
High approach profile
On the day of the incident, the southern Queensland aviation network was affected by widespread reductions in visibility due to bushfire generated smoke haze. Additionally, the Rockhampton area was impacted by moderate, low-level, convective turbulence from localised bushfires.
During descent at night into the strengthening north-westerly wind, the aircraft was buffeted by rising hot air and encountered smoke from the bushfires close to Rockhampton Airport. Convective turbulence from rising and sinking air affected the aircraft’s vertical speed on the approach. Reduced visibility was encountered on final approach as smoke discoloured the runway lighting and precision approach path indicators (PAPI), rendering the vertical approach guidance lights temporarily unusable.
During the late stages of the approach, the flight crew reported that, at about 400 ft, the smoke discolouration of the PAPI lights reduced and they identified that they were slightly high on the approach profile. The aircraft’s airspeed and vertical approach profile was affected by convective turbulence from a local bushfire, impacting the flight crew’s ability to maintain the approach path.
The FO reduced the thrust setting and lowered the nose of the aircraft to correct for being slightly high on the approach path. This, coupled with convective turbulence, very likely resulted in an increased rate of descent and subsequent airspeed reduction towards the minimum approach speed (VMA).
High descent rate
Flight crew reaction to changing in-flight performance, requires them to identify a parameter change is occurring, decide to apply correction, apply the correction technique, monitor the correction for change against the parameter, identify that the desired parameter has been regained, reduce corrective input, and monitor for change.
The aircraft’s flight data noted 2 high rate of descent events when below 600 ft on approach, with a maximum rate of about 1,200 ft/min for a short period of time. This exceeded the operator’s stable approach criteria, which required a rate of less than 1,000 ft/min. The identification of the high descent rate may not have been as immediate as the data suggested, as the flight crew were in the higher workload phase of landing in challenging conditions. Granularity of the vertical speed indicator increments, abbreviated vertical speed readout and display layout most likely affected the flight crew’s ability to readily identify the increased rate of descent above 1,000 ft/min. This required greater attentional resources to identify, correct and monitor the rate than the flight crew had available with the late PAPI identification (as the smoke cleared) of the slightly high approach profile while entering convective turbulence.
Low airspeed management
While on final approach, the FO overrode the autothrottle system, manually reduced the thrust setting and lowered the nose of the aircraft to correct for being slightly high on the approach path. This, combined with the convective turbulence from the bushfire, resulted in a fluctuating rate of descent, peaking at about 1,200 ft/min for about 6 seconds. The recorded flight data showed that the airspeed decreased below the minimum approach speed (VMA). As a result of the low speed, low thrust condition, alpha mode activated at 203 ft.
Consequently, after the captain’s second ‘speed’ call, the FO had to forcibly move the thrust levers forward to counteract the thrust lever resistance, as a result of alpha mode activation. The alpha mode activation combined with flight crew’s actions resulted in the aircraft responding to the increased thrust.
The airspeed increased above the VMA about 3 seconds after alpha mode activated. Alpha mode then disengaged, allowing free movement of the thrust levers, which may explain why the FO described experiencing a reduction in thrust lever resistance. While the airspeed reduced to 5 kt below VMA for 1 second, the airspeed remained above the stall speed by about 27 kt before recovering, and a normal landing made.
Mode confusion
During the approach to land, both pilots identified the deceasing airspeed and attempted to rectify this. However, neither recognised that alpha mode had activated. The FO had identified that the thrust levers appeared blocked but could not identify why this occurred. Consequently, they continued to force the thrust levers forward, without knowing that the alpha mode system was actively increasing thrust to recover airspeed. The flight crew continued the approach and considered that the conduct of a go-around may place the aircraft in a nose high, slow speed condition without the sufficient thrust, thereby increasing the risk of loss of control.
After an uneventful landing, the flight crew discounted the possibility of an alpha mode activation as they recalled that the airspeed had not reduced below the minimum approach speed. Mode awareness is a type of situational awareness based on the pilot’s understanding of aircraft configuration and flight control system modes. Being aware of the active mode(s) and understanding the corresponding actions and responses is necessary for proper use of the autoflight system. Ineffective auto-flight system mode awareness has been identified as a contributing factor in many occurrences since the introduction of complex auto-flight systems (United States Federal Aviation Administration, 1996).
Flight crew training on alpha mode
As per the operator’s standard practice, the flight crew had been checked as competent on their understanding of alpha mode during their initial aircraft type training. However, the simulator demonstration was conducted at altitude and did not include elements of competency relating to alpha mode activation in different flight configurations and states, or at critical times such as final approach. Further, the training did not include the higher force caused by the dynamic rod lockout, which was only applicable to the operator’s F100 fleet. The operator’s flight crew may operate both variants at different times.
In addition to the initial training, flight crews were not routinely assessed on alpha mode during cyclic training. Recurrent or cyclic training was a mechanism for developing and assessing flight crew performance across a range of necessary competencies. This ensured that each crew member was adequately trained and proficient for the aircraft type and their position held. As highlighted by the Civil Aviation Safety Authority, recurrent or cyclic training assists with the prevention of the degradation of critical skills over time.
In this case, it had been more than 1–2 years since the flight crew had completed their initial type training for the F100, noting that this did not capture all aspects regarding alpha mode. As such, the flight crew were not aware that alpha mode activation could occur above the minimum approach speed in different aircraft states, or that thrust lever resistance would be experienced when in this mode. Therefore, the initial type qualification training on the F100 did not adequately prepare pilots to recognise and recover from an alpha mode activation during a critical phase of flight, such as during approach to land. Also, there was no further cyclic training in relation to alpha mode activation and procedures to support flight crew decision making when such an activation occurred.
Stabilised approach criteria
The operator’s criteria for stabilised approach was reviewed and found to be consistent with the International Civil Aviation Organization (ICAO) recognised standard operating procedures. The operator provided this information to flight crew by publication in the Operations Policy and Procedures Manual – Standard operating procedures.
The review of other operators’ manuals found that their procedures allowed for momentary exceedances of the stabilised approach criteria. This allowed flight crew to continue an approach with some flexibility to external environmental influences. The operator’s published stabilised approach criteria did not reflect this flexibility, and the operator’s internal investigation did not consider the approach to be unstable and no further mention of the stabilised approach criteria was identified.
New safety reporting system
The operator’s newly introduced safety reporting system displayed submitted reports on a dashboard in date and time order and assigned a visual coloured 72-hour countdown timer to aid in tracking. This visual tool was displayed against all submitted reports, not just those required to be notified to the ATSB. However, due to the design of the system, ATSB notifiable reports that were submitted late would not only have appeared further down the list but appeared overdue. Similarly, other occurrences that did not require reporting to the ATSB, however required validation by the relevant department responsible managers, would have also appeared overdue.
As previously mentioned, safety reporting systems are an essential tool within a safety management system for gathering valuable safety information. This information could be used for identifying occurrences that required further investigation, for discovering lessons learnt, and for providing a useful source of information for hazard identification. However, this was reliant on a system design that was effective.
In this case, when the captain’s safety report was submitted about 2 days after the incident, it was not likely displayed on the initial dashboard screen due to the date order and it would have been listed below already overdue reports. This meant that it would not have been clearly visible to the safety department staff. This system characteristic was not identified prior to this incident, which made identification and subsequent report tracking more difficult for the safety department. In turn, this did not allow for the effective prioritisation of submitted safety reports.
Organisational change
There had been a significant turnover of staff within the operator’s safety department prior to the incident, with a number of key staff having only been in their respective positions for less than 6 months. This coincided with the introduction of the new safety reporting system. This reduced short-term organisational memory relating to the introduction of the new system, and came at an important stage of system implementation, with the redevelopment of new supporting processes under the operator’s standard operating procedures. This required increased education to the operator’s staff on the use of the new system, by the safety systems department. This likely affected the safety systems manager (SSM) and the acting SSM (ASSM), with increased tasks and workload during a period of organisational and role assimilation within the operator.
The ASSM was approved as the alternate postholder position for the SSM. However, having not previously acted in the role, and with a limited handover, it was unlikely that the ASSM was able to adequately fulfil the requirements of this role in addition to their ordinary workload and remote duties.
Implementation of supporting processes into the operator’s standard operating procedures for the new safety reporting system relied on the SSM to review and make changes to the existing organisational process. However, all procedures had not yet been finalised, in particular, that relating to further requests for information for immediately and routine reportable matters to the ATSB. Therefore, there was little guidance available to the ASSM regarding ATSB reporting.
Safety assurance is a key component of a safety management system. Of particular importance are changes to internal systems and processes or procedures. As previously highlighted by the International Civil Aviation Organization, such changes could inadvertently introduce new hazards and associated risks to an operation. The system change, coupled with new employees in the safety department, and the redevelopment of internal processes, did not identify the visual display deficiencies and possible unintended outcomes of the new safety reporting system. This increased the safety department’s workload and introduced an increased risk of some reports not being appropriately classified, reported, or acted upon in a timely manner.
Findings
ATSB investigation report findings focus on safety factors (that is, occurrences and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the operational event involving a Fokker F28-Mk0100, VH-UQN, at Rockhampton, Queensland, on 10 November 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
On final approach to land at Rockhampton Airport, reduced visibility and turbulence from a bushfire added uncertainty and late identification of a high approach profile.
On final approach, the flight crew experienced a low airspeed management event.
The operator’s training for the Fokker F28-Mk0100 did not prepare pilots for alpha mode activation during critical phases of flight. (Safety issue)
The flight crew were unaware the alpha mode had activated, resulting in mode confusion prior to and after they advanced the thrust levers on final approach.
Other factors that increased risk
On short final, the aircraft's rate of descent increased beyond the operator's stable approach criteria. The crew did not consider that the approach was unstable and continued the approach due to perceived blocked thrust levers, and possible adverse consequences of conducting a go-around.
Changes in the operator's key safety post holder positions, safety reporting systems and internal processes reduced effective safety assurance. (Safety issue)
The operator’s safety management reporting system did not enable the effective prioritisation of submitted safety reports. (Safety issue)
Other key findings
Although the operator provided guidance to flight crews about the stable approach criteria, it did not specifically permit transient exceedances of the set criteria.
Associated with a number of reasons, there was a significant delay in the occurrence (which was a routinely reportable matter) being reported to the ATSB.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety management reporting system
Safety issue number: AO-2019-063-SI-01 Safety issue description: The operator’s safety management reporting system did not enable the effective prioritisation of submitted safety reports.
Flight crew training
Safety issue number: AO-2019-063-SI-02 Safety issue description:The operator’s training for the Fokker F28-Mk0100 did not prepare pilots for alpha mode activation during critical phases of flight.
Organisational change
Safety issue number: AO-2019-063-SI-03 Safety issue description: Changes in the operator's key safety post holder positions, safety reporting systems and internal processes reduced effective safety assurance.
Safety action not associated with an identified safety issue
Additional safety action Alliance Airlines
The operator advised that an update to its stabilisation policy and associated criteria was being conducted and this will also introduce guidance on transient exceedances of the criteria.
Glossary
AFCAS
Automatic flight control and augmentation system
ASSM
Acting safety systems manager
ATIS
Automatic terminal information system
ATS
Autothrottle system
CASA
Civil Aviation Safety Authority
EST
Eastern Standard Time
FAA
United States Federal Aviation Administration
FDR
Flight data recorder
FO
First officer
ICAO
International Civil Aviation Organization
IMC
Instrument meteorological condition
PF
Pilot flying
PM
Pilot monitoring
PAPI
Precision approach path indicator
NAIPS
National aeronautical information processing system
RNP
Required navigation performance
RoD
Rate of descent
SOP
Standard operating procedure
SSM
Safety systems manager
TLA
Thrust lever angle
TOGA
Take-off/go-around
UTC
Coordinated universal time
VMC
Visual meteorological condition
VMA
Minimum allowable airspeed
Sources and submissions
Sources of information
The sources of information during the investigation included:
The flight crew
Alliance Airlines PTY Limited
Virgin Australia Regional Airlines
the aircraft type certificate holder
the recorded flight data
Civil Aviation Safety Authority
Bureau of Meteorology
Airservices Australia.
References
Aeronautical Research Laboratories. (1981). Hazards of colour coding in visual approach slope indicators. Melbourne: Aeronautical Research Laboratories.
International Civil Aviation Organization. (2018). Safety Management Manual (Doc 9859). Montreal, Canada: International Civil Aviation Organization.
International Civil Aviation Organization. (2015). LOC-1/CFIT-2 Safety enhancement initiative:Model advisory circular for air operators – standard operating procedures for flight deck crewmembers.
Myer, K. K., & Oetzel, J. G. (2003). Exploring the dimensions of organizational assimilation: Creating and validating a measure. Communication Quarterly, 438-457.
Weick, K. (1995). Sensemaking in organisations. Thousand Oaks, CA: Sage.
United States Federal Aviation Administration. (2003). Advisory Circular 120-71A. In Standard Operating procedures for flight deck crewmember (pp. 14-15). Washington: Federal Aviation Administration.
United States Federal Aviation Administration. (1996). The Interfaces between Flightcrews and Modern Flight Deck Systems. Washington: Federal Aviation Administration.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Alliance Airlines PTY Ltd
the flight crew
the acting safety systems manager
the safety systems manager
Fokker Services and Dutch Safety Board
the Civil Aviation Safety Authority
the Bureau of Meteorology.
Submissions were received from Alliance Airlines PTY Ltd, the captain, the safety systems manager and Fokker Services. The submissions were reviewed and, where considered appropriate, the text of the final report was be amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 4 November 2019, an Airbus A320-200 aircraft, registered VH-VQG (VQG), was operating a scheduled passenger flight from Sydney, New South Wales, to Sunshine Coast, Queensland (Qld). As the aircraft was on final approach to land, a proximity event occurred with an Aero Commander 500 aircraft, registered VH-UJS (UJS), which was departing Sunshine Coast Airport on the reciprocal runway. The two aircraft paths converged, until the pilot of UJS conducted a right turn and increased the separation between them. The flight crew of VQG continued the approach and UJS continued to Maryborough, Qld, without further incident. The time of the incident was outside the operating hours of Sunshine Coast Airport air traffic control tower and it was therefore operating as a non-controlled aerodrome.
What the ATSB found
The ATSB found that important radio broadcasts made on the common traffic advisory frequency (CTAF) were not heard by the flight crew of VQG and the pilot of UJS regarding each other’s position and intention. These included the inbound broadcasts made by VQG and the take-off broadcast made by UJS. In addition, the flight crew of VQG determined the most suitable runway based on the radio-transmitted aerodrome weather information service. However, this was either recorded incorrectly or heard incorrectly such that the chosen runway was the less favourable of the two options for the wind direction. This resulted in the aircraft approaching the opposite runway to other aircraft at the time. Finally, the pilot of the departing aircraft did not confirm the location and intention of the inbound aircraft prior to commencing take-off, as it was assumed the inbound aircraft would use the most suitable runway for the conditions.
Safety message
When operating in uncontrolled airspace and around non-towered aerodromes, it is important to ensure that the location and intention of surrounding traffic is well understood and communicated prior to commencing take-off or landing.
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. One of the safety concerns is safety around non-controlled aerodromes. The ATSB SafetyWatch page provides information and resources about staying safe around non-controlled aerodromes. In addition, the ATSB booklet A pilot’s guide to staying safe in the vicinity of non-controlled aerodromes outlines many of the common problems that occur at non-controlled aerodromes, and offers useful strategies to keep yourself and other pilots safe.
The Civil Aviation Safety Authority has also produced a resource booklet ‘be heard, be seen, be safe’ which is in relation to radio procedures in uncontrolled airspace, and highlights that radios must always be used in conjunction with a safe ‘see-and-avoid’ procedure.
The occurrence
What happened
On the morning of 4 November 2019, the flight crew of an Airbus A320-200 aircraft, registered VH-VQG (VQG) and operated by Jetstar Airways, were conducting a scheduled passenger flight from Sydney, New South Wales, to Sunshine Coast, Queensland (Qld).
Prior to commencing the descent, both flight crewmembers of VQG independently listened to the Aerodrome Weather Information Service (AWIS) for Sunshine Coast Airport. Both reported hearing that the wind was from 230° (Magnetic) at 6 or 7 kt and recorded it on the take-off and landing data card. Based on those wind conditions, they assessed that runway 18 would be the most suitable runway for landing as it was the most into wind. The flight crew noted that the wind direction from the AWIS differed from the aerodrome forecast and routine aerodrome weather report[1] they had obtained prior to the flight, which was 340° True (329° Magnetic), but assessed that was reasonable for a coastal aerodrome. The flight crew then calculated the landing data using their electronic flight bag[2] software. In accordance with normal procedures, they assessed that for the aircraft landing weight and runway length available they could safely land with a tailwind of up to 10 kt if necessary.
At 0622 Eastern Standard Time (EST),[3] the flight crew of VQG contacted Brisbane Centre air traffic control (ATC) to advise that they were on descent to flight level 130[4] and on approach to Sunshine Coast Airport. As this was outside Sunshine Coast ATC Tower operating hours, the airspace was Class G (uncontrolled) and pilots of aircraft in the vicinity of the airport were communicating on the common traffic advisory frequency (CTAF).[5] Pilots conducting flights under the instrument flight rules (IFR) were also required to report to Brisbane Centre on a different frequency. Brisbane Centre provided a traffic information service to IFR flights about other conflicting IFR aircraft and observed (known) visual flight rules flights. Therefore, the VQG flight crew had one radio on the CTAF and another on the Brisbane Centre frequency, which allowed them to hear both frequencies.
At about 0625, the first officer (FO) who was the pilot monitoring (PM),[6] broadcast on the CTAF stating they were 30 NM south of the field, at an altitude of 10,500 ft and were tracking for a left circuit for runway 18[7] with an estimated arrival time of 0636 at Sunshine Coast. About 2 minutes later the PM made a similar broadcast on the CTAF, with updated altitude and position, again stating their intention to land on runway 18. During that time, the flight crew of VQG were also communicating with the pilot of another aircraft operating to the south of Sunshine Coast Airport who agreed to hold to the south of the field until VQG had landed.
A few minutes later, at about 0631, the PM made a third broadcast on the CTAF stating their altitude, position and intention to land on runway 18.
About 25 seconds later, the pilot of an Aero Commander 500 aircraft, registered VH-UJS (UJS) and operated by General Aviation Maintenance as a freight charter flight, broadcast on the CTAF that he was taxiing for runway 36 at Sunshine Coast Airport. The planned flight was from Sunshine Coast to Maryborough, Qld. Shortly after, the pilot of UJS also contacted Brisbane Centre stating that UJS was taxiing for runway 36. Brisbane Centre responded, advising of the inbound aircraft (VQG) that was turning onto final for approach from the north-east, ‘landing about 36’.[8] Brisbane Centre did not stipulate the runway being used by VQG, nor were they required to. The pilot of UJS later reported that he had observed other aircraft using runway 36 while he was refuelling at Sunshine Coast Airport, and that it usually takes him around 3 minutes on average from start up with his radios on, to being airborne.
At about the same time, the PM of VQG was communicating on the CTAF with the pilot of an aircraft (VH-XTU) to the north of the airport, which was identified by the flight crew of VQG as a potential conflict as per the operator’s ’Ten, Ten, One’ rule.[9] Also at that time, Brisbane Centre was attempting to contact VQG flight crew, regarding the taxiing call made by UJS, however contact was delayed as VQG was communicating on the CTAF with VH-XTU.
On entering the runway, the pilot of UJS visually checked to the south where he believed VQG was approaching from. After not visually sighting VQG, the pilot of UJS commenced take-off without making direct contact with VQG on the CTAF and confirming their location, making a ‘rolling’ (for take-off) broadcast on the CTAF at 06:33:30.
As this broadcast was being made, Brisbane Centre was still attempting to contact VQG, and the flight crew of VQG later reported not hearing the take-off broadcast made by UJS. After the communication with Brisbane Centre was established and finished, a different aircraft broadcast on the CTAF for about 20 seconds.
Once that broadcast finished, the PM of VQG broadcast on the CTAF that they were on final approach[10] for runway 18 and asked the pilot of UJS if he was holding short of the runway. The pilot of UJS responded that they were airborne, had VQG sighted and would track to VQG’s left (make a right turn). Table 1 shows a summary of the relevant radio broadcasts made on the CTAF and Brisbane Centre frequencies.
Table 1: Summary of the relevant CTAF and Brisbane Centre (shaded) radio broadcasts made by the pilots of aircraft VH-VQG and VH-UJS
Time
Frequency
Summary
0625:36
CTAF
VH-VQG first inbound broadcast
0627:11
CTAF
VH-VQG second inbound broadcast
0631:28
CTAF
VH-VQG third inbound broadcast
0631:53
CTAF
VH-UJS makes taxiing broadcast at Sunshine Coast airport
0632:24
Brisbane Centre
VH-UJS makes taxiing call, Centre informs them of inbound VH-VQG ‘turning onto final for approach’ ’about 8 miles north-east’ ’landing about 36’
0632:45 – 0633:18
CTAF
VH-VQG coordinating with VH-XTU, who was on the runway 18 Zulu approach. VH-XTU advised that they would be breaking off at the final approach fix for a circuit.
0632:58
Brisbane Centre
Centre informs VH-VQG of VH-UJS taxiing
0633:30
CTAF
VH-UJS makes ‘rolling’ broadcast from runway 36
0633:30
Brisbane Centre
Centre attempts to contact VH-VQG
0633:38
Brisbane Centre
Centre attempts to contact VH-VQG
0633:40
Brisbane Centre
VH-VQG responds they are communicating with VH-XTU on CTAF, Centre confirms they are also aware of VH-UJS, and VH-VQG responds ‘affirm’
0634:06
CTAF
Another aircraft is broadcasting their position and intention
0634:35
CTAF
VH-VQG broadcasts they are turning 5 mile final runway 18 and queries if VH-UJS is holding short of the runway
0634:48
CTAF
VH-UJS responds ‘negative, airborne’ and that he had VH-VQG sighted and would track to their (VH-VQG’s) left
Source: Airservices Australia and AvData, summarised by the ATSB
Within seconds, a short-term conflict alert (STCA) for the two aircraft was presented on the Brisbane Centre display (Figure 1). The two aircraft passed each other with a recorded separation of 0.7 NM horizontally and 265 ft vertically.
Figure 1: The position of the aircraft in the area in relation to Sunshine Coast Airport, and the alerts that were displayed to Brisbane Centre for the two aircraft VH-UJS and VH-VQG. The aircraft to the north, VH-XTU, is also shown.
Source: Airservices Australia, annotated by the ATSB
The flight crew of VQG discussed conducting a missed approach as a result of the proximity event. However, they assessed it was safer to continue with the approach due to the other aircraft in the area that they had already de-conflicted with, and although there was a tailwind, it was assessed as within tolerance. At about 0637, VQG landed at Sunshine Coast Airport and UJS continued to Maryborough without further incident.
In this occurrence, VQG was fitted with a functional traffic collision avoidance system (TCAS).[11] However, it was inhibited (as a standard) such that when the aircraft was on descent and below 900 ft the system did not generate a resolution advisory (RA)[12] or an aural alert and all traffic, including UJS, was marked as a traffic advisory only.
Safety analysis
The pilots from both aircraft did not hear some of the important radio broadcasts made by the other aircraft regarding their location and intention and did not establish direct communications with each other until after UJS was airborne. The pilot of UJS likely did not have his radio on at the time the flight crew of VQG made their inbound radio broadcasts, therefore missing the opportunity to understand that they were intending on landing on runway 18. There was about 97 seconds between the taxi and take-off broadcasts made by UJS, reducing the amount of time available to determine the location and intention of VQG. The flight crew of VQG did not hear the rolling broadcast made by the pilot of UJS, which occurred at the same time as Brisbane Centre was contacting VQG on the Centre frequency.
It was noted that the flight crew of VQG recorded the aerodrome wind direction as 230° (Magnetic) when planning their approach. However, local aerodrome wind direction was reported as 329° (Magnetic). It is unknown if the flight crew of VQG misheard the airport weather information recording or if the recording was incorrect, as a copy of the recording was unable to be obtained. The incorrect wind information obtained or understood by the flight crew of VQG led them to plan their approach on the least favourable runway for the wind direction at the time, and in conflict with other aircraft operating in and out of the airport.
The pilot of UJS believed that VQG would be landing on runway 36, as it was the most suitable for the wind conditions at the time and other aircraft operating at the airport had been using runway 36. This resulted in the pilot of UJS relying on unalerted see and avoid, to de-conflict with the inbound VQG. This occurred after UJS became airborne and the reciprocal trajectory of VQG was observed.
Findings
From the evidence available, the following findings are made with respect to the separation issue between two aircraft, VH-UJS and VH-VQG, where VH-UJS took off from runway 36 while VH-VQG was landing on opposing runway 18, resulting in reciprocal paths for the two aircraft before the pilot of VH-UJS conducted a right turn to increase separation from VH-VQG.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Important radio broadcasts on the CTAF were not heard by the flight crew of VH-VQG and the pilot of VH-UJS regarding each other’s positions and intentions, leading to them continuing to use reciprocal runways.
The flight crew of VH-VQG assessed runway 18 as the most into wind runway based on information obtained from the aerodrome weather information service, however this information was either recorded incorrectly or heard incorrectly such that runway 36 was instead more favourable. This resulted in the aircraft approaching the opposite runway to what was being used by other aircraft at the time.
The pilot of VH-UJS commenced take-off without confirming the location and intention of VH-VQG, assuming that they would be landing on runway 36, which had been used by previous landing and departing aircraft.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 11 November 2019, at about 1510 Central Standard Time, a Bombardier DHC-8-315 aircraft, registered VH-ZZE and operated by Surveillance Australia, was about to start the take-off roll from Darwin Airport, Northern Territory, on a surveillance flight. There were four crew on board.
The aircraft was on the departure runway with the brakes on. Power was applied to both engines, but when take-off power was reached, and prior to the release of the brakes, the crew heard a loud bang. The take-off was aborted, and air traffic control advised the crew of smoke from the right engine. After reviewing the engine instrumentation, the crew shut down the engine and returned the aircraft to the maintenance hangar.
A subsequent inspection of the runway identified metal fragments behind the aircraft’s take‑off position. An external inspection of the right engine revealed significant damage to the power turbine (PT) assembly.
What the ATSB found
The PT shaft of the aircraft's right engine fractured due to fatigue cracking, resulting in secondary damage and engine failure. The fatigue cracking initiated at corrosion pitting, which was probably associated with prolonged low‑altitude operation in a marine environment.
The PT shaft originally installed in the engine was replaced during its first overhaul in 2011 due to excessive corrosion pitting. However, the finding of corrosion was not escalated by the maintenance organisation to Pratt & Whitney Canada (P&WC), possibly due to the informal reporting process at the time (this process was replaced in 2018 with formal guidance and criteria for reporting such findings).
The ATSB investigation also identified that the PT shaft in Pratt & Whitney Canada PW100 series engines operating in certain marine environments is susceptible to corrosion pitting, which can grow undetected between scheduled inspections, increasing the risk of shaft fracture and engine failure.
What has been done as a result
Pratt & Whitney Canada advised the ATSB that it had commenced a review of historical overhaul experience of the PT shaft in an effort to identify which engines and operators are potentially exposed to an increased risk of PT shaft corrosion.
In addition, P&WC has proposed a range of safety action to address the safety issue concerning corrosion-related fracture of PT shafts in PW100 series engines that should complement its formalised reporting. This includes considering a borescope inspection of the PT shaft between overhauls during hot section inspections (HSI) with defined corrosion inspection criteria. A method to remove contaminants from inside the shaft during service is also being investigated. Additional mitigating action for engines within the PW100 engine fleet that have completed an HSI but are potentially exposed to the risk of PT shaft corrosion, is also being assessed.
While the proposed actions should address the safety issue, no timeline for their implementation was provided. As such, the ATSB has issued a safety recommendation to P&WC to support the proposed action.
Safety message
The corrosion-related fracture of the power turbine shaft of the aircraft’s engine in this occurrence highlights that corrosion pitting that exceeds repair limits on safety‑critical components should be a warning sign to manufacturers, maintainers, and operators that the existing maintenance strategy may not be effective.
Additionally, manufacturers should provide guidance and criteria to maintenance organisations for assessing and reporting corrosion on safety‑critical components. This enables identification of whether the maintenance strategy is effective or if changes are required to reduce the risk of in‑service failures.
The occurrence
On 11 November 2019, at about 1510 Central Standard Time,[1] a Bombardier DHC-8-315 aircraft, registered VH-ZZE (ZZE) and operated by Surveillance Australia,[2] was about to start the take-off roll from Darwin Airport, Northern Territory, on a surveillance flight. There were four crew on board – the captain (pilot monitoring), the first officer (FO) who was the pilot flying, and two system operators.[3]
The aircraft was on the departure runway with the brakes on. Power was applied to both engines, but when take-off power was reached, and prior to the release of the brakes, the crew heard a loud bang. In response, the captain aborted the take-off, reduced both power levers to flight idle, and instructed the FO to contact air traffic control (ATC) to advise they were aborting the take-off and had an engine issue. Air traffic control acknowledged the advice and reported sighting smoke from the right engine before informing emergency services. The captain checked the right engine instrumentation and advised the crew that the torque gauge had failed, and the propeller RPM gauge indicated zero. Other indications for the gas core of the engine, such as fuel flow, appeared normal. The captain instructed the FO to shut down the engine.
After confirming the aircraft brake, hydraulic and electrical systems were functioning, the crew returned the aircraft to the maintenance hangar. A subsequent inspection of the runway by a safety car identified metal fragments behind the take-off position of ZZE.
The right engine was subsequently removed from the aircraft with an external inspection revealing that all of the second-stage power turbine (PT) blades had separated from the disk (Figure 1). The PT assembly could not be rotated but the propeller shaft turned freely.
Figure 1: Rear-view of engine showing second-stage PT damage
The aircraft, registered VH-ZZE (ZZE), formed part of the operator’s fleet of 10 DHC-8 aircraft, which provided aerial surveillance operations for the Australian Border Force. Some of the aircraft began these operations in 1996 and all were fitted with Pratt & Whitney Canada (P&WC) PW100 series engines.
Operating environment
These aircraft were used for maritime surveillance activities, which required extensive flying at low level over the sea. The elevated moisture and salt content in the air at those levels created a corrosive operating environment. The fleet accumulated approximately 15,000 hours per year, with all aircraft and engines being exposed to a marine environment for a similar amount of time.
According to P&WC, there are other PW100 series operators within the global fleet that also conducted maritime surveillance activities.
Aircraft and engine information
The aircraft was a Bombardier DHC-8-315, manufactured in 2007 and operated by Surveillance Australia since March 2008. The aircraft was fitted with two P&WC PW123E turboprop engines, which form part of the PW100 series engine family.
The PW123E engine has a compressor comprising a low pressure (LP) and a high-pressure centrifugal impeller, each driven by an independent axial turbine. In addition, there is a reverse flow annular combustor and a two-stage power turbine (PT) that provides the drive for the reduction gearbox and propeller shaft. At the time of the incident, the right engine, serial number AT0010, had accumulated 25,801.51 hours in service and 12,254.21 hours since its last overhaul.
Engine examination
The damaged engine was transported to a P&WC maintenance facility in Canada for a detailed technical examination, supervised by the Transportation Safety Board of Canada. The following is a summary of the examination’s findings.
Visual examination of the diffuser case, which contained the LP centrifugal impeller, showed corrosion at several locations (Figure 2). The LP impeller blades showed leading edge erosion.
All PT stage 1 and stage 2 blades had fractured through tensile overload (Figure 3).
The PT shaft (serial number A0030D9A) had fractured in two locations, referred to as surface ‘A’ and ‘B’ (Figure 4). Visual examination of the inner diameter next to surface A indicated corrosion pitting (Figure 5).
No. 6 and No. 7 bearing oil transfer tubes had evidence of impact damage, and the vent transfer tube was fractured.
The turbine interstage baffle was found buckled.
The LP turbine disk assembly showed rubbing and cracks at the blade tips.
The PT stator and vane ring exhibited impact damage.
The exhaust case was deformed.
Figure 2: Diffuser case showing areas of corrosion
Source: P&WC, annotated by ATSB
Figure 3: Power turbine disk assemblies with all blades fractured
Source: P&WC, annotated by ATSB
Figure 4: Fractured PT shaft
Circled locations A and B refer to the two different fracture surfaces. Source: P&WC
Figure 5: Corrosion pitting of PT shaft internal diameter next to fracture surface A
Source: P&WC, annotated by ATSB
Metallurgical analysis
Following the engine examination, P&WC conducted a metallurgical analysis on the PT shaft which found that:
Fatigue cracks had initiated from corrosion pits on fracture surface A. Due to the corrosion, the material thickness was 25 per cent below the minimum thickness requirement.
The base material (steel alloy) and its hardness were consistent with the design specification.
The corroded layer near the fracture origin showed the presence of sodium, phosphorus, sulphur, and chlorine.
Fracture surface B showed evidence of bending (as opposed to torsional) overload fracture.
The analysis concluded that the PT shaft had fractured from fatigue cracking, which initiated at the internal corrosion pitting at surface A. The fracture of the shaft at surface B was considered secondary. After the shaft fractured, the PT stage 1 and stage 2 disks moved backwards. The stage 1 disk subsequently went into an overspeed condition, which caused the blades to fracture by tensile overload near each blade platform as designed.[4] The stage 2 disk contacted the exhaust duct, resulting in the blades fracturing through tensile overload, at various heights above the blade platforms, from impact and overspeed.
The damage to the bearing oil transfer tubes, turbine interstage baffle, PT stator, PT vane ring, exhaust case and LP turbine disk assembly were consistent with secondary damage due to the PT shaft fracture. According to P&WC, the LP impeller leading edge erosion, diffuser corrosion and PT shaft corrosion was due the engine’s operational environment.
Power turbine air system and corrosion protection
During normal engine operation, some of the air flowing through the compressor is delivered to the inside of the PT shaft via internal and external tubes. This air is used to seal bearings and cool the PT stage 1 and stage 2 disks (Figure 6).
Figure 6: PW100 series air system
The black arrows show the direction of air flow. The green colour denotes PT shaft related air flow. Source: P&WC, annotated by ATSB
Internal corrosion resistance is provided by an aluminium coating applied to the inside of the shaft during manufacture. P&WC stated that during the metallurgical analysis, it was not possible to evaluate the coating near the surface fractures. However, there were no other indications, such as delamination, which would suggest the coating had been incorrectly applied. P&WC also indicated that based on in-service experience, the aluminium coating had historically provided good corrosion protection.
Engine washes
P&WC advised that engine desalination washes,[5] which are commonly used to clean and remove corrosive contaminants from the compressor and turbine sections, are not intended to perform a similar function for the PT shaft. As the shaft is part of the air system, water and washing fluid can enter the shaft during an engine wash, but not for the purpose of cleaning or removing contaminants. Any residual fluid inside the shaft is expected to evaporate when a post-wash engine run is performed in accordance with the engine maintenance manual (EMM). At the time of the occurrence, there were no maintenance procedures to clean the internal surface of the PT shaft.
Power turbine shaft maintenance
The PT shaft did not have an operational service life and was maintained ‘on condition’. It was subject to maintenance at each overhaul which included cleaning, inspections and, if applicable, repairs.[6] The aluminium coating was removed as part of the cleaning process and then re-applied after inspection or after any repairs. Any corrosion on the shaft (if observed) was evaluated against the repair limits. If within limits, the shaft was repaired, otherwise it was replaced.
The time between overhaul (TBO) depended on whether the operator’s engine maintenance regime was hard-time or soft-time (on‑condition). Engines maintained on hard-time maintenance were overhauled every 8,000 hours. Engines maintained on‑condition, using P&WC’s on‑condition Maintenance Program (OCP), were overhauled based on the condition of the engine, which could extend the TBO beyond 8,000 hours. To be eligible for the OCP, an operator was required to conduct additional inspections and checks between overhauls, but there were no additional tasks required for the PT shaft. The operator was utilising an OCP for its DHC-8 engine fleet.
Engine maintenance history and management of findings
Engine AT0010 was manufactured in 2000 and was fitted to various other DHC-8 aircraft in the operator’s aerial surveillance fleet throughout its life. The original PT shaft (serial number A000547M) was removed for the engine’s first overhaul at 13,547.3 hours in March 2011 due to ‘deep corrosion pitting’ on the inner diameter of the shaft, beyond the repair limits. Corrosion was also observed on various components throughout the engine’s gas path. The shaft was replaced with the subject PT shaft (serial number A0030D9A) that was new from manufacture, which then accumulated 12,254.21 hours in service before fracturing.
The operator advised that post wash engine runs were being performed on its DHC-8 fleet after every engine wash in accordance with the EMM. In addition, engine AT0010 had not experienced any extended periods of inactivity, so had not undergone any preservation[7] since its last overhaul.
P&WC managed in-service findings by categorising them into one of five categories. This process was to ensure the communication of in-service findings which had affected, or had the potential to affect, flight safety or aircraft availability. Category 5 (CAT 5) was introduced in 2018 and covered unusual or unexpected findings discovered by maintenance organisation’s during scheduled engine maintenance.[8] It was intended to provide P&WC with visibility of potential warning signs that might need assessment.
P&WC stated that the reporting process at the time of the engine’s first overhaul in 2011 was informal and relied primarily on the maintenance organisation’s judgement of what constituted an unusual finding worth reporting. Historical P&WC records indicated that the P&WC overhaul facility did not raise the PT shaft corrosion finding during the engine’s first overhaul. Although the introduction of the CAT 5 process provided procedural guidance for maintenance organisations to raise unusual findings, P&WC further stated that engineering judgement, rather than specific criteria, would still be exercised when raising a CAT 5.
Other occurrences
P&WC advised that this PT shaft fracture was the first confirmed to have occurred due to corrosion. P&WC had previously received images of a similar looking fracture, but the parts were not in a condition that allowed for detailed examination. Therefore, the cause of that fracture could not be determined.
Since this occurrence, corrosion on the inside of a PT shaft was discovered during a hot section inspection (HSI)[9] of another engine in the operator’s DHC-8 fleet. While a PT shaft inspection is not normally carried out during an HSI, P&WC elected to conduct an unscheduled visual inspection of the shaft as a result of this occurrence. The shaft was subsequently sent to its maintenance facility in Canada for further analysis.
Examination of the power turbine (PT) shaft by the engine manufacturer, Pratt & Whitney Canada (P&WC), identified conclusively that it fractured due to fatigue cracking that originated from corrosion pitting. Excluding the low pressure impeller leading edge erosion and diffuser corrosion, the observed damage to other engine components, including the second PT shaft fracture location, was consistent with secondary damage due to the initial fatigue fracture.
Although the gas core of the engine continued to operate after the PT shaft fracture, no power could be transmitted to turn the section of the PT shaft still connected to the gearbox and propeller. As a result, no engine power was available, and the crew shut down the engine.
Power turbine shaft corrosion
The corrosion products identified at the PT shaft fracture origin indicated that the corrosion was probably caused by salt-laden air. Since air from the compressor entered the PT shaft during normal engine operation, corrosion causing contaminants (for example, salt) and moisture within the ambient air probably built up on the inside of the shaft, allowing corrosion to occur.
The engine had been operated at low altitude over the sea throughout its life, with PT shaft and air system corrosion evident at its first overhaul and subsequent engine examination. These observations supported P&WC’s conclusion that the PT shaft corrosion was caused by the engine’s operational environment.
As a result of the operator utilising an engine on-condition maintenance program, the engine operated significantly beyond the hard-time overhaul of 8,000 hours, with no additional maintenance of the PT shaft. Coupled with the absence of a cleaning process to remove contaminants from the shaft during inactivity, meant an increased operational time and calendar time between PT shaft inspections, both of which probably contributed to corrosion formation and growth.
Since post wash engine runs were being performed and the engine had not undergone any preservation, it was unlikely that any fluid or moisture would have remained in contact with the shaft surface for any extended period while the engine was inactive. There were also no indications that the shaft’s protective aluminium coating had been incorrectly applied. Therefore, it was unlikely that any of these factors contributed to the observed PT shaft corrosion.
Corrosion management
The information obtained by the ATSB during this investigation indicated three instances of corrosion forming within the PT shaft of PW100 series engines that grew undetected between the scheduled overhaul inspections. All three occurred within the operator’s engine fleet which have been used primarily in a marine environment, with one resulting in a fracture of the shaft.
The PT shaft fracture due to marine environment exposure demonstrated that the existing protective coating and maintenance requirements were not sufficient to prevent progression to corrosion‑related fatigue fracture. Although corrosion pitting may not always lead to a fracture before overhaul, it provides sites for fatigue crack initiation, presenting an increased risk of premature fatigue fracture.
Given the power turbine shaft design and function is the same across all PW100 series engines, and there are other PW100 series operators conducting maritime surveillance activities, there is potential for this risk exposure to extend to other operators within the global fleet.
While P&WC indicated that based on its experience the PT shaft coating provided good corrosion protection, corrosion pitting outside of repair limits might not necessarily have been reported by maintenance organisations during overhaul. Reporting such findings was probably less likely prior to the introduction of the additional guidance through the CAT 5 process in 2018. Therefore, P&WC may have had limited visibility on engines exposed to an increased risk of PT shaft corrosion.
Although engine AT0010 exhibited ‘deep corrosion pitting’ of the PT shaft outside of repair limits at the engine’s first overhaul, the finding was not escalated by the maintenance organisation to P&WC for further assessment, possibly due to the informal reporting process in place at the time. Additionally, it does not appear that the location, extent, size, and depth of the corrosion was recorded. Furthermore, there was no recorded information available regarding an assessment of the finding. Therefore, there was insufficient information to determine whether that specific finding should or should not have been escalated.
Nevertheless, the circumstances of this occurrence illustrate the importance of specific guidance and criteria on how to assess corrosion. In this instance, this would probably have provided P&WC with greater visibility of engines in the global fleet that are exposed to an increased risk of corrosion-related failure.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the engine failure during take-off involving a Bombardier Dash 8, registered VH-ZZE, which occurred at Darwin Airport, Northern Territory, on 11 November 2019.
Contributing factors
The power turbine shaft of the aircraft’s right engine fractured due to fatigue cracking, resulting in secondary damage and engine failure.
The fatigue cracking in the engine’s power turbine shaft initiated at corrosion pitting, which probably resulted from prolonged low‑altitude operation in a marine environment.
The power turbine shaft in Pratt & Whitney Canada PW100 series engines operating in certain marine environments is susceptible to corrosion pitting, which can grow undetected between scheduled inspections. This increases the risk of shaft fracture resulting in engine failure.[Safety issue]
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The power turbine shaft in Pratt & Whitney Canada PW100 series engines operating in certain marine environments is susceptible to corrosion pitting, which can grow undetected between scheduled inspections. This increases the risk of shaft fracture resulting in engine failure.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
aircraft operator (Surveillance Australia)
flight crew
recorded data (CVR and FDR)
engine manufacturer (Pratt & Whitney Canada)
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the flight crew
Cobham Aviation Services
Pratt & Whitney Canada
De Havilland Aircraft of Canada
Transportation Safety Board of Canada
Transport Canada
Civil Aviation Safety Authority
A submission was received from:
Pratt & Whitney Canada
The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 1555 on 26 October 2019, Transperth passenger train service 5077CP travelling from Perth to Armadale stations in Perth, Western Australia arrived on platform two at the Gosnells Railway Station.
As multiple passengers alighted the train and moved along the platform toward the exit gate, a young male child separated from his family group. The child walked among the other passengers but wandered toward the edge of the platform and the side of the stationary railcar.
Around the same time, the driver of 5077CP was preparing to depart the train from the platform. The driver viewed the Driver Assist Video monitor located on the driver’s console to check passengers had completed boarding/alighting the train and were clear before commencing the processes to close the doors.
As the doors were closing, the child crossed the painted safety line and continued to approach the edge of the platform before turning and looking back toward his family group. He stumbled against the side of the third railcar adjacent to its rear door and accidentally stepped off the edge of the platform coping, falling between the railcar and platform to the track formation below.
Nearby persons on the platform and the child’s family members responded almost immediately raising an alarm while attempting to retrieve the child. As train 5077CP commenced to move, a passenger in the third railcar responded to the persons on the platform and contacted the driver via the emergency passenger intercom, calling for the driver to stop.
The train travelled around 12 metres before stopping. After the train stopped, family members lifted the child from the track and onto the platform. Police incident reports indicated the child was uninjured during the fall and retrieval. However, a family member was reported to have sustained injuries and subsequently transported to hospital for treatment.
What the ATSB found
A young male child separated from his family group and wandered close to the platform edge before losing his footing and falling between the platform and adjacent railcar to the track below. The swift reaction by the driver to stop the train in response to an alarm raised by a passenger via the internal emergency intercom system very likely prevented more serious injuries from being received by the young child or other family members.
Safety message
Passengers and other persons present at a railway station platform must observe the markings on its surface that specify the required separation to keep from the platform edge and adjacent track.
The Occurrence
What happened
At about 1555[1] on 26 October 2019, Transperth passenger train service 5077CP[2] travelling from Perth to Armadale stations in Perth, Western Australia arrived at platform two of the Gosnells Railway Station.
As multiple passengers alighted the train[3] and moved along the platform toward the exit gate, a young male child travelling with his family exited the train from the front door of the third railcar. Shortly after alighting, while family group members stopped to attend to a sibling, the young male child separated from the group. The child walked among the other passengers but wandered toward the edge of the platform and the side of the stationary railcar.
Around the same time, the driver of 5077CP[4] was preparing to depart the train from the platform. The driver viewed the Driver Assist Video (DAV) monitor located on the driver’s console (Figure 1) to check passengers had completed boarding/alighting the train. The DAV displayed vision from a CCTV camera[5] of the platform and along the side of the train from front to back. The angle of the camera was sufficient to provide drivers a view along the side of the whole train.
Satisfied the doors were clear, the driver then operated the controls to commence the sequence of processes to close the doors. The driver’s attention then focused toward checking the indication displayed on the trackside signal #453 and the status of the Dorothy Street level crossing ahead.
Figure 1: View of driver’s panel
Source: ATSB
There were still numerous passengers across the width of the platform walking toward the station exit adjacent to the last (fourth) railcar. As the doors were closing, the child crossed the painted safety line (Figure 2) and continued to approach the edge of the platform before turning and looking back toward his family group. He stumbled against the side of the third railcar adjacent to its rear door and accidentally stepped off the edge of the platform coping, falling between the railcar and platform to the track formation below. Nearby persons on the platform and the child’s family members responded almost immediately raising an alarm to passengers on-board the train or reaching down between the platform and railcar trying to retrieve the child.[6]
Figure 2: Typical platform showing painted safety line
Source: Transperth ‘Get on Board’ safety education program.
As train 5077CP commenced to move, a passenger in the third railcar responded to the persons on the platform and contacted the driver via the emergency passenger intercom, calling for the driver to stop. The driver, unaware of the reason for the emergency call,[7] reacted swiftly, applying full service braking to stop the train.
The train travelled around 12 metres before stopping. During the movement of the train, a family member of the child sustained injuries either from contact with the side of the railcar or the platform edge. After the train stopped, family members lifted the child from the track and onto the platform. Police incident reports indicated the child was uninjured during the fall and retrieval.
Emergency services attended Gosnells Station. An ambulance transported the injured family member to hospital for assessment/treatment. Another family member took the young child to hospital. Following clearance from WA Police and train control, train 5077CP departed Gosnells Station for Armadale at about 16:12. Transperth relieved the train crew from duty at Claisebrook Station to conduct follow-up enquiries.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
A young child separated from his family group and wandered close to the platform edge before losing footing and falling between the platform and adjacent railcar.
The swift reaction by the driver to stop the train in response to an alarm raised by a passenger via the internal emergency intercom system very likely prevented more serious injuries from being received by the young child or other family members.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the ATSB to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation. The statement is published as a report in accordance with section 25 of the TSI Act, capturing information from the investigation up to the time of discontinuance.
Overview of the investigation
During an approach to Sydney Airport’s runway 16L on 16 October 2019, VH-VNR, a Tiger Airways A320, was at a speed in excess of that required for that particular phase of the approach. The pilot in command (PIC), performing the pilot monitoring (PM) role, instructed the pilot flying (PF)[1] to correct the speed and configure the aircraft for landing, however, the required corrections did not occur. As a result, the PIC took control of the aircraft, extended the speed brake to reduce the airspeed and configured the aircraft for landing.
During that configuration, at an altitude of about 1,300 ft, the speed brake was extended while the aircraft was in the landing configuration. This resulted in an EGPWS SPEED[2] alert. The configuration was corrected and the approach was stable by 1,000 ft. The PIC returned control of the aircraft to the PF, and the aircraft completed a stable approach and a safe landing.
On 22 October 2019, the ATSB commenced an investigation into the occurrence. As part of its investigation, the ATSB:
interviewed the flight crew
examined digital flight data and flight crew training records
analysed fatigue related data
reviewed the operator’s policy and procedural requirements and the recent occurrence data.
The ATSB determined that the two flight crew system operated as designed, detecting the incorrect approach conditions and correcting those conditions in sufficient time to enable a stable approach. A human factors review of the flight crew’s conduct and a fatigue assessment and examination of the flight crew’s training and the operator’s response to the occurrence, did not identify any factors that justified further investigation.
ATSB comment
Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.
The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.
Finally, the ATSB briefed Tiger Airways about some of its observations and potential learnings. However, it considered that broader communication of this information would not be of significant benefit to other parties.
This investigation was conducted under the Transport Safety Investigation Act 2003 (Commonwealth) by the Office of Transport Safety Investigations (NSW) on behalf of the Australian Transport Safety Bureau in accordance with the Collaboration Agreement.
Safety summary
What happened
On 15 October 2019, a Protection Officer (PO) arranged with the Westmead panel signaller at Granville signal box to implement protection for work on track by use of Absolute Signal Blocking (ASB).
ASB was authorised and signals GE455 and GE463 were set to stop and blocked to prevent access to the worksite. Train 133U left Parramatta station and the signaller set the route for the train and it passed signal GE463 on the Down West Main line. The train was on a route to travel through 727 points to then travel along the Down West Suburban line.
After passing the signal, the driver encountered three workers on the track in front of the train, two were in the four foot of the Down Main line and another was in the danger zone adjacent to them. The driver sounded the train whistle to alert the workers and they vacated the track and danger zone. The driver also applied the emergency brakes and stopped just near where the workers had been.
What the ATSB found
The investigation found the relief signaller at Granville signal box had mistakenly believed the workers were further away from the location that was provided in the agreed arrangements for ASB. This mistaken belief led to the signal protection for the worksite being removed to allow 133U to run on the Down Main to access 727 points.
The relief signaller and the PO had earlier discussed the need to divert trains around the worksite, but neither correctly comprehended the implications of doing this, that is, the diversion would route a train into the worksite. The relief signaller was possibly experiencing the effects of cumulative fatigue due to rostering issues as well as experiencing a high workload. The rostered signaller at the Granville signal panel was absent from their workstation at the time and the relief signaller was operating both the Granville and Westmead signal panels.
The lack of advance notification to the relief signaller about the intended work, and its consequent impact on train running, meant the relief signaller had to devise an improvised train operations plan with no notice, adding to the pressure of operating two signal panels concurrently.
The Network Rules and Procedures for ASB had very little direction and guidance to workers about how to manage the risk of clearing a protecting signal for an alternative route in order to run a train.
What has been done as a result
After this incident, Sydney Trains temporarily prohibited the practice of signallers being permitted to clear any signals used for ASB protection in order to run trains via an alternative route. Changes to the ASB rule and procedure were implemented in December 2020 to prohibit the clearing of the signal immediately protecting a worksite in order to run a train via an alternative route.
Safety message
Railway safeworking rules are in place to achieve safe rail operations and should be developed so that the desired outcomes are supported by suitable procedures.
Signallers are safety critical workers that perform work vital to the safe performance of the rail network. These workers require supervision and should be subject to suitable management arrangements to ensure compliance to relevant work instructions and requirements.
The occurrence
Overview
At 2245[1] on Tuesday 15 October 2019, a PO called the Westmead panel signaller at Granville signal box to arrange work on track protection for a Sydney Trains civil work group. The work group were intending to perform welded track stability analysis (WTSA) measurements on the Down Main line between Parramatta and Westmead stations.
The specific location of the worksite was identified by the PO between absolute signal[2] GE463 and permissive[3] signal M16.1. The location of the workers and the protecting signals used for the protection are depicted on the diagram below, which is based on a map prepared by the PO on their Worksite Protection Plan (Figure 1).
Figure 1: Driver’s Route Knowledge Diagram for Westmead
Source: Sydney Trains annotated by OTSI
The method of work on track protection proposed by the PO was Absolute Signal Blocking (ASB). The PO and the signaller agreed that absolute signals GE455 and GE 463 would be used to protect the worksite, in addition to 728 points being secured in the normal position.
During the conversation between the PO and signaller about the safeworking arrangements, there was discussion about the need to divert rail traffic around the work area. This diversion would require the use of the protecting signals for the alternative route to be able to run rail traffic via 727 points from the Do[4] This was a manoeuvre that was permitted under the Network Rules and Procedures for ASB at the time.
At 2253, the signaller authorised ASB with blocking facilities on signals GE455 and GE463 and 728 points were locked and blocked in the normal position. The workers then made their way to the designated work location at Westmead and commenced work on track under the ASB.
At 2302, the signaller observed run 133U depart Parramatta station and removed the blocking facilities for signals GE455 and GE463 and set the route for the train via 727 points. This movement effectively routed the train into the worksite protected by the ASB.
The driver of run 133U saw the workers on track on the Down Main at approximately 24.700 km and sounded the train whistle. At the same time, other workers outside the rail corridor observed the approach of 133U and shouted a warning of “Train on”. The workers on track quickly vacated the Down Main line to the down cess area. The driver made an emergency brake application and the train stopped just past the location where the workers had been.
The image at Figure 2 is taken from the CCTV on the front of train 133U and shows the three workers in the Danger Zone as the train approaches 727 points on the Down Main line. It is estimated they were approximately 20-30 m from the front of 133U when this image was recorded.
Figure 2. CCTV image from train 133U
Source: Sydney Trains annotated by OTSI
Post incident
The train driver called the signaller at 2305 to report the incident. The signaller called the PO and the ASB was ended at 2307. The signaller then reported the incident to the Train Service Delivery Manager (TSDM) at the Rail Operations Centre.
A Sydney Trains Incident Rail Commander (IRC) was despatched to the site to investigate the incident. The signaller at Granville signal box was relieved of safeworking duties and stood down pending the investigation. The Protection Officer was also stood down from safeworking duties pending the investigation.
Drug and alcohol testing was conducted on the PO and the signaller with negative results for both.
Sydney Trains administer a suite of safeworking network rules and procedures to safely manage work on track. Absolute Signal Blocking (ASB) is one of several methods to protect work on track in the Sydney Trains network. The rule has been in place since July 2012. The rule was previously known as Controlled Signal Blocking, which was introduced in 2001.
Location
Westmead station is located approximately 25 km west of Sydney Central station on the main western line. Four railway lines run through Westmead, the Up West Main, the Up West Suburban, the Down West Suburban and the Down West Main.
Figure 3: Map of Westmead and surrounds
Source: Geoscience Australia
The work on track
The work being performed by the infrastructure workers was WTSA. This involved the workers taking measurements to detect and correct locations that are vulnerable to misalignment of rails. The location of the work was between signal GE463 at 24.635 km and signal M16.1 at 25.932 km.
The work involved two Sydney Trains Infrastructure workers and a PO from Swetha International Pty Ltd, a labour hire company that provides safeworking services to Sydney Trains.
The train involved
133U was a Waratah 8-car A set, A44. The train was crewed by a driver in the leading power car, and a guard in the rear car. The train was operating on a route from Central to Penrith, departing at 2225 and scheduled to arrive at Penrith at 2347.
No abnormal operation of the train was reported during the journey, and it is therefore not considered a factor in the incident.
Operating environment in Granville signal box
Granville signal box is a two-panel signal box, consisting of the Granville and Westmead signal panels. Each panel is operated by a signaller. A relief signaller is always there to provide coverage when the rostered signaller is on a rostered meal break or comfort break.
The roster for the signallers gives specific acronyms to each signaller on shift. These acronyms will be used within this report.
The rostered signaller for the Granville panel is known as GG, the signaller for the Westmead panel is known as GW, and the relief signaller is known as GT. This stands for Granville Table. The Table signaller is the colloquial name for the relief signaller. The table refers to the spare desk or workstation in the signal box where the GT signaller performs various support functions while not providing relief on the signalling panels.
The system of safeworking for Granville signal box is unidirectional rail vehicle detection. The system is described in the Sydney Trains Network Rule NSY 500 Rail Vehicle Detection.
The signaller
The GT signaller operating the Westmead panel at the time of the incident had 15 years’ experience as a signaller in the Sydney Trains/RailCorp network. The GT signaller had no reported history of involvement in safeworking incidents. The GT signaller had all the necessary certifications in place to fulfil the functions of the role, except they had not attended a mandatory safety course. This course was called ‘Apply safety critical communications in the rail industry’. The GT signaller attended this course two weeks after the Westmead incident.
Fatigue management for signallers
Sydney Trains rostering and fatigue management principles were embedded in the operating practices of the organisation. Managing Shift Work and Rostering was an operating procedure used to manage rostering practices to help reduce the cumulative effects of fatigue on rail safety workers, including signallers.[5]
The protection officer
The PO, employed by Swetha International, was an experienced PO with a 12-year history of safeworking qualifications. The PO had only one safeworking incident recorded in their work history at that time, a relatively minor event of protection being left on the track after a possession. There was no evidence from the rostering and work patterns that the PO was fatigued. Consequently, fatigue of the PO is not considered a factor in this incident.
ASB works on the principle of rail signals being set to stop with blocking facilities applied to exclude rail traffic from the work area. Within the rule there are several options to provide protection, including:
Having two controlled absolute signals set to stop with blocking facilities applied or
Having one controlled absolute signal set to stop with blocking facilities applied and
Removing an ESML/EOL key, or
Securing points to prevent access, or
There being an easily reached safe place available and providing a lookout.
It is important to note that the rules provide two layers of protection. This provides a buffer area so that if a train that inadvertently passes the first blocked signal, it does not immediately enter a worksite location. For example:
Figure 4: ASB – Two consecutive controlled absolute blocked signals
Figure 5: ASB – One controlled absolute blocked signal and points secured
Figure 6: ASB – One controlled absolute blocked signal and Lookout
The ASB rule has the facility to allow the protection to be temporarily suspended in order to run rail traffic through the work area, provided certain assurances are gained. When rail traffic has left the work area, the ASB may be re-established. This facility was not used in relation to the work involved in this incident.
Within the ASB rule, there was also the facility to be able to clear signals being used for ASB protection to run rail traffic on an alternative route. This facility required the PO and the signaller to agree about the movements and make sure the worksite is clear of the alternative route. Other than these brief instructions, there was no other guidance in the rule, procedure, or other material to help make decisions when this facility in the rule was used. Sydney Trains withdrew this facility from the Network Rules on 16 October 2019, the day after the Westmead incident. This was achieved by issuing a temporary amendment document known as a Safe Notice Telegram 2019-1047.
The telegram stated:
‘ABSOLUTE SIGNAL BLOCKING (ASB) UPDATED REQUIREMENTS
Effective from 1800 hours, Wednesday 16 October 2019
In exception to NWT 308: Absolute Signal Blocking, when blocking facilities have been applied to exclude rail traffic from a portion of line, blocking facilities MUST not be removed to allow signals to be cleared for an alternate route. Blocking facilities MUST remain applied while the ASB is in force. These requirements will also apply when blocking facilities are applied to signals that are used to exclude rail traffic from a portion of line in accordance with NTR 432: Protecting activities associated with in service rail traffic.’
In December 2020, Sydney Trains introduced rule and procedure changes for ASB that permanently prohibited the clearing of the signal immediately protecting the worksite for the purpose of running a train on an alternative route.
Protection methods under ASB and their principle of operation
Basic principles of protection
The basic principle of protection under ASB is that a signaller will set and maintain one or more signals at stop to prevent rail traffic from intruding into the work area. This is achieved through a mutual arrangement of understanding between the PO and the signaller about the location of the work, the signals needed to protect the work and the choice of which option is used from the choices available within the rule.
The critical element of the protection measure is that someone remote from the work area is responsible for the function of setting and maintaining the signals at stop. This is what stops a train from entering the work area. For the most part, the workers on the track have no control over the status of the protecting signals – they rely upon the competence, capability and diligence of the signaller to ensure the protection is set and maintained for the duration of the work.
Clearing signals for an alternative route
When the ASB rule permits the same signals providing protection to be cleared in order to run rail traffic through an alternative route, it introduces a potentially conflicting objective that must be carefully managed to avoid the situation that occurred in this incident. The ASB rule, as it was on the 15 October 2019, provided almost no direction for those involved in managing the protection and how to deal with this potentially conflicting objective.
The extract from the rule NWT 308, as it was on 15 October 2019, said the following:
‘If protecting signals need to be cleared for an alternative route, the Protection Officer and the Signaller must agree about the movements and make sure that the worksite is located clear of the alternative route.’
The associated procedure NPR 703 Using Absolute Signal Blocking had no direction or guidance at all about how to manage this activity.
Detecting rail traffic approaching the worksite
Workers on track using ASB are also reliant on a signaller remote from the work area correctly identifying that there is no rail traffic closely approaching the worksite before the protection is approved and workers enter the danger zone.
A worker was fatally injured at Kogarah, NSW, in 2010 when a signaller did not detect the presence of a train between the protecting signals and the worksite in time to warn the workers. After the protection was implemented the workers went on track and the then train entered their worksite, striking and fatally injuring a worker.
The NSW Office of Transport Safety Investigations (OTSI) compiled a report about that fatal incident and the findings included how poor practices relating to signal box management contributed to the accident.
This is an example of the safety of the workers on track being a joint responsibility, including a worker who is remote from the worksite, who has a number of other responsibilities and distractions that can lead to errors, mistakes and omissions from this task.
Alternate methods of protection
Rail systems across the world have adopted technologies and practices that place the protection of the work on track in the hands of those doing the work, and who bear the risk of being struck by a train. This includes;
devices to activate track circuits at the worksite to put protecting signals to stop
switches on signals that allow a worker to set and maintain a signal to stop
automatic train warning systems that detect approaching rail traffic and warn workers to move to a place of safety.
Sydney Trains have projects in place that either are under trial or in implementation phase that seek to introduce technologies that provide greater control for worksite protection.
This program is called the Enterprise Track Worker Safety (ETWS) Program. These projects and trials are currently in various stages of progress and development. Use of protection systems that look to eliminate the human error in areas like miscommunication, distraction or performance are to be encouraged.
A device that activates the track circuit of the protecting signal, or a switch that acts on the signal itself to place it at stop, would likely have prevented this incident, as the activation of this type of protection would be in the control of the Protection Officer with the work group. The Protection Officer was with the work team and would be very unlikely to clear a signal that would knowingly allow a train to enter their own work area.
Operating arrangements at Granville signal box
Rosters and meal breaks
Both panels in the Granville signal box are attended 24 hours a day, 7 days a week by a signaller for the purpose of routing trains through their area of control. A relief signaller is present on all shifts to provide coverage for the two signallers rostered on to the panels. The table signaller provides meal and comfort break relief and administrative support to the operating signallers in the form of processing various operational documents that are circulated daily in the Sydney Trains network.
Night shift at Granville signal box runs from 2135 each night to 0535 the following morning. The arrangements for staffing the panels are contained in a document called ‘Table person duties Granville Box’. The document is not published anywhere within the Sydney Trains electronic document management system. It is in hard copy only.
The document is not signed, approved or authorised by any Sydney Trains line management and has no document control or numbering, however it did have currency with the signallers in relation to the operating arrangements.
The document indicates that each signaller has two one-hour meal breaks per eight hour shift on day and afternoon shift. This document does not address the meal break and coverage arrangements for night shift. The document only shows meal breaks and panel coverage for day and afternoon shifts.
Figure 7 – Table Person Duties Granville Box
Source: Sydney Trains
The signallers at Granville signal box therefore had no guidance, direction or other instruction about how and when meal breaks should be taken on night shift or how and when coverage for the signalling panel should be arranged. It was essentially a self-managed function.
On the night of the incident, the GW signaller started work on night shift at 2135 and immediately went on a two-hour meal break. The signaller GT was then required to work on the Westmead panel from the start of the shift to provide a two-hour meal break relief for signaller GW.
At interview, the Sydney Trains line manager advised that it was not normal practice for signallers to commence their shift and immediately have a two-hour meal break. The Sydney Trains line manager advised at interview that two-hour paid meal breaks are not the common practice for Sydney Trains signallers, however this is what occurred on the night of the incident.
Supervision and work arrangements in Granville signal box
At around 2200 hours the signaller GG, rostered to be working the Granville panel, decided they would leave the panel and sit at the desk at the back of the signal box normally reserved for the GT, or table person.
The signaller GG did some of the work normally done by the table signaller, including processing Special Train Notices. The signaller GG also marked some training papers that they attended to as part of their role as a signaller trainer. Signaller GG left the control room at around 2300 to go to the meal room to prepare some food, leaving signaller GT alone in the control room.
This meant the GT signaller was managing both signalling panels for over one hour prior to the ASB incident at Westmead, and for a period of around ten minutes was the only person in the control room out of a team of three. The GT signaller is recorded as answering operational calls for both panels until the incident happened at 2304.
The role and responsibilities of signallers are documented in Network Rule NGE 234 Responsibilities of Signallers.
These responsibilities include:
Safe operation of signalling equipment
Responding to signalling faults, failures and warning alarms
Authorising and issuing procced authorities, work on track authorities and methods
Obtaining authority from the Sydney Trains Rail Operations Centre (ROC) to operate unscheduled rail traffic like defective trains, trains being worked out of service, empty trains being relocated and light engine movements
Dealing with train delays and incidents.
The signallers roles are full time rail safety workers and the signalling panels are attended 24 hours a day, including on night shift. There is still rail traffic at night, including late night passenger and freight trains, and there is normally maintenance activity conducted at night. This warrants the full time attendance of signallers on both signal panels with rostered relief.
No explanation was offered by Sydney Trains for the unapproved absence of signaller GG. At interview, the Sydney Trains line manager considered the act of a signaller leaving their post without normal relief a code of conduct issue. There was no indication this matter was addressed as such.
Sydney Trains have a procedure that generally manages signal box operations, ‘Signal box management procedure’.[6] The procedure was originally issued in 2015.
The procedure covers generic issues including:
Responsibilities of signallers
Operation of signalling equipment
Communication and supervision
Administration and safety equipment.
The signal box management procedure does not have a recognised document number to indicate it is part of the Sydney Trains document management system. The procedure is shown as managed by the Compliance Standards Manager and approved by the Network Operations Manager.
The procedure does not mention how internal operational coverage is managed at individual signal boxes. It does not mention meal breaks or the role of relief signallers during their shift. Given the absence of any direction in this procedure, and the unauthorised nature of the Granville signal box document, Sydney Trains did not address this important aspect of network operations within their established management system.
Fatigue management for signallers
This Sydney Trains rostering and fatigue procedure included eight rostering principles to be observed in order to reduce or manage the cumulative effects of fatigue. These eight rostering principles, and a description of these principles, are reproduced below from the Sydney Trains procedure:
Principle
Description
Acclimatisation
Workers new to shift work and those returning after an extended period of annual or sick leave should not be rostered on night work or an early morning start for their first shift. When on leave, human circadian rhythms quickly re-establish a pattern of sleeping at night and being active during the day. Returning to night or early morning starts may be difficult, a bit like ‘Mondayitis’.
Shift length
The length of a shift should not exceed 12 hours including overtime, especially if it involves a night shift. Human performance declines significantly when people have been working for 12 hours or more, especially where work is done at night or in the early morning.
Total hours worked
Aim for no more than 48 hours per week including overtime, which can be averaged across the roster cycle. The risk of fatigue increases towards the end of a week/roster cycle. This is because a sleep debt has accumulated. Limiting the number of hours worked in a week or roster cycle, provides time off to recover and repay the sleep debt.
Limit night shifts and early morning starts
Aim for no more than: • four consecutive shifts where 12 hour shifts are worked • five consecutive shifts where 10 hour shifts are worked • six consecutive shifts where 8 hour shifts are worked. Working a series of night/early morning shifts disrupts circadian rhythms and leads to accumulation of a sleep debt.
Break during a shift
Schedule frequent breaks especially during a night shift or if the work involves sustained mental or physical activity, if local arrangements allow. Breaks during a shift provide workers with an opportunity to rehydrate and get a short rest. Breaks during a shift may be rostered or managed informally, depending on local arrangements and the nature of the work.
Break between shifts
Aim for at least 12 hours from the end of a shift and the start of the next shift. Industrial agreements may allow for less than 12 hours, however, to reduce the risk of fatigue, a minimum of 12 hours break is needed. Breaks between shifts need to allow enough time for recovery and sleep. Night shifts may need longer breaks between shifts. This is because workers will need to sleep during the day when it is difficult to get good quality sleep
Breaks between cycles
Make sure there are adequate breaks between shift cycles. For example: • Two days off in a 7 day shift cycle • Four days off in a 14 day shift cycle • Eight days off in a 28 day shift cycle. Days off should be a minimum of two consecutive days. Evidence indicates shift workers need at least two consecutive nights sleep per week to enable them to report to work feeling refreshed.
Shift cycles
Schedule consistent start times where possible, or if rotating rosters are used, shift start times should move in a forward rotation i.e. morning-afternoon-night. Consistent start times can help shift workers get into a routine. Where rotating rosters are used, there is evidence that a forward rotating roster allows shift workers to delay sleep and wake up later. This is easier to do than going to sleep earlier or waking up earlier.
The planned, or master, roster and shifts actually worked for the period from 6 – 19 October 2019 for signaller GT is included in the table below.
Date
Planned shift times
Actual shift times
Hours worked
Time until next shifts
6 October 2019
1335 – 2135
1335 – 2135
8
48 hrs
7 October 2019
0000 – 0000
0000 – 0000
0
8 October 2019
1335 – 2135
2135 – 0535
8
16 hrs
9 October 2019
1335 – 2135
2135 – 0535
8
16 hrs
10 October 2019
1335 – 2135
2135 – 0535
8
8 hrs
11 October 2019
1335 – 2135
1335 – 1735 (half shift)
4
20 hrs
12 October 2019
2135 – 0535
2135 – 0535
8
16 hrs
13 October 2019
2135 – 0535
2135 – 0535
8
16 hrs
14 October 2019
2135 – 0535
2135 – 05:35
8
16 hrs
15 October 2019
2135 – 0535
2135 – 0535 (incident 2303)
8
Off roster post incident
Five of the eight rostering principles were not met in relation to the roster of signaller GT in the eight days leading up to the incident. The five principles, and the nature of the departure from these principles, are outlined below.
Rostering principle
Departure from principle during this incident
Limit night shifts and early morning starts
From the 8 October to 15 October 2019, the signaller was rostered for eight consecutive shifts, seven of which were night shifts.
Break during a shift
One continuous shift break was rostered for the shift
Break between shifts
11 October 2019 there was a break of eight hours between shifts
Breaks between cycles
7 October 2019 was a single book off shift
Shift cycles
11 October 2019 backwards rotation of eight hours
According to the Managing Shift Work and Rostering procedure, when departures from these rostering principles occur, line managers must intervene and put in place measures to try and correct the situation. The line manager for signaller GT was unaware of the departure from these rostering principles, and therefore did not put measures in place as required by the procedure. The line manager for GT had not undertaken the mandatory training course ‘Fatigue Management for Managers’.
Sydney Trains acknowledged in their internal investigation report that the requirements for the procedure Managing Shift Work and Rostering were not being followed. Sydney Trains adopted a recommendation from their internal report as follows:
‘Review why the requirements of SMS-08-OP-3128 Managing Shift Work and Rostering, in relation to the diverting from Rostering Principles, are not being followed and determine appropriate corrective actions. In particular: · the process for identifying and managing exceptions to the rostering principles with day to day operations (recording exceptions and capturing controls that are identified as a result); · who has completed the required fatigue training to ensure understanding of the rostering principles; · reporting exceptions to rostering principles; and · the processes around the implementation of the Network operations – fatigue risk management checklist and its integration with the SMS.’
At interview, the signaller GT stated that they were well rested for the shift prior to the incident. Signaller GT recounted how they had an effective rest regime at home when working night shift and had obtained sufficient rest, had slept as usual from about 0830 to 1500, and felt fit and able to carry out their shift.
It is unknown whether the amount of sleep was sufficient to allow for recovery from the seven consecutive shifts. It is possible that the signaller GT was affected by the cumulative effects of fatigue given the deviations from five rostering principles leading up to the day of the incident. However the evidence is not definitive and it is not possible to ascribe fatigue as a contributing factor with any certainty.
Use of bio-mathematical fatigue scores
Sydney Trains employed fatigue modelling (using FAID[7]) for roster design and to ensure that employees were provided with adequate rest opportunity between shifts. Bio-mathematical models attempt to predict the effects of different working patterns on subsequent job performance, with regard to the scientific relationships among work hours, sleep and performance.[8] FAID ‘assigns a recovery value to time away from work based on the amount of sleep that is likely to be obtained in non-work periods, depending on their length and the time of day that they occur.’[9]
That is to say, FAID does not predict fatigue per se but rather predicts a sleep opportunity, demonstrating only that the organisation has provided employees with an adequate opportunity to sleep, producing a work-related fatigue score.[10]
The FAID score is a single number based on a zero to above 120 range. The number ranges and descriptors are given below:
Standard: 0-40
Moderate: 40-80
High: 80-100
Very High: 100-120
Extreme: above 120
The Sydney Trains Operations Manager West/Illawarra was responsible for the planned shift work roster for signaller GT. According to the Operations Manager they would only conduct a risk assessment when the FAID score exceeds 100. The FAID score on the day of the incident was calculated by Sydney Trains as 93. There was no consultation with signaller GT about the planned shift work roster. Departure from the rostering principles, as occurred in this case, did not trigger any action by the line manager related to managing the potential fatigue of the signaller GT.
Sydney Trains have conducted a review of the use of the FAID score as it related to this case. They found that there was no documented rationale for the use of a FAID score exceeding 100 as a trigger for risk management actions.
FAID, along with other bio-mathematical models, is a useful tool to account for hours of sleep opportunity provided, thereby providing an indication of fatigue exposure across a group of employees. It cannot account for the hours of sleep actually achieved by individuals, nor for the quality of that sleep. These additional factors necessitate the use of multiple layers of controls to manage fatigue-related risk.
As a result of inconsistencies with the application of rostering principles Sydney Trains have recommended a review of their procedure for Managing Shift Work and Rostering. In particular:
The process for identifying and managing exceptions to the rostering principles with day to day operations (recording exceptions and capturing controls that are identified as a result);
Who has completed the required fatigue training to ensure understanding of the rostering principles;
Reporting exceptions to rostering principles; and
The processes around the implementation of the Network operations – fatigue risk management checklist and its integration with the SMS.
Safety Critical Communication
The communication between signaller GT and the Protection Officer
Signaller GT and the Protection Officer discussed the need to divert trains around the work area, however neither worker identified that the intended route through 727 would intrude on the worksite.
The lack of direction in the rules and procedures about how to manage this conflict contributed to the error. The error was likely compounded by an assumption from Signaller GT that the work was taking place further west at Westmead platform. This assumption was based on previous work on track activity, like track cleaning, which regularly took place through Westmead platform.
During the period of the conversation between the signaller GT and the PO to establish the ASB, signaller GT was regularly interrupted by phone calls related to the Granville signal panel, which the signaller GT was operating as well, because signaller GG had vacated their workstation.The signaller was performing multiple tasks in ensuring normal train running was occurring, monitoring multiple computer monitors, and ultimately attending to the request for worksite protection.
The communication requirements in NGE 204 require that interrupted communications must be restarted, however the signaller GT and the PO resumed their conversation after the interruption rather than restart it.
There was no advance notification to the signaller about the intended work, and its consequent impact on train running. An improvised train operations plan needed to be implemented. This added to the workload of the signaller and was likely a contributing factor to the error in assuming the workers were located clear of 727 points. The signaller GT misunderstanding of the position of the workers on track and the error in routing the train was likely the result of the cumulative effects of fatigue, magnified by the increased workload.
The lack of direction in the rules and procedures about how to properly identify the actual location of the workers within the area protected by the ASB, compounded by the signaller GT’s assumption about the location of the workers, led to the error of allowing the train 133U to pass protecting signal GE 463 and enter the worksite.
Planning of work in the Sydney Trains network
Sydney Trains Engineering and Maintenance Division employ several thousand people, including maintenance and upgrading staff, performing a multitude of tasks in and around the rail corridor. Sydney Trains also employ numerous contractors performing work on or around the track. Other organisations like Transport for NSW and Sydney Metro are also doing works in and around the rail network.
Many work activities are undertaken within a planned possession regime when occupation of the track is planned in advance and train operations are altered or replaced with buses. This work is advertised, and significant work goes into its delivery, including the altered train working arrangements.
In May 2020, Sydney Trains implemented the Access Pre-Advice system, (APS). This system is regarded as a planning and registration system, not a safety system. The purpose of the APS is to require work outside of a Local Possession Authority to be planned and logged into the system four days in advance, so that Network Operations have some visibility of the intended work and can plan for it.
In the period 20 May to 20 June 2020, there were 1063 applications for Absolute Signal Blocking in the Sydney Trains Network as recorded in the APS. Not all of these requests would result in train diversions, however, this figure illustrates the amount of unannounced work that Network Control Officers had to deal with in the Sydney Trains network prior to the introduction of the APS.
Sydney Trains also have a worksite protection planning system called the Corridor Safety Centre (CSC). This system requires the Protection Officer to contact the CSC and have their protection arrangements reviewed and validated before work commences.
In April 2021, Sydney Trains announced a trial of the integration of these two systems at Waterfall in NSW. This trial may introduce improvements to the process of planning and delivering worksite protection in the network.
At the time of the incident in October 2019, a significant proportion of the work on track that occurred in the Sydney Trains network was done with no prior knowledge of, or advice to, the Operations Division. In this incident, the first knowledge that the signaller had that the work was to occur was when the PO2 called Granville signal box to request the ASB.
There was no evidence available to indicate that the impact to train operations from the proposed work was considered by the Engineering and Maintenance Division. The effort was only put into determining the worksite protection required to permit the work to occur. Any resulting change to train operations is therefore a responsibility that is handed to the signaller to organise, with no advance notice.
Even a relatively small job like the WTSA inspections can cause train operations disruption, because of the need to exclude trains, and therefore, divert trains from their normal timetable. Diversions mean trains are not on their normal rostered path, stopping patterns are altered because different platforms need to be used for passenger working and the volume of services get compressed from two tracks to one.
Passenger information must be dispersed, station staff need to be informed and other adjoining signal boxes need to be advised of the altered train running arrangements. A decision to grant an ASB for a relatively simple task of taking track measurements can have a large effect on the network.
Because the WTSA inspections work was not known to the signaller, the signaller had to devise an improvised train operations plan, with little time to consider the implications of what was being planned. The signaller also had to attend to the other normal train running activities associated with the signal box on those tracks unaffected by the ASB.
The lack of an integrated planning regime for work outside the possession planning process could have increased the possibility of errors and omissions during the delivery of protection for work on track.
At the time of the incident, there was no requirement for this work to be notified to the Operations Division of Sydney Trains, so that some form of planning and preparation for the impact could have been made. At the time of this incident, Sydney Trains did not employ an integrated system to manage work on track in the rail network.
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the near hit incident with workers on track at Westmead on 15 October 2019.
Contributing factors
The PO and the signaller did not come to a clear understanding about the arrangements to use the protecting signal in order to run a train on the alternative route.
The signaller experienced a period of high workload during the shift which likely contributed to the error where signal protection for the worksite was removed to allow a train to run through the worksite.
The signaller's roster departed from rostering principles and the rostering arrangements did not provide sufficient assurance in managing the risks.
Sydney Trains did not provide suitable management arrangements for supervision at Granville signal box to ensure there was adequate coverage on both signalling panels. (Safety issue)
The ASB rule NWT 308 and procedure NPR 703 did not provide sufficient description for the task of using protecting signals for an alternative route. (Safety issue)
There were inconsistences with Sydney Trains’ application of their fatigue management system, in particular the use of a bio-mathematical model to predict individual fatigue risk. (Safety issue)
Other factors that increased risk
The FAID score of 100 used by Sydney Trains as a threshold for intervention has no documented rationale.
A significant proportion of the work on track that occurred in the Sydney Trains network was done with no prior knowledge of, or advice to, the Operations Division.
The Granville signaller was absent from the panel with no rostered relief.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
The ASB rule and procedure for using an alternative route
Issue number description: The ASB rule NWT 308 and procedure NPR 703 did not provide sufficient description for the task of using protecting signals for an alternative route. (Safety issue)
Safety issue description: Sydney Trains did not provide supervision at Granville signal box to ensure there was adequate coverage on both signalling panels. (Safety issue)
Inconsistencies with application of fatigue management system
Safety issue description: There were inconsistences with Sydney Trains’ application of their fatigue management system, in particular the the use of a bio-mathematical model to predict individual fatigue risk. (Safety issue)
Glossary
ASB Absolute Signal Blocking
CCTV Closed Circuit Television
CSC Corridor Safety Centre
EOL Emergency Operation Lock
ESML Emergency Switch Machine Lock
ETWS Enterprise Track Worker Safety program
GG Granville signalbox, Granville panel signaller
GT Granville signalbox, Table signaller
GW Granville signalbox, Westmead panel signaller
IRC Incident Rail Commander
NGE 234 Network Rule General 234
NPR 703 Network Procedure 703
NWT 308 Network Rule Work on Track 308
PO Protection Officer
TSDM Train Service Delivery Manager
WTSA Welded Track Stability Analysis
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Sydney Trains Systemic Safety Investigation Report
Swetha International Pty Ltd Investigation report
Voice recording data from Granville signal box
References
Dawson, D., Noy, Y.I., Harma, M., Akerstedt, T. & Belenky, G. (2011). Modelling fatigue and the use of fatigue models in work settings. Accident Analysis and Prevention, 43, 549-564.
Folkard S, Robertson KA, Spenser MB (2006). The development of a fatigue / risk index for shiftworkers. p.12.
Roach, G.D., Fletcher, A. & Dawson, D. (2004). A model to predict work -related fatigue based on hours of work. Aviation, Space, and Environmental Medicine, 75(3), 61-69.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Sydney Trains
Transport for NSW
The Office of the National Rail Safety Regulator
Swetha International Pty Ltd
Submissions were received from Sydney Trains and The Office of the National Rail Safety Regulator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations & publishing information
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
While the Boeing 767, VH-EXZ, was taxiing for departure from Auckland an imbalance in the fuel load between the left and right main tanks developed while the centre tank was providing fuel to both engines. That imbalance triggered the FUEL CONFIG advisory alert message. In response, the flight crew considered whether there was a fuel leak and, having determined this was not the case, decided to depart and correct the out‑of‑balance condition airborne.
Once airborne, the flight crew delayed the procedure to rebalance the fuel until the centre tank fuel had been depleted. As a result, the fuel imbalance increased to 2.6 t, a weight difference in excess of the fuel imbalance limitation published in the operator’s policy and procedures manual. On arrival at Sydney, the flight crew verbally notified the maintenance personnel of the imbalance but did not enter it into the technical log. The return flight was not loaded with centre tank fuel. The operator’s maintenance organisation did not become aware of the fuel imbalance issue until about 3 days after the occurrence.
What the ATSB found
The ATSB found that the fuel imbalance was the result of abnormal fuel system behaviour, due to a fault within the fuel system, which resulted in fuel being fed into the right main tank from the centre tank. As the imbalance occurred before take‑off, a procedure within the Minimum Equipment List (MEL) required the flight crew to action the relevant non-normal checklist and if discontinuation of the flight was not required, then consult the MEL to determine whether maintenance action was required.
Application of the MEL would have required the aircraft to return for maintenance action.
The flight crew had differing knowledge of the MEL requirements however, they shared a common belief that the risk was low enough for the flight to proceed. Consequently, having consulted only the non‑normal checklist, the aircraft departed Auckland.
Airborne, the flight crew identified that the abnormal fuel system operation was the result of fuel being pumped into the right main tank. Additionally, the flight crew continued to monitor for a fuel leak and noted that the aircraft’s handling did not appear to be affected by the imbalance. Further, as fuel system guidance and the low priority of the FUEL CONFIG advisory alert message indicated minimal risk from a fuel imbalance condition, the flight crew chose to delay rebalancing. Consequently, the flight crew did not determine whether there was full access to the remaining fuel until they had recommenced the FUEL CONFIG non-normal procedure.
The fuel system unserviceability was verbally notified to engineering, however, contrary to the requirements of the operator's policy and procedures manual, it was not entered into the technical fault log. This delayed maintenance corrective action, and likely hampered determination of the cause of the imbalance.
What has been done as a result
The aircraft’s operator advised the ATSB that an amendment to the MEL has been drafted to include clarification as to crew actions in the event of an Engine Indication and Crew Alerting System (EICAS) message between off‑blocks and take-off. This amendment will be situated in the early part of the MEL Introduction section.
The operator has also stated that it will alert flight crew to the procedural requirement through notification of the MEL amendment.
Safety message
This occurrence highlights the value of flight crews being fully conversant with operating procedures, particularly those related to aircraft unserviceability. Those procedures are critical to the safety of flight operations.
It is also important that any unserviceability is recorded in the aircraft’s technical log to ensure that it is addressed and to provide future reference in case of further, or related, instances.
The occurrence
At 1154 New Zealand Standard Time[1] on 27 July 2019, a Tasman Cargo Airlines Boeing 767‑3JHF, registered VH-EXZ, was taxiing for departure from Auckland, New Zealand, for a freight service to Sydney, New South Wales. As the aircraft was entering the runway for departure, the Engine Indication and Crew Alerting System (EICAS) displayed a FUEL CONFIG advisory alert message on the primary EICAS display. The message was the result of an imbalance condition that exceeded a pre-set limit between the left and right main fuel tanks.
The flight crew commenced their duty at about 0930, and consisted of the aircraft captain, who occupied the left seat and was the pilot monitoring (PM), and the first officer, who occupied the right seat and was the pilot flying (PF).[2] The flight, which was scheduled to depart at 1145, was the first of two sectors for the aircraft and flight crew that day.
The flight was dispatched as an EDTO flight[3] authorised to operate up to 120 minutes from an alternate aerodrome. The aircraft was loaded with about 21 t of fuel, with 8.0 t in the centre tank and the remainder distributed evenly between the left and right main tanks. The flight crew arrived early at the aircraft and started the aircraft’s auxiliary power unit (APU) before commencing pre‑flight duties.
Engine start was commenced at 1137 and completed at 1140. Following completion of the engine start:
the fuel panel was properly configured for flight
fuel was distributed as 6.6 t in the left main tank, 6.5 t in the right main tank and 7.9 t in the centre tank.
Taxi for departure commenced shortly thereafter.
The first officer reported that, on approaching the holding point for the departure runway the FUEL CONFIG light on the fuel panel started to intermittently illuminate.[4] The cause of the light was identified as an imbalance between the left and right main tanks, with the left tank low. At that time, the first officer attributed the imbalance to the refuelling being out-of-balance and extended APU use during pre-flight.
At 1156, just after the flight crew had completed departure procedures and the aircraft cleared to enter the runway, the FUEL CONFIG light illuminated. This triggered the FUEL CONFIG advisory alert message. The left tank was indicating 6.6 t, the right tank 7.7 t, while the centre tank had decreased to 6.2 t.
The flight crew established that the fuel panel was correctly configured and assessed that the imbalance was not due to a fuel leak—through comparing the fuel totaliser and the flight management computer’s calculated fuel remaining figures (see the section titled FUEL CONFIG non-normal checklist). They began completing the non-normal checklist and then decided to continue with the departure and address the imbalance condition once airborne because:
rebalancing required changes to the fuel panel (an action that the captain did not wish to do immediately prior to take-off)
the imbalance was not critical to departure
the departure was imminent.
The aircraft departed Auckland at 1200.
Post departure, the flight crew reassessed the fuel imbalance condition. The captain stated that the fuel imbalance did not cause any controllability issues and that the aircraft trim remained at zero for the duration of the fuel imbalance event. The captain continued to check for a fuel leak airborne, and stated that at no time was there any indication of a fuel leak. It was, however, noted that the source of the imbalance was fuel being fed into the right tank.
The first officer reported that, early in the climb, the imbalance was identified to be the result of abnormal operation of the fuel system. While the centre tank fuel quantity was decreasing as expected, and the left main remained stable, the right main was unexpectedly increasing.
The captain stated that, as the rebalancing procedure involved making changes to the fuel panel, which in turn would have resulted in the triggering of the FUEL CONFIG advisory alert message, it was decided to delay rebalancing until the centre tank was nearly empty. As a result, the FUEL CONFIG non-normal procedure that was to be actioned in response to the alert message was not commenced until about 30 minutes after departure. During that period, the imbalance between the left and right main tanks continued to increase. The aircraft reached its cruising altitude of FL 360[5] at 1216.
The flight crew reported that rebalancing of fuel system commenced when the fuel pressure low lights illuminated on the centre tank’s left and right fuel pumps, indicating that the centre tank quantity had reduced to about 400 kg. At that time, the imbalance between the left and right main tanks was 2.6 t. Rebalancing commenced at 1229, with the flight crew actioning the FUEL CONFIG non-normal checklist. When the left and right main tanks were re-balanced, the fuel panel was returned to a normal configuration. The aircraft’s main fuel tanks remained balanced for the remainder of the flight.
On arrival into Sydney, the flight crew reported the abnormal fuel system behaviour by telephone to the maintenance engineer in Auckland who had dispatched the aircraft. It was also discussed with the maintenance engineer who met the aircraft in Sydney. However, no maintenance action to address the fuel imbalance issue was carried out in Sydney and the defect was not entered into the aircraft’s maintenance log prior to the return leg to Auckland.
Fuel was not loaded into the centre tank for the return flight to Auckland. The flight crew reported that, on that return flight, the fuel system operated normally. After arrival in Auckland, the fuel imbalance issue from the previous sector was again not entered into the aircraft’s maintenance log. Maintenance action concerning the imbalance did not commence until 3 days later.
The captain held an Air Transport Pilot License (Aeroplane) and a Class 1 medical certificate. The pilot’s flight experience totalled approximately 19,100 hours, of which 176 hours were on the Boeing 767 (B767). In the 90 days preceding the occurrence, the pilot had flown about 55 hours on B767 type aircraft.
The first officer held an Air Transport Pilot License (Aeroplane) and a Class 1 medical certificate. Their flight experience totalled approximately 9,000 hours, of which 450 hours were on the B767. In the 90 days before the occurrence, the pilot had flown about 105 hours on B767 type aircraft.
Both pilots reported being well rested and alert at the commencement of duty for the occurrence flight and there was no evidence to indicate a risk that fatigue affected the flight crew’s performance.
Aircraft information
Fuel system
The B767 fuel system (Figure 1) comprised:
three fuel tanks—the centre tank, and the left and right main tanks
two fuel pumps in each tank
a fuel quantity system that determined fuel density and quantity to display fuel in kg
a fuel crossfeed system that could supply fuel to an engine from the opposite side fuel tank
fuel panel controls.
Figure 1: The B767 fuel system
A schematic of the B767 fuel tank locations, and the fuel system components. The lower schematic shows the relationship between the left and right wing tank and centre tank, the fuel pumps, crossfeed system and the controls for those systems.
Source: Boeing, modified by ATSB.
The Flight Crew Operating Manual (FCOM) description of the fuel system included the following with respect to the:
fuel tank pump outputs:
The two center tank fuel pumps have greater output pressure than the left and right main tank fuel pumps. When all six pumps are operating, the center tank pumps override the left and right main tank pumps so that center tank fuel is used before [the] left or right main tank fuel.
FUEL CONFIG light:
When the fuel quantity in [the] left and right main tanks differ by 900 kilograms (plus or minus 200 kilograms) or center fuel pump switches are OFF with more than 500 kilograms in the center tank, the FUEL CONFIG light illuminates and the EICAS advisory message FUEL CONFIG is displayed.
fuel imbalance:
Fuel balancing is accomplished by opening the crossfeed valves and turning off the fuel pump switches for the left or right main fuel tank that has the lowest quantity. Fuel balancing may be done in any phase of flight.
FUEL CONFIG Engine Indication and Crew Alerting System (EICAS) advisory alert message, which was triggered when:
Both center pump switches are OFF with fuel in the center tank, or a fuel imbalance between main tanks, or the fuel quantity is low in a main tank.
Fuel for the aircraft’s Auxiliary Power Unit (APU) was fed from a pump located in the left main tank.
Engine Indication and Crew Alerting System
The EICAS provides flight crew with aircraft engine and systems information. It also provides an alerting system to the flight crew about aircraft configuration issues, or system faults and failures. The primary feature of the EICAS are two vertically‑mounted, centrally‑located displays on the forward instrument panel (Figure 2). The EICAS also incorporates visual and aural alerting systems.
Figure 2: Front instrument panel
B767 front instrument panel showing the primary and secondary EICAS screen locations, with expanded view of both. The primary EICAS is displaying warning, caution and advisory level messages.
Source: Boeing modified by ATSB.
EICAS alerts are displayed on the primary EICAS display, with type‑specific visual and aural alerts. The type of alert that EICAS will produce depends on the nature of the issue and its importance or priority. There are four types, or categories of EICAS alerts. Ranked in order of priority, these are:
time-critical warning, which required immediate crew awareness and immediate corrective action
warning, which required immediate crew awareness and corrective action
caution, which required immediate crew awareness and for which corrective action may be required
advisory, which required routine crew awareness and for which corrective action may be required.
The specific alert may also require performance of a non–normal checklist. Non-normal checklists were contained within the Quick Reference Handbook (QRH) and were referenced using the alert message displayed to the flight crew.
Aircraft operating limits
The introduction to the ‘Limitations’ chapter of the FCOM stated that it contained Airplane Flight Manual[6](AFM) limitations, AFM operational information and non‑AFM operational information. The introduction stated that limitations and operational information were included within that chapter if they were operationally significant or prescribed under regulation. Limitations were not included where they were incorporated into normal, supplementary, or non-normal procedures, or were shown on a placard, display or other marking.
The Limitations chapter did not include any fuel system limitations relevant to the fuel imbalance event, although the FUEL CONFIG advisory alert message was triggered for an imbalance that was 900 kg, plus or minus 200 kg.
Operational information
The FCOM contained the normal and supplementary procedures, and the QRH detailed the non‑normal checklists, necessary for the operation of the aircraft. The pre‑eminent source of operations policy and procedure was the Policy and Procedures Manual (PPM). The PPM contained specific procedures, instructions and information required by the Civil Aviation Safety Authority (CASA) that were necessary to ensure the safe conduct of flight operations. Guidance material relevant to the operation of the aircraft was also found in the Flight Crew Training Manual (FCTM).
Normal procedures
FCOM normal procedures
The normal procedures section of the FCOM contained pre-flight and before start procedures that contained specific fuel system configuration selections required of the first officer. These procedures identified that, when there was fuel in the centre tank, the fuel system was to be configured with (see Figure 1):
the FWD and AFT fuel pump switches for the left and right main tanks ON
both FUEL XFEED valve switches OFF
the centre tank left pump and right pump (CTR L and CTR R) switches ON.
The climb and cruise procedures included procedures for when the centre tank emptied of fuel, and/or the CTR L or CTR R FUEL PUMP EICAS advisory alert message was displayed.
FCOM supplementary procedure—fuel balancing
The supplementary procedures section included a fuel balancing procedure. This procedure commenced with advice to use the ‘Fuel Leak Engine’ procedure if a fuel leak was suspected. It then stated the following:
When the fuel quantities in left main and right main tanks differ by an appreciable amount:
Chapter 14 of the PPM provided information on the operator’s operations manual suite. That chapter included the following:
The Aircraft Flight Manual is an integral part of the Certificate of Airworthiness of the aircraft. It will be carried in the aircraft at all times.
The PIC is required to comply with requirements, instructions, procedures or limitations concerning the operation of the aircraft as set out in the Aircraft Flight Manual.
In the unlikely event that the requirements of the Aircraft Flight Manual conflict with the requirements of any manual from the [Tasman Cargo Airlines] TCA manual suite, the requirements of the Aircraft Flight Manual shall take precedence.
PPM—fuel system limitations
The normal operations section of the PPM contained procedures related to the fuel system. Included within that section were requirements concerning fuel usage with fuel in the centre tank. With respect to a lateral fuel imbalance, that section stated:
The maximum allowable fuel imbalance between left and right main tanks for all operations is 1,134 kgs when the total main tank fuel is 21,772 kgs or less...
The operator advised that the PPM fuel imbalance limitations were sourced from the B767 AFM for VH-EXZ. Also sourced from the AFM, the PPM detailed a fuel loading schedule, which required the wing tanks to be filled before fuel was loaded into the centre tank. That schedule permitted 10.0 t of fuel to be loaded into the centre tank with less than full main tanks, provided specific fuel jettison capability and maximum aircraft zero fuel weight criteria were met.
PPM—loading of the centre tank fuel
As the operator’s B767 sectors were exclusively between New Zealand and the Australian east coast, normal fuel loading resulted in the centre tank not being utilised. The operator identified that the aircraft’s capacity for long range operations could be limited by the serviceability of the centre tank system if that system was not regularly used. As the regular schedule was for weekday evening return flights from Auckland to Sydney, which were curfew limited, and a Saturday daylight flight, the operator commenced a policy to load 8 t of fuel into the centre tank on the Saturday flights only.
Non-normal procedures
FUEL CONFIG non-normal checklist
The FUEL CONFIG EICAS message was classified as an advisory alert, which was triggered when one or more of the following conditions occur:
Both centre pump switches are off with more than about 500 kg of fuel in the centre tank
A fuel imbalance of 900 kg ± 200 kg between the left and right main tanks
The fuel quantity is low, less than around 1,000 kg, in a main tank.
The QRH checklist for the FUEL CONFIG advisory alert message stated the following:
1 If an engine has low fuel flow and unusual engine indications, a fuel imbalance may show due to engine damage instead of a fuel leak.
2 The FUEL CONFIG message may be caused by an engine fuel leak, center pump switches off incorrectly, an imbalance, or low fuel.
3 A fuel leak should be suspected if one or more of the following are true:
The total fuel quantity remaining is less than the planned fuel remaining.
An engine has excessive fuel flow.
On PROGRESS page 2, the totalizer is less than the calculated fuel.
The TOTALIZER fuel is the sum of the individual tank quantities.
The CALCULATED fuel is the totalizer value at engine start minus fuel used.
Fuel used is calculated using the engine fuel flow sensors.
The QRH checklist then presented two options to manage a FUEL CONFIG advisory alert:
If a fuel leak was indicated, the flight crew were directed to conduct the ‘Fuel Leak Engine’ checklist
If a fuel leak was not indicated, the checklist continued with the steps required to bring the fuel tanks back into balance. These steps were the same as the fuel balancing supplementary procedure. Finally, the checklist required consideration with respect to low fuel quantity, a condition that was not relevant to this occurrence.
FCTM—fuel balance guidance
The FCTM included the following regarding fuel balance:
The primary purpose of fuel balance limitations on Boeing airplanes is for the structural life of the airframe and landing gear and not for controllability. A reduction in structural life of the airframe or landing gear can be caused by frequently operating with out-of-limit fuel balance conditions. Lateral control is not significantly affected when operating with fuel beyond normal balance limits. The primary purpose for fuel balance alerts is to inform the crew that imbalances beyond the current state may result in increased trim drag and higher fuel consumption. The FUEL CONFIGURATION [non normal checklist] should be accomplished when the fuel balance alert is received.
The FCTM also stated that the flight crew should consider, among other things, that:
during critical phases of flight, fuel balancing should be delayed until workload permits. This reduces the possibility of crew errors and allows crew attention to be focused on flight path control.
The take-off is a critical phase of flight.
Boeing Aero magazine—fuel imbalance
In 2000, Boeing published an article on in-flight fuel imbalance in the quarterly Aero magazine.[7] That article contained the following information about fuel imbalance indications:
With the introduction of the two-crew member flight deck...fuel system automation was incorporated to relieve the flight crew of most fuel management tasks. Fuel use is monitored electronically by the [fuel quantity indicating system], fuel management system, or flight deck indication system. These systems monitor fuel usage and annunciate a fuel imbalance condition in the flight deck when the imbalance reaches a specific value...No action is required by the flight crew unless a fuel imbalance indication is displayed, which the flight crew should address on a time-available basis in accordance with operations manual procedures...
The amount of fuel imbalance allowed before the indication is displayed minimizes additional fuel consumption caused by lateral trim drag and limits the amount of fuel balancing that the flight crew must accomplish. As the fuel becomes unbalanced, lateral trim is required to maintain wings-level flight. The lateral trim requirement increases airplane drag and consequently increases fuel consumption. Waiting until the indication to balance fuel is displayed limits the number of times the fuel must be balanced without significantly increasing fuel consumption.
An indicated fuel imbalance does not affect the ability of the airplane to safely complete its scheduled flight. The flight crew should accomplish the fuel imbalance procedure in a timely manner, but lateral control capability is not significantly affected by an indicated fuel imbalance...
Recorded information
Figure 3 is a graphical display of the fuel tank quantities recorded by the digital flight data recorder (DFDR). The time period covered is from completion of engine start, at 1140 to the time at which the centre tank was completely drained of fuel, at about 1330.
Figure 3: DFDR recorded fuel tank quantities.
A graphical presentation of DFDR data for the fuel quantities recorded in the left and right wing fuel tanks and the centre fuel tanks. The graph covers the recorded data from just after engine start until the centre tank is completely drained of fuel.
Source: ATSB
The data identified that the imbalance was the result of fuel being fed into the right main tank while the engines were being fed fuel from the centre tank. This abnormal condition commenced around the time of the engines start and continued until the centre tank pumps were switched off. The data also identified that, from post‑engine start until landing, the fuel panel switch positions were properly set and in accordance with the normal and supplementary procedures.
The maximum differential of 2.6 t occurred at about 1230. At that time, the centre pump low pressure lights illuminated. In response, the flight crew turned the centre tank pumps off and configured the fuel panel to rebalance the fuel between the left and right tanks. The left and right main fuel tanks returned to a balanced condition at 1308, after which the flight crew returned the fuel panel to a normal configuration. The left and right main fuel tanks remained in balance for the remainder of the flight.
Maintenance information
Prior to a flight, the aircraft captain was required to ensure that instruments and equipment necessary for that flight were installed and functioning properly, and that the aircraft was safe for flight. Further, the captain was required to confirm that maintenance actions from the previous flight had been completed and certified as required. The aircraft’s technical log was the document for recording defects and maintenance action undertaken on the aircraft.
The captain was required to certify that the aircraft was airworthy, and that no further maintenance was required, through signing the acceptance section of the aircraft’s technical log. The VH-EXZ technical log page for the 27 July flight from Auckland to Sydney included the captain’s pre-flight inspection signature with a date time just prior to the aircraft’s departure.
Not all aircraft components, however, were required to be serviceable before flight. Those components that could be unserviceable, and the processes involved in accepting that unserviceability, was determined through the operator’s Minimum Equipment List (MEL).
The Minimum Equipment List
Background
Aircraft are designed to have specific levels of redundancy to achieve a required level of safety. Aircraft manufacturers and the certification authorities have established that the required level of safety is able to be maintained with certain aircraft components being temporarily unserviceable, provided specific conditions are met. The conditions attached to a permitted unserviceability include requirements, such as time limits and/or procedures, to be applied. These permitted unserviceabilities, and their conditions, are published in the aircraft type’s Master Minimum Equipment List (MMEL). All items not included within the MMEL are required to be operative, unless they are non-safety-related items.
CASA required an aircraft operator to develop a Minimum Equipment List (MEL). The MEL was to be based on the latest version of the MMEL, but was also required to take into consideration:
the operator’s particular aircraft configuration and equipment
operating conditions
routes flown
any specific legislative and/or regulatory requirements.
The VH-EXZ MEL
The Introduction section in the MEL contained the following guidance:
Once an aircraft has dispatched, the primary source of information is the Quick Reference Handbook (QRH).
The MEL defined dispatch as:
The point at which an aircraft first moves under its own power for the purpose of commencing flight.
The MEL also contained a section titled Criteria for Dispatch, which included a subsection titled Managing Defects Occurring after Dispatch and before the Commencement of Take-off that contained the following procedure:
If after dispatch and before take-off a defect is discovered the following procedure shall be adopted:
a) The associated 'Non-Normal Checklist' shall be consulted / accomplished. Any failure or checklist that does not permit take-off or requires the aircraft to land at the nearest suitable airport will require the flight to be discontinued.
b) The MEL shall then be consulted to determine if dispatch with the item inoperative is available.
i) If the item is not listed in the MEL, or the MEL dispatch remarks or exceptions prohibit dispatch for the proposed type of flight (eg: flight is not conducted in known or forecast icing conditions), then the flight shall be discontinued.
ii) If dispatch is permitted by the MEL, there is no associated (M) procedure and the PIC considers that the unserviceability does not affect the safety of flight having regard for any associated (O) procedures, the weather conditions likely to be encountered enroute, the duration of the flight and the departures, arrivals and approaches expected to be flown, then the flight may continue...
The MEL contained a cross-reference list that matched EICAS messages to their relevant MEL item. That list included the FUEL CONFIG message, which listed three MEL items associated with that message. Two of those MEL items had (M) maintenance procedures attached to them. An (M) annotation identified that a maintenance procedure was required prior to continued operation of the aircraft.
The flight crew reported that, as the aircraft had dispatched the QRH was the primary procedural document. They also assessed that the risk in departing was low.
With regard to the MEL requirements for managing defects after dispatch but prior to take‑off, the captain advised not recalling that procedure at the time of the occurrence. The first officer reported having an awareness of the procedure but that it was not consulted in response to the FUEL CONFIG message.
CASA advised that, based on the dispatch criteria and the content of the MEL, the fight crew’s required response to the FUEL CONFIG advisory alert message was to return to the gate and seek maintenance action.
Maintenance action in response to the abnormal fuel system condition
Tasman Cargo Airlines (TCA) held an Australian Air Operators Certificate (AOC) issued by CASA for regular public transport (cargo only) operations. Civil Aviation Safety Regulations (CASR) Part 42 required an AOC holder to be approved by CASA as a continuing airworthiness management organisation (CAMO). The TCA maintenance department held the delegated CAMO responsibility for TCA. Their responsibility included:
ensuring rectification of defects
making only approved repairs
ensuring that each item of operational equipment required by or under the regulations was serviceable and fitted
if the aircraft was to operate with a defect, that operation was permitted by, among other things, the MEL.
The function of carrying out maintenance on an aircraft required an organisation with specific facilities, trained personnel, and approval to conduct that maintenance under CASR Part 145—that is, it required an approved maintenance organisation (AMO). TCA contracted the provision of maintenance for its aircraft to an AMO external to TCA. That AMO was responsible for line maintenance of TCA aircraft at Auckland and Sydney. The occurrence aircraft was dispatched from Auckland by an AMO engineer, and met in Sydney by an AMO engineer.
The aircraft’s technical log was the source document for recording defects and details of all maintenance carried out on the aircraft. The operating flight crew and authorised ground engineering personnel were required to enter defects, while engineering rectification of that defect was to be recorded by engineering personnel prior to the next flight. The operator also had authorisation for limited pilot performed maintenance, however, this was not relevant for this occurrence.
As the abnormal behaviour of the fuel system was not entered into the aircraft’s technical log, the CAMO reported that they first became aware of the fuel system’s abnormal behaviour on the Tuesday following the occurrence during scheduled interrogation of the aircraft’s Central Maintenance Computer (CMC). Prior to the CAMO becoming aware of the issue, the aircraft had completed a further Auckland to Sydney and return service on the Monday.
In response to the information derived from the CMC, the engineering personnel checked the fuel system, in accordance with the B767 Fault Isolation Manual (FIM) requirements. The abnormal fuel transfer could not be replicated during the ground maintenance inspection. The operator also reported that there were no specific maintenance procedures required following an exceedance of the fuel imbalance limitation.
Boeing advised that the possible causes of the abnormal behaviour were faults in one of three valves. These valves were identified in the FIM procedure for unwanted fuel transfer from the centre tank to a main tank. That FIM procedure identified these valves as being a boost pump bypass valve, a boost pump discharge valve, and a float operated shutoff valve.
PPM—maintenance requirements
The PPM stated that the pilot in command was responsible for the correct completion of all paperwork, including entries into the aircraft’s technical log. Post flight, the operating flight crew were required to complete the technical log entries for the flight, including defect reporting where necessary.
The maintenance procedures section also contained requirements on the use of the MEL. This section included the following:
The MEL contains only those items of airworthiness significance, which may be inoperative prior to dispatch, provided specified limitations and appropriate procedures are observed. Items that are not included in the MEL and related to the airworthiness of the aircraft are required to be operative. Equipment that is not required for safe operation is not listed, e.g. cargo system items that have no airworthiness significance.
Weather information
The Auckland METARs[8] for the period 1130 to 1230 identified that the weather at the aerodrome was fine, the mean wind was north‑easterly at 14 kt, visibility was 10 km or greater, the temperature was 17° C and the cloud cover was FEW[9] at 3,100 ft. The METARs were also appended with the trend forecast NOSIG, which identified that no significant changes to the existing conditions were expected for the following three hours.
Related occurrences
A review of the ATSB database did not find any other incidents involving the required use of an MEL post-dispatch/pre take-off. However, the ATSB has previously investigated the following fuel imbalance occurrence that resulted in the aircraft diverting.
On 15 April 2012, a Boeing 737-800 aircraft was being turned around at Gold Coast Airport, Queensland, for a scheduled flight to Melbourne, Victoria. During the turn-around, the fuel system was reconfigured to prevent a fuel imbalance developing because of extended ground operations. That reconfiguration procedure involved the crossfeed valve being selected open. Just prior to departure, procedures required the crossfeed valve to be selected closed. During both operations of the crossfeed valve, the crossfeed valve light indicated normal valve operation.
Following departure from the Gold Coast and during the climb, the flight crew observed that both engines were being supplied fuel from the right fuel tank only. This resulted in a fuel imbalance between the left and right main tanks. In response, the flight crew executed the relevant checklist, which confirmed that no engine fuel leak existed. With centre tank fuel available, the flight crew selected the centre tank fuel pumps on, which resulted in the fuel imbalance stabilising. As the flight crew were unable to confirm that fuel from the left main tank could be used once the centre tank pumps were selected off, or that no fuel leak existed, they elected to divert to Brisbane, Queensland.
Subsequent maintenance action identified the cause of the abnormal fuel system operation was a faulty fuel crossfeed valve. The fault prevented the valve from fully closing, resulting in valve leakage.
While VH-EXZ was taxiing for departure from Auckland, a fault in the fuel system resulted in the development of an imbalance in the fuel load between the left and right main tanks. The fault occurred while fuel system was configured for the aircraft’s engines to be supplied with fuel from the centre tank. The imbalance became sufficient to trigger the FUEL CONFIG Engine Indication and Crew Alerting Systems (EICAS) advisory alert message.
After some deliberation, the flight crew decided to continue with the departure and address the imbalance airborne. Once airborne, the imbalance continued to increase until, with the centre tank fuel exhausted, the flight crew completed the FUEL CONFIG non-normal checklist to rebalance left and right main tanks.
This analysis will examine the:
underlying cause of the increasing fuel imbalance
operational response to the fuel imbalance/FUEL CONFIG alert
requirements of the Minimum Equipment List (MEL) for equipment failures that occur post‑dispatch/pre take-off
maintenance notification requirements.
The fuel system fault
When the centre tank contains fuel, the fuel system’s normal setup is for the centre tank to supply fuel to both engines, with the main (wing) tanks being available to provide fuel should the centre tank fuel pressure fall. This is achieved through the centre tank having higher pump output pressure than the main tank pumps, and all tanks feeding a common manifold through one-way valves (Figure 1). With normal centre tank operation, fuel is not to be pumped from the centre tank into either the left or right main tank.
The effect of the fuel system fault was that fuel was pumped into the right main tank during centre tank operation. The fault did not affect the left main tank, the content of which remained stable. As the right main tank quantity increased while the left remained unchanged, eventually an imbalance resulted that was sufficient to cause the FUEL CONFIG light to activate. This in turn triggered the EICAS FUEL CONFIG advisory alert message.
Maintenance investigation was unable to determine the source of the fault. However, Boeing stated that the likely cause was a fault in one of three fuel system valves.
The departure
During the taxi for departure, the first officer observed the FUEL CONFIG light on the overhead panel briefly flicker. On checking the fuel tank gauges, an imbalance condition was identified, which was marginally around the value necessary to intermittently trigger the FUEL CONFIG advisory alert message.
The first officer rationalised the cause of the imbalance to be extended APU usage and an imbalanced fuel load. While a reasonable assumption, it was incorrect and further examination of available information and discussion between the crew members could have resolved the cause of the imbalance at this stage. Departure procedures and clearance to enter the runway for departure followed, by which time the abnormal fuel system behaviour had increased the imbalance sufficiently to activate the FUEL CONFIG advisory alert message.
The flight crew’s response to the FUEL CONFIG alert
The activation of an EICAS alert message required the flight crew to initiate the associated non-normal checklist. The EICAS prioritised alerts in a manner that indicated the safety impact of the triggering fault or condition. In the hierarchy of alerts, the advisory alert was the lowest priority. It identified a need for crew awareness, and that corrective action may be required.
The checklist actions in response to an EICAS FUEL CONFIG advisory alert message were found in the Quick Reference Handbook (QRH). The FUEL CONFIG checklist identified that a possible cause of an imbalance was a fuel leak, and in its first item it required determination of whether a fuel leak existed through the conduct of a specific procedure. The flight crew performed this check.
The remainder of checklist required adjustment of the fuel panel to bring the fuel tanks back into balance. As the alert was of a low priority, the flight crew conferred and agreed to depart and address the imbalance condition airborne. The low priority of the alert and the impending departure, however, appears to have influenced investigation of the cause of the imbalance and the fault indications that were present.
The Minimum Equipment List procedure
The actions required of the flight crew in response to the FUEL CONFIG advisory alert message before departure were not limited to the conduct of the relevant non-normal checklist. The operator’s Minimum Equipment List (MEL) for VH-EXZ also contained a procedure required to be conducted by the flight crew in the event of equipment failure occurring post-dispatch but before take-off.
That procedure first required completion of the relevant QRH checklist. If that checklist did not require a return for maintenance action, then the MEL item for that equipment failure was to be examined. If the requisite MEL relief required maintenance action, then the aircraft was to be returned for that action. There were also other safety related considerations to be completed that also required return for maintenance.
On this occasion the captain did not recall the MEL procedure relating to the management of defects that occurred between dispatch and take‑off. While the first officer did report an awareness of this procedure, both flight crew were influenced by the QRH being the primary document for response to the alert. After applying the required QRH checklist to the point where the procedure called for changing the aircraft’s fuel system configuration, they decided to take-off.
That action was probably the result of a common belief that the risk was low enough for the flight to proceed. That assessment could be supported by the advisory status of the alert message as well as Boeing’s guidance regarding fuel imbalance and on delaying balancing during critical phases of flight.
However, non-compliance with the MEL procedure meant that a risk control designed to prevent the aircraft departing with faulty equipment was not applied.
Departure decision with fuel imbalance
The aircraft departed Auckland with a fuel system that was operating in an abnormal manner as a result of a fault. This raised the risk that further fault could affect the safety of the flight. The departure was also made without the required MEL consideration.
Flight crew’s actions airborne
The flight crew did not identify the abnormal behaviour of the fuel system until after the aircraft had departed Auckland and was established in the climb. Having identified that fuel was being transferred into the right main tank and was causing an increasing imbalance, the flight crew decided to continue to monitor the fuel system and delay rebalancing the fuel distribution until after the fuel in the centre tank was depleted. This decision was based on:
the rebalancing procedure requiring the centre tank pumps to be switched off, which in turn would result in the FUEL CONFIG advisory alert message
Boeing guidance on fuel imbalance, which indicated that the fuel imbalance alert was a compromise between minimising crew attention to rebalancing and minimising excess fuel usage due to trim considerations
the aircraft’s trim indicating that the aircraft was not affected by the imbalance condition
the low priority of the FUEL CONFIG advisory alert message.
While these considerations indicated minimal risk from delaying rebalancing, the Policy and Procedures Manual required the flight crew to observe the Aircraft Flight Manual fuel imbalance limitation. This limitation was significantly exceeded because of the delay in rebalancing. Further, while the flight crew exhibited a level of concern about the system’s operation, as demonstrated by the captain’s continued check for a fuel leak, they did not determine whether the fuel system fault affected access to all fuel in the tanks. As a result, the flight crew’s actions once airborne presented an increased risk to the aircraft's operation.
Maintenance notification requirements
All faults and abnormal system behaviour were required to be reported in the aircraft’s technical log to ensure corrective maintenance action was completed. The responsibility for this rested with the aircraft’s captain. While the captain verbally notified the maintenance engineers in Sydney and Auckland about the abnormal behaviour, the engineering system’s structure and the absence of the technical log entry resulted in a significant delay in maintenance action to identify and correct the fault.
Further, that delay resulted in the aircraft being dispatched for an Auckland to Sydney and return service without corrective maintenance action being undertaken. While centre tank fuel was not taken on that flight, the delay in maintenance action directly affected the likelihood of the maintenance being able to identify and correct the fault that caused the imbalance to occur.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the fuel imbalance involving the Boeing 767-3JHF at Auckland Airport, New Zealand on 27 July 2019.
Contributing factors
A fault in the fuel system, likely caused by the malfunctioning of one of three fuel system valves, resulted in fuel inadvertently being fed into the right main tank and a gradually increasing fuel imbalance between the left and right main tanks. As the aircraft approached the departure runway, this abnormal fuel system behaviour triggered the FUEL CONFIG caution light, and the associated Engine Indication and Crew Alerting System advisory alert message.
Having considered the likelihood of a fuel leak and the low priority of the alert, the flight crew decided to address the imbalance once airborne. However, they did not consider the Minimum Equipment List procedural requirements to return to the line for maintenance action.
Other factors that increased risk
The flight crew became aware of the abnormal fuel system operation shortly after becoming airborne but delayed completion of the associated non-normal checklist. That resulted in continued increase in the fuel imbalance beyond the allowable limit, unnecessarily elevating the safety risk.
Contrary to the requirements of the operator's policy and procedures manual, the abnormal behaviour of the fuel system was not entered into the aircraft’s technical fault log. This resulted in a delay to maintenance corrective action until after a further two sectors had been flown by the aircraft, and probably impacted identification of the underlying fault.
Safety action
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action by Tasman Cargo Airlines
On 22 March 2021, Tasman Cargo Airlines advised the ATSB that an amendment to the Minimum Equipment List (MEL) had been drafted to include clarification as to crew actions in the event of an Engine Indication and Crew Alerting System (EICAS) message between off blocks and take‑off.
This amendment will be situated in the early part of the MEL Introduction section. Tasman Cargo Airlines will also alert flight crew to the procedural requirement through notification of the MEL amendment.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the flight crew of VH-EXZ
Tasman Cargo Airlines
the Civil Aviation Safety Authority
The Boeing Company
recorded data from the aircraft’s Digital Flight Data Recorder.
References
Bolstad, C. A., and Endsley, M. R. (1999). Shared mental models and shared displays: An empirical evaluation of team performance. Proceedings of the 43rd Annual Meeting of the Human Factors and Ergonomics Society. Santa Monica, CA: Human Factors and Ergonomics Society.
Endsley, M. R., and Jones, W. M. (1997). Situation awareness, information dominance, and information warfare (AL/CF-TR-1997-0156). Wright-Patterson AFB, OH: United States Air Force Armstrong Laboratory.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the flight crew of VH-EXZ
Tasman Cargo Airlines
the Civil Aviation Safety Authority
The Boeing Company
the National Transport Safety Board.
Submissions were received from:
the flight crew of VH-EXZ
Tasman Cargo Airlines
the Civil Aviation Safety Authority.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
