On July 14 2019, a GippsAero, GA8 Airvan registered SE-MES, departed Umeå Airport, Sweden for parachuting operations with a pilot and eight passengers on board. The aircraft subsequently collided with terrain north of the airport, fatally injuring the nine occupants..
Investigation
The Swedish Accident Investigation Authority (SHK), conducted an investigation into this accident. As Australia is the State of Manufacture of the aircraft, the SHK requested an Accredited Representative from the ATSB be appointed.
To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.
Findings
The SHK investigation revealed that the in-flight break up was attributed to the aircraft being flown beyond its design and structural limitations following loss of control by the pilot. Pilot inexperience, aircraft loading, weather and hypoxia were offered as probable causes for the accident.
Recommendations with respect to parachuting operations were made to the Swedish Transport Agency and to EASA for the introduction of formal pilot training and improvements related to mass and balance approval procedures, and awareness and knowledge for those involved.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the SHK investigation of the occurrence.
On 22 June 2019, a Robinson Helicopter Company R22, registered VH-HHQ, departed Kutchera Station, Queensland to perform mustering operations. During mustering, as the pilot was manoeuvring the helicopter, the right tail rotor (or anti-torque) pedal cracked and became stuck. The pilot was unable to dislodge the pedal and prepared for an immediate landing in accordance with the stuck pedal procedure. Just prior to landing, the helicopter struck a tree and became uncontrollable. The aircraft impacted the ground and although the pilot was uninjured, the helicopter was substantially damaged.
What the ATSB found
Following examination of the helicopter by the maintenance organisation, a significant fracture was noted at a weld located on a right angle join between two sections of tube. The right pedal was removed from the helicopter and sent to the ATSB for further examination and testing. The ATSB found that the pedal had fractured as a result of a fatigue failure, which had initiated at the welded joint, and progressed until the remaining section of the tube could no longer sustain the in‑service loads. It was considered likely that a pre-existing crack had initiated at the highest stress part of the component, and had opened up following the load applied during the manoeuvre described by pilot, rendering the pedal unserviceable.
The tail rotor pedal had been recently inspected as part of routine maintenance and while it was considered likely that the developing crack was present, it was not detected at that inspection. However, it was considered that this was due to the inherent difficulties associated with inspections at the location of the cracking.
What has been done as a result
While not required as part of the routine inspections, the maintenance organisation has added the tail rotor pedals to the list of components that undergo magnetic particle inspection at each 2,200‑hour overall.
Safety message
The location of the fatigue crack in this accident highlighted the need to be vigilant when performing inspections in difficult or hard to reach places. In the case of the tail rotor pedal, the inspection was made difficult due to the location, and required a torch and mirror to inspect a matte black surface.
Additionally, the quick thinking actions of the pilot following the failure resulted in a good outcome, with no injuries reported.
The investigation
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.
The occurrence
On 22 June 2019, the pilot of a Robinson Helicopter Company R22 helicopter, registered VH‑HHQ, departed Kutchera Station, Queensland to perform mustering operations. While mustering, the pilot applied a small amount of right tail rotor (or anti-torque) pedal[1] to manoeuvre the helicopter to turn back in the opposite direction. During this time, and as the pilot reported repositioning in the seat, the right pedal cracked, which caused it to bend forward and become stuck. The pilot grabbed the right pedal in an attempt to free it and allow the use of the left pedal, but was unable to do so. The pilot continued the flight to the nearest safe cleared area to land and commenced the jammed pedal procedure.[2]
When about 50 ft above ground level, as the pilot was preparing to perform a running landing,[3] it was reported that a gust of wind hit the helicopter from an angle, causing it to spin. The helicopter then hit a tree and then became uncontrollable before coming to rest on the ground. The pilot shutdown the helicopter and exited. There were no reported injuries, however, the helicopter was substantially damaged.
Following examination of the helicopter by the maintenance organisation, a significant fracture was noted on the right tail rotor pedal assembly at a weld located on a right angle join between two sections of thin walled tube (Figure 1). This join was between the vertical section of tube where the pilot places their foot, and the horizontal tube connecting to the tail rotor controls, and sits slightly below the cabin floor. The pedal was removed from the helicopter and sent to the ATSB’s technical facilities in Canberra for further examination and testing.
Figure 1: Fractured right tail rotor pedal as installed on VH-HHQ
Source: Operator, annotated by the ATSB
Context
Tail rotor pedal examination
The ATSB’s initial examination of the right tail rotor pedal (part number A330-1), which had a matte black surface, found that:
The weld had fractured on the side of the pedal closest to the pilot seat (Figure 2).
While the fracture was not through the entire section of the tube, the pedal assembly was no longer capable of maintaining loads and transferring pilot inputs.
The pedal did not show any evidence of dints, scratches or other signs of mechanical damage.
Wear, in the form of missing paint and a shiny smooth surface, was observed on the pedal surface in contact with the pilot’s foot.
Some evidence of corrosion product was observed within the tubes. Robinson advised that this was the first known occurrence of internal corrosion. As part of the manufacturing process, to ensure the removal of any residual moisture, a small breather hole was left open, and the entire assembly heated to remove any internal moisture, before the breather hole was welded shut. Robinson also advised that the amount of corrosion observed appeared to be more than residual moisture from manufacture. They stated that, as the tubes were completely sealed, there was no inspection to detect internal corrosion.
Figure 2: Right tail rotor pedal as received by the ATSB, showing the location of the fracture
Source: ATSB
Following the initial examination, the pedal was fractured in the ATSB laboratory to separate and expose the two fracture surfaces. The majority of the fracture surface was discoloured and exhibited evidence of pre-existing cracking consistent with a fatigue failure (Figure 3). While the surface features were difficult to distinguish, the discolouration was indicative that the crack had been present for some period of time prior to the failure. While it appeared that the crack had initiated along the edge of the weld, no exact origin could be identified. However, the location of cracking was coincident with the location where the pilot input on the vertical tube was transferred to the horizontal tube, which is connected to the tail rotor push-pull tube assembly. As such, this area was subject to the largest torsional bending stress.
Figure 3: Right tail rotor pedal fracture surface following fracture by the ATSB
Source: ATSB
Following the examination of the fracture surface, it was then sectioned in the region adjacent to the likely origin for further inspection. The general fracture surface profile was consistent with a fatigue fracture. While the internal surface of the tube exhibited some evidence of pitting and general corrosion, there was no evidence that the crack initiated at one of these locations. Additionally, as the tubes were completely sealed, it was more likely that the corrosion product was the result of moisture ingress following the initiation of the fatigue crack.
The microstructure of the weld and tube was consistent with a low alloy steel in the heat-treated condition. A microhardness traverse test was conducted from the fracture surface through the weld heat affected zone into the parent metal and was consistent with the material type in the heat-treated condition. These observations complied with the information provided by the manufacturer.
Maintenance history
The helicopter (serial number 4071) had accumulated 5,828.4 hours total time-in-service at the time of the accident. Inspection of the tail rotor pedals was performed at both the 100-hourly inspection and 2,200-hour overhaul. The most recent 100-hourly inspection was performed 37.2 hours prior to the failure, while the 2,200-hour overhaul was completed in February 2017. At the 100-hourly inspection, the maintenance manual task for the pedals stated:
Inspect condition. Verify no cracks. Verify security and operating clearance.
There was no requirement to remove the bearing block cover plates, an access cover on the floor of the cabin, covering the horizontal portion of the rail rotor pedal. While the location of cracking in this occurrence was slightly under the cabin floor, Robinson advised that the affected weld would normally be visible using a torch and a mirror during the inspection. They also advised that the pedal needed to be moved forward and backward to see both sides. In addition to the 100-hourly inspections, at each 2,200-hour overhaul the pedals were removed for closer inspection.
The manufacturer further advised that, where maintenance was undertaken at a field service centre, as was the case for VH-HHQ, the pedals were subject to visual inspection only. However, if the overhaul was performed at the Robinson factory (not available in Australia), the pedals would be examined using a magnetic particle inspection (MPI).[4] This technique would be more likely to identify surface defects, as the paint would be removed prior to the testing, and the contrasting nature of the test medium would mean that cracks would be highly visible.
Similar failures
Robinson advised that they were aware of previous in-service fractures near the weld, however, the cause was either attributed to a modification to the assembly which involved some type of pedal extension (one case) or impact/mechanical damage. A search of the Civil Aviation Safety Authority’s defect report service and ATSB occurrence databases for the previous 10 years did not identify any other similar failures.
Safety analysis
While manoeuvring during mustering operations, the right tail rotor pedal failed and became stuck. The pilot elected to land immediately, but during this, the helicopter struck a tree. The helicopter became uncontrollable and impacted the ground, resulting in substantial damage.
The tail rotor pedal failed as a result of a fatigue failure at a right angle welded joint between two sections of thin walled tube. While the ATSB’s examination identified that the fatigue failure had initiated adjacent to the weld line, the exact origin could not be determined. This location of the cracking was also coincident with the point of maximum torsional bending stress in normal operation. The microstructure and hardness of the tube and weld were consistent with the requirements as specified by the manufacturer.
The pedal had undergone a visual examination at the most recent 100-hourly inspection. While it was likely the crack was present at this inspection, the nature and location of the crack would have made it inherently difficult to detect. The developing fatigue crack would have initially presented as a hairline feature, and it was located on a matte black surface, at a change in section slightly below the level of the cabin floor.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the tail rotor pedal failure and collision with terrain involving Robinson R22 helicopter, VH HHQ near Kutchera Station, Queensland, on 22 June 2019.
Contributing factors
While conducting mustering operations, the right tail rotor pedal failed due to fatigue cracking. During the subsequent emergency landing, the helicopter struck a tree and became uncontrollable, before coming to rest on the ground.
Due to undetermined reasons, a fatigue crack had initiated adjacent to a weld at a high stress location on the pedal. It was likely that the crack had been present at the most recent maintenance inspection, but the location of the weld may have made it difficult to detect in-situ.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future. The ATSB has so far been advised of the following proactive safety action in response to this occurrence.
Increased maintenance inspections
As a result of this accident, the maintenance provider has advised that, although not required by the maintenance manual, the tail rotor pedal assembly will now be included with other components that are sent for magnetic particle inspection at every 2,200-hourly overhaul.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
the pilot
Robinson Helicopter Company
the helicopter owner and maintainer.
References
United States Federal Aviation Administration (2019), Helicopter Flying Handbook, FAA-H-8083-21B.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the pilot
the helicopter owner
the helicopter maintainer
Robinson Helicopter Company
National Transportation Safety Board
Civil Aviation Safety Authority.
Any submissions from those parties were reviewed and, where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 9 July 2019, a Fokker F100 aircraft, registered VH-FWI, was being operated by Virgin Australia Regional Airlines (VARA) as regular public transport flight VA1788 from Geraldton to Perth, Western Australia.
During climb at about 13,000 ft, the left engine flamed out. Due to a pre-existing fault with the autothrottle system the pilot was required to manually select climb thrust on the remaining (right) engine. The crew elected to maintain the incidental speed (250 knots). Due to a desire not to ‘strain’ the right engine the pilot flying also elected not to increase thrust from climb to maximum continuous, and/or reduce the aircraft’s speed towards the recommended single engine climb speed (155–170 knots). Consequently, the crew adopted a cruise level about 6,500 ft below the maximum engine out altitude.
The crew maintained their cleared track to Perth and conducted an approach and landing via the runway 21 instrument landing system, using single engine procedures. The aircraft was accompanied from the touchdown point to the domestic terminal by airport emergency vehicles.
What the ATSB found
The ATSB found that at about 11,500 ft during initial climb the left engine fuel flow regulator (FFR) malfunctioned, resulting in over-regulation of fuel. The left engine autothrottle system attempted to reduce the thrust. Due to a pre-existing and admissible fault within the right engine autothrottle system and the action of an associated ‘clutch-tie’ mechanism, the right engine thrust lever retarded progressively reducing fuel flow demand to the right engine. At about 13,000 ft, as the right engine thrust approached flight idle, the left engine FFR ceased regulating fuel, which caused the immediate flameout of the left engine. Failure of the FFR was found to have resulted from wear related to the component’s service life.
The ATSB also identified that the failure of the FFR resulted in engine 1 thrust variation for about 45 seconds prior to the engine flame out. That went undetected by the crew due to the effects of automation, focused attention on other cockpit tasks and the absence of any alert prior to the engine failure.
The decision to continue to Perth following the engine failure resulted in a longer exposure to one engine inoperative flight risks, compared to a return to the nearest suitable airport (Geraldton).
Finally, by electing not to increase thrust on the right engine or adopt the aircraft’s recommended single engine climb speed, the pilot flying reduced the available climb performance of the aircraft, resulting in a lower cruise altitude than the maximum available. This, coupled with the decision to continue to Perth on the original indirect track, increased the duration of flight and the time that the aircraft was outside the glide range of emergency airports and controlled airspace, in the unlikely event that the situation degraded further.
What has been done as a result
Following this incident and a review of the global failure rate specific to the FFR unit utilised by the VARA F100 fleet, the engine manufacturer, Rolls-Royce, amended the applicable component management plan to revise the recommended FFR maximum overhaul interval (full-life) down from 16,000 to 10,000 hours.
Additionally, the operator provided several internal safety communiqués to all flight crew reiterating the importance of effective failure management and inflight decision making.
Safety message
This incident highlights that the initial indications of component failure/malfunction may be subtle. Automation can obscure significant changes in aircraft system status, including engine health.
The occurrence also illustrates the numerous factors to be considered when managing the initial and subsequent aspects of power loss in a complex aircraft.
The occurrence
Precursor events
On the early afternoon of 9 July 2019, a Fokker F28 Mark 0100 (F100) aircraft, registered VH‑FWI, was being operated by Virgin Australia Regional Airlines (VARA) as regular public transport flight VA1788 from Geraldton to Perth, Western Australia (WA). A captain, first officer, two cabin crew and 24 passengers were on board. The crew were based in Perth (see the section titled General details).
Prior to departing on the previous sector (Perth to Geraldton) the operating crew transferred from another aircraft to VH-FWI. Pre-flight preparations, including a review of the aircraft’s maintenance documentation, highlighted the right engine (engine 2) autothrottle system (ATS)[1] was unserviceable. To facilitate dispatch, the minimum equipment list (MEL)[2] maintenance procedures had been applied. This included disabling the associated ATS switch, the application of a ‘caution’ placard for the crew’s awareness beside the ATS control button on the flight mode panel, and activation of a mechanical clutch-tie[3] between the two thrust levers (see section titled Thrust control).
For the return flight to Perth (incident sector), the crew’s fourth and final leg of their flight duty for that day, the captain was pilot flying (PF), and the first officer was pilot monitoring (PM).[4]
Take-off and initial climb
In accordance with standard procedure for this sector, primarily to avoid active military airspace, the crew had planned the cruise phase at flight level (FL)[5] 330, via waypoint IRWIN then airway Z41 to waypoint HINDS (Figure 1).
After a short time at the terminal in Geraldton, the aircraft taxied for departure and at about 1246 hours Western Standard Time,[6] VA1788 commenced take-off for Perth. The PF elected to climb using the autopilot level change (LVLCH) and the autothrottle climb (CLB) modes (see the section titled Thrust control). During the departure the crew noted a ‘slight deterioration’ in the actual weather compared to the forecast, with a scattered cloud[7] base at the minimum sector altitude (MSA)[8] of 2,300 ft.
At about 1250 the aircraft was identified by the Melbourne centre controller who provided a revised clearance to Perth via waypoint CALIG. The amended route was slightly shorter yet still remained clear of military restricted areas immediately west of the aircraft’s revised track (see the section titled Airspace information and considerations).
Figure 1: Actual verses direct route to destination (Perth) following the engine failure
Source: Google Earth (including ATSB annotations)
Right engine rollback and left engine failure
At 1251:10 the left engine (engine 1) thrust started gradually increasing beyond what was commanded by the flight augmentation computer and the ATS, which was not noticed by the flight crew (see the section titled Recorded engine data and appendices A and B). The PF reported that, at about this time, while still climbing and just prior to entering the transition layer,[] both thrust levers began to move abnormally without crew input. Due to minor ‘play’ characteristic of the clutch-tie mechanism the PF observed a minor split between the two thrust levers during this movement.[10] The PF reported that throughout this time, there was no indication of engine vibrations and that the engine 2 indications displayed on the multi-function display unit (MFDU)[11] all remained ‘in the green’ (normal). However, during interview the PF could not recall what any of the actual engine indications were (Figure 2).
Figure 2: Fokker F100 VH-FWI – MFDU and standby engine indications to flight crew.
Source: Jetphotos.net – Paul Hill (with ATSB annotations)
The PF also reported at about this time the aircraft’s nose started to drop slightly, accompanied by a ‘very minor yaw’ to the right. The PM reported being preoccupied with support duties and not detecting either the abnormal thrust lever movement or the engine status.
About 45 seconds after the initial engine 1 thrust increase, and sometime after the PF detected the abnormal thrust lever movement, the engine 1 fuel flow regulator (FFR) ceased to effectively meter fuel (see the section titled Thrust control). This caused the engine 1 rotation to decay and thrust to reduce. As designed, the combined action of the flight augmentation computer and the ATS compensated by increasing engine 2 thrust. This was accompanied by the return of both thrust levers towards about the maximum continuous thrust (MCT)[12] position. About 30 seconds later, due to lack of fuel, engine 1 flamed out.[13] The crew received a ‘triple chime’ and a master warning alert,[14] immediately followed by an ENG 1 FAIL message on the MFDU.
Due to the pre-existing engine 2 autothrottle system unserviceability, the engine failure resulted in immediate reversion to manual thrust control. Consequently, the PF manually realigned the thrust levers towards the ‘upright’ (normal climb) position on the thrust lever quadrant. The PF elected to maintain the incidental two-engine cruise climb speed of 250 knots, which was above the recommended single‑engine climb speed or ‘green dot’ speed (see the section titled Single engine procedures).
At the time of engine failure, VA1788 was about 41 km south‑east of Geraldton (the nearest suitable airport).[15] The PF verbalised ‘flying the aircraft’ which was the initial step of the operator’s ‘failure management model’ (see the section titled Decision making‑VARA failure management model). The PF then re-confirmed the active autopilot modes via the flight mode annunciators displayed on the primary flight display (PFD).[16]
At about this time the crew perceived the aircraft was ‘struggling to climb’. Consequently, the PF elected to arrest the climb at FL 150. The crew then discussed and agreed on an ‘immediate plan’, including continuing on their cleared track towards Perth.
The PM reported that in accordance with the operator’s procedures, failure of the left engine was identified based on the ENG 1 FAIL alert on the MFDU and illumination of the engine 1 fuel control lever. The PF then confirmed the PM diagnosis by crosschecking key engine parameters with the corresponding standby engine instrument (SEI)[17]
The PF then instructed the PM to initiate the next step in the operator’s failure management model (‘take action’) by initiating the ENG 1 FAIL non-normal checklist (single-engine procedure) displayed on the MFDU. The procedure included attempting an engine 1 restart. Initially the PF thought the engine had restarted, however after discussion with the PM it was agreed the relight had been unsuccessful. As there were several indications of continued engine rotation, the crew assessed the engine was not mechanically damaged and therefore, in accordance with the QRH, did not activate the engine 1 fire suppression system.
Continuation to Perth
By 1254 the crew had secured engine 1. The PM reported the flight management system (FMS) calculated engine-out maximum (ENG OUT MAX) altitude displayed at the time was FL 205 (see the section titled Single engine procedures). At about the same time the crew discussed and agreed to not ‘strain the good engine’. This resulted in a collective decision to descend back to FL 140, 6,500 ft below the recommended ENG OUT MAX altitude.
At 1255:10, approximately 3 minutes after the engine failure and following completion of the MFDU checklist, the PM made a PAN-PAN call[18] to air traffic control (ATC) and advising of the aircraft’s revised altitude. The Melbourne centre controller acknowledged the call.
Following the required adjustment of the traffic collision avoidance system (TCAS) functionality (see the section titled Traffic collision avoidance system), the crew discussed the availability and the aircraft’s glide capability with reference to the various airfields (Jurien Bay, RAAF Pearce and Gingin) to the west of their planned route, should the remaining engine fail (Figure 1 and Figure 3, see the section titled Airport information).
Figure 3: Plan view – Restricted areas R155 and R156 north of Perth
Source: CASA - Airspace Review within 50 NM of Perth Airport, March 2017, page 25 (ATSB annotations)
The crew reported that en route, the cloud was scattered above and below their selected cruise level (FL 140). The PM reported being ‘comfortable’ with the PF’s assessment of glide performance, because the emergency aerodromes discussed were all visible from the aircraft.
At 1303, about 11 minutes after the engine failure, the crew communicated to ATC further details of the situation and their decision to continue to Perth. On receipt of this information, ATC offered a more direct track to Perth through RAAF Pearce airspace. The crew discussed and then declined the track shortening. They later explained that their reasoning was based primarily on workload reduction; specifically, having more time to complete the company’s required procedural steps before conducting a single‑engine approach into Perth.
At this point, the captain transferred aircraft control (PF duties) to the first officer. The captain then briefed the two cabin crew members and made a short announcement to the passengers. The flight crew then completed their outstanding non-normal management items, including reconfirming their initial decision to maintain their cleared track and continue to Perth. The PF reported that the crew were prepared for an approach by about 130 km north‑west of Perth.
From CALIG, the aircraft tracked via a standard terminal arrival route. The crew conducted an approach via the runway 21 instrument landing system (ILS), using single‑engine procedures. Due to the disabled autothrottle system the crew used the autopilot during the descent to about 500 ft. The crew reported that during their approach to Perth the cloud base in the vicinity of the airport was about 3,000 ft, slightly more favourable than during their departure from Geraldton. The aircraft landed at about 1335:10 and was accompanied by airport emergency vehicles from the touchdown point to the domestic terminal.
Post incident maintenance action
Once the passengers deplaned the operator’s maintenance engineering team attempted to restart engine 1. An engine re-light occurred, however the engine would not accelerate beyond ground idle. Troubleshooting resulted in removal of the engine 1 FFR unit ‑ also known as a combined acceleration and speed control (CASC).
The unit was subsequently examined by Rolls-Royce, who found that the internal gear within the drive end assembly was significantly worn (see the section titled Fuel flow regulator and Figure 5). The FFR was replaced, however this unit was also found to be faulty. Another FFR was then fitted and the aircraft was successfully returned to service.
Virgin Australia Regional Airlines (VARA) is based in Perth, Western Australia (WA) and operated under an air operator’s certificate issued by the Civil Aviation Safety Authority (CASA). The airline operates high-capacity regular public transport and charter flights throughout WA and to a number of major cities including Adelaide, Darwin, Melbourne and Alice Springs. VARA operate a fleet of six Airbus A320 and 14 Fokker F100 aircraft.
Flight crew information
The captain held an air transport pilot (aeroplane) licence (ATPL-A), a multi-engine command instrument rating and a class 1 aviation medical certificate. The captain had about 8,100 hours flying experience, of which over 2,300 hours were accrued on the F100, and had been operating as an F50/F100 pilot, based in Perth, for over 11 years.
The first officer (FO) held an ATPL-A, a multi-engine command instrument rating and a class 1 aviation medical certificate. The FO had about 5,700 hours flying experience, of which about 730 hours were accrued on the F100. The FO had completed the F100 type qualification facilitated by the operator in September 2017.
Both flight crew signed on for duty at Perth airport at 0530, and then operated a flight from Perth to Kalgoorlie, and return to Perth. They then transferred to VH-FWI and operated the third sector of their duty day from Perth to Geraldton. Their return flight to Perth (incident sector) was their fourth and final sector for the day.
Both flight crew reported that they had achieved a reasonable amount and quality of sleep the night before and did not feel tired or fatigued at the time of the occurrence. The captain conducted two flights the previous day and had completed office‑based work in the four days prior to that. The FO had been on standby duty the day prior and had operated two flights the day prior to that. The FO did not report any problems with sleep prior to those duties.
Aircraft and engine information
General
Production of the F100 ceased in early 1997. The Australian F100 fleet is the largest in the world comprising about 66 aircraft operated by four high capacity or charter operators. The majority of the national fleet service the fly-in fly-out mining and resource industry.
Powerplant
The F100 is powered by two Rolls-Royce RB 183 Tay Mark 650-15 (Tay 650) engines mounted on the aft fuselage. Each engine is an axial flow, two shaft medium by-pass turbo-fan design rated at 15,100 pounds of thrust (Figure 4).
Figure 4: Rolls-Royce Tay 650-15 cutaway drawing
Source: Rolls-Royce
Thrust control
F100 thrust is controlled by thrust levers mounted in the cockpit centre aisle stand, which (through cables) move fuel control mechanisms via an engine-specific FFR unit mounted within each engine nacelle. The management of forward thrust can be augmented by the autothrottle system (ATS), which automatically moves the thrust levers, based on commands from one of two channels within the automatic flight control and augmentation system (AFCAS).[19] Each ATS channel drives the corresponding thrust lever. The ATS can be used as long as one channel is operative. During normal operations in the autopilot level change (LVLCH) mode, the AFCAS, via the ATS, controls the fuel flow rate to maintain climb (CLB) engine pressure ratio (EPR).[20]> There are two motor-and-clutch systems installed in the aisle stand below the thrust levers. A selectable clutch-tie joins the two and if one ATS channel fails the clutch tie will permit the remaining channel to drive both levers.
Existing thrust control defects
Multiple VARA flight crew had reported various autothrottle faults on VH-FWI in the days leading up to the incident (Table 1). The MEL allowed for the unserviceability of one autothrottle channel as a category C (Cat C)[21] maintenance item, which allowed continued operation for 10 calendar days before repair or replacement was required.
Table 1: Relevant maintenance history of VH-FWI Autothrottle System (5-9 July 2019)
Date
Maintenance Log Entry
Maintenance Action
5 Jul 2019
Autothrottle System (ATS) 2 – Fault in Cruise, disarmed via MFDU procedure
Pilot reported on arrival Adelaide. MEL 22-10-03 applied, Category (Cat) C system expired 15 Jul 19.
5 Jul 2019
ATS 2 – Fault in Cruise, disarmed via MFDU procedure
Pilot reported on arrival Perth. AFCAS interrogated. ATS switch fault. MEL 22-10-03 removed.
8 Jul 2019
ATS 2 – Fault in Cruise, disarmed via MFDU procedure. Reset not successful.
Pilot reported on arrival Broome. MEL 22-10-03 reapplied, Cat C system expired 18 Jul 19.
8 Jul 2019
ATS 2 - Fault in Cruise, disarmed via MFDU procedure. Reset not successful.
Pilot reported on arrival Perth. MEL 22-10-03 reapplied, Cat C system expired 18 Jul 19.
9 Jul 2019
Aircraft released for Perth-Geraldton return with ATS 2 unserviceable and MEL 22-10-03 applied.
Source: ATSB in consultation with VARA Engineering and airworthiness department
Manual thrust reversion
Modern aircraft are designed to be capable of safe operations, despite malfunctions, through designed redundancy. The ongoing single channel autothrottle unserviceability would normally have permitted continued automatic thrust control, however, when combined with an engine failure on the opposite engine, the aircraft systems reverted to manual thrust control. The captain reported that during his last cyclic assessment in the simulator he had been required to demonstrate an ILS approach using manual thrust.
Single engine procedures
The Fokker F100 aircraft operating manual (AOM)[22] provided the following guidance regarding the conduct of single‑engine operations:
After confirming the engine out condition, the PROG [FMS CDU[23] ‘progress page’] may be used to identify the MAX ENG OUT altitude. Maximum altitude [engine out] is that altitude maintained with one engine operating at maximum continuous thrust and the other wind milling.
The MAX ENG OUT altitude enables the highest terrain clearance possible and the maximum glide capability in the event of a second engine failure. Immediately following the engine failure, using the aircraft’s weight and environmental conditions, the FMC calculated the MAX ENG OUT altitude to be FL 205 (20,500 ft).
The manual also noted:
For all single engine accelerations, climbs and drift down descents, operation is accomplished at maximum continuous thrust and VFTO speeds [green dot].
The calculated maximum flight level is restricted by a 1.2G (1.2 x gravity) buffet margin (from stall) and the capability of climbing with a 300 ft per minute rate of climb. The maximum flight level is therefore slightly higher than the ENG OUT MAX altitude as displayed on the FMC progress (PROG) page. The AOM defined green dot speed as the final take-off climb speed (VFTO). It is displayed as a green ‘O’ at the PFD speed scale. Green dot speed is used for various computations and limits, including drift-down and maximum angle climb.
Given the aircraft weight, altitude and environmental conditions at the time, the green dot speed (VFTO) was in the range of 155–170 knots.
Glide performance
One of the design improvements over the original Fokker F.28 Mark 100, in creating the more efficient F100, was a more aerodynamic wing. This resulted in an increase to the aircraft specific lift/drag ratio to 16.8:1[24] that, in nil wind, translates to a glide distance of about 16.8 NM (31 km) for every 1 NM (1.85 km), or 6,076 ft of altitude.
The FMC-calculated, single-engine optimum altitude of FL 205, equated to a glide distance (nil wind) of about 57 NM (106 km). However, at the altitude the crew adopted (FL 140), the glide distance (nil wind) reduced to about 39 NM (72 km).
Figure 1 illustrates the glide ranges from FL 140 and FL 205 respectively. At the time of the engine failure, the forecast wind at FL 140 was south‑westerly at 15–20 knots. This would have reduced the glide range if/when the aircraft was turned west towards any of the available alternate airports.
Recorded data
Analysis of flight data recorder (FDR) information showed that early in the climb phase the engine 1 FFR began to malfunction. Initially this led to over-regulation of fuel to engine 1, resulting in increased EPR. To maintain constant EPR, ATS 1 retarded the engine 1 thrust lever. As a consequence of the clutch tied thrust levers, the engine 2 thrust lever also rolled back from MCT towards flight idle.[25]
Coincident to engine 2 thrust approaching flight idle, the engine 1 FFR ceased delivering adequate fuel to engine 1, leading to a reduction in thrust and eventual flameout (engine failure). As designed, during the initial drop in engine 1 thrust, engine 2 resumed delivering the thrust commanded by the crew via the AFCAS (see Appendix A and B). Due to the pre-existing fault with ATS 2, when the aircraft systems detected failure of engine 1 control of engine 2 thrust reverted to manual control. FDR data indicated that the time from when the engine 1 FFR began to significantly over-regulate fuel, to the engine failure was approximately 45 seconds.
Following arrival in Perth, the aircraft remained powered to facilitate maintenance action including an engine ground run. Consequently, the cockpit voice recorder data was overwritten and not available for this investigation.[26]
Fuel flow regulator
A fuel flow regulator (FFR) is a device that controls the flow rate of fuel supplied to the injectors within the combustion chamber of an engine. In effect, an FFR is used to regulate the thrust produced by a gas turbine engine. The FFR (Part No: CASC509, S/N L1660) had been overhauled in March 2011 by Goodrich Control Systems, including the renewal of all seals, testing and recalibration. On 20 August 2013 it was fitted to engine S/N 17268 with 2,349.9 total hours/1,406 cycles. At that time, this engine was fitted to another VARA aircraft, VH‑FSQ.
On 18 June 2019 engine S/N 17268 (incident engine) was removed from VH-FSQ and fitted to VH-FWI. At the time of the engine failure (9 July 2019), key aspects regarding the FFR service history (time/cycles) included the following time since:
installation on incident aircraft (VH-FWI) - 77.4 hours/47 cycles.
Following the engine failure, the FFR (S/N L1660) was removed and sent to an approved overhaul facility (Rolls‑Royce) for detailed examination. Their report found that the internal planetary and sun gears within the FFR had worn, which would have contributed to the loss of drive, leading to the in-flight shutdown event (Figure 5).
Figure 5: Internal damage to drive, planetary and transfer gear within the FFR
Source: Rolls-Royce
The CASA‑approved system of maintenance[27] for the Tay 650-15 engine and its accessories at the time of the occurrence was derived from the Rolls-Royce engine management plan (EMP). The EMP allowed two options to establish FFR service life (time since overhaul, TSO). The first option required management in accordance with the FFR component management program (CMP)[28] that permitted a maximum service life of 16,000 hours (full life). The alternative option required a mid-life overhaul between 8,000–12,000 hours (mid-life). At the time of the incident VARA was operating under the first option. In addition, the CMP permitted the FFR to be maintained independently of the engine.
Between about August 2010 and August 2015, Rolls-Royce identified a number of in‑flight engine shutdowns and operational disruptions due to failure of internal components of the CASC509 FFR. Therefore, on 21 August 2015 Rolls-Royce issued a Notice to Operators which stated that the failures were due to the FFR being operated beyond the recommended in-service life.[29] The notice recommended that operators manage Tay engine accessories in accordance with intervals published in the Tay 650 generic EMP.
Appendix D highlights the reported CASC509 FFD failures within the Australian F100 fleet between 2011–2019, noting that the most recent three failures (including the subject occurrence) had accrued over 12,000 hours in service.[30]
Route knowledge
Regular public transport pilots often operate the same routes between familiar airports. Civil Aviation Regulation 218 – Route qualifications of pilot in command of a regular public transport flight requires they develop and maintain knowledge and understanding regarding important route characteristics including:
surrounding terrain (lowest safe altitudes)
adjacent airport information (runway orientation, lighting, local conditions)
nearby airspace information (location of non-controlled and controlled areas)
seasonal weather phenomena unique to the route
typical traffic (other aircraft operations) along the route and at each airport.
Additionally, the operator’s Flight Operations Policy and Procedures Manual indicated that:
Flight crew must maintain an appropriate knowledge of airports located on or next to air routes that may be used in an emergency…
Route knowledge assists decision making in both normal and non-normal situations, particularly during the management of events such as engine malfunctions or failures.
Airport information
Geraldton Airport
Geraldton Airport is located about 11 km east of Geraldton. It is a non-controlled, common traffic advisory (CTAF)[31] airport and a base for a number of charter and general aviation operators. The facility has a number of runways, though the F100 could only use runway 03/21, with a length of 2,400 m (7,874 ft) and width of 45 m. VARA designated Geraldton as an approved (main) airport [32] (regular destination). However, Geraldton was not equipped with aviation rescue and firefighting (ARFF) services (see appendix E).
Perth Airport
Perth Airport is a major international facility, a main airport and the home base for VARA, which provided maintenance capabilities. The facility is serviced by two runways and three separate instrument landing systems (ILS). All runways could be used by the F100. Flying operations are supported by continuous (24 hour) category 9 ARFF services.
Perth primary radar has range of 50 NM (93 km). The secondary surveillance radar has range of about 250 NM (463 km). The Australian automatic dependent surveillance – broadcast system (ADS-B)[33] provides radar-like coverage above 5,000 ft throughout most of Western Australia.
Emergency airports
The operator‑approved emergency airports between Geraldton and Perth were RAAF Bases Pearce and Gingin (Figure 1 and Figure 3). This permitted them to be utilised when an ‘immediate risk’ to the aircraft and occupants exists. That is, for time-critical emergencies only, such as an aircraft fire and/or a dual engine failure. RAAF base Pearce is serviced by two runways that are F100 capable.[34] By day, RAAF Pearce was equipped with category 5 ARFF services and Gingin was equipped with category 4 ARFF services.
Jurien Bay Airport
Jurien Bay Airport is located about 100 NM (185 km) south of Geraldton Airport. The airport is primarily used for sky-diving and general aviation (recreational) flying. The main runway (02/20) is 1,300 m long and 18 m wide. The secondary runway is significantly shorter. The main runway did not satisfy the operator’s guidance to crew regarding the ‘physical characteristics’ of emergency airports (runway length > 1,500 m and runway width > 30m).
Airspace information and considerations
In accordance with Annex 11 to the Convention on International Civil Aviation, Australian airspace is classified as either class A, C, D, E or G (Figure 6). The classification determines the category of flights permitted and the level of air traffic services provided.
Class G airspace is not controlled and the primary defences against aircraft collisions are radio‑alerted procedural separation for instrument flight rules (IFR)[35] flights and/or see-and-avoid procedures for visual flight rules (VFR)[36] aircraft.
In class E airspace, IFR are separated from other IFR flights and ‘receive traffic information on VFR flights as far as is practicable’. As with class G airspace, VFR flights separate using the ‘see and avoid’ principle. While class E provides additional defences for IFR aircraft over class G, it does not provide the same level of protection as classes A, C or D.
By direct track, the airspace within about 110 NM (204 km) of Geraldton is class G, from the surface to FL 180. Between FL 180 and FL 245 the airspace is class E. Airspace in this region above FL 245 is class A. From about 110 NM to 135 NM from Geraldton class E airspace is established from 8,500 ft to FL 180.
Analysis of the flight path (indirect track combined with adopted single engine cruise at FL 140 showed that, following the engine failure, the aircraft remained outside controlled airspace (class G) for about 95 NM (176 km). At the aircraft’s adopted speed (250 knots), this distance equated to about 23 minutes flight time outside of controlled airspace. The aircraft then entered class E airspace at about 35 NM north-west of CALIG and class C airspace (Perth terminal area) about 6 NM prior to CALIG at FL 140. This equated to about 8 minutes flight time in class E airspace. That is, about 30 minutes in airspace in which risk was increased marginally, versus class A or C airspace. By way of comparison, the flight planned track combined with either; the original cruise FL 330 altitude or the single engine optimum altitude (FL 205) would have resulted in the aircraft being outside controlled airspace for a total of about 8 minutes while departing Geraldton and climbing to that altitude.
Figure 6: Cross section - airspace between Geraldton and Perth (Surface to FL600)
Source: ATSB (derived from Australian aeronautical information package en route low and high charts for WA)
Traffic collision and avoidance system
High‑capacity transport aircraft such as the F100 are required to be equipped with an advanced traffic alert and collision avoidance system (TCAS).[37] TCAS is designed to prevent mid‑air collisions between aircraft. TCAS operates independently of ATC by using an on-board surveillance capability[38] to detect other transponder equipped traffic and provides:
Traffic display including proximate traffic[39] and traffic advisories (TA)[40] for situational awareness of relatively close aircraft.
Resolution advisories (RA)[41] for very close aircraft with vertical guidance to resolve the threat.
Both TA and RA alerts are generated according to the projected closest point of approach (CPA) or miss distance and the time to co-altitude (TAU). In general, the thresholds (time and distance) for CPA and TAU increase as altitude increases.[42]
In the event of an engine failure, flight crew are procedurally required to degrade the functionality of the TCAS to prevent generation of a climb RA that cannot be achieved due to the associated reduction in aircraft’s climb ability due to the OEI condition.
Regulatory information
Conditions for flight continuation
Civil Aviation Order (CAO) 20.6 Continuation of flight with 1 or more engines inoperative defined important conditions on the pilot-in-command (PIC) of all Australian registered multi-engine aircraft, where an engine has failed, or its rotation has stopped. This included the requirement to notify ATC immediately[43], giving all relevant information and stating intended action in regard to conduct of the flight. It also identified relevant factors that the PIC ‘must’ practically consider prior to a decision to continue beyond the nearest suitable airport, including:
the nature of the malfunction and the possible mechanical difficulties which maybe encountered if flight is continued
the nature and extent of any city, town or populous area over which the aircraft is likely to fly
availability of the inoperative engine to be used
weather conditions en route and at possible landing airports
air traffic congestion
the type of terrain (overflight), including whether the flight is likely to be over water
the distance to be flown coupled with the performance availability should another (remaining) engine fail
relative characteristics of the aerodromes available for landing
aircraft altitude, weight and useable fuel at the time of the failure or shutdown
familiarity of the pilot with the aerodrome to be used.
Multi-engine flight review requirements
Part 61 of the Civil Aviation Safety Regulations requires high‑capacity aeroplane pilots to complete annual proficiency checks and, if the aircraft is multi‑engine, the pilot must also hold a multi-engine aeroplane instrument endorsement. Further, such pilots are usually required to complete an instrument proficiency check (IPC)[44] in either an aircraft or simulator of the same category, within the preceding 90 days. The IPC also includes a check of medical certification, licence documentation and a knowledge assessment.
The associated Part 61 Manual of Standards described the standards for a multi-engine aeroplane type rating renewal, including the following categories:
conduct flight
aircraft systems
navigation
airspace
instrument flying
manage non-normal and emergency conditions
non-technical skills, and
management of passengers and cargo.
The category of ‘manage non-normal and emergency conditions’ specified four aspects that must be assessed:
simulated engine failure in the take-off segment
partial engine failure
simulated complete engine failure and execute a simulated asymmetric approach and landing
other aircraft system malfunctions.
The operator’s flight crew cyclic simulator program for the preceding 24 months (six cyclic exercises) focussed on these aspects and each cyclic session included management of an engine failure in the take-off segment (below 1,500 ft), initial climb, climb and cruise (see appendix F).
Threat and error management
According to Endsley (1996), achieving and maintaining situational awareness is one of the most challenging aspects for flight crew. Civil aviation advisory publication (CAAP) 5.23-1(2): Multi-engine aeroplane operations and training outlined the considerations for flight crew following an en route engine or system failure, which included:
maintaining situational awareness
understanding aeroplane specific systems
applying correct drills and procedures
declaring the appropriate level of emergency
positively managing the subsequent flight profile
utilising contingency plans determined prior to flight.
The CAAP also summarised the manner in which threat and error management should be applied within the operational context, including:
anticipation of potential threats and errors associated with each flight, that is contingency planning which necessitates planning and execution countermeasures
comprehensive briefing of planned procedures prior to departure, including anticipated threats
continuous monitoring and verification of visual and instrument indications to maintain awareness of energy state
Decision making
General
Aeronautical decision making is defined by the Federal Aviation Administration (FAA)[45] as:
A systematic approach to the mental process used by aircraft pilots to consistently determine the best course of action in response to a given set of circumstances.
Flying a high-technology aircraft requires both skilled psychomotor performance and real-time decision making – reliant on situational awareness, educated choice among alternatives and an accurate assessment of risk within a limited time-frame.[46]
The operator’s periodic (cyclic) training and assessment program consisted of a rolling four-month testing period. That is, each flight crew member would be assessed within a flight simulator three times per year. Different elements of decision making were examined in each of the cyclic simulator sessions.
Supporting procedures
To assist crew in the decision-making process, the operator utilised a standard mnemonic:
S – State the problem
A – Analyse the options
F – Fix the problem
E – Evaluate the result.
Further, as part of the ongoing ‘evaluation phase’ crew were expected to assess the following items:
Is the current situation still the most appropriate?
How can we improve the current solution?
What other options are now available?
Risk mitigation
Risk management feeds into decision making in two ways: during the assessment of the precipitating (perceived) threats and in accurately evaluating potential courses of action. In general, if there is limited time, the pilot will tend to implement the course of action that experience dictates is most likely to be successful.
In the February 2018 issue of FAA Safety Briefing[47], the concept of ‘risk mitigation’ (mitigate) was proposed versus ‘administrate’. That is, the FAA now hold that the task of ‘administrate’ after an event should focus on the mitigation of residual risk through the optimisation of the planned (original) path, or the ‘recovery path’ following a non-normal event. An initial urgency call, notifying the controller and other aircraft in the immediate vicinity regarding the nature of a non-normal situation would very likely assist the crew in mitigating subsequent risk.
VARA failure management model
To support sound decision making the operator’s procedures included a generic failure (non‑normal) management framework. This was used by the crew to provide structure to the way they responded to emergency situations and to facilitate safe continuation of flight. The stages of the operator’s failure management model were, in priority sequence:
Fly the aircraft
Confirm the failure - PM should call the failure and PF confirms
Immediate plan – to ensure flight path (PF should state intentions, PM should inform ATS)
Take Action – carry out appropriate recall and checklist items
Circuit breakers – check the status of relevant CBs in accordance with procedures
Normal checklists
Long Term Plan – gather information, choose best alternative, periodically re-evaluate.
The procedures also reiterated the requirements of CAO 20.6 including (not limited to):
Following an in-flight engine shutdown, it is a requirement to notify the nearest Air Traffic Services unit immediately, giving all relevant information, stating the action the Pilot-in-Command intends taking in regard to the conduct of the flight.
VARA flight crew training
Evidence based training (EBT) aims to identify, develop and evaluate the competencies required to operate safely, effectively and efficiently in a commercial air transport environment while addressing the most relevant threats according to evidence collected in accidents, incidents, flight operations and training.[48] EBT takes the concepts of these programs further by structuring recurrent assessment and training according to evidence-based priorities based on a comprehensive analysis of safety and training data from a wide variety of sources.[49]
The International Air Transport Association (IATA) document; Evidence based training implementation guide, a tripartite document comprised between the IATA, ICAO and the international federation of airline pilots’ associations (IFALPA) recommends that an engine failure during the climb should be assessed every three years.
The PM had completed a co-pilot F100 type qualification, facilitated by the operator (VARA), in September 2017. The type qualification included a simulator session that specifically assessed the crew’s actions following an engine flameout. The session also included the procedures for an attempted relight progressing to the remaining engine also failing (dual engine flameout). As part of the training, the instructor also facilitated a discussion regarding F100 glide performance (range) and forced landing considerations, specifically those associated with ditching.
The operator’s EBT framework had not included specific assessment of engine malfunctions or failures during the climb phase of flight for the preceding six assessment cycles[50] or 24 months. However, both the PF and PM had been exposed to a multitude of non-normal scenarios as part of the EBT based periodic training and assessment program during the preceding few years. All assessments had included an examination of their ability to manage the aircraft following an engine failure after take-off.
The number 1 engine failed (flameout) due to failure of the associated fuel flow regulator (FFR) and resultant lack of fuel supply to the engine. This analysis will explore the circumstances of the component failure.
Additionally, while the flight crew’s management of the occurrence resulted in a safe landing, aspects of their response to the engine failure will also be considered, including the:
decision to not return to the nearest suitable airport (Geraldton), instead continue to Perth
execution of the recovery (diversion)
benefits of flight crew training.
Engine failure
About five minutes after take-off, the engine 1 FFR seized due to internal gearing wear that was associated with the unit’s high time since overhaul (14,334.1 hours). This resulted in failure of the FFR to regulate fuel to engine 1, which then consequently flamed out.
As a result of previous, similar occurrences, Rolls-Royce was aware, and had advised operators of the potential for wear related FFR failure due to extended service life. Despite this, the subject FFR failed while being maintained within the service life limits of the Rolls-Royce engine management programme. Since this occurrence, Rolls-Royce have introduced a 10,000-hour midlife inspection and rework requirement for the FFR maintenance option selected by VARA (see the section titled Safety action). This requirement, which includes replacement of the sun and planet gear assemblies, would likely have prevented the subject failure and should reduce the future frequency of this failure type.
Presentation of the failure
In complex multiengine aircraft, one engine can rollback unnoticed by the flight crew, due to the autopilot and autothrottle masking the thrust asymmetry created. In this case, the PF noticed unusual thrust lever movement (due, in part, to the clutch tie), but did not associate that movement with the uncommanded increase in engine 1 thrust (due malfunctioning FFR). Further, although the PF noticed the movement of thrust lever 2, the progressively significant reduction in thrust (rollback) of engine 2 was not detected.
It is likely that the deteriorating health of engine 1 went undetected by the crew due to the effect of the automation/clutch tie and the absence of any cockpit alert. Additionally, at the time, the PF reported being focussed on the unusual (slightly decoupled) and uncommanded movement of the thrust levers due to the action of the clutch-tie mechanism. The PM was preoccupied with various support duties including cabin crew coordination, communicating with air traffic control and the completion of transition procedures.
Single engine operation
The operator’s F100 aircraft operations manual, provided clear guidance on the management of an engine failure throughout the varying phases of flight. These procedures were designed to maximise the aircraft’s single‑engine climb performance in order to ensure terrain clearance, allow flight in controlled (higher) airspace, avoid low level weather, and to optimise glide range should the remaining engine fail. In a limited fuel situation, these procedures also served to maximise single‑engine range and/or endurance.
For this event, at the point of engine flameout, fuel remaining, and terrain clearance were not limiting factors. However, by not slowing the aircraft towards the best angle of climb (green dot) speed, and by not increasing engine 2 thrust from CLB towards MCT the aircraft’s single‑engine climb performance was degraded, resulting in the crew’s decision to descend to FL 140. The crew recalled this collective decision was due to concern with ‘straining the good engine’ associated with any attempt to increase altitude, being ‘well above the lower safe altitude, with clear skies’ and ATC coverage. That is, they couldn’t see any advantage to going higher.
That the aircraft was only capable of manual thrust control was significant for the crew, as the autothrottle system provides automatic speed and gust protection, inputs to the angle of attack (alpha)[1] mode protection, and windshear protection. If required, a missed approach, regardless of landing point (Perth or Geraldton), would need to be carefully executed manually to prevent exceeding any engine limitations. Both flight crew reported that they had practiced a manual thrust approach in the operator’s preceding cyclic (simulator) assessment session, and this assisted their conduct during the single‑engine recovery into Perth.
Post incident - course of action
Decision to continue to Perth
Regardless of experience, flight crew require time to initially identify a non‑normal condition (engine failure) and consider their ‘immediate plan’. Once the aircraft was in the vicinity of waypoint IRWIN (Figure 1), the crew had a number of options:
return to the point of departure and the nearest suitable airport (Geraldton)
maintain their incidental altitude (FL 140) and original track continuing to avoid active military airspace, or
optimise their recovery path to Perth.
The decision to continue, divert or return can be complex and requires crew to have a comprehensive understanding of the characteristics of the route, including the suitability of proximate airports, the forecast and actual weather, airspace factors and their respective aircraft’s systems.
The operator’s procedures in the event of an engine failure or shutdown required the crew to land as soon as practicable[52] Notionally, the concept of ‘land as soon as practicable’ versus land as soon as possible[53] is predicated on the crew considering the existence and/or risk of further complications such as a fuel leak, fuel contamination and/or engine fire.
With respect to the relevant factors outlined in CAO 20.6 for continuation of the flight to Perth, the crew reported considering the following:
although above alternate minima, a deteriorating cloud base on return to Geraldton may have necessitated a non-precision approach, at least for the initial segment
anticipation of increased workload at Geraldton due to local traffic (two aircraft)
the aircraft’s thrust control system had reverted to manual thrust only
Perth runway 21 was ILS capable and significantly longer than the runway 21 in Geraldton
Perth airport was supported by category 9 ARFF services.
These factors supported their course of action to continue to Perth. However, the ATSB considered that the following factors supported returning to Geraldton Airport following the engine power loss, consistent with the operator’s procedural requirement to ‘land as soon as practicable’:
it was the nearest suitable airport
as a regularly used VARA port, the crew were thoroughly familiar with it
the weather at the time would probably have permitted an approach in visual flight conditions.
While continuation to Perth was a permitted option, it also resulted in longer exposure to one engine inoperative flight risks, compared to a return to the nearby Geraldton Airport.
Additionally, the route selected, combined with the decision to adopt a cruise altitude 6,500 ft below the recommended (FMS generated ENG OUT MAX) single engine altitude, resulted in the aircraft remaining outside of:
controlled airspace, or in class E airspace until about 167 km (90 NM) north of Perth
glide range to Perth Airport or an emergency airport for about 222km (120 NM) track miles, or about 30 minutes flight time.
In accordance with the operator’s single engine procedures, the crew also degraded the functionality of the TCAS to prevent the production of unachievable climb advisories (RA) when operating on one engine. This reduced the mechanisms by which the crew could avoid conflicting traffic.
Recovery execution
Technically, the continuation to the planned destination (Perth) was also a ‘recovery’, as the aircraft was operating under a non-normal (single‑engine) condition. The PF reported that the crew’s key priorities for the recovery included maintaining a safe aircraft configuration, availing the crew planning time and managing the increased workload associated with single‑engine and manual thrust operations.
Although the recovery track to Perth remained unaltered, the adopted cruise level (FL 140), below the recommended single engine altitude, limited the aircraft’s potential glide distance by about a third. Continuing the climb closer to, or at the green dot speed with increased engine 2 thrust would have availed the crew more time and glide distance in the exceptionally unlikely[54] event that remaining engine also failed.
The crew recalled being confident that in the event of the failure of their remaining (right) engine they could have recovered to either RAAF Pearce or Gingin, ATSB analysis found that this would not have been possible for a further 30 minutes after the initial engine failure. Prior to this point, the crew discussed the option of Jurien Bay Airport. While Jurien Bay did not meet the operator’s requirements as an emergency airport for flight continuation decision making, once the decision to continue to Perth had been made, it would have provided a viable option in preference to an off‑field landing in the event of a second engine failure. However, by maintaining their diverging (as cleared) track away from the coastline and around military airspace, the aircraft actually tracked away from Jurien Bay and Gingin (Figure 1) for a period.
Following the application of the operator’s failure management procedures, the crew were required to reassess (evaluate) their understanding of the evolved risk profile of continued flight via the SAFE model. The crew probably assessed that the likelihood of a second engine failure was remote but may not have fully contemplated the operational risks associated with continued single-engine flight at the lower altitude. Consequently, opportunities were missed to further mitigate operational risk via repositioning the aircraft into controlled airspace, more expeditious (direct) tracking to Perth and the optimisation of their glide range. The crew reported their overriding concern was workload management. Naturally, due to the abnormal situation, workload was increased. However, a direct track to Perth Airport or the runway 21 ILS initial approach fix could have further reduced their workload (given visual conditions).
In any event, a prompt landing is a key precaution against the risk associated with failure of the second engine, or further issues arising from the original engine failure, including effects on other aircraft systems. Should it occur, the resulting consequence (a forced landing on an unprepared area or a short runway) could be significant. Therefore, when faced with a one engine inoperative situation, consideration should be given to minimising the remaining flight time through track shortening and maximising the glide range of the aircraft. In this case the recovery path selected did not mitigate risk to as low as reasonably practical (ALARP).[55]
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the engine failure involving the F100 registered VH-FWI and continuation of the flight from about 41 km south of Geraldton. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
About 5 minutes after take-off, while climbing away from Geraldton, the engine 1 fuel flow regulator failed, resulting in fuel starvation to the engine and the total loss of thrust (flameout).
The fuel flow regulator seized due to internal gearing wear, despite being maintained within the recommended service life limits of the Rolls-Royce Tay 650-15 engine management programme.
Other factors that increased risk
Following the failure of engine 1 the crew did not adjust the aircraft speed or thrust, electing to maintain the aircraft’s incidental (cruise climb) speed of 250 knots. This degraded the single‑engine climb performance resulting in increasing the time that the aircraft was outside controlled airspace and the glide range of an emergency airport.
The decision to continue to Perth following the engine failure resulted in a longer exposure to one engine inoperative flight risks, compared to a return to the nearest suitable airport (Geraldton).
Other findings
Thrust variation from engine 1 (over about 45 seconds) due to the failing fuel flow regulator went undetected by the crew due to the effects of automation/clutch tie, focused attention on other cockpit tasks and the absence of any alert prior to the engine failure.
Flight crew competency regarding execution of a manual thrust approach had recently been assessed as part of the operator’s F100 cyclic training and assessment program and was found to have assisted during the approach to land.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the flight crew
Air Accidents Investigation Branch, United Kingdom
Airservices Australia
Australian Bureau of Meteorology
Civil Aviation Safety Authority (CASA)
Fokker Services
Rolls-Royce (United Kingdom)
Virgin Australia Regional Airlines (VARA)
References
Airservices Australia - Safety Bulletin – what happens when I declare an emergency? 18 July 2016.
Civil Aviation Safety Authority (CASA), Airspace review within 50 NM of Perth Airport, May 2017.
Civil Aviation Advisory Publication (CAAP) 215-1(3.2) Guide to the preparation of Operations Manuals, March 2020.
Dos Santos Marques, G, Engine condition monitoring as a route to savings, November 2010.
Endsley, M (1996), Automation and situational awareness in R. Parasuraman and M. Mouloua (Eds.) Automation and human performance: Theory and applications (pp 163-181) Mahwah, N.J., Lawrence Erlbaum.
Eurocontrol Publication: Guidelines for controller training in the handling of unusual/emergency situations, 2nd Edition, 31 July 2003.
Federal Aviation Administration (FAA) Safety Briefing- Back to Basics, 29 Jan 2018.
International Air Transport Association; Evidence-based training implementation guide, 1st Edition, July 2013 (triparted guidance document: IATA, ICAO and IFALPA).
Innes-Jones, G, & Scandpower L.R, Complacency as a causal factor in accidents – fact or fallacy? 2012.
International Civil Aviation Organisation (ICAO) Doc: 9137-AN/898 Airport Services Manual, Part 1 – Rescue and Firefighting, 4th Edition, 2015.
Orasanu, Judith & Martin, Lynne. (2008). HESSD ’98 100 Errors in Aviation Decision Making: A Factor in Accidents and Incidents.
Ross, S Prof, Introduction to Probability and Statistics for Engineers and Scientists, 5th Edition, 14 Aug 2014.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the flight crew (captain and first officer)
the operator’s (VARA):
- head of flying operations
- head of airworthiness
- head of safety
an accredited representative of the Aviation Accident Investigation Board (AAIB)
Rolls-Royce
CASA
The ATSB received submissions from CASA, Rolls-Royce, the operator (VARA) and the aircraft captain. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A - Fuel flow regulator malfunction and engine failure
Failure sequence:
A detailed review of the recorded data (see also Appendix B) identified that:
The application of the minimum equipment list (MEL) provisions regarding channel 2 of the autothrottle (ATS) had the following effects:
- the engine 2 thrust lever was mechanically clutch-tied to the engine 1 thrust lever. Therefore, ATS 1 via the engine 1 thrust lever was driving both engine thrust levers. That is, the ATS had no ability to command engine 2 thrust directly.
- The automatic engine pressure ratio (EPR)[57] synchronisation capability was unavailable to the crew. Instead the PF was required to synchronise the thrust of the engines manually via manipulation of the associated levers. This explains the minor EPR split from take-off through to about 1248:40 (see parameters at 0448:40 above).
As the PF was using LVLCH mode in climb (CLB), ATS 2 was commanding climb EPR.
From about 1248:40 to 1250:00 the EPR appears to have been synchronised by the PF. However, from that point EPR synchronisation ceased. As designed, the engine 2 fuel flow continued to gradually reduce as altitude increased. This is normal as engine performance increases with altitude due to decreasing total air temperature.
Engine 1 thrust increase - At about 1251:10 (about 5 minutes after take-off) the engine 1 FFR unit began to malfunction and was unable to provide the required reduction in fuel flow as altitude increased. This resulted in a higher engine 1 engine pressure ratio (EPR) and associated increasing EPR split between the two engines from about 1251:10 onwards.
Engine 2 thrust decrease - Due to the action of the autothrottle system (channel 1) and the clutch-tie mechanism, the engine 2 thrust lever followed the engine 1 thrust lever resulting in gradually reducing engine 2 EPR (thrust). .
Consequentially, the tie clutched engine 2 thrust lever was dragged back with the engine 1 thrust lever. This presented to the pilot flying (PF) as a gradual roll-back of both thrust levers. The EPR on the MFDU during this time indicated a marginal increase in engine 1 EPR and a reducing engine 2 EPR.
At 1251:17 engine 2 fuel flow decreased at a higher rate due to increasing thrust from engine 1. At this point the EPR split was 0.03 (engine 1 EPR of 1.62, engine 2 EPR of 1.59). The engine 1 fuel flow continued to increase to produce a maximum EPR of 1.69.
At about this point, the PF reported observing abnormal thrust lever movement. The PF recalled thrust lever engine 1 retarding while engine 2 thrust lever followed, albeit more slowly. The ATSB was unable to clarify the degree of thrust lever movement throughout the failure sequence as the FDR data did not include parameters associated with thrust lever position.
This discrepancy between the thrust lever positions (both rolling back together), and the indicated thrust (asymmetric), with absence of any aircraft warning system alerts, is likely to have contributed to the late identification of the failure by the crew during transition (high workload period).
Engine 2 rollback - At 1252:03, engine 1 parameters reached their maximum values. As designed, the AFCAS continued to reduce engine 2 fuel flow towards flight idle, producing the engine 2 rollback.
Engine 1 FFR failure - As engine 2 parameters reach their minimum values the engine 1 FFR ceased to effectively meter fuel.
At 1252:04 engine 1 fuel flow decreased sharply. The split between each engine EPR was 0.45 (engine 1 EPR of 1.69, engine 2 EPR of 1.24). As designed, the AFCAS detected the decay in engine 1 rotation (refer to N1 and N2) and commanded a rapid increase in engine 2 thrust to restore the total commanded thrust.
At 1252:07 engine 2 fuel flow started rising sharply, followed by the engine 2 EPR. Other associated engine 2 parameters increased rapidly. This corresponded to the PF observation that the thrust levers returned to the ‘wedges’.[58] At this point ATS1 was still engaged and the thrust lever movement was due to ATS1 inputs.
Engine failure and manual thrust reversion - At 1252:29 engine 1 flamed out and the ENG1 FAIL, and master warning alerts were generated by the aircraft’s warning system. Immediately following this, as designed, the engine 1 ATS disconnected resulting in reversion to manual thrust control.
Appendix B - Recorded flight data: Flight overview
Appendix C - Probability of dual engine failure specific to the Australian F100 fleet
If p is the probability of an engine failing or requiring an inflight shutdown per hour flown, then the following is approximately true:
2p is the probability of a failure or inflight shutdown of one engine on a twin‑engine aircraft
2p2 is the probability that both engines have an engine failure or inflight shutdown on a twin‑engine aircraft
Importantly, this assumes that the failures were not related to each other (mutually exclusive) and that the probability of a second engine failing is not changed after the first engine fails. That is, that thrust is not increased above MCT, which would further ‘strain’ the engine. There are similar relationships for more engines.
For the period 2008 to 2012, the Australian specific F100 fleet reported 11 engine related occurrences, of which 5 occurred during take-off and 4 during the climb phase.
This data highlights a combined engine failure and inflight shutdown (IFSD)[59] rate of about 3.63 per 10,000 hours[60] (3.63 x 10-4).
Therefore, for the period, 2p ≈ 3.63/10,000 and p ≈ 1.82/10,000.
This equates to a probability of both engines failing of 2p2≈ 2 x (1.82/10,000)2≈ 6.6/100,000,000 hours (6.6 x 10-8). Which suggests it is exceptionally unlikely[61] that both engines fail or have inflight shutdowns (assuming there is no common cause).
Appendix D - Historical data related to FFR CASC509 (Australian F100 fleet)
Date
Defect Number (DR)
Operator
Aircraft Registration:
FFR (CASC509) Serial No:
Effect (Failure Summary)
FFR hours at time of failure
6 Feb 20
Rolls-Royce ‘Service Letter’ revising maximum time between overhaul down from 16,000 10,000 hrs.
Appendix E - Australian Aviation Rescue Fire Fighting (ARFF) Categories
The principal objective of an ARFF service is to save lives in the event of an aircraft accident or incident occurring at or in the immediate vicinity of an airport. The ARFF service is provided to create and maintain survivable conditions, to facilitate egress routes for occupants and initiate rescue of those occupants unable to make their own escape without direct aid.
Source: ICAO Annex 14, Table 9-1 and 9-2 and ICAO Airport Service Manual, Part 1.
Notes:
Category 4 ARFF: a specialised albeit relatively limited emergency response capability specific to aviation operations.
Category 9 ARFF: refers to significant capability including large amounts of stored water, foam discharge rate/capability and dry chemical availability. In Australia, Category 9 ARFF is available at Adelaide, Brisbane and Perth airports. (Source: Part 139H CASA Manual of Standards Chapter 2).
Appendix F - Summary of engine malfunctions – VARA cyclic program (Jul 16 - Aug 20)
Cyclic No.
Assessment Period
Simulated environment
Engine failure after take-off (EFATO)
Engine failure IFSD and/or single engine operations (SEO) by phase of flight
Note: The PM (First Officer) completed engine failure training during the climb phase as part of an initial aircraft type (F100) qualification (Training simulator session #8) in late September 2017
Incident date: 9 July 2019 (41 km south of Geraldton, WA)
14
Sep-Dec 2019
Coondewanna TMA & Coondewanna-Broome
V1 cut
15
Jan-Apr 2020
Melbourne TMA & Melbourne-Adelaide
After take-off
16
May-Aug 2020
Adelaide TMA & Adelaide to Mildura
Wet runway V1 cut at 50 ft. AGL
Source: VARA flight operations training – F100 flight crew training cyclic simulator instructor guides
Notes:
This summary does not include all cyclic matrix (assessment) items. Each simulator session is time limited. Engine failure after take-off (EFATO) is assessed for every cyclic assessment. V1 refers to the decision speed to continue with the take-of that is, if an engine fails at or after V1 you are trained to continue with the take-off. V1 cut refers to a simulated engine failure in very close proximity to the aircraft achieving the V1 speed during the take-off roll (manoeuvre).
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 4 July 2019, while conducting a demonstration flight of an Alauda Airspeeder prototype unmanned aircraft system at Goodwood Aerodrome, United Kingdom (UK), the remote pilot lost control of the aircraft. In response, the pilot activated the safety ‘kill switch’ intended to immediately terminate the flight, but it had no effect.
The unmanned aircraft then climbed, to approximately 8,000 ft and entered controlled airspace at a holding point for flights arriving at Gatwick Airport, before its battery depleted and it fell to the ground. It collided with terrain in a field of crops approximately 40 m from occupied houses, outside of its designated operating area. There were no injuries.
Investigation
The UK Air Accident Investigation Branch (AAIB) investigated this occurrence. As Australia was the State of Manufacture of the aircraft, the AAIB requested appointment of an Accredited Representative from the ATSB.
To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act2003.
Conclusion
The AAIB found that the Alauda Airspeeder Mk II was not designed, built or tested to any recognisable standards and that its design and build quality were poor. In addition, the operator’s operating safety case, which formed the basis for gaining an exemption from the UK Civil Aviation Authority, contained several statements that were shown to be incorrect.
The Civil Aviation Authority’s Unmanned Aircraft Systems unit had assessed the operator’s application and, after clarification and amendment of some aspects, issued an exemption to the Air Navigation Order to allow flights in accordance with the operators Operational Safety Case. The Civil Aviation Authority did not meet the operator or inspect the Alauda Airspeeder Mk II before the accident flight.
There have been many other similar events where control of an unmanned aircraft has been lost, resulting in either it falling to the ground or flying away. The AAIB also identified that, even a small unmanned aircraft falling from a few metres could cause a fatal injury if it struck a person.
The AAIB investigation report made several Safety Recommendations and the final investigation report can be found at www.aaib.gov.uk.
Any further information regarding this investigation should be directed to the AAIB via: enquiries@aaib.gov.uk
_____________
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the AAIB investigation of the occurrence.
Occurrence summary
Investigation number
AE-2019-032
Occurrence date
04/07/2019
Location
near Goodwood Aerodrome, West Sussex, United Kingdom
State
International
Report release date
24/02/2021
Report status
Final
Investigation level
Short
Investigation type
External Investigation
Investigation phase
Final report: Dissemination
Investigation status
Completed
Mode of transport
Aviation
Aviation occurrence category
Loss of control
Occurrence class
Accident
Highest injury level
None
Aircraft details
Model
Alauda Airspeeder prototype unmanned aircraft system (UAS)
On 6 July 2019, the pilot of a Robinson Helicopter Company R44 helicopter, registered VH-KCH, was conducting a private flight from a property near Mansfield, Victoria, with one passenger on board. Shortly after take-off, the helicopter struck a powerline and subsequently collided with terrain resulting in serious injuries to the passenger and minor injuries to the pilot.
What the ATSB found
The pilot obtained some information from the landowner about powerlines on the property from where the helicopter took off, and a neighbouring property. However, he did not identify the presence of powerlines during the flight planning process and he did not see the wires or the associated poles during the shallow departure. The wires were strung across a valley with a span of 560 m, which the helicopter struck 158 ft above the ground. The wire did not have aircraft warning markers and did not require marking in accordance with Australian Standard 3891.
The ATSB also identified that, unlike other states of Australia, electricity network information was not readily available in Victoria to aid pilots during the flight planning process.
Safety message
The ability of pilots to detect powerlines depends on physical characteristics such as the spacing of power poles, the orientation of the wire, and the effect of weather conditions. Depending on the environmental conditions, powerlines may not be contrasted against the surrounding environment. In addition, the size of the wire and limitations of the eye can mean that it is actually impossible to see the wire.
watch for power poles and fly directly over them when crossing powerlines
constantly scan the terrain on either side of your flight path for poles/towers
always maintain at least 500 feet above ground level except during take-off and landing.
The Aerial Application Association of Australia Powerline Safety Program aims to encourage and facilitate power companies to improve aviation safety. The program involves the provision of mapping information of powerline networks and the marking of powerlines by network operators wherever it is requested by a pilot, aviation company or landholder.
In summary, effective wire avoidance can be achieved using a combination of:
available wire location information
wire marking
avoidance of unnecessary low flying, especially flight below the height of surrounding higher terrain where wire spans may be present.
The occurrence
What happened
At 1259 Eastern Standard Time[1] on 6 July 2019, a Robinson R44 Raven 1 helicopter departed Moorabbin Airport, Victoria, for a private flight to a rural property near Mansfield, Victoria. The 128 km flight was conducted under the visual flight rules[2] with the pilot and one passenger on board.
At about 1400, the helicopter landed at the property in a westerly direction.
After spending about 1 hour at the property, the pilot and passenger boarded the helicopter for the planned return flight to Moorabbin. The pilot assessed there was a light breeze and elected to depart in a north-westerly direction, over different ground to that overflown during the arrival.
Shortly after 1505, the helicopter lifted off and climbed gradually. The pilot reported that he focused on clearing two trees on the departure path, and that he did not notice a powerline pole on the nearby hilltop (Figure 1). The helicopter accelerated to an airspeed of at least 50 kt and travelled about 400 m from the take-off site.
Figure 1: Helicopter shortly after take-off (hilltop pole visible from that location)
Source: Provided to the ATSB
At 1506, the helicopter struck a two-wire powerline, 158 ft above ground level (Figure 2). The pilot reported that he did not see the wires, but felt a jolt and observed that the windscreen had cracked. He did not identify that the helicopter had struck a powerline, and focused on controlling the helicopter to a run-on landing. The helicopter descended rapidly, travelling about 400 m after the wirestrike, in which time the pilot felt another jolt. The aircraft collided with the ground in an upright position before it spun around and rolled over. The pilot sustained minor injuries and the passenger was seriously injured. The helicopter was substantially damaged (Figure 3).
Figure 2: Overview of the accident location
Source: Victoria Police, annotated by ATSB
Figure 3: Accident site showing wire tangled in the wreckage
Source: Victoria Police, annotated by ATSB
A witness standing under the powerline heard and saw the helicopter take‑off. He reported that the powerline was ‘very hard to see’ and that he saw a flash (arcing) when it was struck by the helicopter.
Pre-flight planning
The pilot contacted the property owner prior to the flight and was advised that the property had solar power and no powerlines. The property owner did not know the contacted powerline ran across the valley and he could not see the wires from his property.
The pilot had visited the property and the neighbouring one many times by car and knew of powerlines and poles at the neighbouring property, which were about 26 ft (8 m) high. However, he was not aware of the distribution powerline that the helicopter struck and stated that he had not expected to encounter powerlines more than 150 ft above the ground.
Powerline
The single phase, two wire (conductor) 22 kV powerline was strung across the spur line. It traversed a valley from a pole on the top of a hill to a pole located near the main road. The span ran perpendicular to a line of poles leading to a neighbour’s house. The span length was 559 m between poles and the maximum clearance above the valley was 48.1 m (158 ft).
Following the wirestrike, the helicopter pulled the two wires off the pole, which then parted and fell to the ground. Some of the wire remained attached to the helicopter (Figure 3) with the rest of the span on the ground and resting in trees.
Mapping
Energy companies in New South Wales and Queensland provide general aviation pilots (including those conducting authorised low-level operations) with access to network maps of high voltage electricity transmission lines and lower voltage distribution lines. The information is provided with a caveat that it may not be current and accurate.
Similar access to network maps is not provided by Victorian energy companies although the Victorian Department of Environment, Land, Water and Planning has a Spatial Datamart, which includes high-voltage transmission network information. The data does not contain information on the lower voltage distribution network. Additionally, use of the data for flight planning purposes requires extraction of the powerline information from a large dataset and processing to present it in a readily usable format such a map overlay.
conducting a pre-flight briefing and reconnaissance
applying appropriate flying techniques
reading the physical structure indicators, e.g. poles and insulators
knowing the location of powerlines on and around the property or the area you are flying in.
Marking
Wire markings enhance the visibility of wires. The requirements for marking powerlines and their supporting structures were published in Australian Standard AS 3891 Part 1, Permanent marking of overhead cables and their supporting structures for other than planned low-level flying and Part 2, Low levelaviation operations.
The powerline associated with this accident was not considered to be in an area involved in planned low-flying operations as described in AS 3891.2, although it was reported that aerial agricultural operations had previously occurred in the vicinity of the powerline. Additionally, the helicopter landing site was not an authorised landing area as defined in Part 1, nor did the cable height exceed 90 m or span exceed 1.5 km. The powerline therefore did not require marking in accordance with either Australian Standard.
The ATSB publication Avoidable Accidents No. 2 - Wirestrikes involving known wires: A manageable aerial agriculture hazard states that ‘even in cases where the criteria of AS 3891.1 do not apply, there may be an obligation on the owner of the wire to mark the wire. This could be the case if there is a high level of risk in the particular circumstances associated with the visibility of the wire. If you consider that a wire creates an unacceptable level of risk you should tell the owner of the wire (and the property owner if they are not the same person).’
After this accident, local landowners advised the ATSB that the powerline was erected in the 1970s, and that an aircraft conducting aerial agriculture had struck it in the 1980s. They reported that following that past incident, orange plastic marker balls had been fitted to the wires, however, they had perished over time and not been replaced.
No other wirestrikes involving this powerline were known to have occurred, and the energy transmission company had no record of any wirestrikes.
Weather
Footage of the take-off showed a sunny day with clear sky with some scattered high-level clouds, no wind and visibility greater than 10 km.
The United States Federal Aviation Administration (FAA) Safety Study of Wire Strike Devices Installed on Civil and Military Helicopters found from 1970-1979 and 1986-1996 clear skies and unlimited visibility conditions during most reported wire strikes and from 1994-2004, 86 per cent of the fatal wirestrike accidents occurred in day visual meteorological conditions.[3]
Pilot experience
The pilot had 73.8 hours total aeronautical experience and attained his Private Pilot (Helicopter) Licence in April 2019. The pilot had completed 5.2 hours in an R44 helicopter in the 90 days prior to the accident flight.
The FAA study referenced above found that most of the helicopter wirestrikes occurred with experienced pilots. The study found that in the United States, between 1994 and 2004, there were 124 wirestrike accidents involving civil helicopters, of which 41 were fatal. About 60 per cent were general aviation operations, while agricultural operations accounted for about 27 per cent of the accidents. The average rotorcraft flying experience of the pilots was about 4,000 hours.
Previous occurrences
Between July 2003 and June 2011, a total of 166 aircraft wirestrikes were reported to the ATSB. Electricity distribution and transmission companies identified an additional 101 wirestrikes that occurred during the same period that were not reported to the ATSB. Further information is in ATSB report from 2011, Under reporting of aviation wirestrikes.
According to ATSB publication Wire-strike Accidents in General Aviation: Data Analysis 1994 to 2004, 15 per cent of wirestrike accidents occurred in aircraft conducting private operations. Of those accidents, 61 per cent occurred in the vicinity of the landing area. These included take-off, approach, landing and conducting an aerial inspection of the landing area.
Safety analysis
As part of his pre-flight planning, the pilot sought and obtained some information about hazards, including powerlines, from the property owner. However, the owner was not aware of the distribution powerline strung across the valley. Additionally, and unlike other states, readily usable electricity network maps were not available to assist the pilot’s planning. Such maps provide valuable safety information to aid pilots in planning flights, and assist the visual identification of hazards, such as wires and poles. From past visits to the property by road, he knew of some low powerlines at a neighbouring property however that knowledge did not assist identification of the airborne wire hazard.
The pilot elected to depart in the same direction as the helicopter landed. Therefore, he had not overflown the powerline when arriving, depriving him of an opportunity to visually identify it. Additionally, he did not conduct aerial reconnaissance of the take-off and departure track that might have helped identify the powerline’s poles and wires. Consequently, when the pilot departed from the property he was unaware of the presence of the distribution powerline across his intended flight path.
Powerlines at significant heights above the ground can be expected in valleys as they are often strung across them to use the terrain to reduce the number of poles and the need to clear vegetation below the wires. However, the pilot reported that he did not expect any powerline at a height of more than 150 ft above the ground. The pole on the hill was visible from the take-off site, but the pilot did not see it. Nor did he see (or expect) the powerline wires, which are inherently difficult to sight and had no markers to increase their visibility. Consequently, as the pilot conducted a shallow departure climb down the valley the helicopter struck the powerline about 400 m from the take‑off site.
The circumstances of this accident highlight that the most effective means of preventing wirestrike can be achieved using a combination of:
available wire location information
wire marking
avoidance of unnecessary low flying, especially flight below the height of surrounding higher terrain where wire spans may be present.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The helicopter’s track down the valley and a shallow climb gradient resulted in controlled flight into the unseen powerline that was not fitted with visual markers.
The pilot’s pre-flight planning had not identified the powerline that was unknown to the property owner of the take-off site, and detail of the powerline network was not available to the pilot.
Acknowledgements
The ATSB acknowledges the assistance provided by Victoria Police during this investigation.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 22 June 2019, the airboat Gale Force was operating on a wetlands tour. The tour involved sections of at-speed driving through Sweets Lagoon, 55 km to the south-west of Darwin, Northern Territory. The tour was along a well-defined, at times shallow, muddy and vegetation-covered watercourse through open swampland. While negotiating a turn, control of the airboat was lost, resulting in collision with a tree. The airboat driver and the four passengers on board were injured. The airboat was damaged and disabled, requiring removal ashore for repair. The passengers and the airboat driver received first aid and were evacuated to Darwin for further treatment. The airboat driver and two of the four passengers were taken to Darwin hospital for treatment and were discharged later that day. The remaining two passengers only required first aid.
What the ATSB found
While negotiating a turn to starboard, the airboat was slightly off-track with insufficient reserve engine power to drive the boat safely through the turn. The stern likely rode up and skipped over the mud and plant surface, control was lost, leading to the airboat spinning and impacting the tree stern-first on the starboard side. The ATSB also identified that operational limitations, such as safe speed, which would have reduced the likelihood of the collision and reduced the injury consequences, had not been fully identified and implemented.
What's been done as a result
Outback Floatplane Adventures have updated safety management system procedures and requirements to better reflect the company’s focus away from ‘adrenaline-based’, toward ‘nature-based’ tours. Specific airboat training, guidance and competency requirements have been implemented along with updated emergency procedures. Prior to taking command, airboat skippers are to be competent in operating the designated airboat in specific tour areas.
Safety message
All business operations should be carefully and regularly assessed for risk. Such assessments should include specific, targeted appraisal of vessel operations as well as the suitability of passengers to undertake tours. In addition to responding to an emergency situation, particular attention should be paid to identifying and implementing safety controls to reduce the likelihood and consequence of an incident.
The occurrence
What happened
At about 0630 Central Standard Time[1] on 22 June 2019, eight guests arrived at the Outback Floatplane Adventures (OFA) office at Darwin Airport, Northern Territory. They had all booked on the OFA ‘half day ultimate adventure tour’ and had been transported to the OFA office to complete formalities and commence the tour. At the office, the passengers signed documentation to acknowledge that they had read, understood and agreed to conditions on an indemnity form. This form provided the passengers with some awareness of the risks involved in the tour and advised them to listen to and obey all OFA directions. The passengers were also shown a short aviation safety video prior to boarding the flight from Darwin to Sweets Lagoon, the site of the tour.
Sweets Lagoon is about 55 km south-west of Darwin and the flight, in OFA’s float plane, took about 20 minutes. The eight passengers and pilot arrived at the Sweets Lagoon pontoon at about 0730 and were greeted by the airboat skipper and the site host. A helicopter pilot who was also qualified to drive airboats was also at the lagoon.
The tour activities proceeded as planned. Initially, all guests were taken on a one-hour breakfast cruise of Sweets Lagoon on board the custom house boat Cyclone Creek. This was followed by a one-hour rainforest cruise on board the airboat Gale Force (Figure 1).
Figure 1: Gale Force
Source: Outback Floatplane Adventures
Prior to boarding the airboat, a safety briefing was conducted during which passengers were instructed to remain seated unless advised otherwise by the skipper and to remain within the airboat at all times. The locations of emergency equipment (fire extinguisher, life ring, radio, satellite phone and first aid kit) were pointed out and passengers informed that the tour would remain within mobile phone range at all times. All passengers donned life jackets and were provided with hearing protection against the noise of the airboat engine and fan. Finally, passengers were advised to hold on to the seat in front in the event of a need to brace. However, no specific advice was given to occupants of the front row regarding how to brace.
The rainforest tour was held in a watercourse off the southern end of the lagoon. It was a slow‑paced tour winding along confined tracks through the surrounding forest. The tour included regular stops to view the wildlife and scenery. Once completed, the tour returned to the pontoon.
At the pontoon, the tour party was separated into two groups of four. One group remained at the pontoon while the other group were taken on a ‘hot lap’ wetlands tour in Gale Force. The passengers could not recall any specific notice of what this tour would involve. The tour progressed without incident and the four guests remaining at the pontoon could clearly hear the airboat. The impression gained was that this tour would be more fast-paced than the earlier rainforest tour and would be more exhilarating.
The first tour group returned about 15 minutes later. The passengers appeared impressed and happy with the ride. The second group of four, consisting of two couples, then boarded. The skipper directed them to sit in the front row of seats. The tour departed and the airboat proceeded at low speed, away from the pontoon, off the lagoon and into a nearby watercourse. The tour passed through a narrow, winding, treed area, along a clearly defined channel, and entered a more open swampland area. From here, the airboat speed was increased.
A few minutes into the ride, the airboat was at speed when the track into a turn to starboard was slightly misjudged and control was lost. The airboat’s stern swung to port and left the channel. The starboard aft corner of the airboat swung round and made contact with a tree a few metres from the water’s edge (Figure 2).
Figure 2: Location of the collision
Source: Outback Floatplane Adventures; annotated by the ATSB
The impact threw the occupants backwards and then, as momentum swung the bow round, they were propelled forward, out of their seats. The skipper was injured and dazed from being thrown against the airboat side cage. The passengers sustained varying degrees of injury, including cuts and bruising, depending on where they were seated.
The skipper stopped the airboat engine, and gathered the first aid kit and passed it to the passengers. The skipper then telephoned the staff at the pontoon, reported that the collision had occurred and that the airboat was disabled. Immediate assistance was requested including pick‑up using the stand-by airboat stationed at the pontoon.
About 15 minutes later, the skipper and passengers were transferred to the second airboat and returned to the pontoon. A short time later, all eight guests and Gale Force’s skipper boarded the float plane for return to Darwin. OFA staff arranged medical transport to meet the aircraft upon its arrival and the skipper and two of the passengers were taken to Darwin hospital for further assessment and treatment. All three were released from the hospital later that day. The other two passengers only required first aid.
Gale Force was retrieved from the site and taken ashore for inspection and repair. The airboat had damage to the fan, the protective cage and the hull and the transom had been pushed to port by the impact (Figure 3).
The airboat was stripped and the hull repaired. New components were obtained and fitted and the airboat was inspected, surveyed and approved prior to returning to service.
Figure 3: Gale Force stern damage
Source: Outback Floatplane Adventures
Regulation
The regulatory requirements for vessels such as Gale Force were set out in in the Marine Safety (Domestic Commercial Vessel - DCV) National Law Act 2012[2],[3] and associated standards and regulations. Specific requirements were dependent upon factors such as the category of vessel, its date of construction, its size, and its intended operation. While there was no definition of ‘airboat’ in the National Law, the Australian Maritime Safety Authority (AMSA) advised that they were considered to be a novel, or special, vessel.[4]
Certificate of operation
The key mechanism in the National Law relating to safe operations was the certificate of operation. The certificate of operation sets out the conditions under which a domestic commercial vessel, or fleet of vessels, must operate. These included details of the vessels used, how and where the vessels could operate, and other conditions AMSA considered necessary due to the nature of either a vessel or an operation.
Safety management system
One requirement of the National Law was that the vessel must have a safety management system that complied with the requirements in marine order 504.[5] A safety management system (SMS) is the key way that vessel owners are expected to manage the risks of their operation and the regulations require that all operations are covered by a SMS.[6]
With regard to the operation of airboats in particular, AMSA expected that the SMS would include:
a comprehensive risk assessment which addressed (identified and controlled) organisational and operational risks including risks to people, the vessel, the business, and the environment
detailed information on:
passenger management and passenger safety including briefings
emergency management, including how to deal with incidents in remote, difficult to access locations
communications
training, including that specific to airboat operation.
To fulfil the requirements of the National Law Act, OFA held a certificate of operation and maintained a system of safety.
Outback Floatplane Adventures
Outback Floatplane Adventures (OFA) offered seasonal tours of the Northern Territory’s natural and wildlife sights from its base in Darwin.
OFA had implemented a safety management system which addressed the operational requirements specified in marine order 504. This included the following documents:
a safety management system—updated September 2018
a standard operations manual
an employee handbook—updated March 2018.
OFA required that the minimum competency as airboat skipper was to hold a Coxswain grade 1[7] near coastal qualification. Since assuming control of the company, the current management focus had shifted from one of promoting the adrenaline/thrill side of company tours, to emphasising the natural aspects (scenery and wildlife). The guests interviewed as part of this investigation confirmed that the appeal of the airboat tour experience did not require the adrenaline component. This shift in approach included updating of company promotional products in conjunction with changes in operating procedures and verbal instruction to staff. Airboat operating speeds were reduced and previous airboat coxswain guidance regarding spins and fast laps was removed from procedures. These changes were implemented prior to this occurrence.
Airboat skipper-coxswain
Gale Force’s skipper had worked in various positions within the tourism industry for more than 10 years. The skipper had obtained a Coxswain grade 1 certificate of competency in 2015 while working on board a dive boat. Since that time, the skipper had continued in the tourism industry commanding a variety of different small tourism vessels in northern Australia waters. In 2018, the skipper drove a five‑person airboat conducting private tours of a buffalo station in the Northern Territory, and after about six months moved to Darwin and commenced with OFA. Under the supervision of OFA’s experienced airboat skipper, this skipper commenced conducting tours on Gale Force, starting with the rainforest tour, for the final few weeks of the 2018 season.
The OFA 2019 tour season commenced in March. Gale Force’s skipper was assessed by the OFA representative as competent and assigned full operation of the airboat for both tours. Prior to the collision, Gale Force’s skipper had a total of almost 500 hours experience as an airboat driver.
At the time of the incident, new airboat drivers worked in a ‘buddy’ system with an experienced OFA airboat driver. Once considered competent, the candidate was given command of the airboats and ultimately the responsibility as tour manager for the Sweets Lagoon airboat operations.
Gale Force
Gale Force met the requirements applying to Australian DCVs which included having a unique identifier, a certificate of survey, a certificate of operation and was crewed by suitably qualified persons. Gale Force was an Australian-registered domestic commercial vessel in survey as a class 2E vessel—certified to carry 12 unberthed passengers and 1 crewmember on smooth waters in daylight hours only. It is square-bowed, 7.5 m long with a 2.5 m beam and hull depth of 0.870 m aft tapering to 0.575 m at the bow. Freeboard was about 0.5 m, fully loaded, measured three-quarters of the length from the bow. The hull bottom was fitted with a 12 mm-thick nylon sheet as a protective and lower friction surface for driving over vegetation or mud.
On board, the passengers were accommodated in three rows of bench seats, separated by a centre aisle into port and starboard seats each able to hold two people. The rows were step‑mounted from the bow to aft—the first row was below the gunwale, the second level with it and the third above it. The driver’s seat was mounted on the centreline behind and above the third row of passenger seats. Behind the driver, mounted within a protective cage, were the 415 kW engine, fan and rudders.
Gale Force was built by Diamondback Airboats, Florida, United States in 2013. The vessel passed survey in Australia in 2013, and entered service with OFA soon after. The airboat was delivered with passenger seatbelts which were removed after discussions between the owner and the regulator. The operating conditions were to be in smooth, shallow waters at low speed, and it was thought the restraints would increase the risks to passengers should the airboat turn over.
However, Gale Force was fitted with minimal other forms of passenger restraint—low backed bench seats with end rails only and side fences extending well above seat height. Occupants of the second and third rows could hold on to the seat in front but the front row passengers were essentially unrestrained in the case of a sudden stop.
Furthermore, the risk of injury to airboat occupants in the event of a sudden stop, such as collision, was not specifically assessed. Even at slow speeds, it is possible for people and equipment to be thrown about in an unsafe manner. Protection measures, such as some form of restraint or additional grab bars, were not available to all passengers, resulting in injuries during the collision.
Previous incident
In 2016, Gale Force was involved in a collision on Sweets Lagoon with another airboat operated by OFA. As a result of that incident, operating procedures were updated and track signage was improved. At the time of this occurrence, the Sweets Lagoon tour operations had changed to operating only one airboat at a time in the area.
Airboats
Airboats are unlike other craft in design, operation and capability. They are suited to specialised types of work in shallow, vegetation-choked, or muddy conditions where conventional craft cannot travel. Generally, airboats have shallow draught, are flat-bottomed, and have a high centre of gravity and low freeboard. They often have large amounts of engine power. Weight distribution, surface conditions (including the presence of mud and vegetation) and power significantly affect their stability and handling.
Airboat handling/manoeuvrability
Power is required for both control and propulsion. Engine power is necessary to force air over the rudder to initiate and complete turns. The combination of power and speed are used to force the rear of the boat to ride up onto the surface of the water and slide through a turn. However, when the operator reduces power, significant steering ability is lost. Essentially, a good operating speed is the slowest speed that will maintain the boat on the plane. This provides control with minimal draught yet is slow enough to stop or to take evasive action if needed.
Although the most basic operator instructions are relatively simple, the subtleties and skills required for safe operation are quite complex. Sufficient experience and good judgement of the operator are essential for safe airboat use.
Safety analysis
The incident
As the airboat was being driven through a confined swampland watercourse on the second wetlands tour, it was at or near full throttle when going into a turn to starboard. In contrast to the earlier tour, the approach into the turn was misjudged and the airboat was slightly off track to port. In this area, the channel narrowed and the surface of the water was broken by grass, water plant and mud patches (Figure 2).
As the airboat crossed this surface, it rode up onto the material and control was lost. The airboat engine was at full throttle and there was insufficient reserve power available to drive the boat forward and through the turn. Consequently, the stern swung to port, through about 120°, and left the channel. The stern swung round until the starboard quarter impacted a tree a few metres from the water’s edge.
Risk assessment
The Outback Floatplane Adventures safety management system documents contained several risk tables, principally concerned with business, environmental and personnel risk. The change in management focus had reduced operational risk through lowering airboat speeds and it would be reasonable to expect that the new airboat operating conditions, while driving within constricted and changeable waterways, would also have been assessed and documented. However, at the time of the incident, the risks associated with the airboat operations, such as a collision (which still existed), were not explicitly documented.
Therefore, measures to prevent such an occurrence and to limit the consequences were not shown to have been considered or implemented. Such measures would include detailed airboat operational guidance and assessment of occupant restraint arrangements.
While the company had changed the tourism focus away from adrenaline/thrill activities, the amended tour operations had not been assessed in sufficient depth. Consequently, lingering risks associated with the ways the tours were conducted, and in which the airboat was operated, were not fully identified and implemented.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Gale Force was being driven, at speed, through a confined swampland watercourse when the track and engine power into a turn were misjudged. During the turn, the stern likely rode over the changing water surface, spun round and impacted a tree.
Operational limitations, which would have reduced the likelihood of the collision and reduced the injury consequences, had not been fully identified and implemented.
Proactive safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Outback Floatplane Adventures
Outback Floatplane Adventures has advised the ATSB that they have taken the following proactive safety actions:
reduced the speed of operation of the airboats
updated the safety management system documents, procedures and processes
implemented specific airboat training, operational guidance and competency requirements, relating to airboat stability and driving
introduced updated and expanded procedures for emergency preparedness.
The future assessment of suitably qualified airboat skippers will be conducted by an independent and experienced airboat operator. The assessment will ensure that, prior to taking command, the skipper is competent in airboat operations in the tour areas and on the specific vessel they will be in charge of.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 3 July 2019, a rolling stock maintenance electrician obtained clearance from the duty controller to enter the west track at the station terminus at Bullocks Flat. The electrician sought to install a missing traction motor cover retaining clip under stationary train Alpha 24. While the electrician was under the platform, he heard the train brakes release and the electrician moved out from under the train before the train moved a short distance. The electrician was not injured.
What the ATSB found
The duty controller granted an electrician access to the west track while the daily 1700 shunt on west track was taking place. It is likely the duty controller did not connect the two activities, the 1700 shunt and the electrician accessing west track, due to other activities occurring at the time, including a visit from an off-duty controller. The Skitube system for managing access to track did not detect the conflict of the rail maintenance worker under the train at the same time the train was being shunted.
The electrician had not applied the required protection flags to the train set to indicate work was being conducted on the train. The system of placing protection flags on both ends of a train set does not isolate energy to ensure a train cannot be moved when it is being worked on.
Elements of the Skitube safety and environment management system are reliant on procedures being followed to manage safety risks. There is little scope for the system to recover when there has been a human error or other procedural error.
The ATSB also found:
The rolling stock return to service authority was ineffective as a control in providing assurance that all required tasks were completed and verified.
The electrician felt an urgency to re-install the missing R-clip with concerns a dislodged inspection cover may lead to an equipment failure from the ingress of foreign material into the traction motor.
What has been done as a result
The temporary track access procedure and form were reviewed, updated and documented. The Skitube train red flag procedure was formalised and documented as a discrete procedure. Including the requirement to lower the pantograph, apply brakes, remove the keys, lock the driver’s cab and place a “Do Not Operate” tag onto all driver’s cabs when a person is required to be in close proximity to a stationary train. The feasibility of a positive lockout within the driver’s cabin that locks the pantograph in the lowered position is being reviewed. This is not a standard mechanism available from the manufacturer and requires re-engineering and completion of a change management process.
The completed changes and other major safety rules and processes were communicated to all staff who were required to demonstrate an understanding of the requirements prior to the 2020 operating season. Further consultation and communication will be undertaken with staff on other changes that are still in progress.
Safety message
Workers must ensure they are protected and follow safety procedures before entering the danger zone or when interacting with trains. Systems should identify when conflicting activities take place that increase the risk to workers. Organisations should assess their risk controls for adequacy in protecting workers, and where required consider additional lines of defence.
The occurrence
On 2 July 2019 a Skitube 2-carriage train set (set 3) was scheduled for service at the Bullock’s Flat maintenance centre. An electrician (electrician 1) conducted the scheduled maintenance requirements on set 3, which would form part of the 4-carriage train, Alpha 24.
Electrician 1 started work on set 3 understanding the train set would re-enter service that afternoon. Nearing completion he was told set 3 would not be returning to service that day.
Electrician 1 completed the remaining tasks and then completed the return to service authority, ticking off all check tasks as complete. Thinking he had completed all tasks successfully, he did not go back under the train set to confirm.
Set 3 was signed off as complete and ready for service at 1515 AEST[1] on 2 July 2019.
On the morning of 3 July 2019 set 3 entered service as part of the 4-carriage train which would subsequently be designated Alpha 24. The train service ran throughout the day without any reported issues.
During end of shift clean-up in the maintenance centre, a maintenance technician found an R-clip on the ground and handed it to the maintenance electrician (electrician 2).
Based on the location it was found on the ground, electrician 2 understood where the R-clip may have come from and knew it to be a securing R-clip of a traction motor inspection cover.
The electrician took immediate action to ensure it was replaced.
Figure 1: R-clip securing traction motor inspection cover
The image shows the traction motor inspection cover secured with the R-clip installed.
Source: Skitube, annotated by OTSI
At 1645 the electrician approached the Skitube duty controller in the Skitube control room and asked that downhill train, Alpha 24, enter the station slowly for an inspection.
At 1652, the electrician requested formal clearance by radio from the duty controller to enter the west track at Bullocks Flat Terminal (BFT) to conduct a roll-by inspection[2] of the approaching passenger train. Alpha 24 was a 4-carriage train made up of two 2-carriage sets coupled together, set 3 (downhill) and set 4 (uphill).
Figure 2: Overhead view of Bullocks Flat Terminal
Approximate location of Alpha 24 (set 3 and 4) when it arrived at Bullocks Flat Terminal.
Source: OTSI
The inspection was carried out from a purpose built inspection pit under the track adjacent to the west platform. The electrician was looking for the location of a missing traction motor inspection cover R-clip, found on the ground in the maintenance area.
The duty controller provided the electrician clearance to enter the west track inspection pit (west pit). The duty controller’s view of the west platform was partially obstructed by train Charlie 25, stationary at the BFT east platform.
At 1653, the electrician asked the duty controller to advise the train driver (driver 1) of Alpha 24 that the electrician would be in the inspection pit and to reduce the train’s speed to under 10 km/h as the train passed over the inspection pit. Shortly after, the duty controller radioed Alpha 24 and requested that the driver “come in slow as people in the pit need to look underneath, no faster than 10km/h”. Driver 1 repeated the details back to the duty controller, confirming the request.
As Alpha 24 crossed number one points on the way into the west platform, driver 1 reduced the train speed to under 10 km/h. The electrician and driver 1 made visual contact and the electrician acknowledged driver 1 with a hand wave as the train approached the pit.
At 1657, another driver (driver 2) entered the duty control room to advise the duty controller he would be assisting driver 1 with uncoupling of Alpha 24 train into set 3 and set 4. This uncoupling procedure regularly occurred around 1700 each day. Driver 2 then walked to, and waited along the middle of the east side of the west platform.
At 1658, driver 1 brought Alpha 24 into the west platform and stopped approximately four metres from the platform dead-end. Driver 1 opened the carriage side doors and the passengers alighted from the train. Shortly after, the electrician advised the duty controller by radio that he was clear of the inspection pit. The duty controller acknowledged the electrician was clear of the pit. The electrician locked the access to the inspection pit and walked to the downhill end of Alpha 24 on the west platform.
At 1659, driver 1 and driver 2 commenced uncoupling Alpha 24, by firstly removing the hi-fog fire suppression system inter-car connector between set 3 and set 4. Driver 2 then entered the driving cab on the uphill end of set 3 and propelled set 3 (first movement) downhill towards the platform dead-end by approximately 50 cm to ensure disengagement of the Scharfenberg type couplers.
Figure 3: Coupling between set 3 and set 4
Hi-fog fire suppression system inter-car connector (A) and Scharfenberg type coupling mechanism (B)
Source: OTSI
Not long after set 3 came to a stand, at 1701:32 the electrician used the radio to request clearance from the duty controller to enter the west track at west platform and the duty controller provided clearance to enter the track.
At 1701:45, the electrician descended the ladder attached to the lead end (downhill) of set 3 and entered the crawl space between the underside of the west platform and set 3.
Moments after, driver 2 walked through the interior of set 3, and at 1701:53, entered the driving cab at the downhill end of the set. Driver 2 then drove set 3 approximately three metres towards the platform dead-end. The electrical pantographs on both sets 3 and 4 were up and in contact with the electrical overhead power supply while on the west track.
Just prior to this second movement of set 3, the electrician had located traction motor three in readiness to replace the missing R-clip. Before replacing the R-clip, the electrician heard the brakes on set 3 release, moved back against the wall under the platform and clear of the train set before it moved. When the train set stopped again, the electrician installed the missing R-clip.
Shortly after, the electrician climbed out from west track and at 1703 advised the duty controller by radio that he had cleared west track from under set 3 and the duty controller acknowledged the clearance.
Following the incident, the electrician approached driver 2 to report that he was under the train set during the second shunting movement. The incident was then reported through the company’s incident reporting system. Driver 2 advised he was not aware anyone was working on the train set.
The Skitube Alpine Railway (Skitube) operates trains between Bullocks Flat Terminal (BFT), off the Alpine Highway near Jindabyne, New South Wales (NSW), and the Perisher and Blue Cow snow-ski fields. The Skitube comprises passenger stations at the BFT and at the Perisher and Blue Cow ski-fields. Additionally, the Skitube has a maintenance facility in a siding near BFT. The rollingstock operates on a rack mechanism to enable the train to negotiate the 1 in 8 ruling grade and the track is a standard gauge configuration.
Operating at capacity, Skitube is capable of carrying up to 4,500 passengers per hour between the three passenger stations. Services run to a schedule during the ski season and typically operates from the June long weekend to the October long weekend, with a peak season from July to September. BFT experiences a morning and afternoon peak period during the ski season in line with skiers heading to and returning from the ski fields.
Passenger carriages
Skitube passenger carriages are wide-body design vehicles and operate in 2 and 4-carriage configurations. The train set will operate with a driving cab at each end to enable the train set to be operated in the opposite direction from a dead-end station.
Alpha 24 consisted of 4-carriages when it arrived at BFT. It was uncoupled into two 2-carriage configurations set 3 and set 4 just prior to the incident.
Figure 4: View from Control room window
Set 3 on west track, east track clear at Bullocks Flat Terminal.
Source: OTSI
Control room
The Control Room is located at BFT on the eastern side of the platform. The duty controller is seated in this room where there is visibility of east and west track. There is limited access to the control room to minimise disruption to the duty controller and to ensure integrity of the control room and the rail system is maintained. No more than three persons may occupy the control room during winter operations. The only staff permitted in the control room, and only whilst conducting Skitube business are; incoming and outgoing duty controllers, Skitube Manager, Assistant Skitube Manager and the Skitube Operations Supervisor. Other staff may enter the control room for work-related purposes at the request of the duty controller. Where possible other staff members should enter the visitors area only, via the terminal entry, not the concourse entry.
Duty controller
The duty controller manages activities on the Skitube by communicating with staff through a discrete two-way radio and by telephone. The duty controller monitors the railway through a network of closed-circuit television (CCTV) cameras. The duty controller also controls the movement of trains by operating signals and points through a supervisory control and data acquisition (SCADA) control system. The duty controller issues and monitors permits to work for those who are required to work in the rail corridor.[3]
The duty controller completed Skitube Duty Controller training and assessed as competent on 31 August 2018. Additionally, he completed a number of units of competency, relevant to his role as duty controller, through the Transport Industry Skills Centre. He was deemed competent in these units on 21 September 2018. The duty controller completed Skitube refresher training for train driver and duty controller and assessed competent on 31 May 2019.
Train driver 1
Train Driver 1 (driver 1) was the driver in control of the downhill train designated Alpha 24. Driver 1 commenced as a seasonal driver in 2006, completed training and assessed competent as a train driver. He worked the 2007 season then took a break and returned to work the 2015 through 2019 seasons. He completed and assessed competent in driver refresher training each year.
Train driver 2
Train Driver 2 (driver 2) was the driver assisting driver 1 to uncouple the Alpha 24 4-carriage set into two, 2-carriage sets. Driver 2 was employed by Skitube in 2003 as a seasonal train driver. Driver 2 was a permanent employee and has held roles as the Head Controller and was Skitube Operations Supervisor at the time of the incident.
Driver 2 completed and was assessed as competent for both train driver and duty controller refresher training on 4 June 2019. Driver 2 was also a qualified trainer and assessor for Skitube train drivers and duty controllers.
Maintenance electricians
The maintenance electrician conducts electrical maintenance on Skitube assets, including rolling stock, in accordance with Perisher Blue standards and procedures. The maintenance electrician will typically conduct rollingstock maintenance at the Bullocks Flat maintenance facility, however, the maintenance staff may carry out tasks at other work locations in accordance with the relevant procedures for that location.
There were two maintenance electricians involved in this incident.
The electrician that conducted the maintenance inspection on set 3 (electrician 1) commenced as an electrician in March 2016. He had certified in Electrotechnology – Systems Electrician from TAFE in 2011. He had also been deemed competent in a number of Skitube competencies, including Locomotive Operation in 2016 and Service and Repair Electric Train in 2017.
The electrician directly involved in this incident (electrician 2) commenced in February 2017. He was a qualified level 4 electrician. He had been trained and deemed competent in the Skitube’s track safety awareness program, track access and track and maintenance lock-out procedures.
Safety and environment management system
Return to service authority
At the completion of a maintenance service on a train set, the maintenance team were required to complete a rolling stock return to service authority. Depending on the type of work completed on the train set, the mechanic or electrician conducting the work was required to initial next to the work item to indicate the work had been completed.
On 2 July 2019, according to the information on the completed return to service authority, set 3 was fit to return to service at 1515. Set 3 had undergone routine mechanical and electrical work. A mechanic and electrician that worked on the set had initialled all tasks on the form, including the check task, ‘All motor covers replaced and secured’. This check task was a single check box to denote all motor covers were replaced and secured. The motor car on set 3 has four traction motors hence four motor covers to replace and secure.
Skitube duty controller’s manual – track access
The Skitube duty controller’s manual requires any person entering within 3 metres of the track (track area) have permission from the Skitube duty controller to access the track area. Additionally, the person must report to the duty controller when clear of the track area. The manual states permission to access the track may be obtained by Skitube radio.
Electrician 2 accessed the track area on two occasions, the first was to get into the west pit and the second was to get access under set 3 to replace the R-clip.
On both occasions, he made contact with the duty controller over Skitube radio and was granted permission by the duty controller prior to accessing the track area.
Skitube duty controller’s manual – protection flag
The Skitube duty controller’s manual outlines the function of the protection flag. The protection flag (red rectangular flag) is to be fitted on the end of trains to indicate the train is defective or someone is working on the train. When the flag is in place it states the action is “do not move the train”.
Electrician 2 did not place protection flags on the train prior to entering the track area below the train. The duty controller had not checked that the electrician had taken the protection flags from the control room.
Figure 5: Example of protection flag on set 3
Source: OTSI
Control room logbook
The duty controller is required to fill in the Control room logbook to provide an account of the activities that occurred throughout the shift. The logbook entries on the 3 July 2019 included the following entries amongst many others;
‘1658 - split 3 & 4 set 3 oos’
‘1702 – EM x 1 BFW under set 3 clear 1703’
The first entry referred to set 3 and set 4 being separated, with set 3 being left out of service (oos).
The second entry referred to one electrical maintenance person (EM x 1) at Bullocks Flat West (BFW) under set 3 and was clear at 1703.
Temporary track access form
The duty controller is required to follow check list, PBPL SEMS 3.6.2 – Temporary track access form before providing clearance for a worker to enter the track.
There is no reference to this form in the Skitube duty controller’s manual. Use of the form is included in duty controller training. It is not included in duty controller refresher training or assessment.
The form had been set up to provide the duty controller a set of logic gates which would aid the decision of whether track access should be granted or not.
On the day, the duty controller granted access and recorded the electrician accessing the track under set 3 at 1702 and clearing the train at 1703.
Skitube train driver’s manual – multiple unit operations
This Skitube train driver’s manual outlines the procedure to uncouple a train. The instructions in the document refer to the specifics of coupling and uncoupling the train sets only. It does not cover the requirements for the driver to notify the duty controller that uncoupling is going to take place.
Uncoupling the carriage sets was a routine task that occurred at approximately 1700 hours each day. It enabled the uphill two-carriage set to complete a return run to Perisher and Blue Cow Terminals to pick up and return staff finishing work on the mountain and to pick up rubbish from the resorts accumulated throughout the day.
When train set 3 was deemed fit to return to service at 1515 hours on 2 July 2019, the return to service authority had been completed by a Skitube maintenance mechanic and maintenance electrician (electrician 1). They were also the maintenance staff that completed the maintenance tasks on the train set.
The rolling stock return to service authority indicated all return checks had been completed and it was ready to return to service.
It is likely set 3 operated throughout the day on the 3 July 2019 without the R-clip securing the motor cover, the R-clip was found in the maintenance pit by one of the maintenance technicians during clean-up near the end of the day.
Electrician 1 had worked on the train set on the 2 July 2019 and was responsible for completing the maintenance work and completing the return to service authority, including securing the traction motor inspection covers.
In electrician 1’s statement, the electrician said,
I needed to complete this work quickly as the train was required to be put back in service.
On completion of the electrical work under the train, electrician 1 moved onto working on the pantographs (on top of the train) and on completion filled in the return to service authority. Electrician 1 stated,
I did not re-enter under the train to complete a check as I believed I had completed all the work as I moved through.
The risks of using checklists for maintenance tasks has been reviewed in past research. Pearl and Drury[4] identified,
Checklists… aid the mechanic in recalling all the numerous tasks to be performed in the check. As the worker performs these tasks repeatedly, there is a tendency to perform them partially from memory, with a block of sign offs made at a convenient time. This is not how workcards [checklists] are intended to be used, and as such use can result in errors.
The return to service authority was used in the manner described by Pearl and Drury. The task of ensuring a securing R-clip had been replaced was not checked at the same time the checklist was completed. This allowed the maintenance worker to make an error (omission) thinking they had completed the task but had not.
A process or system provides little assurance when it requires the same person doing the work to complete a check sheet to attest the work has been completed. Without a second person checking that work has been completed as required, the system is not resilient to a human error.
The rolling stock return to service authority was ineffective as a control in providing assurance that all required tasks were completed and verified.
Replacing the R-clip
At interview, electrician 2 recalled being given an R-clip found on the ground by one of the technicians during clean up. Based on the location it was found on the ground, electrician 2 understood where the R-clip may have come from and knew it to be the securing R-clip of a traction motor inspection cover. When he was given the R-clip, the electrician took immediate action to ensure it was replaced.
Electrician 2 expressed concern that the missing R-clip may lead to an equipment failure if the inspection cover dislodged and allowed the ingress of foreign material into the traction motor.
It is likely his appreciation of the potential damage risk to the traction motor caused the electrician to seek the location and replace the R-clip immediately, rather than wait for it to be replaced when set 3 was back in for scheduled service.
Managing track access
Any person entering the track area requires permission from the duty controller before accessing the track area and is also required to inform the duty controller when they are clear of the track area.
This mechanism of control ensures a single point of contact is informed of all activities occurring on the track network area. This enables the duty controller to make informed decisions about all activities on the network and ensure there are no conflicting tasks.
When electrician 2 requested access to the west track, the duty controller granted access over the radio.
There were two secondary layers of control that did not help the duty controller identify there was about to be conflicting tasks on the network.
A secondary layer of control in the Skitube system was for the duty controller to record all activities into the Control room logbook. While this task serves multiple purposes, a known benefit for the duty controller is deeper processing and understanding of the task when a written record is made in the logbook. A number of studies have found deeper processing and understanding of information when the information is summarised and written down.[5] This additional task of recording information into the logbook is likely to provide the duty controller with a greater level of processing about each task occurring on the network.
The records in the Control room logbook indicated the duty controller made entries about the train uncoupling and the electrician requesting access under set 3, however this mechanism of control did not trigger a conflict in the duty controllers mind.
Another secondary layer of control in the Skitube system was for the duty controller to record when workers were accessing the track area on the temporary track access form. The intent of the control was to aid decision making and provide greater awareness of the activities occurring on the track.
It is likely this form was not being used as intended and therefore did not assist in raising the awareness of the duty controller to the pending conflict.
The duty controller granted access and recorded the details of workers accessing the track in the first table on the form. This indicated there was no train travelling towards the area when access was granted on each of the four occasions listed. When electrician 2 requested access to the Bullocks Flat West Pit (BFW PIT), it was to observe a train pass over the west pit to determine where the missing R-clip had come from. The nature of the request suggests the temporary track access form should have had this as an entry in the second table. The train was travelling towards the area, the train was within 1,000 m and access was considered urgent.
Figure 6: Temporary Track Access Form completed 3 July 2019
Source: Skitube, annotated by OTSI
The temporary track access form recognises and seeks to address the immediate risk of a train travelling towards the area, the distance the train is from the area and how urgent access to the track is. If followed correctly, a discussion about the work being done would happen in order to determine the level of protection needed.
The temporary track access form required an input from the duty controller which is the same input required for the Control room logbook (to write details about a person entering the track area).
The input required from the duty controller is the same however the two controls serve different purposes. The control room logbook maintains a record of all activity on the rail network, the temporary track access form aids the duty controller to make the right decision when granting a person access to the rail network. The repetition of required input from the duty controller likely resulted in the temporary track access form not being followed as intended.
While other controls, such as restricted access to the control room, are in place to help minimise distraction to the duty controller, it is likely the duty controller was also distracted by a number of other activities occurring at around the same time.
The train on the east platform (Charlie 25) had just departed,
The platforms were crowded by the passengers alighting from the arriving train (Alpha 24) on west platform,
The duty controller was acknowledging radio calls from train services operating between the three terminals,
Two people that alighted from Alpha 24 (one an off-duty controller) had made their way and presented at the control room to retrieve a personal item.
These distractions likely led the duty controller to the unintended action of granting the electrician access under set 3. Reason[6] summarises similar situations in the following;
Common among the acts of humans are moments of absent-mindedness when we become aware that our actions have strayed from their intended path. Two conditions appear to be necessary for the occurrence of these slips of action: the performance of some largely automatic task in familiar surroundings and a marked degree of attentional ‘capture’ by something other than the job in hand.
The primary control for managing access to the track is the duty controller. The duty controller is subjected to various distractions which can reduce the effectiveness of duty controller to safely manage access. Skitube’s secondary layers of control, the temporary track access form and the control room logbook can assist the duty controller but require concerted effort from the duty controller to be effective.
At a time when the duty controller’s attention was captured by other activities, the procedures for managing access to the rail network did not assist in alerting the duty controller to the pending conflict.
The Skitube system for managing access to track did not detect the conflict of the rail maintenance worker under the train at the same time the train was being shunted.
Protection flags
The Skitube system requires a worker to place red protection flags on each end of the train to stop a train from being moved when the train is defective or when work is being conducted on the train. When these flags are in place it is easy for the driver of the train to see them when they step into the driver cabs at either end of a train set.
In this incident, the driver was reliant on electrician 2 installing flags across the driver’s cab windscreen on both ends of the train set to indicate work was being conducted on the train. In his statement, electrician 2 understood he had a responsibility to place protection flags on the train set but also felt there was a breakdown in communication as he was given clearance without the train set being flagged out. Skitube’s system does not specifically allocate who is responsible to ensure protection flags are in place before work commences.
The operator’s internal investigation highlighted their system contains references and documentation on the use of protection flags, although further additional information is required to clarify the protection flag process.
As protection flags had not been placed on the train set, there was nothing to alert the driver of the electrician being under the train. However, protection flags on the far ends of the train may not have been visible from the inwards cabs between set 3 and set 4. Therefore, there was a possibility of the driver missing the visual cue of the red protection flag and moving a train set when uncoupling.
The incident may have been averted if the duty controller was compelled to obtain assurance the red protection flags were in place on the train before finalising the clearance for the electrician to enter west track.
Positive isolation
The placement of protection flags on the ends of the train is not a positive isolation of energy. The protection flags do not ensure the train is isolated and cannot be moved while being worked on.
In this incident, the train was moved twice by the drivers uncoupling the train sets. The first movement of the train set occurred in order to separate the scharfenberg type couplers. If the electrician had placed protection flags on the ends of the train set, it is likely the drivers would have spotted these due to the external flag that protrudes out from the side of the train.
However, there is a possibility the drivers, when working in between train sets, could miss the visual cue of the flags and move a train set whilst a person is working on it. The protection flag is only a visual cue. There is nothing to stop a driver from moving a train set when a worker has placed protection flags on the train.
In the rail industry and in other heavy industries, the practice of de-energising equipment (e.g. turning off starter switch and lowering pantographs) and then isolating (locking the starter switch in off position) to ensure energy cannot be placed back into the equipment until repairs are complete, is a common practice.
The provision of lock-out tags to maintenance staff to prevent drivers (or other persons) operating controls could reduce the risk of recurrence significantly.
Safety and environmental management system not error tolerant
The safety factors identified in the course of the investigation highlighted a dependency these areas of the Skitube system has on workers correctly following procedures to effectively manage safety risk.
The effectiveness of the return to service authority was dependent on the diligence of the maintainer ensuring critical steps had been completed before signing off. As highlighted in this incident, it is easy for an error to occur in this process as there is no timely check on the work of the maintainer, to pick up any error that may have been made. Once the omission to replace the R-clip was made, there was no other mechanism of control to allow the system to recover.
The duty controller has responsibility for managing access to the track. The Skitube system has considered the likelihood of the duty controller making an error and has in place, two secondary layers of control to aid the duty controller. These secondary layers of control, the control room logbook and the temporary track access form, did not provide the duty controller with any greater awareness of a pending conflict. This was likely due to an unintended action where key information was not considered due to distractions and incorrect use of the temporary track access form. Once this conflict was missed, the system was reliant on electrician 2 using the protection flag procedure to indicate he was working on the train set.
The protection flag procedure relies on workers following and installing the protection flags on the train set before commencing work. As this was not done by electrician 2, there was no mechanism for the driver to realise there was a person under the train set. As the protection flag system does not isolate energy from the train set, the risk of the train set being moved whilst a worker is working on it can be realised.
These mechanisms of control in the Skitube system are dependent on people following documented procedures to be effective. When a person has made an error in judgment or by omission, the system is left open for safety risks to be realised.
These elements of the Skitube safety and environment management system are reliant on procedures being followed to manage safety risks. There is little scope for the system to recover when there has been a human error or other procedural error.
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the near miss of a maintenance worker on Skitube Alpine Railway, Bullock’s Flat, on 3 July 2019.
Contributing factors
The duty controller granted an electrician access to the west track at the same time the daily 1700 shunt on west track was taking place.
The electrician had not applied the required protection flags to the train set to indicate work was being conducted on the train.
The Skitube system for managing access to track did not detect the conflict of the rail maintenance worker under the train at the same time the train was being shunted. [Safety issue]
Other factors that increased risk
The rolling stock return to service authority was ineffective as a control in providing assurance that all required tasks were completed and verified.
The system of placing protection flags on both ends of a train set does not provide a positive isolation of energy to ensure a train cannot be moved while it is being worked on. [Safety issue]
Elements of the safety and environment management systemare reliant on procedures being followed to manage safety risks. There is little scope for the system to recover when there has been a human error or other procedural error. [Safety issue]
Other findings
The electrician felt an urgency to re-install the missing R-clip with concerns a dislodged inspection cover may lead to an equipment failure from the ingress of foreign material into the traction motor.
It is likely the duty controller did not connect the two activities, the 1700 shunt and the electrician accessing west track, due to other activities occurring at the time, including a visit from an off-duty controller.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The Skitube system for managing access to track did not detect the conflict of the rail maintenance worker under the train at the same time the train was being shunted.
Safety issue description: The system of placing protection flags on both ends of a train set does not provide a positive isolation of energy to ensure a train cannot be moved while it is being worked on.
Elements of the safety and environment management system not error tolerant
Safety issue description: Elements of the safety and environment management system are reliant on procedures being followed to manage safety risks. There is little scope for the system to recover when there has been a human error or other procedural error.
General details
Train details
Train operator:
Perisher Skitube
Registration:
Alpha 24
Type of operation:
Passenger
Departure:
Bullocks Flat Terminal
Destination:
Bullocks Flat Terminal
Persons on board:
Crew – 1
Passengers – Nil
Injuries:
Crew – 0
Passengers – 0
Damage:
None
Speed:
2km/hr
Length:
16.8m
Width:
3.8m
Sources and submissions
Sources of information
The sources of information during the investigation included:
Duty controller on shift at the time of the incident
Train driver operating set 3 at the time of the incident
Electrician that conducted the maintenance on 2 July 2019
Electrician that accessed west track
Maintenance manager and safety manager of Perisher Skitube
Recorded closed circuit television at the Bullocks Flat Terminal
Recorded audio files of Skitube network operations
Maintenance data and checklists from Perisher Skitube
Operational and maintenance procedures from Perisher Skitube.
References
Christmas A, Harris B and Lampe E, 2019, The Effects of Note-taking Strategies and Gender on Word Recognition, Spring Showcase for Research and Creative Inquiry. 15. https://digitalcommons.longwood.edu/rci_spring/15
Marin L and Sturm S, 2019, Why aren’t you taking any notes?’ On note-taking as a collective gesture, Received 15 Apr 2019, Accepted 15 Jan 2020, Published online: 10 Apr 2020. www.tandfonline.com/doi/full/10.1080/00131857.2020.1744131
Bohay M, Blakely DP, Tamplin AK and Radvansky GA, 2011, Note Taking, Review, Memory, and Comprehension, The American Journal of Psychology, Vol. 124, No. 1 (Spring 2011), pp. 63-73
Pearl A and Drury CG, 1995, Improving the Reliability of Maintenance Checklists. Human Factors in Aviation Maintenance Report No. DOT/FAA/AM-95/, Washington, D.C.: Office of Aviation Medicine. Ch. 8.
Reason J, 1990, Human error. New York: Cambridge University Press.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
PerisherBlue Pty Ltd
Office of the National Rail Safety Regulator
Transport for NSW.
Submissions were received from:
PerisherBlue Pty Ltd
Office of the National Rail Safety Regulator.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 29 June 2019, at about 1249 Eastern Standard Time, an amphibious Cessna 208 aircraft, registered VH-ZWH, was travelling from Rose Bay to Berowra Waters, New South Wales (NSW). After the aircraft landed and was slowing down to taxi speed, the front left float of the aircraft bumped into a small stationary boat. There was no damage to the aircraft or boat, and one person in the boat sustained minor injuries.
What the ATSB found
The ATSB found that the pilot did not see the boat, due to a combination of factors including the weather conditions on the day as well as the colour, size, lack of movement and location of the boat as it was positioned in the aircraft’s direct path.
What's been done as a result
The aircraft operator has introduced the requirement for company pilots to manoeuvre towards the right side of the river to reduce the risk of a blind spot near the area of the collision. Also, as a standard operation, company pilots are to reduce the speed of the aircraft to an idle power taxi speed after landing, 100 m before the start of the 4-knot zone at Berowra. In addition, the company’s safety management system was updated to reflect additional post incident response requirements.
Safety message
This incident is a reminder of the importance of scanning and assessing landing areas for any potential hazards, and of the joint responsibility of both aircraft and marine vessels to see and avoid other aircraft/vessels operating on the water. When choosing an operating speed for any vessel or aircraft on the water, consideration should be given to any potential blind spots and areas where other vessels could emerge.
The occurrence
What happened
On 29 June 2019, at about 1230 Eastern Standard Time,[1] an amphibious Cessna 208 Caravan aircraft, registered VH-ZWH (ZWH) operated by Sydney Seaplanes, departed from Rose Bay on a charter flight to Berowra Waters, New South Wales (NSW). On board were the pilot and eight passengers.
At about the same time that the aircraft took off from Rose Bay, two adults and two children departed from the Berowra Waters Marina in a hired small aluminium boat, which the marina reported as being about 4.8 metres in length. The boat hirer (boat operator) did not have a boat licence, nor was one required to operate the boat. The children were wearing lifejackets and the adults were not wearing lifejackets, nor were they required to in the circumstances in accordance with NSW Marine Safety Regulation (2016).[2] After about 15 minutes, the boat operator stopped the boat near the middle of Berowra Creek to have lunch, and turned off the motor.[3]
About 5 minutes after the boat had stopped, ZWH approached the landing area on Berowra Creek (located in Berowra Waters). The pilot assessed that the wind conditions were suitable for landing and positioned the aircraft to land on Berowra Creek in a south-westerly direction (Figure 1). After landing, because of the long distance to taxi to the restaurant, the pilot kept the aircraft’s speed up, maintaining the aircraft ‘on the step’ (see Seaplane positions) for some time. At the same time, the pilot was also monitoring a large white boat that was heading south out of Calabash Bay, ensuring that it continued moving away from the aircraft and was not going to present a hazard. As the aircraft approached the 4-knot zone of the creek (Figure 1), the pilot reduced the speed and the aircraft moved from the step to the taxiing position.
The boat operator saw the aircraft land and travel towards their stationary boat. As the aircraft approached, the boat operator became concerned that the aircraft was not going to stop. Because the boat appeared to be in the aircraft’s direct path, the boat operator started the motor and began turning the boat away from the aircraft. As the aircraft was slowing to taxi the pilot felt a bump while at a speed of about 6 to 7 knots.[3] The pilot looked around the nose of the aircraft (which was obstructing part of the forward field of view) and saw that the front left float had contacted the boat, which the pilot had not seen until then. The silver hull of the boat had been motionless on the calm, glassy surface of the creek and its dark blue canopy and dark clothing worn by the adults in the boat had blended into the surrounding area.
The aircraft is powered by a PT6 series gas turbine engine with a full reversing propeller. After seeing the boat, the pilot reported selecting full reverse thrust and the aircraft moved away from the boat. There was no damage to the aircraft or the boat and one person on board the boat sustained minor injuries.
The boat operator subsequently reported previously hiring a boat in the same area once before but was unaware that seaplanes operated in the area. The previous time, the boat operator had not seen or heard any aircraft in the area, and therefore was not expecting to see one operating nearby.
Figure 1: Image of the Berowra Waters area showing the location of the collision, the landing direction of VH-ZWH and significant landmarks
Source: Google earth annotated by the ATSB.
Seaplane positions
When moving on the water, the aircraft had two states it could be in, either ‘on the step’ or in the taxiing position (Figure 2). On the step most of the weight of the aircraft is being supported by hydrodynamic lift rather than the buoyancy of the floats, and it is the take-off and landing position.
Figure 2: Diagram of the difference between being ‘on the step’ and being in the taxiing position
Source: FAA Seaplane, skiplane, and float/ski equipped helicopter operations handbook - annotated by the ATSB.
Safety analysis
Due to a combination of factors the pilot did not see the boat prior to the collision. The factors included the weather conditions on the day, as well as the colour, size, lack of movement and location of the boat as it was positioned in the aircraft’s direct path. The colour of the boat blended into the surrounding environment.
The actions of the boat operator of starting the engine and attempting to move out of the aircraft’s direct path likely reduced the risk to the boat occupants due to the change in the angle of impact as the aircraft struck the boat.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
While slowing to taxi speed, the aircraft collided with a small boat that was motionless in the middle of the creek and in the aircraft’s direct path. The boat’s lack of movement, silver hull and dark blue canopy reduced the pilot’s ability to discern it from the background environment.
After the boat operator realised the aircraft was travelling directly towards them, the boat operator started the motor and attempted to manoeuvre the boat out of the direct path of the aircraft.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Proactive safety action
Aircraft operator
As a result of this occurrence, the aircraft operator has advised the ATSB that they have taken the following safety actions:
Company pilots where possible are to manoeuvre on the right-hand side of the river to reduce the risk of a blind spot near the area of the incident.
As standard operations, company pilots are to reduce the speed of the aircraft to an idle power taxi speed after landing, 100 m before the start of the 4-knot zone at Berowra.
The company safety management system was updated to reflect additional post incident response requirements.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 10 June 2019, the driver of Xplorer service NP43 was operating a passenger service between Werris Creek and Moree. Shortly after departing Gunnedah, the driver passed signal GH19 at Caution and continued at track speed of 115km/hr, unaware that signal GH23 was at Stop. The position of the sun likely reduced the driver’s ability to sight signals GH19 and GH23 from a safe distance. When the driver did sight signal GH23 at Stop, there was insufficient distance to stop prior to points 55. NP43 traversed points 55 in excess of the maximum track speed of 50km/hr for the points. The train, travelling at approximately 110km/hr, came to a stop approximately 400m into the Whitehaven Coal Loop. When NP43 entered the coal loop three people were injured, a passenger and a member of crew were struck by flying objects, and a crew member was thrown from their seat striking their head.
What the ATSB found
It was found that the driver of NP43 was not aware signal GH23 was at Stop, in order to protect an Up movement at Emerald Hill. The driver passed signal GH19 without sighting the signal and the position of the sun likely affected the driver’s visibility of signal GH23. There was insufficient stopping distance prior to points 55 once the driver sighted signal GH23.
Safety message
Drivers are reminded of the importance of operating to the current conditions, but also with consideration to potential future conditions. If safe sighting distance is reduced due to environmental factors, it is important to reduce speed and be prepared to stop.
The occurrence
What happened
On 10 June 2019, NSW Trains were operating a passenger service between Werris Creek and Moree. This service consisted of a two car Xplorer service designated as NP43.
At 1558[1] service NP43 departed Werris Creek for Moree in the Down[2] direction. This service departed 13 minutes late due to the late arrival of service NP23 to Werris Creek. These services were operating to a modified timetable as a result of track work near Muswellbrook.
At 1636 the driver of NP43 contacted the North Panel Network Controller (NC), located at ARTC’s North Control Centre, Broadmeadow to advise that NP43 was at Gunnedah station. During the communication the NC advised there was a train ahead, after that they should get the signal to proceed. Between 1639 and 1642 a coal service designated NB933 travelled in an Up direction and entered the Gunnedah loop line north, locally referred to as the ‘Gunnedah Long Loop’.
At 1643 NP43 departed Gunnedah after signal GH7 indicated a proceed indication.
At 1645 NP43 passed signal GH19 with a yellow Caution indication. This signal is located on the right hand side in the direction of travel at 478.100km[3].
At 1646 the NC contacted the driver of NP43 to confirm that NP43 had passed the Gunnedah Long Loop, with the driver confirming he had passed the long loop. The NC acknowledged the driver’s message and advised, ‘shouldn’t be too long and that signal should set up for you’.
At 16:46:28 NP43 passed signal GH23 at Stop, located at 480.028km and entered the Whitehaven Coal Loop siding at approximately 110km/hr. The train stopped approximately 400m into the coal loop (see Figure 1 for incident location). The driver stated when he did see signal GH23 at Stop, he initiated an emergency brake application, but was unable to stop prior to points 55.
The driver of NP43 contacted the NC to advise of the signal passed at danger (SPAD), confirming that the signal was at Stop, however it was not visible to the driver due to sun glare.
The driver was checked by the Passenger Service Supervisor (PSS) as fit to continue. The NC then made arrangements for the driver of NP43 to change ends and return to the main line. NP43 was cleared to continue north, with the driver accompanied by the PSS for the remainder of the journey. The driver of NP43 was breath tested by NSW Police on arrival at Narrabri, returning a negative blood alcohol reading.
There were three reported injuries from increased lateral forces as a result of NP43 traversing points 55, in excess of the maximum track speed of 50km/hr for the points.
Figure 1: Gunnedah signal location
Source: ARTC. Modified and annotated by ATSB
Safety analysis
The late running of NP43 and time of the year meant the sun was lower than the driver was expecting or reportedly had previously seen. The driver last operated this route one month prior to this occurrence.
The position of the sun aligned directly with the path of NP43, likely reducing the safe sighting distance to within 100m of signals GH19 and GH23. The driver reported that the sun was reflecting from the stainless steel coal wagons parked in the Gunnedah long loop. This may have distracted the driver from sighting signal GH19. The driver reported wearing sunglasses and utilising the cab blind in an effort to block the sun, but reported his visibility was still affected.
The driver reported he knew the location of signal GH19, however did not see the signal on passing and continued at track speed. The driver also reported never seeing signal GH19 with a Caution indication in the previous 12 years, which likely influenced the driver continuing at track speed.
A site inspection completed the following day confirmed the position of the sun would have affected the driver’s visibility of the signal aspects for GH19 and GH23 (see Figure 2). This inspection was completed at the same time in similar weather conditions to the previous day.
Figure 2: Signal sighting at approximately 100m and 30m to GH19 and GH23
Source: ARTC. Annotated by ATSB.
The NC had set signal GH23 to Stop to protect the Up movement of a coal train into the sidings at Emerald Hill. With signal GH23 at Stop, points 55 were set in the reverse position in order to direct rail traffic travelling in the Down direction into the Whitehaven Coal Loop siding. Signal GH19 was set at Caution as signal GH23 was at Stop. The driver of NP43 was not aware of the Up movement at Emerald Hill and was not expecting signal GH23 to be at Stop, having not seen signal GH19.
The driver of NP43 was contacted by the NC after passing the end of the long loop as part of the requirement to block work[4] in this section of track. This call was made after NP43 had passed signal GH19. Although the call from the NC was made when NP43 was approaching signal GH23, it is unlikely the call from the NC distracted the driver from sighting signal GH23 at Stop.
The driver reported throwing the radio handset aside on sighting the signal at Stop, therefore it is possible the driver did not hear or comprehend the NC stating ‘shouldn’t be too long and that signal should set up for you’. It takes approximately 500m to stop a two car Xplorer from 115km/hr in emergency braking mode, therefore it is unlikely NP43 would have been able to stop prior to points 55.
The maximum sign posted speed for points 55 is 50km/hr. The speed NP43 traversed the points created lateral forces which resulted in the following:
a passenger being struck by a falling bag
the Senior Passenger Attendant (SPA) being struck with items stored in the buffet
the PSS being thrown from their seat in the rear car and striking their head, requiring first aid.
It is a requirement for a driver to be accompanied by a qualified worker following an incident until the driver is relieved[5]. If the qualified worker doubts the ability of the driver to safely operate the train, they must tell the NC and secure the train. The qualified worker in this case was the PSS as the SPA cannot perform the role of a qualified worker. Given the PSS received a minor head injury, the potential effectiveness of their assessing and monitoring the safe operation of the train could have been limited. The driver could, however, monitor the PSS post incident.
The health and fatigue of the driver were assessed and it was considered these did not contribute to this occurrence.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The driver of NP43 was not aware that signal GH23 was at Stop and continued at track speed after passing signal GH19 without seeing the signal indication.
The driver's vision of the signals GH19 and GH23 was likely impaired due to the position of the sun. The sun reflecting off the side of the coal wagons prior to signal GH19 possibly further impaired the driver's vision. Under these conditions the driver did not suitably adjust the speed of the train to allow for safe sighting of the signal.
The NC set the route so that GH23 was at Stop to allow for an Up movement of a freight train into Emerald Hill Loop.
The driver was qualified and had frequently operated passenger trains through this section. In the previous 12 years, the driver reported not sighting GH19 at Caution. This likely influenced the driver to continue after not seeing the signal indication.
The driver of NP43 was not distracted by other activities or the requirement to block work within this section of track.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 7 June 2019, Pacific National (PN) were operating freight train 6CM3 between Griffith, New South Wales and Appleton Dock, Victoria. The train arrived at the Junee Down Platform for a scheduled driver change. The relieved train crew performed a roll-by inspection when the train departed at 2159. During the roll-by inspection, the relieved train crew detected the 40th and 41st wagons had derailed and contacted the driver by radio to stop. The derailment blocked the Olympic Highway level crossing at Junee and disrupted freight and passenger services. The Down Platform road required repairs and was unfit for use until 10 June 2019.
What the ATSB found
The ATSB found that the 40th and 41st wagons derailed at a broken rail near 119A points. The broken rail allowed wheels from 6CM3 to derail, damaging the wagons and infrastructure. It was found that rails forming turnouts between main lines were not being ultrasonically tested following a change in maintenance practices. A likely detectable rail defect went undetected with the rail breaking in two places on two different occasions. The crew performing the roll-by inspection detected the derailed wagons preventing the escalation of this occurrence.
What's been done as a result
The Australian Rail Track Corporation identified rails forming turnouts that were not previously subjected to ultrasonically testing and included these in the asset management register. Scheduled testing of these identified assets has been included in the ultrasonic testing contractor’s annual testing program.
Safety message
Rail infrastructure managers should ensure that inspection techniques effectively monitor and report on asset condition. Risk controls should also be continuously assessed to control risk to an acceptable level through the life cycle of the asset, in particular, when changes are made to inspection regimes.
The occurrence
What happened
On 7 June 2019, Pacific National (PN) were operating freight train 6CM3 between Griffith, New South Wales and Appleton Dock, Victoria.
Train 6CM3 operated between Griffith and Junee on the Country Regional Network (CRN)[1], arriving at the boundary of the CRN and Australian Rail Track Corporation (ARTC) network at approximately 2147.[2]
The train crossed from the CRN network through 113 and 119 points in the Down[3] direction, arriving at the Junee platform at 2154 for a crew change. At 2159, the train departed in the Down direction with the relieved crew performing a roll-by inspection[4] from the platform. During the roll-by inspection, the crew detected the train had derailed and contacted the driver by radio to stop the train (Figure 1).
The ARTC network control centre south was advised of the incident, and safeworking protection was applied to protect the site. Inspection of the derailment site identified that the 40th and 41st wagons had derailed. The two wagons had run in a derailed state from near 119 points at 485.348 km[5] to alongside the platform at 485.688 km (Figure 2).
The derailment blocked the Olympic Highway level crossing at Junee and disrupted freight and passenger services on the Main South Line.[6] The Down Platform road required repairs and was unfit for use until 10 June 2019.
Figure 1: Junee network diagram
The path of train 6CM3 is shown in orange and depicts the train crossing from the Country Regional Network to the Australian Rail Track Corporation network by crossing points 113 and 119. Source: Australian Rail Track Corporation, modified and annotated by OTSI
Figure 2: Derailment site
Source: Australian Rail Track Corporation and Pacific National, annotated by OTSI
Safety analysis
The rail was found to be broken in two places in the closure rail[7] between 119A and 119B points at 485.348 km (Figure 3). The two rail breaks showed different failure characteristics indicating the likely failure sequence (Figure 4):
Break one exhibited signs of oxidation across the full face of the rail, end batter[8] and some worn areas on the fracture face. A small section of the rail head showed signs of fatigue cracking that likely initiated from rolling contact fatigue (RCF)[9] at the gauge face. The smooth areas of the fracture face indicate wear between the two faces as a result of vertical displacement of the broken rail.
Break two exhibited light oxidation at a fatigue crack that likely initiated from RCF. The remainder of the fracture face showed signs of a brittle overload fracture, with no visible oxidation.
Oxidation across the full fracture face of break one indicated it had occurred sometime before break two. The weight of the wagons passing over the broken rail likely created a bending moment,[10] causing increased stress in the rail head. The increased stress likely led to the progression of the fatigue crack (break two). While train 6CM3 was crossing through points 119A, the rail likely broke (break two) with sudden brittle fracture.
There was deformation and evidence of flange marks (point of mount) at break two, with witness marks to the point of drop approximately 4.5 m from the point of mount. A total of eight wheels derailed on the 40th and 41st wagons, although the first wheel to derail could not be established.
The roll-by inspection detected the derailment within approximately 340 m, preventing further damage to infrastructure. This train could have continued to operate in a derailed state had it not been detected. The condition and operation of train 6CM3 was unlikely to have increased the risk of derailment with the wheels derailing at the broken rail.
Figure 3: Broken rail segment
Source: Pacific National, annotated by OTSI
Figure 4: Broken rail analysis
Source: Australian Rail Track Corporation, annotated by OTSI
The track at Junee is subjected to routine inspection and testing in accordance with ARTC maintenance standards, including visual and ultrasonic rail defect testing. The most recent maintenance inspections completed for points 119A were:
24 January 2019 – Detailed visual inspection of points.
10 April 2019 – Manual detailed ultrasonic testing of turnout.
3 June 2019 – Track patrol visual inspection.
Maintenance records indicated that there were no known faults with points 119A prior to the derailment. It is very likely that the rail was visibly broken (break one) at the time of the track patrol[11] performed on 3 June 2019 but the break was not detected. Track patrols provide a level of assurance but are limited to large or obvious defects. It is also likely the manual detailed ultrasonic testing of turnout inspection completed on 10 April 2019 did not test the closure rail at the location of the break.
In 2017, ARTC changed the requirements for ultrasonic rail testing of turnouts in New South Wales (NSW). This change aligned the testing with other interstate areas where testing was conducted using continuous ultrasonic testing vehicles. Prior to this, in NSW, all rails in turnouts were subjected to 6-monthy manual hand-held ultrasonic testing.
It was found that at the time of the derailment, rails within turnouts between main lines were not being tested by ultrasonic testing vehicles. There were also no specific requirements in the ultrasonic testing contract for the testing of turnouts between main lines.
At the time of implementing the change to the inspection requirements, the change management process did not detect the loss of the risk control associated with ultrasonic testing of turnouts. Additionally, following the change in 2017, it was unclear which areas of turnouts continuous ultrasonic testing could test and which areas needed manual hand-held ultrasonic testing.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The derailment of two wagons of train 6CM3 occurred due to a broken rail at 119 points. It is likely detectable fatigue cracks were not identified before the rail broke as the rail was not ultrasonically tested.
ARTC maintenance practices did not ensure that rails forming turnouts between main lines were ultrasonically tested as part of scheduled testing.
ARTC’s change management process did not identify the loss of a risk control (ultrasonic testing) at the time of changing the requirements for ultrasonic rail testing in turnouts within NSW.
A roll-by inspection detected the derailed wagons preventing further damage.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Australian Rail Track Corporation
As a result of this occurrence, the rail infrastructure manager has advised the ATSB that they are taking the following safety actions:
Asset maintenance
Turnouts between main lines not previously subjected to continuous ultrasonic testing have been identified and included in ARTC’s maintenance asset register. Ultrasonic testing of turnouts not tested previously has been completed. The ultrasonic testing contractor has included these identified assets in the annual testing program.
Maintenance standard ETE-01-03 Non-Destructive Testing of Rail (for Internal & Surface Defects) is currently under review.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
