Safety summary

What happened

On 16 March 2019, two passengers were seriously injured when the basket of a Kavanagh B‑400 hot‑air balloon tipped over during vehicle-assisted deflation.

Prior to the accident, the balloon, operated as a scenic charter flight, landed without incident at a private property near Coldstream, Victoria.

Due to a lack of wind and the large size of the envelope, the crew elected to use the retrieval vehicle to assist by pulling the envelope over (by the crown line) during the deflation.

During this process, with 16 passengers and the pilot on board, the vehicle assisting inadvertently pulled the basket over, seriously injuring two passengers.

What the ATSB found

The ATSB found that the operator had not conducted a risk assessment around the use of a vehicle to assist in the deflation process. Although not required by regulations, the lack of a risk assessment likely left the operator and crew unaware of the risks associated with the vehicle-assisted deflation, and without appropriate procedures to control those risks. Consequently, a communication breakdown between the pilot and vehicle driver led to the basket tipping, and the passengers were unprepared and not in landing positions during the deflation process - increasing their likelihood of injury.

The ATSB also found that the Civil Aviation Safety Authority had not provided guidance to commercial balloon operators concerning the risks associated with vehicle‑assisted deflation. This likely contributed to the limited awareness commercial operators had of the risks associated with vehicle‑assisted deflation. Further, with substantial growth in the number of large, Australian-registered balloons requiring vehicle-assisted deflation, this is an ongoing safety risk.

What's been done as a result

The operator has updated their procedures to reduce the probability of a communication breakdown during the deflation process and is requiring the pilot to instruct passengers to assume landing positions during any vehicle-assisted deflations.

CASA has indicated they will publish an advisory circular, which will include guidance on deflation of hot air balloon envelopes using a vehicle to assist.

The ATSB has released a safety advisory notice (AO-2019-014-SAN-014) to all commercial balloon operators about the risks associated with vehicle‑assisted deflation, as identified in this report.

Safety message

This investigation highlights that gradual changes to operational procedures, while possibly perceived as inconsequential, have the potential to conceal new or emerging safety risks. A thorough assessment of any introduced changes should identify these new risks and allow their mitigation or reduction to an acceptable level.

This investigation also highlights that an increase in the number of aircraft and occupants (passengers and crew) exposed to a hazard has a compounding effect that, in a relatively brief period, can increase the overall risk significantly.

The occurrence

What happened

On 16 March 2019, at about 0700 Eastern Daylight‑saving Time,^[1] a Kavanagh B‑400 hot‑air balloon, registration VH‑LNB and operated as a scenic charter flight by Picture This Ballooning, was being prepared for departure from a private property near Dixons Creek, Victoria.

The balloon operating crew conducted passenger safety briefings:

• at the meeting point (including equipment that can be carried on board and what to expect during the flight)^[2]
• on the bus during the transit from the meeting point to the launch site (including conditions at the launch site and the inflation procedure), and
• at the launch site prior to the passengers entering the basket.

Prior to take‑off, with the passengers positioned in the basket, the pilot also conducted a safety briefing which included the risks associated with a layover landing in windy conditions, and having all the passengers demonstrate they could correctly assume the landing position.^[3] The two ground crew assisted the pilot by checking the passengers had understood the briefing and could physically adopt the landing position.

At around 0720, after the pilot and ground crew conducted pre‑flight and radio checks, the balloon lifted off with 16 passengers and the pilot on board.

During the flight, the ground crew were in communication with the pilot by radio to coordinate arrival at the planned landing site. At the landing site, prior to the arrival of the balloon, the ground crew launched a pibal^[4] and observed that there was nil wind below 300 ft above ground level. This information was communicated to the pilot.

About 10 minutes prior to landing, the pilot conducted another passenger briefing concerning safety during landing. This included the requirement for the passengers to assume the landing position.

The balloon landed without incident at a private property near Coldstream, Victoria at about 0820, with the passengers all satisfactorily adopting the landing position.

Following the landing, the pilot began to shut down the burner system and waited for the two-ground crew to prepare to deflate the envelope. Due to a lack of wind and the large size of the envelope, the crew elected to use the retrieval vehicle to assist by pulling the envelope over (by the crown line) during the deflation. Then, by radio, the pilot instructed the driver in the vehicle to drive forward. The vehicle started to slowly move forward, at less than walking pace, pulling the envelope. The driver’s vision of the balloon’s basket was obstructed by the collapsing envelope. During this process, the second ground crew member (located next to the basket) and the driver could not see each other.

The pilot then put down the handheld radio to operate the vent line, which required both hands. The envelope began to deflate faster than anticipated and the fabric started to collapse directly on top of the basket and burners. The second ground crew member assisted by lifting the fabric away from the burners and passengers. The pilot picked up the radio and instructed the driver to ‘drive a little bit faster’. The pilot then put the radio back down on the top of one of the fuel tanks and proceeded to operate the vent line and talk with the passengers. The driver proceeded for another 5 to 6 m then started to slow down.

Shortly after, at around 0830 (10 minutes after landing), the basket began to tip (Figure 1). The pilot instructed the passengers to ‘hang on as best they could’ and did not have the opportunity to use the radio to command the driver to stop.

The second ground crew member jumped out of the way of the tipping basket. The pilot’s radio landed at second ground crew member’s feet. The second ground crew member then communicated with the driver to stop and quickly get back to assist.

The driver, unaware of what was happening with the basket, heard unintelligible sounds from the radio and decided to stop the vehicle.

Two of the 16 passengers were seriously injured^[5] when they were propelled out of the basket as it tipped over. One of the passengers sustained two broken ribs and another was knocked unconscious for around 10 minutes.

The pilot and second ground crew member, who had both received first aid training about 8 weeks prior, began administering first aid to the injured passengers and called an ambulance. The driver, also trained in first aid, took control of the injured passengers and continued to administer treatment. Around 15 minutes after the basket tipped, an ambulance arrived, and the injured passengers were taken to Maroondah hospital. Both were discharged later that day.

Figure 1: VH-LNB basket final resting position

Source: Victoria Police. Annotated by ATSB

__________

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. RACV club in Healesville, Victoria
3. The landing position is designed to reduce the likelihood of injury from a layover or hard landing. Occupants face away from the balloon’s landing direction, holding onto rope holds with their feet flat and knees together but slightly bent.
4. An abbreviation of ‘pilot balloon’, which is a small, helium-filled free balloon with a light that is realised and visually tracked to determine the wind at different altitudes.
5. A serious injury is an injury that requires, or would usually require, admission to hospital within 7 days after the day when the injury is suffered. Transport Safety Investigation Regulations 2003 Part 1.

Context

Balloon deflation

All hot air balloons have a load ring known as a crown ring at the top of the envelope. Attached to the crown ring is a crown line, which is long enough to reach to the balloon’s basket. During envelope deflation, a vent at the top of the balloon is opened progressively to release hot air. To prevent the envelope collapsing on top of the basket in light wind conditions, a force is applied to the crown line to pull the envelope down and away from the basket.

For smaller balloons (generally less than 350,000 ft³), one or two persons can provide enough force by pulling on the crown line and walking away from the basket. For large balloons, the crown line can be attached to the rear of a vehicle that then drives slowly away from the basket pulling the envelope as it deflates.

Crew experience

The pilot obtained a private balloon pilot certificate in 1997 and commercial balloon pilot licence in 2000. At the time of the accident, the pilot had just over 2,000 hours (10 hours in the previous 90 days) as pilot in command.

The ground crew member driving the vehicle during the deflation had around 20 years’ experience as a ground crew member for Picture This Ballooning (PTB). The other ground crew member had been working in this position for the operator for around 4.5 years.

Aircraft information

VH‑LNB was a Kavanagh Balloons B‑400 hot‑air balloon designed and manufactured in Australia with an envelope air capacity of around 400,000 ft³. The balloon was certified to carry up to 22 passengers and the basket had capacity to accommodate 20 passengers within four passenger carrying compartments, and a pilot in the central compartment (Figure 1). Heat was produced by a four‑burner liquefied petroleum gas system.

Meteorological information

The pilot reported reviewing several weather forecasts for the intended flight time, on the night before the flight and again on the morning before the flight. In addition, prior to, and during the flight, the ground crew launched pibals (pilot balloons) to check the prevailing wind speed at different altitudes. This information was communicated to the pilot.

The ATSB obtained weather data from the Bureau of Meteorology for Coldstream Airport (approximately 5 km from the accident site). It included observations recorded at 1‑minute intervals between 0700 and 0900 on 16 March 2019 (at ground level). Across that period, the winds were calm (0 kt) with no gusts.

Organisational information

Picture This Ballooning

Picture This Ballooning (PTB) was a charter balloon operator that had been operating for around 22 years. It had 15 balloons in their fleet, of which 11 were used for passenger charter operations. The operator had two balloons (one Kavanagh B‑350 and a B‑400) with envelope sizes of 350,000 ft³ or more. Sizes below this were less likely to require a vehicle to assist during deflation. PTB began using a vehicle to assist with in the deflation of their two large balloons about 12 months prior to the accident.

Communications procedures

The operator’s Operations manual (OM) contained the following procedure for radio communications:

Communication with retrieve crew will be via UHF radios with mobile phones as back up. Prior to launch the pilot must conduct a UHF radio check with the crew to ensure two-way communication is possible. During flight both parties shall maintain a continuous watch.

The operator’s crew procedures and training manual contained additional information regarding radio failure:

Use of mobile phone as back up

Recognise that the radio is not working if you are not receiving instructions

Pilot has a crew number and vise [sic] versa

Stay near the balloon and do not get too far in front

Try a second radio

It’s not that big a deal so long as you think what the pilot would want you to do.

Although not documented prior to the time of the accident, the process during vehicle‑assisted deflation, as reported by the pilot and the ground crew member driving, was that once the instruction to drive forward was given, the driver would continue until the pilot commanded them to stop.

Following the accident, the pilot identified that putting down the handheld radio and not maintaining communication throughout the entire process was a likely contributor to the accident.

Passenger safety briefings

The operator’s procedures contained in the OM required the pilot in command to conduct passenger briefings:

as to correct inflation procedures

inside basket on landing positions prior to lift off.

The OM also contained the following information regarding briefing of passengers:

Passengers are to be briefed on the ballooning experience in general and safety aspects of ballooning (e.g. the fan, landing positions, exiting the basket, etc). Pilots should make use of the PTB checklists and briefing cards found on board all PTB balloon basket.

Further, the OM contained the following information regarding the positioning of passengers in basket:

A physical demonstration of landing positions by the passengers must be conducted before take-off on each flight.

The pilot and a passenger reported that a safety briefing was conducted, upon arrival at the launch site, primarily regarding the hazards associated with the inflation fans (pre-boarding). Another briefing was conducted in the basket prior to launch (pre-flight) which included passengers demonstrating they could correctly assume landing positions. A final briefing, primarily concerning landing positions, was also conducted by the pilot around 10 minutes prior to landing (pre-landing).

In addition to the safety briefings, the balloon had safety cards on board that also contained safety information including a pictorial representation of the body position when in the landing position (Figure 2).

Figure 2: Picture This Ballooning’s on-board safety briefing cards

Source: Picture This Ballooning

Landing position

The Kavanagh Balloons Flight Manual contained procedures for fast landings, including:

When a high horizontal landing speed is expected, passengers should be made aware that the basket will tip forward and they should take a lower-than-normal landing positions to avoid being thrown out of the basket.

The pilot reported that during the vehicle‑assisted deflation the passengers were not in the landing position.

Crew’s awareness of the risk of tipping during vehicle‑assisted deflation

The pilot reported that at the time of the accident not noticing that there was a problem until the basket began to tip. In addition, while having previously observed baskets tipping due to wind, the pilot had not considered that the deflation vehicle could produce the same outcome. Further, the ground crew member driving the vehicle also reported not expecting anything to go wrong during the deflation process.

Civil Aviation Safety Authority

The Civil Aviation Safety Authority (CASA) is an independent statutory authority with the primary functions of conducting safety regulation of civil air operations in Australia and the operation of Australian aircraft overseas.

Passenger safety briefings

CASA’s Civil Aviation Advisory Publication: Passenger safety information: Guidelines on content and standard of safety information to be provided to passengers by aircraft operators (CAAP 253-02 V2.0), included specific guidance for balloon operators regarding passenger safety briefings during pre‑boarding, pre‑flight, pre‑landing final approach and landing.

The guidance did not contain information regarding passenger safety briefings during the deflation process.

Safety management system

CASA regulations did not require operators of balloon aerial work and charter operations to have a safety management system (SMS).

CASA have proposed Civil Aviation Safety Regulation (CASR) Part 131, which was available as an exposure draft until 30 September 2019, and scheduled to commence on 2 December 2021. Part 131 would have required balloon transport operators (currently charter operations) to have an SMS that is ‘…appropriate for the size, nature and complexity of the operator’s balloon transport operations’. The SMS must include:

…a safety risk management process, including:

(i) Hazard identification processes; and

(ii) Safety risk assessment and mitigation processes

In addition, the proposed Part 131 also contained the requirement for balloon transport operators to have a safety manager with

…sufficient relevant safety management experience to capably lead, manage and set standard to enable the operator to safely implement the operator’s safety management system…

and the responsibility for

…managing the operation of the safety management system including managing corrective, remedial and preventative action in relation to the system…

In a 22 November 2019 update, CASA provided a summary following the consultation period for Part 131:

To provide additional time to consult with industry on the requirements related to safety management systems and training and checking systems, CASA has removed the proposed regulations related to safety management systems (SMS) and training and checking systems for balloon transport operators (including the requirement for the two associated key personnel – the head of training and checking and the safety managers).

Large balloons in Australia

Multiple ground crew and pilots reported to the ATSB that the use of the vehicle‑assisted method is only used for balloons with envelope sizes of 350,000 ft³ or greater (some reported 400,000 ft³ as the minimum size). Balloons with smaller envelope sizes are more likely to be collapsed by hand in low wind conditions.

Figure 3: Number of large VH-registered balloons on 30 June between 2000 and 2019

Source: Civil Aviation Safety Authority

The ATSB conducted an analysis of the trend in the risk associated with vehicle‑assisted deflation. This was based on vehicle-assisted deflation only being used for balloons with a capacity of 350,000 ft³ or greater.

Over the period mid‑2015 to mid‑2019, the number of large balloons registered in Australia increased by around 8-9 more balloons each year (Figure 3).

Given this trend, it is likely that the use of vehicles to assist during deflation will continue to increase over the period 2020–2022. In addition, the average size of these balloons (350,000 ft³ or greater) has also increased and accordingly, the average number of passengers per larger balloon flight has also increased.^[6] It follows then, that, the number of passengers potentially exposed to injury associated with vehicle‑assisted deflation per flight will also probably increase.

Related occurrences

A review of the ATSB occurrence database found the following ground handling occurrences involving the use of a vehicle to assist in the deflation process:

Occurrence 201600589

At 0700 on 22 April 2016, the pilot of a Kavanagh Balloons B‑425 was seriously injured when the basket tipped during a vehicle‑assisted deflation. During the deflation, the pilot dropped the radio resulting in a communication breakdown with the driver of the vehicle. The pilot was then unable to command the driver to stop, resulting in the vehicle driving too far, causing the basket to tip. At the time of the accident, there was probably only one passenger still on board the balloon.

Following that occurrence, the operator involved implemented new procedures intended to reduce the likelihood and consequences of a communication breakdown during vehicle‑assisted deflation. This included the following information:

Communication needs to be very clear not only on the radio but visually as well. This is where the second crew member is vitally important, if for whatever reason radio comms are lost between the PIC [pilot in command] and vehicle this crew member needs to be able to convey information between basket and vehicle. Whilst anyone is pulling over an envelope, please limit radio transmissions in other balloons and retrieve vehicles, multiple people using the same channel will cause cancelling of transmissions, PIC and driver only to use radio during the pull-down procedure with the vehicle driver “reading back” instructions, this ensures the information is correct and understood. If multiple balloons are about to begin collapsing their envelopes using mobile phones is preferred to ensure continuous communication. Discuss hand signals between crew members before commencing procedure and if at any-time communication either visual or verbal is lost STOP and wait until comms are restored.

The new procedure also contained information intended to reduce the consequence of a similar accident:

While collapsing envelope the pilot is to remain inside basket and passengers are to adopt landing positions.

Occurrence 201809492

At 0630 on 31 December 2018, a passenger on board a Kavanagh Balloons B‑400 sustained a minor injury when the basket tipped during a vehicle‑assisted deflation. During the deflation, radio interference resulted in a communication breakdown between the pilot and the driver of the vehicle. The driver was unable to hear the pilot’s command to stop, resulting in the vehicle driving too far, causing the basket to tip. At the time of the occurrence there were 18 passengers on board the balloon.

__________

6. Generally, the larger a balloon’s envelope size the more passengers the balloon can carry. Balloon with envelope sizes of 450,000 ft³ or greater are more likely to carry 20 or more passengers.

Safety analysis

This analysis will discuss how and why the basket tipped over during the vehicle‑assisted deflation and the effect of the passengers not being in the landing position. The risk management of vehicle-assisted deflation will also be analysed from both the balloon operator’s perspective and the commercial balloon industry and regulator more broadly.

Communication breakdown and procedures

During the vehicle-assisted deflation, the driver did not have vision of the basket and the pilot (in the basket) put the hand-held radio down. Subsequently, the pilot was unable to pick up the radio in time to order the driver to stop the vehicle when it became apparent that the basket would tip. In addition, the second ground crew member was not in a position to effectively communicate with the driver during the deflation. The scenario collectively meant that no one could quickly communicate with the driver to prevent the basket tipping.

Picture This Ballooning (PTB) did not have specific procedures for vehicle-assisted deflation or communicating during the process. The general loss of communication (radio failure) procedure was not suitable during vehicle‑assisted deflation because there was no time in which to access an alternative means of communication in the event of a communication breakdown.

The normal communication practice for vehicle-assisted deflation was for the driver to continue until the pilot instructed them to stop. However, the pilot could have a very short time to instruct the driver to stop if they approached the point where the basket tips. This would require continuous radio communication between the pilot and the driver, which was lost when the pilot put down the radio to open the vent. While the communications procedure in the company’s operations manual required pilot and ground crew to ‘maintain a continuous watch’ during flight, it did not stipulate the same during deflation. However, if the pilot needed two hands to open the vent, an alternative means of communicating with the driver was required.

The vehicle-assisted deflation process did not effectively utilise the second ground crew member and that person was not required to be in a position to be able to communicate with the driver by an alternative means such as shouting or signalling.

The pilot and ground crew did not use standard communication phraseology during the vehicle‑assisted deflation. The lack of standard phraseology can increase the likelihood of miscommunication or delayed actions.

Use of passenger landing position

The landing position was designed to reduce the likelihood and severity of injury during layover landings. ATSB analysis concluded that the injury profile of passengers within a basket that tips during a vehicle‑assisted deflation would be similar to when a basket tips during a fast landing.

PTB did not have specific passenger positioning procedures for vehicle-assisted deflation, nor was there a specific passenger briefing for this process. In addition, the pilot was unaware there was a risk of the basket tipping, and accordingly, did not instruct the passengers to assume the landing position during the vehicle‑assisted deflation. As such, most of the passengers were not in the landing position during the deflation and were thus exposed to a greater risk of injury when the basket tipped.

Awareness of tipping risk

The pilot and ground crew was unaware that there was a risk of the basket tipping during the vehicle‑assisted deflation. A greater awareness of the risks associated with vehicle‑assisted deflation would likely have prompted greater vigilance during the process and thus a reduced probability of the basket tipping. Further, the pilot would have been more likely to brief passengers on the risk and instruct on use of the landing position.

Operator’s safety risk management processes

Before the accident, the operator had not conducted a safety risk assessment of deflation techniques, nor were they required to by current regulations or their own management processes and practices. As a result, the operator had not properly considered the risks of vehicle-assisted deflation and so had not considered writing specific safety procedures to ensure it was done safely and the crew was aware of the risks.

Following a similar accident, another operator working under similar conditions developed a new procedure for deflation. This included measures to reduce the likelihood of a communication breakdown^[7] during vehicle‑assisted deflation and having passengers in the landing position during the process. This further indicates that if a risk assessment had been conducted by PTB, it is probable they would have identified communication breakdown and the risk of injury to passengers (if the basket tipped) as key operational risks requiring mitigation.

CASA guidance material

Guidance material produced by CASA did not contain information regarding passenger safety briefings during the deflation process.

Prior to the subject event, there had been two related accidents with similar contributing factors. More generally, the ATSB found limited awareness of any risks associated with vehicle‑assisted deflation in the commercial ballooning industry. It is likely that if guidance material had been issued by CASA on the risks associated with vehicle‑assisted deflation, it would have increased awareness of the associated risks with operators introducing large balloons to their charter operations.

As balloon charter operators are not presently required by regulation to have a safety management system (SMS), there was, and remains, a lower likelihood of these operators conducting risk assessments for changes in operations. Given another operator involved in a similar accident reported that they had not conducted a formal risk assessment of vehicle‑assisted deflation prior to the accident, guidance material from CASA could have drawn attention to the risks for these operators.

With the increase in the numbers of larger balloons registered in Australia, it is expected that the use of the vehicle-assisted deflation practice will similarly increase and will likely be used by a greater number of operators over time. Further, with larger envelope and basket capacities comes an increase in the numbers of passengers exposed to injury risk in the event of a basket tipping during a vehicle-assisted deflation. As such, this guidance will be important for helping educate other operators as they move to larger balloon operations in the future.

__________

7. Driver ‘reading back’ pilot’s instructions; use of mobile phones if radio interference is anticipated; second ground crew member to stand in a position visible to both pilot and the driver; and, if visual of verbal communications is lost, the driver is to stop and wait until communication are restored.

Findings

From the evidence available, the following findings are made with respect to the ground handling event involving a Kavanagh B‑400 balloon, registered VH-LNB, near Coldstream, Victoria on 16 March 2019. Two passengers were seriously injured when, during deflation, the balloon’s basket was inadvertently tipped by the vehicle assisting with deflation of the envelope. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The pilot put down the handheld radio to operate the vent line, and the second ground crew member was not in an observable position for the driver, which led to a communications breakdown and limited their opportunity to promptly command the driver to stop to avoid the basket tipping.
• The majority of the passengers were not in the landing position when the basket tipped, increasing their probability for injury.
• Picture This Ballooning did not have any procedures for conducting vehicle‑assisted deflation. [Safety issue]
• The pilot and ground crew were unaware of the risk of the basket tipping from the vehicle pulling the envelope during vehicle-assisted deflation.
• Picture This Ballooning's safety risk management processes and practices were not sufficient to facilitate the identification of key operational risks associated with vehicle‑assisted deflation. [Safety issue]

Other factors that increased risk

• The Civil Aviation Safety Authority provided no guidance for operators concerning the risks associated with vehicle‑assisted deflation. [Safety issue]

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Vehicle-assisted deflation procedures

Safety issue number: AO-2019-014-SI-02

Safety issue description: Picture This Ballooning did not have any procedures for conducting vehicle-assisted deflation.

Risk management processes

Safety issue number: AO-2019-014-SI-01

Safety issue description: Picture This Ballooning's safety risk management processes and practices were not sufficient to facilitate the identification of key operational risks associated with vehicle-assisted deflation.

Guidance on vehicle-assisted deflation risks

Safety issue number: AO-2019-014-SI-03

Safety issue description: The Civil Aviation Safety Authority provided no guidance for operators concerning the risks associated with vehicle‑assisted deflation.

Additional safety actions

ATSB safety advisory notice to all commercial balloon operators

Safety Advisory Notice number: AO-2019-014-SAN-014

To accompany this report and encourage proactive safety action, the ATSB has released a safety advisory notice to all commercial balloon operators informing them of the risks associated with vehicle‑assisted deflation.

The ATSB advises all commercial balloon operators utilising vehicle‑assisted deflation methods to review their current operational practices in light of the findings in the ATSB investigation report AO-2019-014 with the aim of mitigating the risks associated with the procedure. This review should be conducted with emphasis on:

• reducing the risks associated with a communications breakdown between the pilot and vehicle driver, and
• include a review of the positioning of occupants within the basket to minimise the likelihood of injury if the basket tips during the vehicle‑assisted deflation.

Future study proposed by Picture This Ballooning

Action number: AO-2019-014-NSA-015

Picture This Ballooning has informed the ATSB that, at the earliest practical date, they intend to study the forces present during the vehicle‑assisted deflation process and to pass these results to other commercial ballooning operators.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Picture This Ballooning
• The Civil Aviation Safety Authority
• The Bureau of Meteorology
• Witnesses
• Victoria Police.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Picture This Ballooning and the Civil Aviation Safety Authority.

Submissions were received from Picture This Ballooning and the Civil Aviation Safety Authority. There submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

At about 0931 Eastern Daylight-saving Time on 25 February 2019, Train TD 6591, an empty Comeng passenger train operated by Metro Trains Melbourne (MTM) collided with the end of line protection (buffer stop) at Newport siding, Victoria. The collision damaged the buffer stop and the front of the train. The leading carriage (333M) derailed, and the train driver (the only person on board) was hospitalised with minor injuries.

What the ATSB found

Recorded data showed that the driver applied the brakes 1.5 seconds prior to impact, which was after the train had passed the required stopping point. There were no driver inputs in the preceding 25 seconds, although no driver inputs other than a final brake application to stop the train were required during that period as the train was maintaining the required speed. While the train was equipped with a safety system (a pilot valve as part of the master controller) that was designed to apply the brakes in situations such as driver incapacitation, it was not activated to apply the brakes during the sequence of events. The recorded data indicated that sufficient pressure was maintained on the pilot valve (master controller). The driver may have been incapacitated for a period of time before the collision, however, the ATSB could not determine any details of incapacitation including duration and cause.

Although it was not identified as a contributory factor due to a day off prior to the accident, as a result of rostered work it is likely the train driver experienced levels of fatigue known to have an effect on performance during the week prior to the accident (but not on the day of the accident).

Safety message

This investigation highlights the importance of train safety systems to protect against driver error and incapacitation. In addition, drivers should maintain their health and fitness for work to reduce the likelihood of driver incapacitation, including adequate nutrition and hydration as well as consideration of the potential impact of fatigue. The ATSB SafetyWatch information on fatigue provides resources and guidance.

The occurrence

What happened

On 25 February 2019, Train TD 6591, a six-car Comeng passenger train, operated by Metro Trains Melbourne (MTM), travelled from Flinders Street Station to Newport Station, Victoria, where all passengers disembarked. The driver commanded the train to depart the station once receiving an indication that the train was empty, with the intention to stable^[1] it at Newport siding, 810 m from the station. CCTV footage showed the train transiting to the siding with the driver visible and appearing alert.

While approaching the stabling location, for about 25 seconds from 0930:35 Eastern Daylight-saving Time,^[2] there were no recorded inputs from the driver. At about 0931, the train collided with the end of line protection (buffer stop) and derailed. Recorded data showed a brake application about 1.5 seconds prior to impact, which was after the train had passed the required stopping point. The collision resulted in substantial damage to the front of the train and the buffer stop, and the driver was hospitalised with minor injuries (Figure 1).

Figure 1: Front of Comeng train TD 6591, showing collision with buffer stop and derailment

Source: ONRSR, annotated by the ATSB

The train driver reported losing consciousness for an unknown period of time. The last thing that the driver could remember was noticing the track points were set correctly on entering the siding, with the next memory being after the collision.

Train driver

The driver had been driving MTM trains and based out of Newport for over 3 years, was suitably qualified and held a Category 1 medical (assessed as fit for duty unconditional in accordance with the medical standards contained in the National Standard for Health Assessment of Rail Safety Workers). Following the collision, the driver was tested for drugs and alcohol and returned a negative result for both.

The driver was admitted to hospital due to injuries sustained and examined by medical professionals. The driver reported that after extensive testing the medical professionals categorised the incapacitation as a vasovagal syncope (a common faint), possibly due to dehydration and lack of nutrition. The driver reported having a coffee and a banana but no water on the morning of the accident. The maximum temperature on the day was recorded to be above 30 °C, and the driver reported that the drivers cab was warm prior to the loss of consciousness and that there was no way to control the temperature as it was pre-set through the train. The driver also reported that the sun felt hot coming through the window.

Train controls and pilot valve

The brake controller (Figure 2) commanded the train’s pneumatic brakes through driver inputs.

The train was also equipped with a pilot valve system which was designed as a fail-safe mechanism such that the brakes would apply if there was no pressure applied by the driver (such as from incapacitation). When the pilot valve was ‘opened’ the brake pipe pressure would release and the brakes would apply. In order to keep the pilot valve ‘closed’, pressure was required to be maintained by the driver through either a foot pedal or hand controller. The hand controller for the pilot valve (hand pilot valve) formed part of the master controller (Figure 2).

The driver was using the hand pilot valve at the time of the accident. The hand pilot valve required a minimum downward pressure of 0.6–1 kg be maintained on the master controller handle to keep the valve in a closed position, preventing the brakes from applying.

Post-accident testing of the train’s braking system and hand pilot valve found no faults that would have contributed to a failure to stop.

Figure 2: Comeng driver’s cab of 333M, showing location of the brake controller, and combined master controller with hand pilot valve

Source: MTM, annotated by ATSB

Logged data

Each driving cab of the train was fitted with a Vigilance Control Event Recorder System (VICERS) data logger that recorded the speed, acceleration and operational status of the driving controls. The data logger from the leading cab (333M) was reviewed as it was the active cab and also the first carriage to impact the buffer stop. The logged data showed the following:

• The train’s speed was maintained below 15 km/h during the stabling operation and the driver used several brake and throttle modulations to do so.
• Driver inputs stopped at 0930:35 and there were no further inputs for about 25 seconds, with a brake application at 0931:00
• The brake application about 1.5 seconds prior to impact (at 0931:00) was consistent with an emergency brake application commanded by movement of the brake controller.
• There was no recorded change of state of the pilot valve system until impact.

Additional safety systems

The train was equipped with two additional safety systems to assist in protecting against driver error and incapacitation: a trip-lever and a task-based vigilance system.

Trip-lever

A trip-lever would initiate emergency braking if the train passed a signal requiring the train to stop. In this accident, the train was entering a siding and did not pass any signals requiring the train to stop. Therefore, there was no requirement for the trip-lever to activate the brakes.

Task-based vigilance system

The task-based vigilance system monitored driver control inputs and if there were no inputs for a certain amount of time, a warning would sound. If the driver did not respond to that warning, the brakes would apply. The timer would reset when certain tasks were performed, such as operation of the master controller or brake controller.

At the time of the accident, due to the train’s speed, the system was operating on a 45-second interval. The 25-second time period which elapsed without driver inputs was therefore too short to activate the system.

Fatigue

The driver’s rosters for the three months prior to the accident and reported 72-hour history were reviewed as part of a fatigue analysis, which included the use of biomathematical modelling. The roster was input into two biomathematical modelling software programs, FAST^[3] and FAID.^[4] Biomathematical modelling forecasts the effects of circadian rhythms and sleep on performance, but cannot determine fatigue (or predict errors caused by fatigue) due to individual and situational circumstances.

Both models’ outputs indicated that the predicted levels of fatigue on the day of the accident were not in a range known to have a significant impact on performance. This was likely due to the driver having a day off work two days prior, which would have impacted the biomathematical modelling outputs.^[5] However, in the week preceding the accident, before the day off, both biomathematical modelling outputs predicted that the driver was likely experiencing levels of fatigue shown to have an effect on performance.

Safety analysis

The driver may have been incapacitated in the period prior to the accident and therefore temporarily lost awareness of the driving task, leading to the train not stopping at the designated stopping point as the driver did not apply the brakes in sufficient time. While it is possible the driver was incapacitated in the period before the collision, due to limited and conflicting evidence the cause, duration and presence of incapacitation could not be determined. Although dehydration was raised as a possible reason for why the driver may have fainted, the available evidence could not confirm this. In addition, although the logged data showed no driver inputs for 25 seconds followed by a brake application, the duration of any incapacitation could not be confirmed as no driver inputs other than a final brake application to stop the train were required during that period as the train was maintaining the required speed. However, the recorded brake application occurred after the train had passed the required stopping point (and therefore was not effective in stopping the train).

The pilot valve was part of the overall train safety system, including the trip-lever and vigilance system. In this situation, the pilot valve was the only aspect of the safety system that could have activated and applied the brakes to protect against driver incapacitation. The hand pilot valve required minimal pressure to prevent the brakes from applying. It is very likely that adequate pressure was maintained on the pilot valve (master controller) during the period when no driver inputs were made, and therefore this part of the safety system was not triggered to activate the brakes and stop the train.

The driver’s rosters for the previous three months were reviewed through a fatigue analysis, including the use of biomathematical modelling software. This analysis indicated, due to the number of rostered days worked and the timing of shifts, the driver was likely experiencing a level of cumulative fatigue known to have an effect on performance in the week preceding the accident, before the day off. However, aspects such as the time of day, the driver’s 72-hour history including a day off work, and the driver reporting being very alert, suggests that fatigue was a not contributing factor in this accident.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The driver did not apply the brakes at the required time to stop the train, nor did the pilot valve brake activate, resulting in the train colliding with the buffer stop and derailing.
• Due to rostered work it is likely the driver experienced levels of fatigue known to have an effect on performance during the week prior to the accident, but not on the day of the accident.
• The ATSB could not confirm the presence or length of any driver incapacitation before the accident.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. To leave rail traffic unattended and secured, usually in a siding.
2. Eastern Daylight-saving Time (EDT) was Coordinated Universal Time (UTC) + 11 hours.
3. Fatigue Avoidance Scheduling Tool (FAST®). FAST predicts fatigue based on actual sleep and work schedules, and critical event scenarios using a model of human fatigue and circadian variation in cognitive performance and alertness.
4. Fatigue Audit Interdyne (FAID) Quantum. FAID predicts sleep opportunity, and as a proxy, estimates fatigue due to work-related causes.
5. For FAID, a recovery value is assigned depending on the length of non-work periods and the time of day that they occur.

Overview of the investigation

On 12 February 2018, the ATSB commenced an investigation into a loss of tractive effort on train 8466 at Ardglen, New South Wales (NSW), which occurred on 10 February 2019.

Train 8466, operated by Qube Logistics, was planned to transport mineral concentrate from Cobar, NSW, to Port Waratah, NSW. During the journey, 10 wagons were added. This required the addition of another locomotive, which was attached at Werris Creek.

The train departed Werris Creek with three diesel-electric locomotives (QBX005, QBX004 and QBX001) hauling 61 wagons with a total length of 961 m. The train crew consisted of two drivers.

After pausing briefly at Chilcotts Creek, the train made its way up the 1 in 40 grade to the Ardglen Tunnel, until its speed dropped and it came to a stop near the distant signal on the approach to Ardglen. The driver inspected the locomotives but did not identify any problems.

The driver restarted the train, but soon after locomotive QBX001 began to perform erratically, intermittently losing tractive effort. The locomotive began to provide tractive effort again, and the train accelerated to 18 km/h and entered the northern portal of the tunnel at 11 km/h.

About 2 minutes after entering the tunnel, locomotive QBX005 derated to produce no tractive effort, and within another minute, the other two locomotives also derated to produce no tractive effort. The tunnel was filled with exhaust smoke, which entered the lead locomotive QBX005’s operating cab and reduced the drivers’ visibility.

When the driver sensed the train was moving again, he assumed the locomotives were producing tractive effort, but the train was actually rolling backwards towards the northern portal of the tunnel. When the train approached the tunnel’s exit, the driver realised the problem and made a full service brake application. The second driver made an emergency call to train control, who advised the track behind the train was clear and the points were set correctly to protect the train movement. Ultimately, the train rolled back a total distance of 982 m. Although this was an unplanned event, communications between the train crew and train control at all stages ensured protection was in place.

As part of its investigation, the ATSB interviewed the drivers, reviewed the train’s event recorder data and obtained loading records for the train and other trains used by the operator. The ATSB also obtained and reviewed the operator’s investigation report on the occurrence.

Based on this information, it was identified that:

• The train’s initial documentation, prepared by the train crew, indicated that the 61 wagons weighed 4,636 t (76 t per wagon). A subsequent calculation by personnel in the operator’s customer service centre, and entered into the operator’s transport management system prior to the train’s departure, was 4,392 t (72 t per wagon). This latter weight was erroneous, and after the occurrence the actual weight was determined to be 4,608 t. However, the operator reported that the locomotive capability for the planned route was 5,148 t (1,716 t per locomotive), in excess of the actual weight.
• The locomotives were manufactured in 2015. Locomotive QBX001 had previously experienced derating issues due to its exhaust sensor not operating consistently to deliver accurate temperature readings to the locomotive management system. It had recently been repaired and certified by an external contractor, which involved a temporary repair of a wiring harness. However, during the occurrence sequence, the locomotive continued to experience intermittent faults with the exhaust sensor.
• Ardglen Tunnel had no exhaust or gas ventilation or artificial illumination. When in the tunnel, exhaust gases from the locomotives surrounded the locomotive bodies and were forced forward of the locomotives, resulting in the ingestion of exhaust gases into the locomotives’ engine air intakes.
• There was no requirement for an operator to carry oxygen self-rescue units in the lead locomotive of a train passing through the Ardglen Tunnel, although such units were required for operating through the Ulan Tunnel (which the train normally operated through). Such oxygen self-rescue units were on board locomotive QBX001, but the crew had not transferred them to the lead locomotive QBX005 (nor were they required to do so).
• The driver was presented with ambiguous and incomplete information when the three engines derated. He saw that the lead locomotive had derated, but there was no visual indication that both the trailing locomotives had derated, and no audible indication that the trailing locomotives derated. While in the tunnel, the driver sighted the speed indicator consistently displaying a speed above 0 km/h, but the indicator did not differentiate between forward and reverse speed.
• The operator identified several proposed actions to improve the safety of its operations.

ATSB comment

Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

Safety summary

What happened

On 21 January 2019, freight train 6BM9 was to travel from a logistics terminal in Barnawartha in northern Victoria to Altona, in Melbourne. The train consisted of two locomotives and 31 freight wagons. The train departed Barnawartha at about 1400 and travelled in a south-westerly direction through Wangaratta, Benalla and Euroa.

At 1530, the train passed through Creighton travelling at about 100 km/h. About 0.5 km after crossing Creighton Siding Road, the leading bogie of the third-last wagon derailed. The wagon derailed a short distance before a rail bridge. The train was brought to a stop with minor damage to the wagon and track, and no injuries.

What the ATSB found

The ATSB found that the wagon probably derailed as a result of the lateral misalignment of the track. The track misalignment was not evident to the locomotive crew when the train entered the location and developed under the dynamic loading of the train.

The track misalignment was probably primarily the result of track lateral instability. A mud hole at the derailment location had resulted in poor ballast support of sleepers, reducing the track’s resistance to movement. A combination of this degraded support and compressive forces within the rails created conditions for track instability. The longitudinal compressive forces were due to the hot conditions of that day, and possibly localised low stress-free-temperatures in the rails near the rail bridge.

The Australian Rail Track Corporation’s (ARTC) systems for managing track lateral stability did not lead to the location being managed as a special location potentially vulnerable to instability. Although the reduced ballast profile at the mud hole had been identified and monitored in accordance with the ARTC code of practice, more significant levels of response were available to manage the risk of instability. These included repair or imposing a temporary speed restriction when temperatures reached a predetermined limit.

What has been done as a result

ARTC advised that its Track Stability Management Plan (TSMP) for the section containing Creighton has been reviewed. As a result, the 2019/20 TSMP included Stress Free Temperature testing at several sites, and 13 sites were identified as special locations for the monitoring of track stability, including the Creighton derailment site.

ATSB has made a safety recommendation for ARTC to review its systems for the identification and management of track vulnerable to instability, considering the findings of this report.

Safety message

It is important for rail infrastructure managers to have systems in place to identify track sections vulnerable to lateral instability during the summer period.

The occurrence

Events prior to the derailment

On the afternoon of 18 January 2019, SCT Logistics container service 6BM9 departed Bromelton in Queensland to travel to Altona in suburban Melbourne, Victoria (Figure 1). The train consisted of two locomotives hauling 18 wagons.

Figure 1: Intended route of train 6BM9 from Bromelton, Queensland to Altona, Victoria

Source: Google earth annotated by Chief Investigator, Transport Safety (Victoria)

The train arrived at Taree, New South Wales (NSW) at 0324 on Saturday 19 January, where there was a change of crew. The train then travelled to Leightonfield, for another crew change at about 1210 the same day. The next crew change was at Wagga Wagga at 1950, also on the same day. The next stage of the journey, between Wagga Wagga in NSW and Barnawartha in Victoria, was also uneventful, the train arriving just after midnight on 20 January.

Due to capacity constraints at its final destination in Melbourne, the train was held at the SCT Logistics terminal in Barnawartha for about 38 hours. During this stop, 13 wagons were added to the consist to give a total of 31. The train crew for the next leg joined the train on 21 January at about 1230. The train was inspected, and departed Barnawartha at about 1400.

The derailment

The train travelled in a south-west direction through Wangaratta, Benalla and Euroa. It was handling as expected out of Euroa, and crested Creighton Bank at a speed of about 95 km/h. On the downgrade following the crest, the train’s speed increased to about 108 km/h.^[1] The driver progressively reduced the throttle setting from Notch 8 to Notch 2 before crossing Creighton Siding Road at a speed of about 102 km/h. The train then crossed two short bridges before a wagon derailed immediately ahead of a third bridge at about 1540. The crew reported that they had not noticed any track irregularities prior to the derailment.

The driver stated that he saw a plume of dust towards the rear of the train in the rear view mirror and he also observed a loss of brake pipe (BP) pressure. The End-of-Train device (EOT)^[2] registered a reduction in BP pressure, followed by a reduction of pressure in the locomotive electronic air brake (EAB)^[3] system.

The train came to a stop with the lead locomotive just past the 141 km post. After stopping, the crew initiated an emergency call to network control. One of the crew then inspected the train and identified that the leading bogie of the third-last wagon (CTQY 666T) had derailed (Figure 2).

Figure 2: Derailed bogie of wagon CQTY 666T

Source: Australian Rail Track Corporation (ARTC).

Observations following derailment

Immediately following the derailment and prior to the drop in temperatures that evening, the track at the derailment location was inspected by the rail infrastructure manager, the Australian Rail Track Corporation (ARTC). The track exhibited a significant lateral misalignment (Figure 3).

Figure 3: Track misalignment photographed at 1710 on 21 January, after derailment

Source: Australian Rail Track Corporation

This photograph was taken soon after the derailment in temperatures similar to those existing at the time of the derailment, and prior to the track cooling overnight. It shows a significant track misalignment ahead of the rail bridge.

__________

1. Train speeds provided are as recorded on the data logger from locomotive SCT004
2. End-of-Train device measures brake pipe pressure on the last wagon and displays it on the driver’s console.
3. Electronic Air Brake (cab controls)

Context

Track information

Track location

Creighton is located in the rural municipality of the Strathbogie Shire Council in north central Victoria, about 143 rail-km from Melbourne (Figure 4).

Figure 4: Track between Violet Town and Avenel, indicating incident location Creighton

Source: e-way street directory, Melway 2017, annotated by Chief Investigator, Transport Safety (Victoria)

This rail corridor extends between Melbourne and Wodonga in northern Victoria and is part of the interstate standard-gauge^[4] rail connection between Melbourne and Sydney. Since July 1998, the standard-gauge network in Victoria has been managed by the Australian Rail Track Corporation (ARTC).^[5]

The corridor continues to receive significant investment. The North East Line Upgrade^[6] project commenced planning in 2018, started works in 2019 and is due for completion in 2021. The scope of the project includes the removal of mud holes, drainage improvements, replacement of ballast and resurfacing including packing and compacting of ballast.

The standard-gauge track on the north east corridor has a history of mud hole formation and rough ride. In 2011, the ATSB conducted an investigation to examine the safety of rail operations on the Melbourne to Sydney line.^[7] ATSB found that train forces on a weakened formation, as well as the effects of highly fouled ballast, poor drainage and heavy rainfall during 2010 and 2011, contributed to the development of mud-holes and poor vertical alignment on this corridor.

Typical track construction

The structure of a track consists of a number of components, including the rail, sleepers, ballast and the formation (Figure 5).

Figure 5: Track structure

Source: Chief Investigator, Transport Safety (Victoria)

The formation is the earthworks upon which the ballast is laid and typically consists of the sub-grade (earth fill on top of the natural earth) and a capping layer of compacted material that provides a sealing layer to the sub-grade. The ballast covers the capping and distributes the loads to the formation while also providing the necessary support to the sleepers to maintain track geometry under vertical, lateral and longitudinal loads. Sleepers and their fastenings support and locate the rail.

Track at Creighton

There were two parallel, standard-gauge bi-directional tracks at Creighton—an east and west track. The incident train was travelling towards Melbourne on the east track. The maximum permitted speed for this line segment was 130 km/h and there were no temporary speed restrictions in force at this location, nor had any speed restrictions been imposed due to heat. The authorised speed for the class of train that derailed was 115 km/h.^[8]

The east track through Creighton was constructed using 60 kg/m Continuous Welded Rail (CWR)^[9] affixed to 250 mm deep concrete sleepers using Pandrol ‘fastclip’ resilient fasteners. Concrete sleepers were at a nominal spacing of 667 mm.^[10] Construction standards specified ballast at a depth of 250 mm and a shoulder width of 300 mm.^[11] The standard stated that the ballast shoulder height be determined by the sleeper design.

Creighton Siding Road is located 143.276 rail-km from Melbourne.^[12] Travelling towards Melbourne, there were seven rail bridges over a relatively short distance. They were located at 142.944 km, 142.852 km, 142.710 km, 141.827 km, 141.505 km, 141.161 km and 140.880 km (Figure 6). The derailment occurred a short distance before the bridge at 142.710 km, and the train came to a stop just prior to the bridge at 140.880 km.

Figure 6: Incident track section

Source: Pass Assets, Public Transport Victoria, Annotated by Chief Investigator, Transport Safety (Victoria)

Rail bridge construction

The point of derailment was between the short rail bridges at 142.852 km and at 142.710 km. Both bridges were transom bridges, with timber sleepers fixed to I-beam girders supported at each end by concrete abutments. Rails were secured to sleepers with Trak-Lok type fastenings that had a design toe load of approximately 9 kN for each fitting. The rail bridge at 142.710 km was about 7.4 m long and in good condition (Figure 7).

Post-incident track inspection

An examination of the track following the derailment identified misaligned track up to the 142.710 km rail bridge and associated lateral displacement of sleepers. Significant ballast fouling was observed from 16 to 27 m before the rail bridge. The most severe fouling and loss of ballast profile was from about 20 to 24 m prior to the rail bridge (Figure 7). A dip in the track through this mud hole location was observed.

Site evidence indicated that the initial derailment was of a single wheelset that had derailed to the left of the track before the bridge at 142.710 km. The point of mount of the left-hand wheel and the drop-off points of both wheels could not be determined with certainty. There was some indication of the right-hand wheel having dropped inside the right rail about 10 m before the rail bridge. There was further evidence indicating that the second wheelset (of the same bogie) derailed prior to the next bridge at 141.827 km.

Figure 7: Mud hole and track buckle on east track before bridge located at 142.710 km.

Source: Chief Investigator, Transport Safety (Victoria)

This photograph was taken in the early morning of the day following the derailment. The rails had contracted in the cooler overnight temperatures and the magnitude of the track misalignment had reduced from its peak. The photograph shows the heavy fouling of the ballast about 20-24 m ahead of a short rail bridge.

At the location of the mud hole there was severe contamination of the ballast and a loss of ballast between sleepers, and at sleeper ends (Figure 8).

Figure 8: Mud hole at the derailment location

Source: Chief Investigator, Transport Safety (Victoria)

Post-derailment rail stress free temperature measurements

Following the derailment, ARTC reinstated the track during cooler temperatures, and without the need to cut rail. Following track restoration, the stress free temperature (SFT) of each rail was measured by ARTC.^[13] Measurements were made at 142.760 km on the evening of 23 January 2019, with rail temperatures at about 23°C. The ARTC measurements estimated an SFT in the Up rail (left rail looking towards Melbourne) of 34°C, and an SFT in the Down rail of 36°C. It is not known the extent to which stress in each rail may have been equalised along their length as a result of the derailment and the subsequent restoration works.

Pre-derailment track inspections

Track patrols and inspections

The ARTC Track and Civil Code of Practice detailed the requirements for track patrols, general inspections and detailed inspections.^[14]

ARTC undertook track patrols every 7 days or as specified in their Track Maintenance Plan (TMP). These patrols were typically performed from road-rail vehicles. Unscheduled inspections were also carried out in response to ‘defined or abnormal events’ and included those required at special locations where defects were more likely.^[15]

ARTC conducted a range of other general and detailed track inspections to monitor the condition of track infrastructure, ranging in frequency from 6 to 24 months. ARTC standards specified that the general inspection of track stability be conducted as temperatures started to increase after the cold season, normally the end of August, and as close as possible to, or in conjunction with, the ballast general inspection.

Inspection outcomes

Previous inspections had identified the presence of the mud hole on the Creighton (Down) side of the 142.710 km rail bridge, and this was recorded within the ARTC’s Routine Maintenance – Defect Work Orders. Defect Work Orders for at least the previous two years indicated that the mud hole was monitored fortnightly but no remediation was undertaken.^[16] The same inspection finding and response was made in all prior inspections with the report closed-out on the maintenance management system with the note ‘remove mud hole, PO^[17], supervisor, excavator, tamp, undercutter bar 36 tonne ballast’. The most recent track patrol inspection at the location prior to the derailment was conducted by road-rail vehicle on 14 January 2019.

There were no other specific findings or outstanding actions identified from previous general or detailed inspections at this location.

Track geometry

Track geometry was measured every four months using the ‘AK-Car’^[18] to assess geometry against maintenance standards. Parameters measured included track gauge, cant, twist and rail vertical and lateral variation.

The most recent geometry measurements at the derailment location were made on 10 October 2018. The TOP^[19] recorded by the AK car in the vicinity of the mud hole just before the bridge at 142.710 km indicated rapid changes in TOP measurement but was within permitted tolerance. As there was no exceedance of standards, no outstanding actions were recorded. The deviation in LINE^[20] recorded by the AK car was no more than 5 mm in the vicinity of the mud hole, and was within permitted tolerance.

Management of lateral stability of track

Introduction

A track buckle occurs when the longitudinal expansion of rails in hot conditions leads to high compressive forces, and the track structure is unable to prevent the track from moving laterally to relieve the stresses developed within the rails. Managing the lateral stability of track therefore involves both the management of rail stress, and the design and maintenance of track support structures including ballast.

Management of rail stress

Continuously Welded Rail (CWR)

The ARTC code of practice for Track Lateral Stability specified a rail stress-free temperature (SFT) of 38°C in track with CWR. The SFT is the temperature at which there are no temperature induced stresses in the rail.^[21] An SFT is chosen to minimise the potential for track buckle (in hot conditions) and for a rail break (in cold conditions). The SFT of a rail can change over time if there is longitudinal creep of the rail. CWR affixed to concrete sleepers using resilient fasteners has an enhanced ability to resist longitudinal creep forces.^[22]

Rail fastenings

Rail fasteners generate a toe load on the rail flange, providing resistance to longitudinal movement, and to rail roll and lateral shift. High toe loads mean that rail and sleeper are more likely to act as a single assembly.^[23] The resilient fastenings used on track at this location were Pandrol ‘fastclip’.^[24] For concrete-sleepered track, the ARTC standard required a minimum designed toe load per rail seat (two fastening clips per rail seat) of 15 kN for track with axle loads not exceeding 25 t. Although toe load is related to longitudinal creep resistance, there is no direct and consistent relationship.

Monitoring of rail stress free temperature

ARTC track standards specified that rail creep monitoring and control measures would not usually be necessary at locations with CWR with concrete sleepers and resilient fastenings.^[25] The standard noted that this arrangement was known to provide good resistance to longitudinal rail movements, but that ‘practices for the measurement of rail creep should be considered and take into account the influence of fixed points in the track’. ^[26] There were no creep monitoring facilities through the Creighton location.

Changes in a rail SFT are not easily observed in CWR.^[27] ARTC did not check SFT in CWR affixed to concrete sleepers unless it was identified during detailed inspection that the SFT may have lowered. In such cases, ARTC measured rail SFT using VERSE testing.^[28] This testing involved unfastening 30 m of rail and lifting the rail by hydraulic jack. By measuring the lifting force and height, and the rail temperature at the time of the measurement, it was possible to estimate the temperature of the rail at which it would be stress free (the SFT). The ARTC Track Stability Management Plan for the Sydney to Craigieburn corridor for the 2018-2019 high temperature season did not require the SFT of rail to be measured through the Creighton location.

Ballast requirements for lateral resistance

Ballast performs a critical function in maintaining track stability. The ARTC standard^[29] for ballast specified the required ballast profile, and the required corrective action should the profile be diminished (Table 1). Pictorial definitions of the reduced ballast profile are provided at Appendix A.

Table 1: ARTC Ballast Profile Condition - Response Codes

The data was for track with concrete sleepers and curvature >400 m radius, and freight line speed of 115 km/h.

Source: ARTC

The response code table notes^[30] state that ‘in concrete sleepers the responses apply where height and width deficiencies occur over 10 m or greater.

Standard for special locations

ARTC procedures for managing track stability stated that a location that has an increased risk of track stability were defined as a special location.^[31] Further, special locations are defined as areas:^[32]

• potentially vulnerable to instability
• with a history of instability, or
• where the SFT is ‘suspect’.

These procedures stated that special locations may require rectification work or more detailed inspections prior to the high temperature season and typically, special locations may include:

• track sections with a history of lateral instability or pull-apart failures
• bunching points
• areas with non-conforming ballast profile
• sites with localised initiators (e.g. mud holes).

The procedures specified that sites required to be monitored as special locations shall be determined and are to be recorded in the Asset Management System (AMS) and a register attached to the Track Stability Management Plan (TSMP).

Track Stability Management Plan

The Track Stability Management Plan (TSMP) was designed to be regularly updated and included actions to be undertaken to manage track lateral stability in accordance with ARTC standards and procedures.

The TSMP covering the Creighton location applied to defined sections of concrete-sleepered track between approximately 30 and 200 rail-km from Melbourne. It was last updated (prior to the derailment) on 24 September 2018,^[33] and was endorsed by the Corridor Manager Sydney to Craigieburn. The plan included results of Stress Free Temperature (SFT) measurements since the previous plan review, and a schedule of planned SFT measurements. There were no ‘previous’ or scheduled SFT measurements at the derailment location.

The plan noted that after establishment of concrete sleepers between 200.614 and 99.305 km in 2016, inspections had indicated that there had been little or no evidence of creep. Creep measurements were no longer taken and SFT measurements were taken in locations identified during track inspections.

The plan detailed ‘Buckling Resistance Management’ and the requirement to define locations with ballast deficiencies that required temporary speed restrictions when forecast temperatures reached or exceeded 38°C.^[34] There were no such locations identified within the plan.

The plan included a special locations register, although there were no locations listed on the plan provided.

Track buckling predictor

In 2017, ARTC published a document^[35] on the use of a predictor model to assist with the prediction of instability by estimating the rail temperature at which the track was likely to buckle.

The ARTC buckling predictor was based on the Schramm^[36] and Bartlett^[37] models developed in the 1960s. The Schramm model is an empirical model based on field data whereas the Bartlett had a combined empirical and theoretical basis. The output of the predictor model was an estimate the temperature of the rail at which the track may buckle.

The train

Locomotive crew

The drivers for this sector were suitably qualified and had been assessed as medically fit.

Locomotives and wagons

SCT Logistics container service 6BM9 from Barnawartha consisted of two locomotives SCT004, SCT012 and 31 wagons. The first 25 wagons were carrying containerised goods. Wagons 26 to 29 each carried two empty containers, while wagon 30 carried one empty container. The last wagon was not carrying any containers. The train was about 991 metres long and had a trailing tonnage of 2072 t.

The derailed wagon CQTY666T (wagon 29) was a two-slot container flat wagon loaded with two empty containers, each weighing about 2.28 t (Figure 9).

Figure 9: Derailed wagon CQTY 666T

Source: Advisian, Worley Parsons Group.

The wagon was travelling with its B-end leading with the lead bogie CAYE 6300 derailing. The wagon was fitted with AAR 2E, three-piece ride control bogies of nominal capacity 23 tonne axle load. The bogies were fitted with Stucki type constant contact side bearers and conventional AAR 4:1 brake rigging.

Post-incident inspection of wagon

Post-incident inspection of the wagon and the bogies revealed minimal wheel tread wear with moderate operational spalling damage. The light to moderate bolster gibb contact indicated either extended operation on poor track or bogie hunting.

Components of the friction wedge system such as wear plates, friction wedges and bolster pockets were all partially worn, while the wedges and side frame column wear plates were in good condition. The most likely cause of this wear would be inadequate attention to friction wedge pockets in the bolster at overhaul (Figure 10).

Figure 10: Bogie components

Source: Advisian, Worley Parsons Group, annotated by Chief Investigator, Transport Safety (Victoria).

Weather conditions

Around the time of the derailment, the temperature at Shepparton was approximately 38 °C. Shepparton is about 39 km from Creighton and it is probable that conditions at Creighton were similar. From 19 January, the Bureau of Meteorology had forecast a maximum temperature of 39 °C for Shepparton on 21 January 2019.

__________

4. 1435 mm gauge.
5. ARTC is incorporated under the Corporations Act, with all shares owned by the Commonwealth of Australia,
6. Managed by ARTC.
7. RO-2011-015 – Safety of rail operations on the interstate rail line between Melbourne and Sydney
8. Individual trains may be limited in speed depending on their class, rolling stock classification and other criteria.
9. Rail lengths welded end-to-end into strings greater than 400 m.
10. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Sleepers and fastenings, Section 2, Version 2.0.
11. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Ballast, Section 4, Version 2.4.
12. All chainage figures used in this report are based on the asset records maintained by Public Transport of Victoria. There are small differences between these figures and those used by ARTC.
13. Using VERSE system
14. ARTC, Track Patrol, Front of Train, General and Detailed Inspections ETE-00-02
15. Ibid.
16. The mud hole location is identified at ARTC chainage 142.688 – 142.700, that varies slightly from asset system chainages. This mud hole is the same mud hole as that identified on site immediately prior to the point of derailment.
17. Protection Officer.
18. The AK car is a track inspection vehicle also known as a track recording car used to test several geometric parameters of the track without obstructing normal railroad operations. The cars use a variety of sensors, measuring systems, and data management systems to create a profile of the track being inspected.
19. TOP is the up or down variation (vertical) from the mean alignment of the rail and is measured by the AK car.
20. LINE is the variation on a horizontal plane from the mean alignment of the rail and is measured by the AK car.
21. At the SFT, if a small section of rail was removed, the gap would remain constant. It would neither close nor widen unless the rail temperature was to change.
22. Australian Railway Infrastructure standard AS7639:2013 Track Structure & Support.
23. Nafis Ahmad, Shah Sanjar & Mandal, Nirmal & Chattopadhyay, Gopinath & Powell, J. & Micenko, P. (2011). Improvement of rail creep data to measure the stress state of a tangent continuously welded rail (CWR) track
24. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Resilient Rail fastenings for medium Duty Concrete Sleepers – Design ETD-02-02.
25. Fastenings that exert a toe load on the rail foot inhibiting creep.
26. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Track Lateral Stability, Section 6, Version 2.5.
27. By comparison, in jointed track the expansion and contraction of rail can be observed and simple measurements taken at joints to estimate the stress condition of the rail at temperature extremes.
28. VERSE is a proprietary device used for non-destructively measuring the Stress Free Temperature in rail, and is marketed by Pandrol Australia Pty Ltd.
29. ARTC Engineering (Track & Civil) Code of Practice, Section 4 Ballast, 5 September 2012
30. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Ballast, Section 4 - Note 2 to tables 4.3, 4.4 and 4.5.
31. Australian Rail Track Corporation, Managing Track Stability, ETM-06-08, Version 1.1.
32. Australian Rail Track Corporation, Managing Track Stability, ETM-06-08, Version 1.1, Section 3.8.
33. Seymour Track Stability Management Plan
34. In accordance with ARTC Code of Practice – Section 4
35. Track Buckling Predictor ETI-06-06, Version 1.0, 16 March 2017.
36. Schramm, G. (Trans. Lange, H.). Permanent Way Technique and Permanent Way Economy. 1st Edition. 1961.
37. Bartlett, D.L.(1960) The Stability of Long Welded Rails, Civil Eng. and Public Works Review Vol. 55, No. 649, 1033-1035, NO. 650, 1170-1171, No. 651, 1299-1303, No. 653, 1591-1593.

Safety analysis

Lateral Track Stability

When rail temperatures exceed the stress free temperature (SFT) of continuously welded rail (CWR), the rail will be in longitudinal compression. This scenario occurs regularly over the summer period. In this instance, the ambient air temperature was around 38°C. Rail, particularly when exposed to direct sunlight, reaches temperatures considerably higher than the ambient. In this instance, the rail temperature was probably of the order of 57°C.^[38] This rail temperature is about 20°C above the nominal design SFT^[39] and so rails would have been in a state of longitudinal compression in the environmental conditions at the time of the derailment.

Under such conditions, maintaining track stability relies on rail fastenings and track support, including ballast, to resist the forces acting to laterally misalign (buckle) the rails. Ahead of the rail bridge at 142.710 km, there was a mud hole and a loss of ballast profile around sleepers. This reduced resistance to track lateral movement and increased the potential for track instability at this location.

Site evidence was also consistent with a loss of track stability through this location. Deformed track formed an ‘S’ buckle that ended at the rail bridge. The bridge had probably acted as a fixed point.

Inspection of the derailed bogie did not identify defects or out-of-tolerance items, although there was some evidence of bogie hunting. The locomotive driver did not observe the misalignment ahead of the train, meaning the buckle developed under the dynamic loading of train 6BM9. It is possible that bogie behaviours influenced the magnitude of the load on the track. The wagon that derailed was carrying empty containers, probably making it more vulnerable to flange-climb derailment than the loaded wagons earlier in the consist.

Consequences

In this case, one bogie on the freight train derailed, resulting in minor track damage. However, had the bogie of train 6BM9 not derailed on the misalignment that had formed under the train, the XPT passenger service travelling from Sydney to Melbourne may have encountered the track misalignment. It was expected to pass through the location about 80 minutes after the derailment, at 1650.

Factors contributing to track instability

Methodology

In 2017 ARTC published a model for predicting the temperature at which track in a given condition may buckle. The prediction tool was based on older models developed by Bartlett and Schramm.

For this investigation, the part of the ARTC prediction tool that draws on the Bartlett model has been used to examine the potential for track buckle at the Creighton derailment location. Bartlett attempted to quantify the relative importance of rail, fastenings and ballast and developed a quasi-theoretical model.^[40] It is recognised that the model provides an indication only of buckling temperature and sensitivity to key parameters, rather than definitive prediction. The sensitivity to buckling of three parameters are considered; ballast profile, the amplitude of a lateral defect acting as a buckle initiator, and the stress free temperature of the rails.

For modelling using the ARTC buckling predictor, a number of parameters were fixed based on the conditions at site, and with some assumptions (Table 2).

Table 2: Input parameters used in predictor model

Sensitivity to reduced ballast profile

The potential influence of a loss of ballast profile on the predicted track buckling temperature was examined for a range of ballast shoulder widths,^[45] and model predictions made for different values of initial misalignment, and rail stress free temperature (Table 3).

Table 3: Variables used in modelling sensitivity to ballast profile

The predicted buckling temperatures for a range of scenarios was compared to the estimated rail temperature at the time of the incident. The results of the prediction model indicate that at ballast shoulder widths of under 100 mm, track misalignment was plausible, particularly in the presence of a higher initial misalignment and/or lower rail stress-free-temperatures (Figure 11).

Figure 11: The influence of ballast shoulder on predicted track buckling temperature

Source: Model information and tools published by ARTC, with input data by Chief Investigator, Transport Safety (Vic)

Local misalignment acting as buckle initiator

Ballast through the mud hole was significantly degraded. The potential impact of such a loss of support was two-fold. It resulted in a loss of lateral resistance to track buckle, and also the potential for the development of a lateral ‘initiator’ for track buckling. The most recent track geometry measurement was taken in October 2018, and indicated no lateral defects over 5 mm. However, the measurement was taken prior to the summer period before the derailment. The development within the mud hole of a buckle initiator of increased amplitude either over time, during the passage of other trains prior to train 6BM9, or under train 6BM9, are all possible scenarios. The sensitivity to the magnitude of an initial misalignment was modelled for a range of rail stress free temperatures and a fixed ballast shoulder width of less than 100 mm (Table 4).

Table 4: Variables used in modelling sensitivity to ballast profile

The predicted buckling temperatures for a range of scenarios was compared to the estimated rail temperature at the time of the incident. The results of the predictor model indicate that the magnitude of the buckling initiator is a significant factor in the predicted magnitude of the lateral buckling force and the potential for a heat-induced buckle. The model suggests that with an initial lateral misalignment of over 10 mm, track buckle was plausible, particularly in the presence of lower rail stress-free-temperatures (Figure 12).

Figure 12: The influence of rail misalignment on predicted track buckling temperature

Source: Model information and tools published by ARTC, with input data by Chief Investigator, Transport Safety (Vic)

Variation of stress-free-temperature over a track section

The SFT of a rail can change over time, either by the rail moving through its fastenings or the track (rail with sleepers) creeping longitudinally. Research has found that SFT can vary considerably over a section of track, particularly near track features such as turnouts, crossings and bridges.

Esveld^[46] reported on research commissioned by the International Union of Railways (UIC) to improve knowledge of forces in CWR track. This work included conducting simultaneous day and night measurements of longitudinal and lateral rail displacements, longitudinal forces in rails as well as temperature of rails in straight-line sections, sharp curves, turnouts and adjoining zones.

Figure 42 from this research (reproduced as Figure 13) shows the longitudinal distribution of stresses (shown as Neutral Rail Temperature (NRT) or SFT as used in this report) measured simultaneously across a 350 m section of tangent track through a complete day-night cycle. Esveld showed that for the rail section studied, the average SFT was approximately 33°C but the actual SFT varied along the length of rail due to two effects. Firstly a variation of about 7°C with a change in actual rail temperature as rail cools and heats during a 24 hour period and secondly, a variation from 27 to 40°C along the length of the rail during the hottest part of the day (in each case disregarding the readings at the extremities of the test section). Therefore, understanding the distribution of stress as well as the variation with ambient temperature is important to understand the risk of buckling.

Figure 13: Typical short-term track response on the straight section of CWR track when the lateral movements reach a few millimetres.

Source: C Esveld (1998) Improved Knowledge of CWR Track, ERRI Committee D202 paper on study commissioned by the International Union of Railways (UIC.

The ARTC standard for installing CWR on concrete sleepers specified an SFT of 38 ± 5 °C. Following this incident, the rails were unfastened, straightened and the SFT of each rail estimated using VERSE testing. The measurements were taken approximately midway between the bridges bounding the section of track in which the derailment occurred. There was not a large difference between the two rails, with their estimated SFT being 35 ± 1 °C.

This instance presented an unusual scenario with bridges at end of a section of about 140 m in length. The extent to which there may have been localised creep towards the bridge at 142.710 km prior to the derailment cannot be ascertained or estimated. By way of example, a localised additional compression of 2 mm over a 20 m length of rail equates to a reduction of about 8°C in the rail’s SFT. This in turn would have the effect of heightening the likelihood of track instability.

Using the ARTC predictor tool, the sensitivity to a localised reduction in rail SFT was predicted for a range of initial lateral misalignments (initiators) and a fixed ballast shoulder width of less than 100 mm (Table 5).

Table 5: Variables used in modelling sensitivity to rail stress free temperature

A localised reduction of SFT of 5-10°C on the measured post-incident 35 °C ‘average’ for the section (to an SFT of 25-30°C) would have resulted in heightened likelihood of track buckle, particularly in the presence of an initial lateral misalignment of more than 10 mm (Figure 14).

Figure 14: The influence of rail SFT on predicted track buckling temperature

Source: Model information and tools published by ARTC, with input data by Chief Investigator, Transport Safety (Vic)

Summary

It is not feasible to determine the extent to which each facet of the track condition contributed to its instability and vulnerability to misalignment under loading from rail traffic. However, it can be concluded that a reduced ballast profile through the location contributed to track instability either through a broad loss of lateral resistance, or a localised loss of resistance that resulted in an increased value of initial misalignment (buckling initiator).

Any localised reduction in SFT in the rails abutting the rail bridge would also have increased the likelihood of a track buckle forming at this location.

Management of lateral stability at mud-holes

Standards for managing stability

Track ballast

To support management of track stability, ARTC specified maintenance requirements for track ballast, and associated response measures for reduced ballast shoulders. Maintenance records indicate that the mud hole was being monitored (response code A6) and the mud hole listed on the Routine Maintenance – Defect Work Orders. This response was probably in compliance with the ARTC code of practice that specified response codes for a shoulder deficiency over at least 10 m. While the localised ballast profile deficiency in the more severely contaminated area was probably consistent with the profile identified for an A5 or A4 response, this deficiency did not extend the 10 m required by the Code to trigger such a response.

Special locations and treatment

ARTC procedures for managing track stability categorised locations that had an increased risk of track instability as special locations. This potentially included sites with localised initiators like mud holes. The mud hole at Creighton had been identified by ARTC but had not been categorised as a special location. The procedures did not provide clear guidance to field staff on facets of ballast condition within a mud hole that might trigger its designation as a special location. Such criteria may have included mud hole severity, length or proximity to a fixed point that may heighten the track’s vulnerability to lateral instability.

Special locations required rectification work or more detailed inspections prior to the high temperature season. As the Creighton location was not identified as a special location, it was not remedied in line with the special location process.

Track Stability Management Plan

The Track Stability Management Plan (TSMP) was designed to be regularly updated and included actions to be undertaken to manage track lateral stability in accordance with ARTC standards and procedures. The plan detailed ‘Buckling Resistance Management’ and the requirement to define locations with ballast deficiencies that required temporary speed restrictions when forecast temperatures reached or exceeded 38°C.^[47] There were no such locations identified within the plan for the 170 km section that included Creighton.

The plan noted that after establishment of concrete sleepers in 2016, inspections had indicated that there had been little or no evidence of creep. Creep measurements were no longer taken by ARTC and therefore the evidence base for this commentary within the TSMP is unclear.

SFT measurements were taken at locations identified as those where SFT may have been compromised. Evidence suggests identified locations were mostly those areas that had been affected by track disturbance. The criteria for the selection of other sites for SFT testing, that had no clear trigger such as disturbance or compromised geometry, were not clearly defined.

Rail stress management

In those areas on this corridor with established concrete-sleepered CWR track, ARTC did not have a program of network-wide monitoring of rail stress. This maintenance policy appears based on the position that this type of track construction was less likely to creep, and lead to variation in rail SFT of a magnitude that would trigger track buckle or rail breaks. Monitoring of variation in SFT was limited to those sites identified by inspection or following track disturbance, typically from maintenance activity.

The regime established by ARTC for the management of rail stress may not identify all locations in the network with potentially problematic variation in SFT. It could not be established whether the suite of standards and procedures used by ARTC to manage rail SFT, and its implications on track stability, adequately managed this risk.

__________

38. Rail temperatures may be fifty per cent more than ambient. Wu Y., Munro P., Rasul M.G., Khan M.M.K., A review of Recent Developments in Rail Temperature Prediction for use in Buckling Studies, RTSA Conference on Railway Engineering, Wellington, 2010. In this instance the rail was exposed to direct solar radiation.
39. The nominal SFT of rail on this corridor was 38 ± 5 °C.
40. ARTC document ETI0606T-01 Track Buckling Predictor, version 1.0, 16 March 2017, Technical notes.
41. This value is set by the predictor model.
42. A nominal figure has been used consistent with the Schramm model set value of 10m.
43. The model specified options for a factor of 0.1 (Smooth riding wagon), 0.2 (Slightly hunting wagon), 0.3 (Moderately hunting wagon) or 0.4 (Badly hunting wagon). The factor 0.3 was used for all modelling based on the wagon inspection that suggested some hunting behaviour.
44. The model provides a range of 0 and 250000 for tonnes of traffic since resurfacing. This is a measure of interlocking and support of the ballast, and accounts for recent disturbance. Given the fouling and degradation of ballast in the vicinity of mud holes, a nominal, intermediate tonnage value of 100,000 has been has been used to minimise the impact of use of extreme values for this parameter.
45. The width of ballast shoulders at the end of sleepers.
46. Esveld C, Improved Knowledge of CWR Track retrieved 22 September 2020. D202_Paris_98.PDF (esveld.com)
47. In accordance with ARTC Code of Practice – Section 4

Findings

From the evidence available, the following findings are made with respect to derailment of freight train 6BM9.

Contributing factors

• A mud hole and the associated loss of ballast resulted in a reduction in track lateral resistance at the derailment location.
• There were significant longitudinal compressive forces in the rails at the derailment location due to the hot conditions of the day and possibly localised reduction in rail SFT leading into a rail bridge.
• The combination of reduced track lateral resistance and longitudinal compression within the rails was sufficient for the track to misalign under the dynamic loading of train 6BM9, and for one wagon to derail.
• The loss of ballast profile at the derailment location probably required a more significant level of response than being monitored, such as a temporary speed restriction or repair.
• The ARTC systems for managing track lateral stability did not lead to the location being managed as a location potentially vulnerable to instability. [Safety issue]

Other findings

• ARTC systems for monitoring rail stress free temperature (SFT) in concrete-sleepered CWR track probably did not identify all locations that have SFT outside the Code of Practice guidelines.

Safety issues and actions

Management of track lateral stability 

Safety Issue Number: RO-2019-003-SI-01 

Safety issue description: The ARTC systems for managing track lateral stability did not lead to the location being managed as a location potentially vulnerable to instability.

Response by Australian Rail Track Corporation

The ARTC advised that this location was not deemed to be a special location. The process for identifying special locations, targets locations susceptible to incorrect SFT and instability.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Australian Rail Track Corporation reviews its processes and criteria for identifying and managing track locations vulnerable to lateral instability, considering the findings of this investigation report.

Additional safety action by Australian Rail Track Corporation

ARTC advised that their Track Stability Management Plan (TSMP) for the 30–200 km section had been reviewed by its internal audit team. As part of the 2019/20 TSMP, 10 sites had been subject to VERSE (Stress Free Temperature) testing, and 13 sites identified as special locations for the monitoring of track stability. This included the Creighton derailment site.

General details

Train details

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• SCT Logistics
• Locomotive drivers
• Recorded data from locomotive data loggers.

References

Nafis Ahmad, Shah Sanjar & Mandal, Nirmal & Chattopadhyay, Gopinath & Powell, J. & Micenko, P. (2011). Improvement of rail creep data to measure the stress state of a tangent continuously welded rail (CWR) track.

Schramm, G. (Trans. Lange, H.). Permanent Way Technique and Permanent Way Economy. 1st Edition. 1961.

Bartlett, D.L.(1960) The Stability of Long Welded Rails, Civil Eng. and Public Works Review Vol. 55, No. 649, 1033-1035, NO. 650, 1170-1171, No. 651, 1299-1303, No. 653, 1591-1593.

Wu Y., Munro P., Rasul M.G., Khan M.M.K., A review of Recent Developments in Rail Temperature Prediction for use in Buckling Studies, RTSA Conference on Railway Engineering, Wellington, 2010. In this instance the rail was exposed to direct solar radiation.

Esveld C, Improved Knowledge of CWR Track www.esveld.com/Download/TUD/D202_Paris_98. PDF retrieved 22 September 2020.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

Submissions were received from:

• Australian Rail Track Corporation
• SCT Logistics
• Office of the National Rail Safety Regulator.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – ARTC pictorial definitions of reduced ballast profile

Source: ARTC Engineering (Track & Civil) Code of Practice Section 4 Ballast

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Overview of the investigation

At 0325 Eastern Daylight-savings Time on 6 February 2019, a Pacific National loaded coal train, MR280, travelling from Moolarben to Kooragang Coal Terminal, derailed near Baerami on the Ulan branch line on the Hunter Valley Network. All wheels of the leading bogie of the 88th wagon derailed and travelled in a derailed state for approximately 1.83 km. As the derailed train reached the points of the Baerami crossing loop, another five wagons derailed and three wagons rolled on their side, narrowly missing a stationary empty coal train UL369.

The Australian Rail Track Corporation was the rail infrastructure manager for the Ulan branch line.

ATSB’s preliminary evidence collection revealed:

• There were known track defects constituting a complete track formation failure in the section of track at the point of mount and in the region approaching the derailment site. Post derailment track measurements confirmed there was a failure of the track formation at the site of the derailment.
• These defects were not treated in accordance with the ARTC’s code of practice, and they deteriorated more rapidly than expected and consequently contributed to the derailment.
• The multiple defects acted in a compounding manner but were treated in isolation. ARTC’s code of practice allowed for consideration of multiple defects and the compounding effect and required more stringent action to be taken accordingly.
• It is likely ineffective track drainage in the area of the derailment contributed to the loss of track formation.
• Prior to the derailment, track workers that inspected the section of track where the derailment occurred had identified a defect that they did not report into the asset management system, contrary to the requirements of the system.
• The last train to successfully traverse the section of track was WG949, and the train crew identified rough riding. However, an inconsistent application of the read-back element of network rule ANGE 204 (Reporting and Responding to Conditions Affecting the Network) likely resulted in the rough riding report not being acted upon.
• Train management of MR280 was consistent with operating procedures and the condition of the rolling stock did not contribute to this derailment.

Reasons for the discontinuation

The ATSB considered the contributing factors to the derailment were a result of individual actions, where personnel had not executed the intent of the ARTC code of practice and/or had not followed procedures as required.

In response to the incident, the ARTC took safety action, including:

• implemented a daily ‘known conditions review’ meeting at all provisioning centres so that call outs, TCR’s and known conditions could be frequently reviewed with other current information and ensure appropriate controls were in place for the management of defects
• issued a communication to key operational staff to reiterate the requirements and their responsibilities under network rule ANGE 206.

Based on this information, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues or identify opportunity for the enhancement of transport safety. Consequently, the ATSB has discontinued this investigation.

Safety summary

What happened

On 28 January 2019, at 1908 Eastern Daylight-saving Time,^[1] a Sikorsky S-64E Skycrane, registered N173AC and operated by Erickson Inc., collided with water at Wood Creek Dam, Victoria. The collision occurred following an approach to the dam to fill an external tank with water for firebombing operations. All the crew exited the aircraft and swam to shore. One crewmember was seriously injured and two were uninjured. The aircraft was substantially damaged.

What the ATSB found

The ATSB found that the approach path to the dam was incrementally shortened over the course of the days’ operation. It is likely that the final tight approach path was at the upper margins of allowable speed and angle of bank, requiring a steep flare that contributed to the aircraft entering vortex ring state on approach.

Furthermore, the shape of the dam and surrounds of the site reduced the opportunity for recovery, and the aircraft impacted the water. The carriage of additional crew increased the risk of injury, while training for emergencies directly supported the crew’s survival.

What's been done as a result

Erickson Inc. advised that the following safety action was taken in response to this occurrence:

• vortex ring state avoidance and recovery was to be emphasised in future training and checking
• a policy preventing non-essential personnel from being aboard during firefighting operations had been introduced.

In addition, the organisation that facilitated operation of the United States‑registered Skycrane during Australian firebombing operations, Kestrel Aviation, advised that the following safety action was also undertaken:

• It was reiterated to pilots that, though aircrew work in close partnership and cooperation with aerial attack supervisors (AAS), AAS instructions are advisory. The pilot in command retains full authority to make decisions to ensure the safety of the aircraft and management support was available if escalation was required.
• Kestrel Aviation increased the frequency of contact with Erickson Inc. crews to provide safety management support, and reduce operational pressure.

Safety message

When performing aerial work it is easy to accept incremental changes that gradually reduce margins. While these changes often increase efficiency, it is worth checking how much an operation has deviated from earlier versions and re-evaluating elements if they appear less stable.

Helicopters excel in confined areas, yet are vulnerable when operating within them. Periodic reassessment of confined areas, and approach and departure profiles, should be done throughout the duration of an operation. Both supervising parties and operating crews are well-positioned to do this.

The ATSB has previously emphasised the importance of Helicopter Underwater Escape Training (HUET) for all over-water helicopter operators. This accident demonstrates the value of HUET in saving lives.

Following an accident, it is common to overlook the need to unplug one’s helmet. Using a good quality extension cable that will maintain the integrity of communications and release under tension in the event of an emergency can also save lives.

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) +11 hours.

The occurrence

What happened

On 28 January 2019, a Sikorsky S-64E Skycrane, registered N173AC, operated by Erickson Inc., was prepared for firebombing flying activities at Essendon Airport, Melbourne, Victoria. The Crew Chief, a licenced aircraft maintenance engineer, confirmed the aircraft’s serviceability and readied it for flight.

The crew of N173AC comprised three specialists:

• Pilot in Command (PIC), handling the aircraft and managing the task
• Second in Command (SIC), supporting the PIC with operational calculations and monitoring
• Crew Chief, voluntarily supporting the crew in flight with systems knowledge, and keeping a lookout for obstacles behind the aircraft, from a rearward‑facing seat.

The crew were highly experienced in S‑64 firebombing operations. The PIC had eighteen years’ helicopter experience and had operated the S-64 for four years. The SIC had forty-four years’ helicopter experience, twenty years flying S-64, and had been firefighting in Australia for twenty years. The Crew Chief had thirty-four years’ experience in helicopter engineering, including twenty-six years maintaining and developing the S-64.

All the crew reported that they were acclimatised and well-rested. Both pilots acted as alternating PIC and SIC in two-hour cycles throughout the day. The PIC sat in the left seat, and the SIC in the right. The pilots exchanged positions and roles prior to the beginning of each cycle. The accident occurred on the third cycle of the day.

Figure 1: Sikorsky S-64E Skycrane helicopter, N173AC

Source: Uniform Photography

History of the flight

At about 1000 Eastern Daylight‑saving Time,^[2] the crew repositioned the aircraft to Latrobe Valley Airport, 125 km east of Melbourne. There, they rested and prepared the aircraft while awaiting further instructions. After lunch, the crew was tasked with firebombing activities to the west of Thomson Dam, Aberfeldy, Victoria (Figure 2).

An aerial attack supervisor (AAS) coordinated the aerial assets for the firefighting mission. The AAS identified a dip site.^[3] The considerations for selection of the dip site included:

• no obstacles or wires
• that the site would remain clear of smoke
• the distance from the flame front allowing efficient delivery of suppressant
• aircraft working in concert could fill and drop their load while maintaining safe separation from each other.

Once the AAS identified the dip site, they showed the firebombing crew its location. The firebombing crew then had the final say on the dip site’s suitability for the operation.

Figure 2: Dip site location (Fire boundary as of 31 January 2019)

Source: Country Fire Authority

The dip site was Wood Creek Dam, 7 km west of the fire front. It sat at 3,480 ft above mean sea level, at the eastern base of Mount Gregory, in the Yarra Ranges National Park, Victoria (Figure 3). It had a narrow body and steep sides surrounded by tall trees. The crew assessed the dip site as confined, but not outside acceptable limits of operation.

The flight crew used the Aircraft Weight Reference Guide to calculate how much water the aircraft could carry, and then reduced the calculated figure by 91 kg to optimise performance for departure from the dip site.

Figure 3: The steep sides and narrow body of the dip site pictured from the west

Source: Department of Environment, Land, Water and Planning, Victoria, annotated by the ATSB

The crew used the aircraft’s pond snorkel^[4] to fill the tank. The snorkel required the aircraft to be stationary for up to 45 seconds, and a dedicated pump provided the pressure to fill the tank. While there were operating instructions and a checklist, there were no specific procedures around approaching waterways with a pond snorkel.

The operator classified firebombing as an external load operation, since the suppressant can be jettisoned. Procedures for control of the aircraft during external load operations required:

• descent with any combination of airspeed and rate of descent as long as rate of descent was below 800 ft/min when below 200 ft above ground/water level
• landing with a nose-up attitude of less than 10° in order to avoid tail skid strike
• limiting angle of bank to 30° for safe operation when the Automatic Flight Control System (AFCS) was engaged
• AFCS to be engaged in normal operations in order to smooth pilot inputs
• minimum clearance to obstacles of half a main rotor diameter (11 m for the S‑64).

During filling, the helicopter was positioned one main rotor diameter from the left-hand side of the dam for the PIC to keep visual hover references. This left no more than two rotor diameters to the right.

On each fill, the crew flew a descending right turn, stopped in a high hover, then descended vertically into the dam. Satellite data showed early approaches had a final approach length of 300 m to 400 m. As the aircraft crossed the southern tree line of the dip site, airspeed averaged 30 kt, and the rate of descent averaged 630 ft/min.

After a number of water drops, the AAS re-tasked the crew to fight a flame front further north, which was east-northeast from the dip site. Each drop was also incrementally further north. This resulted in the crew gradually tightening the approach to the dip site (Figure 4).

Figure 4: Change in working location over time

Source: Google Earth, Kestrel Aviation, annotated by the ATSB

During the occurrence approach, the tighter approach resulted in a greater than normal flare^[5] to arrest the aircraft at the aiming point in the dip site. The higher nose pitch up prompted the SIC to advise the PIC to move forward of the trees before descending any further to ensure tail rotor clearance. Clear of the trees, the flare was increased.

While descending with a nose-high attitude, the aircraft struck the water tail-first, submerging and removing the tail rotor, causing rapid rotation to the right through one and half turns. While rotating, the main rotor blades separated as they contacted water. The right cockpit door separated from the fuselage, and the aircraft came to rest on its left side, submerging the cockpit.

Each crewmember recalled the rehearsed drills from their helicopter underwater escape training (HUET). They identified their seat belt and nearest exit to orientate themselves in the aircraft. They all waited until the last moment to draw a breath, and did not unbuckle and exit the helicopter until motion had ceased. The crew reported that it was not possible to see anything underwater, and that jet fuel contamination was present.

The SIC in the right seat exited through his doorway, from which the door was already missing. The PIC could not open his door so he swam across the cabin (up) and was assisted by the SIC to exit through the right hand door. As the rear door was jammed, the crew chief in the aft seat pushed out a window from the rear of the cabin, and exited through it.

Neither pilot unplugged their helmet. However, the extension cords from the aircraft to the helmet plug allowed the plug to release, preventing the helmets from snaring the pilots. All three crew escaped, and inflated their life jackets. Two crew were uninjured, and one crewmember sustained a knee injury.

At the time of the accident, crews aboard S-76 and S-61N helicopters were assessing the potential of the dip site for later use in night operations. An AAS aboard the S-76 relayed details of the accident to an incident controller who enacted the emergency response plan. Neither the S-76 nor the S-61N was equipped or able to provide direct assistance, other than monitoring, and relaying information.

Following exit from the helicopter, the only form of communication available to the Skycrane crew was hand signals. They gave thumbs-up indications to the crew of the overhead S-61N to advise that they were okay. The Skycrane crew then swam to shore and trekked through dense bush to a road where they were met by rescuers.

Meteorological information

The crew received a situation report, including weather and a common barometric pressure^[6] as they began the firefighting activity. Following the failure of a 4G-equipped iPad earlier in the day, beyond this report, the crew did not have access to up-to-the-minute weather data.

The weather on the day saw temperatures over 25°C, a significant reduction from recent heatwave conditions. Winds aloft were northerly and pushed plumes of smoke to the south. The crew and witnesses to the event all assessed the wind to have been a northerly. The crew of the Skycrane advised that the wind had dropped off from around 16 kt and remained a light northerly.

Turbulence was reported to be mild. Outside of smoke, visibility was greater than 10 km. At the time of the accident, the sun was at 258°, and 15° above the horizon.

Locations on the ground showed significant local variation in wind direction and strength throughout the day (Figure 5).

Figure 5: Local variation in wind speed and direction. (15-minute average 1900 to 1915)

Source: Google Earth, Wunderground, Bureau of Meteorology, annotated by the ATSB

Flight recorders

It was a contractual requirement that all firefighting aircraft were equipped with satellite tracking devices. That data was stored remotely from the aircraft and was available shortly after the accident. The system recorded the location, altitude, heading, and groundspeed of the aircraft at 15‑second intervals for the duration of operation.

The Skycrane was also fitted with a Universal Avionics CVR-120 cockpit voice recorder (CVR). Divers recovered the CVR 45 days after the event, once the complex task of recovering the helicopter allowed access to the device. The CVR, submerged for the duration, showed little outward damage, yet voice data could not be recovered from the unit.

Vortex ring state

Vortex ring state (VRS) is a condition of powered helicopter flight that causes a loss of lift in the rotor system. During normal operation, the rotor system pushes large amounts of air down while it produces lift. If the helicopter descends into this downwash, the air can recirculate back up and over the rotors instead of it flowing down and away. This causes the same parcel of air to circulate around the rotor. As a result, the rotor system no longer has the steady stream of air required to produce lift and the helicopter will descend despite the application of additional power.

The United States Federal Aviation Administration Helicopter Flying Handbook details the methods of VRS recovery as follows:

The traditional recovery is accomplished by increasing airspeed, and/or partially lowering collective to exit the vortex. In most helicopters, lateral cyclic thrust combined with an increase in power and lateral antitorque thrust will produce the quickest exit from the hazard. This technique, known as the Vuichard Recovery (named after the Swiss examiner from the Federal Office of Civil Aviation who developed it) recovers by eliminating the descent rate as opposed to exiting the vortex.

The crew were trained to use the Vuichard recovery technique for recovery from vortex-ring state. In the Skycrane, it requires the pilot to apply full power, right cyclic^[7] and left pedal to side slip the helicopter out of its own downwash and into the ascending air just outside of the rotor system.

Safety analysis

Shortening of approach and vortex ring state

The sun progressed to a point low in the west, opposing the crew’s turn onto final approach, and casting long shadows from the steep sides, across the tree line and the surface of the dam. The crew reported that from their angle of approach the surface looked glassy, supporting their assessment of the wind becoming lighter. Video recorded shortly after the event showed that the shape of the dip site and shadows disguised a light tail wind. Wind was only visible on the surface through a 10-degree arc from the south-southwest.

A witness to the event reported that the aircraft had an apparent high rate of descent and a nose‑high attitude. The crew reported that they did not feel that any of the parameters were excessive, though speed and angle of bank were felt to be at the higher end of their normal range.

The satellite data showed the accident approach was a right-hand turn, with about a 30° angle of bank, and a radius of 150 m. The rate of descent developed from 650 ft/min to 780 ft/min. All flight parameters were within operational limits, however the length of the final approach was considerably shorter than earlier approaches (Figure 6).

The shorter approach at the upper end of the acceptable envelope of operation required a steeper than normal flare to stop the helicopter. The crew reported that once they descended below the tree line, the aircraft generated no lift and fell into the dip site, colliding with water. The crew stated that they had very likely encountered vortex ring state (VRS). The topography, high rate of powered descent, and steep flare that reduced the airspeed, created conditions conducive to the onset of VRS. The crew reported that the rapidity of onset and dimensions of the dip site did not provide enough time or space to manoeuvre sideways to effect a recovery.

Figure 6: Shortening of final approach path

Source: Google Earth, Kestrel Aviation, annotated by the ATSB

Carriage of additional crew

The operator’s operations manual stated that only flight crew and crew essential to the operation could be carried aboard the aircraft during firefighting operations. The operation could be conducted without the Crew Chief and not all company Crew Chiefs were on board their aircraft during firefighting operations.

While the Crew Chief had significant system and task knowledge, he was not required to be on board the helicopter. On this occasion, his presence exposed him to the significant hazards associated with underwater egress. More generally, the carriage of additional personnel during specialised operations like firefighting exposes them to unnecessary risk.

Egress from the submerged helicopter

Although two other helicopters were overhead, and their crews had activated the emergency response, no immediate assistance was available to the Skycrane crew. The crew had to rely on their own resources and equipment to survive.

The crew reported that Helicopter Underwater Escape Training (HUET) was fundamental to their survival. HUET enabled the crew to act rationally and decisively when submerged in the cockpit and to use the regularly‑practiced drills to escape the aircraft.

Additionally, the helmet cord release mechanism (Figure 7) prevented snaring and potential drowning after the pilots exited the submerged aircraft without unplugging their helmets.

Figure 7: Helmet cord release mechanism

Source: ATSB

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The crew conducted a tight descending right hand turn into the dam, inside the upper margins of the flight envelope. This approach required a steep flare on arrival and likely resulted in the rapid onset of vortex ring state.
• The dam’s steep sides and narrow tapered body provided limited opportunity for vortex ring state recovery actions, contributing to collision with water.
• The Crew Chief's presence aboard the aircraft during firebombing operations exposed him to unnecessary risk.
• All crewmembers credited their survival to skills learned and practiced in Helicopter Underwater Escape Training. In addition, the helmet cord extension cables detached easily from the aircraft, contributing directly to the crew's egress from the flooded cockpit.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

2. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
3. Dip site: A body of water at which firebombing aircraft draw water for firefighting operations.
4. Pond snorkel: A flexible hose which hangs below the helicopter to allow the tank to be filled from a variety of water sources.
5. Flare: the nose-up pitch of a helicopter used to reduce airspeed and rate of descent.
6. Common barometric pressure: All aircraft in the vicinity set the same pressure on the subscale of the altimeter. This allows aircraft to more accurately maintain vertical separation from each other.
7. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the fore, aft, and lateral direction.

Safety summary

What happened

On the morning of 22 January 2019, a British Aerospace (BAe) 146-300, registered VH-NJZ, landed in Sydney, New South Wales, en route from Melbourne, Victoria, to Brisbane, Queensland on a scheduled freight operation.

Before commencing the cargo-unloading process, a tail strut was attached to the rear of the aircraft. After completion of the cargo-unloading and loading process, the aircraft was taxied for departure to Brisbane with the tail strut still attached. During the take-off roll, the tail strut detached, resulting in the runway being contaminated with foreign object debris.

The complete tail strut was recovered from the runway and the aircraft continued to Brisbane, where it landed without further incident.

What the ATSB found

The ATSB found that pre-departure checklist items, required to be performed by the captain and engineer in a challenge-and-response manner, were not completed. This negated the value of the checklist as a risk control, and resulted in a missed opportunity to detect the tail strut’s presence prior to departure.

The ATSB also found that the engineer performing the aircraft turn-around had no effective means or procedure to contact the aircraft while it was taxiing. As a result, and despite attempting various methods, the engineer was unable to alert the flight crew that the tail strut was still attached to the aircraft.

What's been done as a result

Following the occurrence, the operator disseminated Safety Alerts to relevant staff highlighting the despatch procedure, including the challenge-and-response requirement for the relevant cockpit to ground checklist.

The operator also provided appropriate control tower telephone numbers to engineering staff at all operating bases, allowing them to contact the tower immediately if required.

Finally, the operator emailed all company pilots, further highlighting the despatch procedure. This included the requirement that when the aircraft’s tail strut was not used, the local ground support equipment tail strut was to be visible to the flight crew prior to aircraft despatch.

Safety message

Checklists are an essential tool for overcoming limitations with memory, and ensuring that action items are completed in sequence and without omission. While their value may not be obvious for routinely performed tasks, the incomplete use of checklists has been cited as a factor in previous aircraft accidents.

The occurrence

What happened

On 22 January 2019, a British Aerospace 146-300, registered VH-NJZ (NJZ), was being operated by National Jet Express on a scheduled freight service between Melbourne, Victoria and Brisbane, Queensland via Sydney, New South Wales. At about 0415 Eastern Daylight-saving Time,^[1] NJZ landed in Sydney and exited the runway for freight-loading operations.

A licenced aircraft maintenance engineer employed by Cobham Aviation Services reported marshalling NJZ in, and the flight crew subsequently shut down the aircraft’s engines. The engineer placed chocks at the nose wheels and instructed the flight crew to release the parking brake. The engineer positioned boarding stairs at the forward left cabin door and attached a tail strut^[2] to the rear of the aircraft (Figure 1). The tail strut was part of the Sydney Airport ground support equipment. The engineer also had the option of using a tail strut that was carried on board the aircraft.

The engineer reported opening the aft lower cargo hold door, on the rear right side of the aircraft to retrieve the sill protectors.^[3] The engineer waited for the aircraft freight door to be opened remotely by the captain, installed the sill protectors, and conducted an external visual inspection of NJZ. After the inspection, the engineer engaged in a brief conversation with the flight crew, and returned to the line hut to await completion of loading by the loading team.

The captain reported completing an external visual inspection of the aircraft then returned to the cockpit to plan the next sector to Brisbane with the first officer. Upon completion of loading by the loading team, the captain positioned himself at the top of the boarding stairs and the engineer returned to the aircraft. The engineer removed the freight door sill protectors and signalled the captain to commence lowering the freight door. After the freight door was closed, the engineer visually checked that it was flush with the aircraft skin and that the locks had correctly engaged. The engineer then signalled the captain that the freight door had locked correctly. The captain replied with a thumbs-up, entered the aircraft and closed the cabin door behind him.

The engineer proceeded to the aft lower cargo hold door on the right side of the aircraft, stowed the sill protectors, closed and locked the cargo hold door. The engineer then walked back around towards the front of the aircraft and positioned the boarding stairs clear. The engineer connected a headset to the nose of the aircraft for communications with the flight crew and removed chocks from the nose landing gear wheels. The engineer then took up a position at the nose of the aircraft to commence communications with the flight crew for engine start.

The captain confirmed communications with the engineer, and the engineer responded ‘stowed and closed, you are clear all four’. The flight crew proceeded to start all four engines. After the engines were all started successfully, the engineer disconnected the headset, closed the communications panel, and proceeded into the line hut to put away the headset and torch. At 0451, NJZ taxied forward out of the bay and then toward holding point Golf for take-off on runway 16R.^[4]

Figure 1: Example of a tail strut fitted to NJZ and showing opened freight door

Source: Cobham Aviation Services Australia

At that time, a ground staff member from a different company arrived at the line hut on a tug and informed the engineer that NJZ had commenced taxiing with the tail strut still in place. Leaving the line hut, the engineer proceeded outside and saw that NJZ had commenced taxiing towards the runway. The engineer began pursuing the aircraft on foot, and attempted to attract the captain’s attention by waving his arms and shouting. The engineer, realising he wouldn’t be able to get the pilots’ attention, joined the ground staff member on the tug and proceeded after NJZ.

The engineer did not have a contact number for the Sydney Control Tower and was therefore unable to inform them of the situation quickly. Instead, he telephoned National Jet Express Maintenance Watch^[5] and asked them to contact the flight crew to inform them of the situation. National Jet Express Maintenance Watch relayed the message to National Jet Express Operations,^[6] who in turn attempted unsuccessfully to contact both pilots by mobile phone.

The engineer, realising that he was not going to catch NJZ prior to it entering the runway, approached a nearby works safety officer. As the engineer was asking the safety officer to immediately contact the tower via radio, to prevent NJZ from taking off, the aircraft turned onto runway 16R, powered up and departed.

The captain reported that during the take-off roll, he felt his phone vibrating in his pocket but did not answer as he was concentrating on the departure.

Following the aircraft’s departure, Sydney Tower closed Taxiway Bravo and runway 16R to allow a visual inspection to take place. A Sydney Airport ground safety worker subsequently located the tail strut, took photographs, and recovered the multiple components (Figure 2). The photographs of the recovered tail strut components were sent to the engineer’s mobile phone and the engineer confirmed that the entirety of the tail strut had been recovered. The engineer relayed this information to National Jet Express Maintenance Watch, who passed it on to the captain. The captain, satisfied that the entire tail strut had departed the aircraft, continued the flight to Brisbane.

On arrival at Brisbane, air traffic control requested that NJZ land on a secondary runway in case there was any residual part of the tail strut still attached to the aircraft. The aircraft landed and stopped on the runway without incident, and the rear of the aircraft was inspected by a Brisbane Airport ground safety officer. NJZ was then permitted to taxi to its bay. Engineers subsequently inspected the rear of the aircraft and no damage was evident.

Figure 2: Tail strut as found on Sydney runway 16R post NJZ departure

Source: Sydney Airport

Operator despatch procedure

The operator’s Bae146 Aircraft Ground Operations manual detailed the cockpit to ground communication requirement as listed in Table 1.

Table 1: Stand-Off Bay Despatch Using Intercom Checklist

The engineer stated that during the turnaround of NJZ, prior to stowing the sill protectors, he walked past the tail strut and did not remove it. The captain and engineer commenced the required checklist prior to engine start. During this verbal exchange the challenge-and-response checklist was shortened to ‘We are stowed and closed you are clear for all four’. Immediately after the engineer disconnected communications from the aircraft the engineer proceeded into the line hut. He reported that this did not allow him an opportunity to view the tail strut as the aircraft taxied past.

Safety analysis

During pre-departure checks, the verbal exchange between the captain and engineer was not performed in accordance with the Stand‑Off Bay Despatch Using Intercom challenge-and-response checklist. While that was possibly the result of it being a routinely performed task, it negated the value of the checklist as a risk control, and presented a missed opportunity to detect the tail strut prior to departure.

The engineer had no effective means or procedure to contact the aircraft while it was taxiing. Despite that, he attempted various methods to contact the flight crew but was unable to alert them to the tail strut still being attached to the aircraft prior to take‑off.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• During pre-departure checks, the full checklist between the captain and engineer was not completed. This negated the value of the checklist as a risk control and resulted in a missed opportunity to identify that the tail strut was still attached to the aircraft prior to it departing the bay.
• The engineer had no effective means or procedure to contact the flight crew while the aircraft was taxiing. As a result, the flight crew were not alerted to the error prior to take‑off.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Following this occurrence, on 23 January 2019, Cobham Aviation Services issued a Safety Alert to relevant staff that highlighted the despatch procedure including the cockpit to ground checklist requirements.

Cobham also provided appropriate control tower telephone numbers to engineering staff at all operating bases. This allows staff to immediately contact the tower if a need arises.

Cobham also emailed all company pilots, further highlighting the despatch procedure. This included the requirement that when the aircraft’s tail strut was not used, the local ground support equipment tail strut was to be visible to the flight crew prior to aircraft despatch.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Daylight-saving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. A tail strut supports the rear of an aircraft while cargo is loaded and unloaded.
3. The sill protectors are metal guards to protect the sill of the freight door area from damage during loading and unloading.
4. Runway name: the number represents the magnetic heading of the runway. The letter designates the qualifier for multiple runways (left/right) if necessary.
5. National Jet Express Maintenance Watch is an internal company department that provides engineering advice to the operating fleet.
6. National Jet Express Operations is an internal company department that monitors the operating fleet.

Safety summary

What happened

On the morning of 19 January 2019, a Eurocopter EC130 helicopter, registered VH-YHS, conducted a private flight from Moorabbin Airport to an authorised landing area (ALA) near Mansfield, Victoria with the pilot and two passengers on board. A return flight to Moorabbin was planned for later that afternoon.

At about 1500 (Australian Eastern Daylight Time - AEDT), the pilot and passengers boarded the helicopter at the ALA for the return flight. The pilot prepared for take-off and lifted off the helicopter more rapidly than he normally did. As the helicopter became airborne, it began to rotate counter-clockwise (yaw to the left). The pilot tried to control the yaw but the helicopter quickly turned through 360° and, unable to control it, he made a decision to land the helicopter.

The left skid of the descending helicopter subsequently contacted the ground, resulting in a rolling movement that led to the main rotor blades striking the ground. The collision destroyed the aircraft, the pilot sustained minor injuries however the passengers were uninjured.

What the ATSB found

The investigation did not identify any airworthiness issues with the helicopter and it was considered that the loss of control was not attributable to a mechanical issue. It was also determined that the prevailing light winds did not contribute to the loss of control.

The pilot reported that he did not lift the helicopter into a balanced hover, and tried controlling its yaw mainly with the cyclic control instead of through the full application of opposing right, tail rotor pedal. Management of unanticipated yaw in helicopters with shrouded tail rotors (Fenestron) is the subject of the manufacturer’s guidance and learnings from similar accidents.

Safety message

This accident demonstrates the criticality of helicopter pilots understanding the aircraft’s characteristics so that they can anticipate its response when becoming airborne, and are not surprised by events. Controlling yaw in helicopters with a Fenestron tail rotor, as in this case, is an important consideration. Airbus Helicopters and the European Union Aviation Safety Agency (EASA) provide specific guidance relating to this issue to assist pilots.

The occurrence

What happened

At 1033 Eastern Daylight‑saving Time^[1] on 19 January 2019, a Eurocopter EC130 helicopter, registered VH-YHS (YHS), departed Moorabbin Airport for a private authorised landing area (ALA), 19 km south-south‑east of Mansfield, Victoria. The pilot and two passengers were on board for the private flight to a rural property and intended to conduct a return flight that afternoon. The pilot’s pre-flight inspection had not identified any defects or outstanding maintenance issues for the helicopter.

At 1115, after an uneventful flight, YHS landed at the rural property. Over the next few hours, the pilot attended to various matters there as planned, and had lunch with the passengers.

Shortly before 1500, the pilot and passengers returned to the helicopter. The helicopter was parked in an open area, facing south with a 0.5 m-high earth mound to its left (Figure 1). The mound prevented water entering the nearby shed and ran the length of the area, which had clusters of trees around it in different directions. The pilot had undertaken five previous flights to the property in the helicopter in the previous 5 months.

After assisting the passengers to board the helicopter, the pilot conducted a walk-around and did not identify anything unusual. He then boarded and, following a normal engine start, carried out his take-off checks. As was his usual practice, he set the friction settings for both the cyclic^[2] and collective^[3] controls to minimum resistance.^[4] The wind was about 10 kt from the south-west (about 45° to the right of the helicopter), the sky was clear and it was approximately 30º C.

As the pilot increased to full power for take-off, he observed that the front right passenger had not put on her headset and signalled for her to do so. While he waited for her to put the headset on, keeping YHS on the ground, he noticed the cabin temperature was 32 ºC and turned on the air‑conditioning.

Shortly after 1500, the pilot was again ready to take-off. He raised the helicopter off the ground, more rapidly than he normally did without getting the usual ‘fine balance’^[5]. At a height of about 3 m above the ground, the helicopter began to yaw to the left (turning counter-clockwise), seemingly pivoting about the tail and its attitude became progressively unstable (Figure 1, Top).

The pilot applied inputs, mainly cyclic, to control the helicopter’s movement but the yaw increased. The aircraft now seemed to be pivoting about the main rotor, moving closer to the trees and shed (Figure 1, Middle). The pilot recalled that the helicopter felt ‘unstable’ and moved the cyclic but did not get the response he expected. In seconds, the helicopter had turned through 360° (Figure 1, Bottom). Unable to control the helicopter, the pilot decided to land and lowered the collective.

As the helicopter descended, its left skid contacted the mound, resulting in the helicopter pivoting around that skid and the main rotor blades striking the ground. The helicopter came to rest on its left side, facing the shed (Figure 2). The sequence, from lift-off to ground contact, occurred over about 5 seconds.

The pilot turned off the engine and battery, exited through the shattered left windscreen and assisted the passengers from the helicopter. The pilot sustained minor injuries while the passengers were uninjured.

Figure 1: Accident sequence

Source: ATSB analysis of information from pilot and witness video (partial) superimposed on Google Earth image

Figure 2: Accident site

Source: Seven News Melbourne, annotated by ATSB

Pilot

The pilot completed his helicopter flight training in a Hughes 300 helicopter in 2010. He completed EC130 type training in November 2011 and had accumulated 227 flight hours in that aircraft (from a total of 315 flight hours). Since his last flight review in November 2017, he had flown YHS for 13.5 hours of which 4 hours had been in the 90 days preceding the accident – the last flight being 46 days prior.

The pilot commented that he had:

• not heard or seen anything unusual with the helicopter before the accident
• tried controlling the yaw mainly with the cyclic, did not know how much right pedal he had used and assessed that he should have used more pedal to control yaw
• not flown regularly since his last flight review and noted that during his EC130 type training he had needed more pedal input than in the Hughes 300.

Aircraft information

The EC130 is a single-turbine engine helicopter with a clockwise-turning main rotor and a shrouded Fenestron tail rotor (Figure 2). The helicopter has a maximum take-off weight of about 2,427 kg and can carry seven occupants. The EC130 is a high-performance helicopter compared to the Hughes 300 (in which the pilot first trained). The Hughes 300 has a counterclockwise turning main rotor and a conventional unshrouded tail rotor.

The EC130 with its Fenestron anti‑torque system^[6] requires greater right pedal^[7] input to overcome torque from the main rotor during lift off than a helicopter with a conventional tail rotor. The pedal control inputs are also not linear with respect to the effect on helicopter yaw.

The helicopter’s manufacturer (Airbus Helicopters) published service letter 1673-67-04 in February 2005 with guidance for managing yaw. The letter reminded pilots that the Fenestron anti‑torque system requires more right pedal travel than a conventional tail rotor to counter left rotation (yaw). The letter stated that if sufficient pedal is not applied quickly to correct yaw, its rate will increase. Further, insufficient pedal input to stop yaw combined with pilot input to decrease altitude could result in the helicopter rolling to the side and contacting the ground.

Post-accident activities

There was no recorded data to determine the flight control inputs and their effect on the motion of YHS during the accident. The pilot’s account, a partially obscured witness video, and photographs of the wreckage were the main sources of evidence.

The maintenance organisation for YHS carried out an examination at the accident site before moving the wreckage to its maintenance facility. This examination found no evidence of airworthiness issues that could have resulted in the accident. It was also determined that the helicopter was within its performance envelope and had sufficient fuel for the planned flight.

The ATSB sought the manufacturer’s input for this accident and was advised that as no technical (mechanical or control) issues with YHS had been identified by the maintenance organisation, the accident was probably the result of a handling error.

In July 2019, about 6 months after the accident, Airbus Helicopters published safety information notice 3297-S-00 to highlight unanticipated yaw. The notice warned that an unanticipated yaw can be rapid and is most often toward the left (where the main rotor rotates clockwise). It further noted that even if the pilot’s response was prompt, the yaw might not immediately subside and lead to the pilot thinking that the input was ineffective.

Similar accident

In October 2015, an EC130 helicopter was departing Megève altiport, France, for a sightseeing flight when the pilot lost control of the aircraft, which collided with the ground (BEA2015-0647 report). The helicopter was destroyed, and the seven occupants were injured.

The pilot had 300 flight hours in helicopters, including 9.5 hours in an EC130 and 74 in the similar AS350 helicopter. The investigation found that while stabilised in the hover, the pilot initiated a left turn to face the climb out direction. However, the pilot was unable to stop or slow the yaw and decided to land, lowering the collective. The helicopter yawed through several more revolutions before colliding with the ground. No technical issues to explain the accident were identified.

As part of the investigation, a flight in a helicopter of the same type in similar conditions was undertaken, and it was found that pushing the right pedal to 70 per cent of its travel stopped a yaw rate of 100° per second to the left in 3 seconds.

Safety analysis

The earlier flight made by VH-YHS (YHS) that day indicated the helicopter was operating normally with no defects. The high-performance helicopter was also operating well below its maximum capacity with only three occupants.

In preparing to take-off, the pilot lifted YHS more rapidly than he normally did without first letting it rest lightly on the skids and applying control inputs to lift it gently into a balanced, controlled hover for the climb out. The higher-than-normal application of control inputs resulted in the torque from the main rotor not being balanced by the anti-torque from the Fenestron tail rotor. Consequently, once the helicopter was off the ground it yawed significantly to the left. The wind from the right may also have initially increased the yaw rate.

The pilot’s pre-take-off checks did not confirm that everyone and everything was ready for the flight. As a result, he had to delay the take-off while a passenger put on her headset. He then noticed the elevated temperature and turned on the air-conditioning. These interruptions may have influenced his actions in lifting off more rapidly than he normally did.

The rate of left yaw offered limited time to regain control. The pilot reported that he principally applied cyclic control rather than the required full application and maintenance of opposing right, tail rotor pedal input. When his applied inputs did not arrest the yaw rate, the pilot assessed that the best option was to land the helicopter.

Similar accidents in the same or comparable helicopters, together with manufacturer’s guidance, provide information for pilots to manage unanticipated yaw and avoid accidents. These show that the outcome of YHS’s attempted landing with a significant yaw rate was somewhat predictable - a skid contacting the ground, the helicopter rolling over and the main rotor blades striking the ground. The rapid development of the accident sequence (about 5 seconds) also illustrates the limited time for pilot actions/decisions in such hazardous situations, which fortunately did not result in serious injury in this case.

The maintenance organisation’s examination found no evidence of airworthiness issues with YHS to explain the accident. The pilot’s account and the manufacturer’s comments also support a conclusion that a mechanical issue and the light wind did not contribute to the accident.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The pilot was unable to control VH-YHS yawing to the left after lifting off and decided to land. When the left skid of the descending helicopter contacted the ground, it rolled over and the main rotor blades struck the ground, destroying the aircraft with the pilot sustaining minor injury.
• No mechanical issue with the helicopter was identified and the prevailing light wind did not contribute to the loss of control and subsequent collision.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the lateral direction.
3. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
4. The helicopter flight manual suggests adjusting flight control friction settings to the preferred resistance.
5. The fine balance is a two-step lift-off where the pilot lifts the helicopter slightly to be light on the skids, while making control inputs to balance the helicopter, before gently lifting into the hover.
6. The function of the helicopter tail rotor/Fenestron is to counteract the torque produced by the main rotor to maintain directional control.
7. Pedals: a primary helicopter flight control. Left and right pedal input moves the helicopter in the corresponding direction to maintain control for directional flight (yaw).

Safety summary

What happened

At about 0825 Eastern Standard Time on 9 January 2019, an Insitu ScanEagle X200 (X200) unmanned aircraft system was launched to conduct ‘beyond visual line of sight’ aerial survey work in the Woleebee Creek area of Queensland. The flight crew consisted of two pilots and two ground crew.

Shortly after launch, one of the ground crew observed the X200 pitch up and then enter an aerodynamic stall. The flying pilot commenced the emergency procedures for a stall-spin, however the X200 self-recovered before the checklist was completed. At about the same time the pilots received an alert indicating an airspeed sensor failure and initiated the associated emergency procedure checklist.

Before visual sight was lost, the ground crew observed the X200 oscillating in pitch as it continued to fly to the programmed first waypoint. While the flying pilot was executing the emergency procedures checklist, the X200 entered a second aerodynamic stall. Following self‑recovery from a low height above terrain, the X200 commenced a climbing orbit. Shortly after, the X200 entered a third aerodynamic stall, this time from a height that was insufficient for recovery, and collided with terrain. There was no post-impact fire and the X200 was destroyed. There were no reported injuries to people or damage to infrastructure. A post-incident inspection of the X200 identified a partial blockage in the pitot system.

What the ATSB found

The investigation found that the blockage in the pitot-static system resulted in unreliable airspeed data being supplied to the autopilot. Unreliable airspeed data led to the X200 entering an aerodynamic stall at a height that was insufficient for recovery.

During the pre-flight checks, there were opportunities for the erroneous airspeed indications to be identified. However, they were not recognised by the crew or flagged by the ground control station.

What's been done as a result

Following the occurrence, the manufacturer revised their procedures to reduce the risk of aircraft being affected by a pitot blockage. Additionally, all of the operator’s pilots underwent refresher training. This included emergency procedures simulator experience.

The X200 manufacturer revised their procedures to provide support to pilots and ground crew in correct assembly of the articulated turret, identifying anomalies (on the ground and in-flight), and steps for aircraft recovery in the event of a departure from normal flight. In addition, updates to the operational software would ensure any spurious on‑ground anomalies were alarmed, to prevent the X200 being launched with an unidentified issue.

Safety message

This occurrence highlights the importance of confirming the significance of any unexpected observations during the pre-flight checks, to minimise the risk of the aircraft departing with an unserviceability. In addition, providing pilots and ground crew with the reasoning behind specific checks and procedures can enhance their ability to identify anomalies and perform the appropriate corrective actions in a timely manner.

Insitu ScanEagle X200

Source: Insitu Pacific

The occurrence

What happened

On the morning of 9 January 2019, the Insitu Pacific (the operator) crew prepared to conduct a 4‑hour ‘beyond visual line of sight’ survey flight, in the Woleebee Creek area, about 350 km west‑north‑west of Brisbane, Queensland. The flight was being conducted by an Insitu ScanEagle X200 (X200).

The crew consisted of two remote pilots^[1] (one acting as mission controller/pilot in command and one acting as pilot flying) and two ground crew (who were also qualified remote pilots).^[2] The two pilots for this flight were located in the ground control station (GCS).^[3] Headsets were worn by all crew members, to enable effective communication. All crew reported to being ‘refreshed’ and looking forward to the day’s flight.

The X200 was launched at 0825 Eastern Standard Time.^[4] The crew described the launch as ‘textbook’. The secondary ground crew member maintained visual contact with the X200, typically done until advised by the pilots that they had video feedback from the on-board camera.^[5] He reported that, about one minute after launch, the X200 pitched up ‘quite high’, before entering an aerodynamic stall.^[6] He immediately advised the pilot flying (PF) with the standard phrase ‘wings level, wings level, you’re stalling’. At this time, the primary ground crew member also observed the X200 in a ‘left-hand spin’ and advised the PF ‘you’ve stalled, wings level, wings level’.

At the same time, the GCS identified the stall condition and projected the ‘stall-spin’ emergency procedures checklist to the display. The PF commenced the checklist items, however the X200 self‑recovered before the checklist was completed. The ground crew reported the X200 recovered ‘low to the ground’ and then commenced a climb to return to the programmed flight altitude.

At about the time of the recovery from the first stall, the GCS initiated the warnings and emergency procedures checklist for an ‘airspeed failure’. Upon the mission controller’s direction, the PF commenced the airspeed failure checklist. The ground crew reported that following a ‘steep’ climb, the X200 was then observed to be ‘porpoising’ (oscillating in pitch) while it continued to the first programmed waypoint. Shortly after this, the X200 flew beyond visual sight of the ground crew.

Telemetry data showed that, about 90 seconds after the first stall, the X200 entered a second stall. The X200 self-recovered again, at about 150 ft above the ground, and commenced a climbing orbit. After about 30 seconds, the X200 entered a third stall and impacted the ground eight seconds later. The mission controller advised the ground crew that the X200 had been lost. Total flight time was less than four minutes and distance from the launch site to the collision with terrain location was about 4.75 km (Figures 1 and 2).

Figure 1: X200 flight path

Source: Insitu Pacific and Google Earth, modified by the ATSB

Figure 2: X200 flight profile

Source: Insitu Pacific and Google Earth, modified by the ATSB

Post-accident recovery and inspection

The aircraft impacted the ground near vertically, there was no post-impact fire and the X200 was destroyed. There was no evidence of in-flight break-up or collision with vegetation or infrastructure prior to the impact. In addition, there were no reported injuries. The operator conducted an examination of the occurrence X200 and identified a partial blockage in the pitot system, which was subsequently confirmed by the manufacturer. The blockage appeared to be a combination of a section of O-ring debris and grease.

Flight operations

The Civil Aviation Safety Authority (CASA) issued the operator with an authorisation to operate the X200 beyond visual line of sight, within a defined area. Some of the authorisation’s requirements included:

• all remote pilots were to hold a CASA authorisation
• a mode C transponder^[7] was to be operational, and transmitting accurate barometric altitude, on all flights
• a primary and secondary ‘fail safe’ mode to ensure that, in the event of data-link loss, the X200 did not depart the area of operation and would land at a pre-determined location
• air traffic control at Brisbane was to be advised of the intended operation 15 minutes prior to launch, and the crew were to maintain standard airspace radio procedures for the duration of the flight
• the operator was to ensure a current Notice to Airmen (NOTAM)^[8] was active for each operation
• the X200 was only to be operated in visual meteorological conditions.

In addition to the CASA authorisation, the operator’s procedures included:

• no flight over populous areas
• operations were conducted at altitudes intended to avoid agricultural and passenger aircraft.

Remote pilots underwent a 10-week course prior to being endorsed to operate the X200. This course included a theory component and time in the simulator. The pilots recalled that ‘airspeed failure’ was included in the course, however they felt that particular emergency procedure wasn’t focussed on as ‘heavily’ as others.

The accident site was located within the defined operational area, which was in accordance with the authorised requirements.

Aircraft information

The ScanEagle is a small, long-endurance, low-altitude unmanned aerial system (UAS) built by Insitu, a subsidiary of Boeing, and is used for defence and civilian applications (the X200 variant). The X200 (Figure 3) has a wingspan of 3.1 m, a length of 1.6 m, maximum take‑off weight of about 23 kg and a typical cruise speed of 50-60 kt.

The nose module (payload) on the X200 is interchangeable, depending on the type of mission being flown, and was supplied by the payload manufacturer. The payload fitted to the X200 at the time of the occurrence consisted of a camera assembly located in an articulated turret (turret). The camera could be directed through a defined fore/aft arc and the turret rotated through 360˚.

The pilot controls the X200 entirely through the aircraft autopilot from launch until recovery. The aircraft’s flight path is controlled by position, altitude and airspeed commands through the remote pilot station computer (part of the ground control station), which is then sent to the aircraft autopilot. The pilot does not have a control yoke, or equivalent, that links directly or indirectly to the aircraft control surfaces.

Typically, once the X200 has launched, the pilot commands it through a pre-planned sequence of locations and orbits around each location of interest. At the completion of the flight’s activities, the pilot would position the aircraft in preparation for the recovery phase using the same method of control. In this instance, the emergency procedure checklist actions involved the pilot utilising additional X200 autopilot control laws in order to negate the erroneous airspeed information.

Figure 3: X200 with articulated turret

Source: Insitu Pacific, modified by the ATSB

Pitot-static system

The pitot-static system senses ram air pressure through the pitot probe (on the forward face of the payload) and static air pressure through the static ports (on each side of the payload). The two pressures are used to calculate true airspeed (TAS) and barometric altitude (Alt). The autopilot uses this data to calculate the minimum and maximum airspeed in relation to the weight of the X200 and to maintain controlled flight.

The pitot and static tubes for the X200 were routed from the pitot probe and static port through the turret and connected to the pitot-static tubing in the fuselage. If not correctly oriented during assembly, the tubes could become pinched, blocked or damaged with turret operation. Obstructed pitot-static tubes have the potential to cause incorrect TAS and Alt calculations, affecting autopilot operation.^[9] In addition, the TAS and Alt indications to the pilots would also be unreliable. The manufacturer alerted X200 operators to this potential condition in November 2017, via both a service advisory and an operational advisory. Damage sustained to the X200 during this occurrence prevented testing for possible turret interference.

The service advisory (SA) provided expanded procedures for pitot and static tube routing and connection, and inspection procedures if an anomaly was identified during pre-flight checks. A review of the X200 maintenance records showed the turret had been installed as per the SA in July 2018. Since then, it had been operated for about 80 hours, without indication of turret interference.

The operational advisory (OA) included:

• information about how to identify and troubleshoot different types of incorrect TAS and Alt indications on the ground and in-flight
• a pre-flight function test to identify incorrect TAS and Alt indications shown on the ground control station (GCS) program
• in-flight emergency procedures to normalise the incorrect TAS and Alt indications and avoid loss of controlled flight.

The function test was to be completed before every flight and the OA provided examples of how anomalies with the pitot-static tubing may appear on the GCS display. Where inspection and routing of the pitot-static tubes did not rectify the anomaly, the turret was to be replaced prior to next flight. The OA procedures had been incorporated into the GCS program at the time of the occurrence.

In addition, the payload manufacturer identified a quality issue with the turret assembly procedures that had the potential to induce a blockage in the pitot system. The operator identified that the occurrence X200 was affected by this quality issue, consisting of excess grease and O‑ring debris forming the pitot-system partial blockage. The X200 manufacturer published procedures to inspect (and, if required, clean) turrets that were in-service and prior to fitment. The operator examined the remainder of their fleet with these revised procedures, with no further occurrences identified.

Pre-flight checks

As part of the pre-flight procedures, the primary ground crew conducted an inspection of the X200 while the secondary ground crew readied the launcher and recovery systems. At the same time the pilots, located in the GCS, conducted their pre-flight systems checks, which included a function test of the pitot-static system (Figure 4). This test included the primary ground crew fitting a sealed clear tube to the pitot probe, which increased pressure in the system and simulated an airspeed indication associated with forward flight (equivalent to TAS). The procedure stated that any reduction in pressure (TAS) indicated on the GCS during the test, equal to or greater than the specified limits, was indicative of a system leak that required rectification prior to flight.

During the test, a slow rise of about 10 kt TAS occurred, while the indicated altitude remained steady. The OA detailed that if the TAS ‘increases slowly without turret movement or pressurisation of the pitot-static system’, this was an indication of a blockage in the pitot-static system. As per the OA, turret movement had the potential to induce a restriction in the pitot system tubing, which could ‘clear’ with subsequent movement. The pitot system was pressurised and the turret was being operated for part of this test and as such, the rise in TAS as a possible indication of a blockage may have been difficult to identify. Following this occurrence, a revised OA amended the criteria for the slow increase in TAS to show ‘at any time’ during the procedure, removing any ambiguity surrounding pitot pressurisation and turret movement during the tests.

With no pitot system leak identified by the pilots, the tooling was removed. At this time, the pilot flying (PF) commented that the TAS was ‘slow to release’ (return to pre-check indication). The primary ground crew member reported that he heard this comment however, he took no action as he wasn’t aware of the significance of this indication. The pilot pre-flight checklist identified that slow to release pressure was indicative of a blockage in the pitot system.

Following completion of the crew’s pre-flight checks, the GCS continued with the system self‑checks, while the crew met outside for a pre-mission brief, as per their standard procedure. During the time the crew were outside, the GCS self-check indicated an anomaly within the pitot‑static system. In this instance, there was an increase over time in TAS, while the Alt decreased. For this indication, the procedures required an inspection of the pitot-static system prior to launch. However, this indication was not flagged or latched.^[10] Therefore, when the pilots returned to the GCS, there was nothing to alert them to this additional indication of a pitot system anomaly.

Figure 4: Pitot pressure test indications

Source: Insitu Pacific, modified by the ATSB

All subsequent pre-flight checks were described as normal. Weather conditions at the time were recorded as overcast conditions, 22˚C, a wind speed of about 6 kt and were described by the crew as ‘ideal’.

Autopilot and the occurrence flight

The X200 autopilot control loops rely on airspeed to control altitude. The target airspeed for the occurrence flight was 53 kt. Recorded data shows that following launch, the TAS reached 70 kt. This resulted in the autopilot commanding a rapid pitch up to try to arrest the perceived high TAS. The pitch attitude was too great for the actual airspeed, which resulted in the X200 entering an aerodynamic stall. Stall recovery took 12 seconds, with an altitude loss of 579 ft (at a rate of 48 ft/s), before the X200 began to climb back to the programmed flight altitude.

Erratic TAS is one of the parameters that can lead to a stall-spin in the X200. Flight data showed that erratic TAS was present from launch, before the turret was unlocked and operated. This was consistent with a blockage of the pitot system, rather than turret interference.

The erratic TAS also resulted in the porpoising flight profile following the first stall and recovery. Following about 80 seconds of porpoising flight, the data showed another rapid increase in TAS. The autopilot likely commanded the X200 to increase pitch attitude, which again resulted in an aerodynamic stall and rapid reduction in height. Within 12 seconds, the X200 had again self‑recovered from the stall, but at a much lower altitude than the first recovery. The second stall required 778 ft for self-recovery (at 64.83 ft/s rate of altitude loss).

This was followed by another extreme increase in TAS, leading to the third stall. This stall was at a similar rate to the second stall. Recovery was again initiated but only 591 ft was available and the X200 collided with terrain, about 9 seconds later (Figure 5).

Figure 5: Flight data showing erratic indicated airspeed and altitude

Source: Insitu Pacific, modified by the ATSB

Safety analysis

Following launch, the Insitu ScanEagle X200 (X200) twice entered an aerodynamic stall and self‑recovered. The X200 entered a third stall, this time at a lower height, and did not recover prior to collision with terrain. The analysis will examine the pre-flight indications of the pitot system blockage and its effect on the flight.

Pre-flight checks

The pre-flight checks provided three opportunities for anomalies in the pitot static system to be detected. There was a slow rise in TAS, which was indicative of an anomaly in the pitot system. The pressurisation of the pitot system and movement in the turret during the pitot-static function test, however, may have meant that the slow rise in TAS and the physical blockage was not obvious. The slow reduction in TAS after the pressure test was an indication of a pitot system blockage. This was noted by some of the crew, however the significance of this indication was not recognised.

The ground control station (GCS) system self-checks showed an additional indication of a pitot system anomaly, however it was not observed by the crew, as they were carrying out other duties at the time. At the completion of the self-checks, there was no ‘flag’ or other indication on the GCS that the pitot system irregularity had occurred. This resulted in the indications of pitot system anomaly not being identified by the crew or flagged by the GCS, resulting the X200 being launched with a blockage in the pitot system.

Unreliable airspeed data

The X200 autopilot uses true airspeed (TAS) and altitude (Alt) data to maintain controlled flight. The blockage in the pitot system resulted in unreliable airspeed data being provided to the autopilot, affecting calculation of TAS. While there remained the possibility that the turret interference may also have been present, it could not be determined as contributory in this occurrence. Flight data showed that erratic (TAS) data was present from launch, before the turret was unlocked and operated. Subsequent movement of the turret may have alleviated any turret‑induced restriction in the pitot system but due to the presence of the identified blockage, the airspeed data was unreliable even without any turret interference.

Following launch, the autopilot interpreted the TAS as increasing and increased the pitch (nose up) to maintain target airspeed. This resulted in the X200 nose-up attitude being too great for the actual airspeed and led to an aerodynamic stall. The X200 self-recovered and recommenced the climb to operating altitude.

Following recovery from the first stall, flight data showed the TAS was oscillating by up to 30 kt, resulting in the ‘porpoising’ flight profile, indicative of the autopilot trying to maintain controlled flight using unreliable airspeed data. A rapid 30 kt increase in TAS likely led to the autopilot increasing pitch attitude, resulting in the second aerodynamic stall. Again, the X200 self-recovered, however at a much lower altitude. A third rapid TAS increase followed shortly after, leading to the final stall, with insufficient height available for recovery.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• Erroneous airspeed system indications during the pre-flight checks were not identified by the crew or flagged by the ground control station, resulting in the X200 being launched with an unserviceable pitot-static system.
• A blockage in the pitot-static system resulted in unreliable airspeed data being supplied to the autopilot.
• Unreliable airspeed data led to the X200 entering an aerodynamic stall at a height that was insufficient for recovery.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

The operator

As a result of this occurrence, the operator advised the ATSB that the following safety actions, in cooperation with the X200 and payload manufacturers, have been undertaken:

Pilot training

Following the occurrence, all of the operator’s remote pilots underwent refresher training with a focus on identification and emergency procedures regarding incorrect true airspeed (TAS) and/or barometric altitude (Alt) indications. The training consisted of theory (including ‘how’ the system works and symptoms of pitot-static blockage) and several hours’ simulator experience of failures and use of emergency procedures. Feedback from the pilots following this training was positive. In addition, the ATSB was advised that the X200 manufacturer will amend the ab-initio pilot training to highlight pitot-static system anomalies and associated pre- and in-flight procedures.

Training and enhanced procedures can provide ‘reasoning’ behind the steps. This can assist pilots and maintainers in their understanding of indications and events, prompting effective actions and timely resolution.

The manufacturer

Documentation and procedures

The X200 manufacturer published a revised Operational Advisory (OA) on 18 February 2019. One amendment in this revised publication was the inclusion of an image from the occurrence X200, showing the Ground Control Station indication for ‘slow to release’ pitot pressure. The criteria for the slow increase in TAS was also amended to ‘at any time’ during the procedure, removing any ambiguity surrounding pitot pressurisation and turret movement during the tests.

In addition, the revised OA included an additional caution (in red text) warning that the ‘TAS error exceeds launch limit alarm is disabled for pre-flight pitot-static system checks. Therefore, it is critical to monitor the TAS-ALT-Tachometer plot throughout the on ground phase for any abnormal TAS or Alt signatures’. The operator reported that the X200 manufacturer advised a ‘latching system alarm’ would be incorporated into the next software release (scheduled for mid-2019) to alert the crew where the TAS has exceeded a threshold during on-ground checks.

Further, the manufacturer revised their procedures for assembly of the turret and provided a reworked procedure to X200 operators to reduce the risk of in‑service aircraft being affected by a pitot blockage.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. A remote pilot licence (RePL) is required for commercial operations involving remotely piloted aircraft systems (RPAS) that are greater than 2kg maximum take-off weight.
2. Minimum crew for a deployment consisted of two pilots and one ground crew. When teams consisted of two ground crew, they were identified as primary and secondary. The secondary crew member assisting the primary as directed.
3. The computers and associated equipment required for flight operations were located in a converted climate-controlled shipping container and collectively known as the GCS. The pilots were located in the GCS for the entire flight, including launch and recovery. The launch and recovery sites were determined each mission and located to best suit the weather and intended flight, which could be some distance from the GCS.
4. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
5. The GCS provided location information via GPS and maps. The video feedback provided additional situational awareness for the pilots.
6. Aerodynamic stall: occurs when the airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically 16˚ to 18˚, and results in reduced lift.
7. A mode C transponder transmits both aircraft identification and altitude.
8. A NOTAM advises personnel concerned with flight operations of information concerning the establishment, condition or change in any aeronautical facility, service, procedure, or hazard, the timely knowledge of which is essential to safe flight.
9. ‘TAS’ terminology in the remainder of the report refers to the TAS calculated from the unreliable pitot pressure (airspeed) data.
10. A flag, or latch, is a special mark indicating that a piece of data is unusual. This alert will remain, even if the event has passed, until a clearing action has been conducted by a member of the crew.

Safety summary

What happened

On 6 January 2019, SCT Logistics freight train 6MP9 derailed near Cook, South Australia, while travelling from Melbourne, Victoria to Perth, Western Australia. The number 36 vehicle on the consist, wagon ARFY 2198T, experienced a ruptured wheel, resulting in the derailment. No other wagons derailed in the occurrence and there were no injuries.

What the ATSB found

Thermal damage to the wheel resulted in the initiation of a fatigue crack in the flange which propagated into the plate. Cracking then continued propagating around the plate, branching out to the rim, resulting in the wheel failure and ultimate derailment of the wagon.

At the last inspection, the flange fatigue crack was likely observable but was either not detected, or was deemed acceptable under the work instruction provided. This work instruction provided guidance that was less conservative than the Australian Standard, but it was not possible to establish whether compliance with the standard would have prevented the occurrence.

What's been done as a result

SCT Logistics has worked with their primary maintenance provider to develop an improved inspection process for wheels exhibiting issues with brakes (e.g. sticking brakes), as these issues can lead to heat-related fatigue cracks.

SCT Logistics also plans to phase out the type of wheelsets that ruptured in the occurrence, in favour of a type that is less prone to the development of fatigue cracks due to thermal issues.

Safety message

Vigilant field inspections are a useful tool for the detection and monitoring of fatigue cracks. However, they are not infallible, and should be utilised with an understanding of their limitations.

Further, selection of the appropriate materials can assist in reducing the occurrence of fatigue cracks and subsequent wheel failures.

The occurrence

What happened

On the evening of 4 January 2019, SCT Logistics freight train 6MP9 departed Melbourne, Victoria for Perth, Western Australia. At 0635 Central Daylight‑saving Time^[1] on 6 January 2019, the train derailed at 869.700 km in the Fisher-Thomiar section, near Cook, South Australia. The derailment involved the number 36 vehicle on the consist, wagon ARFY 2198T. One of the wheelsets on the ‘B’ end of the wagon experienced a ruptured wheel, resulting in the derailment (Figure 1). No other wagons derailed as a result of the rupture, however gouges in the rail were found, as well as some broken sleepers and missing clips.

Prior to the derailment, the train passed over two wayside detectors designed to alert the operator of abnormalities that might indicate wheel or bearing damage. There was no record of any alerts received from these detectors.

Figure 1: The ruptured and derailed wheel in situ

Source: SCT Logistics

Context

Wheelset examination

The majority of the failed wheelset pieces were recovered from the accident site. These pieces and the adjacent wheelset were sent to SCT Logistics’ primary maintenance provider, Gemco Rail (Gemco), for a preliminary inspection. This examination was attended by the ATSB, the Office of the National Rail Safety Regulator, and independent consultants, Bureau Veritas.

A visual examination of the wheel found two potential fatigue regions on the ruptured wheel. One of these was within the flange of the wheel, while the other was within the plate (Figure 2). The wheelset and fragments were then provided to Bureau Veritas for an independent metallurgical examination, in order to determine the nature of, and possible reasons for, the failure.

Figure 2: Two fatigue regions in the flange (left) and the plate (right)

Source: ATSB

Metallurgical examination

Bureau Veritas found that the wheelset met the chemical and hardness requirements for Class C wheel material, as specified by the Association of American Railroads (AAR). The second wheelset on the derailed bogie was recorded as Class B. Both wheel-types were permitted, but Class C wheels were harder with less ductility.

The examination confirmed that two regions of fatigue cracking were present in the wheel. The wheel failed as a result of cracking that initiated at the wheel flange. The fatigue crack on the flange propagated into the rim, and the mode of cracking changed from fatigue to brittle fracture. The crack then propagated into and around the wheel plate, connecting to the second fatigue crack within the plate. The propagation continued through the plate, branching out into the rim at various locations and resulting in the wheel rupturing into multiple pieces when it finally failed. This fracture sequence is illustrated in Figure 3, where blue arrows indicate the direction of crack propagation.

Figure 3: Recovered wheel fragments with direction of crack propagation

The blue arrows indicate the direction of crack propagation. The letters and numbers were used in the Bureau Veritas examination report to identify the different fragments and cracks, respectively.

Source: Bureau Veritas, modified by ATSB

The fatigue crack on the flange (crack 4 in Figure 3) was determined to be a thermal crack, 20 mm in length at the surface, formed in a white etching layer. Thermal cracks are caused by rapid changes in the temperature at the surface of the wheel. The presence of a white etching layer confirms a rapid temperature change occurred, as these layers are regions where the steel has transformed into martensite. Martensite is a brittle form of the metal created by heating and rapid cooling, and is more susceptible to cracking than the original flange material.

Bureau Veritas reported that the fatigue crack in the plate region may have initiated at non‑metallic inclusions found in that part of the wheel. However, this could not be confirmed due to damage at the fracture region because of the wheel failure.

Additional thermal cracks were identified near the crack on the flange (crack 4), although these did not propagate into the rim or the plate. The two largest additional cracks measured 12 mm and 15 mm in surface length (Figure 4). Bureau Veritas reported that the cracks in Figure 4, including the one that propagated into the plate, occurred in a region with evidence of sliding, rather than rolling, contact. Sliding contact can lead to rapid temperature changes in the flange, and the resultant formation of a white etching layer.

Figure 4: Thermal cracks adjacent to the flange fatigue fracture region

The surface has been cleaned and prepared for examination. Coloured dye has been used to highlight the cracks.

Source: Bureau Veritas, annotated by ATSB

Comments from the wheel manufacturer

Following the release of Bureau Veritas’ examination report, the wheel manufacturer reviewed and provided comment on the included observations/findings. The manufacturer assessed that the inclusions observed near the plate fatigue cracking were innocuous, and unlikely to provide a suitable site for the initiation of a fatigue crack. They also asserted that the size of the inclusions was within the acceptable range under AAR standards. The manufacturer believed that the fatigue crack likely initiated after the flange crack propagated into the plate, and the wheel lost its rigidity.

The manufacturer also noted that class C wheels were relatively hard, and that:

Class C material being high carbon, high hardness and lower ductility is not generally recommended for tread breaking applications with high thermal load and potential thermal issues.

Wheel maintenance history

Wheelset 39867 was originally fitted with Class C forged wheels on 22 February 2015. It was inspected and reprofiled on 12 October 2016 and again on 19 September 2018. The wheelset was installed on the occurrence wagon (ARFY 2198T) on 28 September 2018. A field inspection, known as an A2 inspection, was performed on the wagon on 10 December 2018, which included an examination of the wheelset. The wagon passed the inspection and returned to service. No wheel cracking or other damage was noted prior to the derailment on 6 January 2019.

The A2 inspection was performed with the wagon on rails, so a small part of the wheel would have been obscured. The inspection involved various checks, which included:

• ensuring the wheel dimensions were within limits
• looking for defects or damage on the tread
• looking for signs of overheating
• inspecting any visible cracks.

Inspection standards for thermal cracks

Gemco provided a work instruction to personnel performing A2 inspections, which instructed them to classify thermal cracks based on their size and location. A Class 4 thermal crack was defined as one longer than 10 mm within the flange or edge of the rim, or any crack longer than 40 mm. This definition was based on the Rail Industry Safety and Standards Board (RISSB) Wheel Defects Code of Practice. The Code of Practice, which was referenced by the Australian Standard for rolling stock wheels, defined Class 4 thermal cracks as any crack visible on the flange, cracks longer than 10 mm on the edge of the rim, or any crack longer than 40 mm. The presence of a Class 4 crack required the train speed to be limited to 40 km/h until the wheel could be replaced.

Figure 5 compares the definition provided by Gemco’s document with the one from the RISSB Code of Practice. The only difference between the two definitions was that Gemco permitted flange cracks up to 10 mm long, while RISSB did not permit flange cracks of any size. Under Gemco’s work instruction, flange cracks below 10 mm did not fit under any classification and therefore did not need to be recorded.

Figure 5: Definition of Class 4 thermal cracks provided by Gemco (left) and RISSB (right)

Source: Gemco, RISSB

Safety analysis

The white etching layer observed on the flange fatigue crack indicated that the wheel was exposed to abnormally high temperatures at some point, probably due to sliding contact with the rail. Exposure to such temperature altered the material property of the steel and facilitated initiation of a fatigue crack, which propagated from the flange into the rim and then the plate. The Class C wheel type may have increased the wheel’s susceptibility to fatigue cracking compared with the softer Class B wheels on the adjacent wheelset.

The crack progressed through the plate and joined with a second fatigue crack. The reason for this second crack’s initiation could not be determined, nor could it be determined whether it initiated as a result of the flange crack or if it was already present in the wheel. However, given the extent of cracking at this point, it did not appear to have a significant effect on this wheel failure. Cracking then continued propagating around the plate, branching out to the rim, resulting in the wheel failure and ultimate derailment of the wagon.

Examinations following the derailment found that the flange fatigue crack and the adjacent thermal cracks were longer than the 10 mm stated in the work instruction. As an inspection for thermal cracks was carried out 27 days prior to the wheel failure and derailment, it is likely that one or more of these cracks were present at the inspection, but they may have been missed, or obstructed by the rail.

It is also possible that the cracks were observed by the inspector, but were visually assessed as smaller than 10 mm long. If the cracks had a surface length below 10 mm, then under Gemco’s work instruction they would not have required any action, and their presence would not need to be recorded.

Without further details from the thermal crack inspection, it was not possible to determine whether or not the derailment would have been prevented if the work instruction prohibited all thermal cracks on the flange, as described in the more conservative RISSB Code of Practice.

Findings

From the evidence available, the following findings are made with respect to the derailment of SCT Logistics freight train 6MP9, near Cook, South Australia on 6 January 2019. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• Thermal damage led to the initiation and propagation of a fatigue crack through the wheel flange. This may have been exacerbated by the wheel type, which was more susceptible to thermal cracking. The crack progressed through the wheel plate, and ultimately resulted in the wheel failing.
• The flange crack that led to the wheel failure was likely present at the last inspection, but was either not detected, or was an allowable length based on the maintenance provider’s work instruction.
• The maintenance provider’s work instruction for classifying thermal cracks on the wheel flange was not as restrictive as the Australian Standard.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

The operator and maintenance provider

As a result of this occurrence, SCT Logistics worked with Gemco to develop an improved inspection process for wheels exhibiting issues with brakes (e.g. sticking brakes) – as these issues can lead to the development of thermal cracks.

SCT Logistics has also instructed Gemco to only install Class B wheelsets when replacements are needed, so that Class C wheelsets are phased out of the fleet through attrition.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Central Daylightsaving (CDT) Time: Coordinated Universal Time (UTC) +10.5 hours.