What happened

At about 0845 Western Standard Time^[1] on the 16 September 2018, a Cessna 207, registered VH-MIA (MIA), operated by Kalbarri Scenic Flights, took off to conduct a scenic flight from Kalbarri, West Australia (WA), to East Wallabi Island, WA. A pilot and three passengers were on board the aircraft.

The pilot had conducted a short scenic flight lasting about 45 minutes earlier that morning. She had around 30 minutes between flights to prepare the aircraft for the second flight.

The pilot advised that she briefed the passengers on the safety aspects of the aircraft before taking off. The flight proceeded past the township of Kalbarri and then along the shoreline before heading to East Wallabi Island, part of the Abrolhos Islands, at about 2,500 ft above mean sea level.

The aircraft overflew the island and the pilot reported that she observed the windsock was indicating an easterly wind, which was a crosswind for both runways. She decided to join runway 36 on the mid-crosswind leg of the circuit. The pilot reported that she touched down on the runway abeam the taxiway (see Figure 2), which normally gives her enough runway length to stop the aircraft. However, on this occasion, she could not stop the aircraft and overran the runway end by approximately 1 metre (Figure 1). The aircraft was not damaged and there were no injuries to the pilot or passengers.

Figure 1: VH-MIA after runway excursion

Source: Sue McAuliffe

Runway strip

The runway strip on East Wallabi Island is a privately owned unsealed strip. It is 637 m long and 30 m wide. The pilot reported that it slopes down slightly in the middle and has soft sand at one end. The windsock is on the western side of the runway on a slight hill.

Figure 2: East Wallabi Island runway and Kalbarri, North Island and East Wallabi Island

Source: Google Earth, annotated by ATSB

Weather at East Wallabi Island

East Wallabi Island does not have a dedicated weather forecasting service, but weather observations from North Island, which is 20 km north-west of East Wallabi Island, indicated that the wind was from the south at approximately 8 knots. This would indicate that the wind was almost all tailwind at the time the aircraft landed.

Pilot comments

The pilot reported she had checked the weather before they had departed on the first flight that morning.

The pilot reported that the approach and landing appeared normal until the aircraft did not slow after the aircraft touched down on the runway. She had slowed the aircraft to 80 kts on the final leg of the approach and touched down at the normal speed. She applied brakes as normal, released and then reapplied the brakes, to ensure the wheels did not lock, as this was a gravel strip.

The pilot reported that she used the position of the taxiway along the runway as her decision point as to whether she was going to conduct a go-around. As everything felt normal at that stage, she did not conduct a go-around.

The pilot reported that she was not fatigued. She had a day off the day before the incident. She had slept normally and had risen at her normal time of around 0530. She had arrived at the airport at around 0700, which gave her plenty of time to prepare for the flights. She was not feeling time pressure and the workload for the flight was normal.

She also advised that she had flown to the island a number of times and knew the strip well.

Operator comments

The operator reported that the aircraft was loaded within the aircraft limits.

The operator has discussed the incident with the pilot. They have stressed the importance of checking the windsock on the final leg of the circuit to ensure there is no downwind component, especially on a short runway. The operator and the pilot have also discussed the importance of using all available weather data, in particular the observations page on the Bureau of Meteorology website before going flying.

Previous occurrences

A review of the ATSB occurrence database for similar occurrences identified that in the last 10 years there were 14 incidents where a tailwind contributed to a runway excursion on landing. Of these, 11 were excursions where the aircraft ran off the end of the runway. Seven of these aircraft sustained substantial damaged.

Safety analysis

While the pilot advised she had checked the wind as they overflew the runway to join the circuit for runway 36, weather information received from the Bureau of Meteorology indicated that there was a southerly wind at the time the aircraft landed. The ATSB could not clarify if the pilot misread the windsock or the wind direction had momentarily changed when they joined the circuit and returned back to the southerly direction before the aircraft landed. The aircraft most likely landed with a tail wind component resulting in a faster ground speed at touchdown and the aircraft overrunning the end of the runway.

The pilot’s decision to land the aircraft adjacent to the taxiway reduced the available stopping distance available. Using the full runway strip, would probably have allowed the pilot to stop the aircraft on the runway.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• It is likely that the aircraft landed with a tailwind component resulting in the aircraft overrunning the runway.
• The pilot’s chosen landing position did not use the full runway strip length, reducing the stopping distance available.

Safety message

This incident highlights the importance of, where possible, landing with a headwind. Landing with a tailwind could result in an increase in the required landing distance by 21 per cent for the first 10 kts of tailwind, according to the United States’ Federal Aviation Administration advisory circular no. 91-79A Mitigating the risks of a runway overrun upon landing. They also advise that for some smaller general aviation aircraft (for example a Cessna 152), the landing distance required will increase by 10 per cent for every 2 kts of tailwind. If a pilot is not expecting a tailwind component, there is a significant risk that the aircraft will overrun the runway when operating on a short runway. One way of reducing the chances of landing with a tailwind is to include a check of the windsock during pre-landing checks and to conduct a go-around if a tailwind is detected.

Runway excursions continue to be a safety concern around the world with the Transport Safety Board of Canada recently releasing its Watchlist 2018, which lists runway overruns as one of its two aviation safety concerns for 2018.

About this report Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.

Safety summary

What happened

On 7 September 2018, the pilot of a Yakovlev 9-UM (YAK 9) aeroplane, registered VH-YIX, departed Latrobe Regional Airport, Victoria for a local private flight. The aircraft was observed by witnesses to the north of Moe, Victoria performing aerobatic manoeuvers. A short time later the aircraft impacted the ground in a steep nose‑down attitude, fatally injuring the pilot and destroying the aircraft.

What the ATSB found

The ATSB found that the aircraft entered a spin at low altitude from which it was not possible to recover. There was no evidence of pilot incapacitation, or a mechanical fault with the aircraft that contributed to the accident.

The pilot had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. He was therefore likely unaware of its unique handling characteristics and not adequately prepared to conduct the solo aerobatic flight.

The ATSB also identified a number of other factors that, while not contributory, increased safety risk. These included inadequate aircraft maintenance and operation without important flight and maintenance documentation.

Safety message

This accident highlights the inherent risks associated with performing low-level aerobatics in high performance aircraft. Pilots engaged in such flights are encouraged to observe minimum approved operating heights above the ground, commensurate with their ability and qualifications, and to engage in regular flight reviews and/or flight instruction.

Pilots should also ensure that careful preparation and planning is undertaken prior to each flight and that all documentation, checklists and required manuals are appropriately stored and accessible within the aircraft.

The occurrence

What happened

On 7 September 2018, a Yakovlev 9-UM (YAK 9), VH-YIX was flown from Boonah Queensland, to Latrobe Regional Airport, Victoria. The relocation of the aircraft was undertaken by two separate pilots, with a handover conducted at Dubbo Airport, New South Wales. One of the pilots, an instructor, flew another aircraft from Latrobe Regional Airport to Dubbo. On arrival at Dubbo the pilots swapped aircraft for their respective return flights.

Prior to landing at Dubbo in the YAK 9, the pilot from Boonah opened the forward cockpit canopy in-flight to provide greater visibility for the landing. It was reported that the resultant turbulent airflow from the open canopy ejected a number of aircraft documents from inside the cockpit. After landing at Dubbo, the instructor was advised of the loss of the aircraft checklist, maintenance release, Certificate of Registration, and Special Certificate of Airworthiness from the aircraft.

The instructor conducted an uneventful flight back to Latrobe Regional Airport in the YAK 9, and landed at about 1155 Eastern Daylight-saving Time.^[1] He refuelled the aircraft with 341 litres of aviation gasoline and parked the aircraft on the Latrobe Valley Aero Club hardstand at 1244.

One of the aircraft’s owners (the pilot) met the instructor on arrival. The pilot told the instructor that his intention was to conduct some taxi practice prior to a pre-arranged instructional flight scheduled for 1630 that afternoon.

The instructor and the pilot discussed the absence of the checklist and other required documents. The instructor reported that they agreed that the aircraft should not be flown, but taxiing would be acceptable, provided the aircraft’s operating temperatures were monitored. The instructor then proceeded inside the aero club to prepare another student for a training flight.

Sometime later, the instructor heard the pilot attempting to start the YAK 9. After numerous starting attempts, the instructor went outside to assist the pilot to apply the correct starting sequence.

At about 1420, the pilot began to taxi the aircraft, which was witnessed by two aircraft engineers standing outside a hangar at the northern end of runway 21. The aircraft was taxied along to the run-up bay. The witnesses observed that the rear canopy of the aircraft was open and that the pilot appeared to conduct routine engine checks. A short time later, the aircraft entered runway 21, the pilot applied power and commenced to take-off.

The instructor, who was walking across the tarmac from the aero club, recalled observing the take-off roll of the YAK 9 and noted that the aircraft used more than double the normal length of runway before it lifted off. The instructor then noticed that the rear canopy was not secure.

He attempted to contact the pilot from within the aero club by radio to advise him that the rear canopy was not secure. The instructor made several broadcasts but did not receive a response from the pilot. However, another pilot in the area responded to the instructor’s radio call, which confirmed that the radio call had been broadcast.

The YAK 9 initially maintained runway heading as it continued to climb. At 1428, it was identified by military radar turning off runway heading to the west at about 130 kt (Figure 1). The aircraft climbed to about 2,600 ft above mean sea level (AMSL). About 4.6 km to the south‑west of Latrobe Regional Airport, it was observed on radar to level out.

Figure 1: Flight track of VH-YIX

Source: Google Earth with annotations by ATSB

At 1431:09, the aircraft was about 18 km to the north-west Latrobe Regional Airport at about 2,800 ft, and travelling at 206 kt groundspeed when the pilot began to conduct what ground witnesses assessed as aerobatic manoeuvers. Radar contact with the aircraft was lost during those manoeuvres. The aircraft briefly reappeared on radar at 1431:34, at about 3,100 ft, (2,900 ft above ground level) with a groundspeed of 157 kt. This was the last contact received by radar, and showed a 49 kt reduction in groundspeed during the 25-second period when the aircraft was not visible on radar.

Figure 2: Video captured by a witness with overlayed ATSB analysis

Source: Witness footage with ATSB analysis and annotations

Witnesses in the Moe region, who were actively watching the aircraft from the ground, observed the YAK 9 conduct a series of what appeared to be aerobatic manoeuvers. One witness described what appeared to be a roll followed by a loop. They stated that as the aircraft came out of the bottom of the loop, the aircraft appeared to conduct an abrupt left turn before it began spiralling towards the ground. Video taken by another witness showed the aircraft in a spinning, steep nose‑down attitude prior to disappearing from view (Figure 2). These four frames were captured over 0.48 seconds.

At about 1432, the aircraft impacted terrain in a paddock about 3 km north of Moe, in a flat, slightly right‑wing and nose-low attitude, with little to no forward movement (Figure 4). The aircraft was destroyed, and the pilot was fatally injured.

__________

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours

Context

Pilot information

Qualifications

The pilot held a Commercial Pilot Licence (Aeroplane), issued in March 1983. At the time of the accident, the pilot held the appropriate aircraft ratings and endorsements to operate the YAK 9. The pilot had undertaken an aeroplane flight review with an instructor in a twin-engine Cessna 310, about two weeks prior to the accident.

In August 1997, the pilot conducted spin training in a basic aerobatic training aircraft. At that time, the pilot also received an aerobatic endorsement. This qualification permitted the pilot to perform basic aerobatic manoeuvres such as loops, aileron rolls, slow rolls, barrel rolls and stall turns. The endorsement contained an altitude restriction which required the pilot to have completed any aerobatic manoeuvre by 3,000 ft above ground level.

Experience

The pilot was a relatively experienced private aircraft operator, and had operated a number of ex‑military, high-performance warbird aircraft. The pilot had logged over 2,000 flight hours in multiple aircraft types, and had flown about 100 hours in warbird aircraft. The pilot had recorded a total of 1.9 hours in VH-YIX as at 29 March 2018, however it was reported that a number of additional flights were undertaken in the aircraft but not recorded in the pilot’s logbook. The instructor who had overseen all of the pilot’s operation of the aircraft estimated that the pilot’s experience in the YAK 9 was about 5‑6 hours.

As part of transitioning to operate high-performance warbird aircraft, the pilot had voluntarily undertaken a significant number of instructional flights in warbird aircraft since 2011. Flight training records and instructor interviews indicated that the pilot normally required debriefing in a number of areas after these flights. Basic warbird aircraft handling issues were identified as the most prevalent debriefing points. However, the use of checklists and correct procedures were also identified a number of times. Several different instructors noted in the pilot’s training records that he needed to fly often to retain currency and consistency in operating warbird aircraft.

The pilot had conducted aerobatics in a number of high-performance warbird aircraft in the two years prior to the accident, however he had not flown the YAK 9 in over 3 months, and had not previously conducted aerobatics in the aircraft.

Medical

The pilot conducted an aviation medical examination on 10 July 2018 and was issued a Class 2 aviation medical certificate on 31 July 2018. Limitations placed on the pilot’s medical certificate required distance vision correction to be worn whilst flying and reading correction to be available whilst exercising the privileges of the licence. A review of the previous five years of medical files did not identify any medical concerns. The post-mortem examination found no evidence of any medical conditions that may have affected the pilot’s performance.

The pilot was reported to be excited about the return of the YAK 9 to Latrobe Regional Airport, and took a flight bag when departing for the airport that morning. However, family members reported that the pilot was uncertain if he would fly the aircraft that day.

Aircraft information

General

The YAK 9 is a two-seat, low-wing, aerobatic^[2] aircraft with retractable landing gear. At the time of design, it was intended to perform the role of an advanced wartime aerial combat platform. Manufactured with front and rear flight controls, the primary flight controls are located in the front cockpit section with independent, secondary flight controls located in the rear passenger cockpit.

VH-YIX was manufactured in Russia in 1996 and exported to the United States shortly after construction without an engine. A Special Airworthiness Certificate issued for the purpose of experimental exhibition was granted on 20 February 2004 to allow the aircraft to operate in the United States. Logbook entries indicate that an Allison V-12 liquid‑cooled engine was installed and on 12 April 2004, the aircraft had flown 1.5 hours. The aircraft was imported to Australia and was placed on the Australian civil aircraft register on 19 July 2004, as VH-YIX.

Handling characteristics

As part of dive recovery, most aircraft require the application of rearward pitch control input to raise the nose and ease out of a dive. Experienced YAK 9 pilots reported that the aircraft exhibited a divergent pitch control that was more pronounced when it had a rearward centre of gravity. This characteristic, which is different to most other warbird aircraft, meant that the effort required to pull back on the control stick reduced as the airspeed increased during a high-speed dive. That behaviour increases the possibility of the pilot over-controlling the aircraft with excessive pitch-up input. This, in turn, increases the risk of unintentionally entering a high‑speed stall by exceeding the wing’s maximum angle of attack^[3] and entering a spin.^[4]

The YAK 9 flight manual emphasises the need for smooth and deliberate control inputs for aerobatics. A high-speed stall occurs when the airflow over one or both wings of an aircraft detaches and becomes turbulent due to a high angle to the relative airflow.^[5] At this point the addition of a yawing force, most typically due to an out of balance condition, begins to rotate the aircraft into a spin. These forces will continue until control input from the pilot stops them. High‑performance aircraft like the YAK 9 transition into a fully developed spin quicker and more forcefully than a typical light training aircraft. It is essential during recovery from a spin to have sufficient altitude to effect the recovery. Experienced YAK 9 pilots stated that, depending on pilot experience, 5-7,000 ft is required to safely recover the aircraft from a developed spin.

The YAK 9 flight manual states that recovery from a spin (Figure 3) also requires considerable forward control stick movement to hold the aircraft in a dive until the speed builds up. It also warns pilots not to energetically over-control the elevator during dive recovery as the aircraft may ‘wing rock’, which is a symptom of impending stall. Should too much rearward control stick application continue, then the aircraft may re-enter a stalled state that may lead to a further spin.

Figure 3: Spin recovery stages

Source: Civil Aviation Authority New Zealand- Spin Avoidance and Recovery –page 11.

Maintenance

It is an Australian regulatory requirement that the aircraft maintenance history is documented in the aircraft and engine logbooks. A review of the aircraft’s logbooks indicated that the YAK 9 was operated in Australia for about 106 hours before the aircraft was damaged in a landing incident at Tyabb, Victoria, in September 2015. The aircraft underwent a significant repair process, which was completed on 21 October 2016. The aircraft logbook indicated that, as part of the repair the:

• rudder and port aileron had been removed, repaired, recovered and refitted
• fin and port wingtip had been repaired
• engine was removed, bulk stripped and refitted
• propeller was overhauled and propeller blades replaced
• centre and rear cockpit canopy transparencies were removed and replaced.

An independent inspection of the flight control system was undertaken relating to the rudder and port aileron refit.

Following the purchase of the aircraft from the original owner, a maintenance provider conducted a periodic inspection, and a maintenance release was issued on 20 December 2017. The aircraft’s total time in service was 107.9 hours when it became registered to the pilot on 22 January 2018.

Entries in the maintenance release^[6] indicated that it flew a further 15.9 hours before the day of the accident. The last recorded entry on the aircraft maintenance release was dated 29 May 2018 and listed a total time in service of 122.8 hours with no recorded outstanding maintenance or defects. It was reported by the ferry pilot that prior to departing Boonah, there were no outstanding recorded maintenance or defects.

It was originally reported that the Yak 9 was relocated to Queensland for maintenance, however the only maintenance performed on the aircraft during its time at Boonah related to checking the security of coolant hoses. It was subsequently reported that the aircraft was primarily flown to Queensland to attend, and conduct a display at, an air show.

Requirements for the carriage of a documents in flight

The Civil Aviation Regulations 1988 (CAR) require that the pilot-in-command of an aircraft carries, as a minimum on the aircraft during flight, the maintenance release and the flight manual (if any).

Paragraph 139 (1) (c) of the (CAR) also directs that an aircraft shall not commence a flight unless there is a valid maintenance release or other approved document in force, covering the period of the proposed flight. This is to ensure that the pilot-in-command:

• is informed of any defects in the aircraft
• is able to determine that all required maintenance on the aircraft has been completed and certified
• can determine that no maintenance requirement will become due during the time of the proposed flight.

Pilots familiar with operation of the YAK 9 reported that there was little provision to store flight documents in the cockpit. When preparing to land the aircraft, it was common for a pilot to open/slide the forward canopy rearward to allow for a better view of the landing area during the final turn for landing. On a previous occasion, opening the forward canopy in flight resulted in the loss of the aircraft maintenance release and the aircraft checklist. At that time, the maintenance release was re-issued by an approved maintenance organisation.

A similar situation occurred when the aircraft arrived at Dubbo, on its return flight to Latrobe Regional Airport on the day of the accident. As a consequence, the aircraft departed Dubbo without the maintenance release or checklist. The instructor reported that on arrival at Latrobe Regional Airport, he asked the maintenance provider to arrange a replacement maintenance release for VH-YIX. However, before a maintenance release could be reissued, the aircraft departed the airport without an aircraft checklist or current maintenance release.

In the case of VH-YIX, the aircraft checklist was incorporated into, and formed part of the flight manual. Neither the flight manual nor the maintenance release were located at the accident site.

Rear canopy

The rear canopy of the YAK 9 can be secured from the rear seat inside the cockpit, or prior to flight from the front seat. Securing the rear canopy from the front seat requires the front seat pilot to face backwards in order to lock the rear canopy in place, prior to resuming the control seat.

The YAK 9 pre-flight checklist specifically requires that in single seat operations, prior to starting the engine, the rear seat must be properly prepared by securing the seatbelt assembly to prevent interference with the aircraft’s controls, and the rear canopy is also to be locked in place prior to taxi. It is not possible to secure the rear canopy once seated from the front seat.

Wreckage and impact information

On-site examination

The accident site was in a flat grazing paddock, 19 km west-north-west of Latrobe Regional Airport. The aircraft collided with terrain close to the fence line of two properties.

Figure 4: Major features of the wreckage at the accident site

Source: ATSB

The site inspection confirmed the presence of all the major flight control surfaces including trim tabs, the tailplane, fuselage and wings.

Fuel burns to grass were identified forward of the aircraft’s orientation. This was the result of the highly compressed wing structure rupturing the main leading edge fuel tanks, allowing fuel to escape on impact, chemically burning vegetation adjacent to the accident site.

The lack of wreckage trail, high compression of the aircraft structure and close proximity of the majority of the aircraft pieces indicated an impact at a high vertical speed with little forward movement.

Figure 5: Right wing structure impact damage

Source: ATSB

Ground impact marks and aircraft damage indicated that the YAK 9 collided with terrain in about a 30° right wing low, and 30° nose‑low attitude (Figure 5). This attitude and wreckage distribution was consistent with the wreckage pattern of an aircraft established in, or partially recovering from, a spin.

One propeller blade separated from the aircraft at impact and the other two sustained damage consistent with the engine operating under low power at the time of the accident. Witness reports of engine popping and backfiring prior to impact were consistent with the engine operating in a dive with a reduced power setting. The inspection of the engine and its controls did not reveal any defect that may have prevented its operation. The availability of fuel, serviceability of the ignition and engine control systems and a lack of structural defects, indicated that all systems appeared serviceable during the flight.

In combination with the propeller blade damage, it is likely that at the time of impact with terrain, the engine was operating, however at a low power setting.

The flight controls were present and accounted for at the site. Examination of the systems did not reveal any pre-existing defects that may have inhibited normal operation.

Some anomalies were noted within the wreckage during the ATSB’s on-site phase of the investigation, these included:

• the rear canopy was not accounted for within the wreckage at the accident site - it was subsequently located by a land owner in a nearby paddock
• one of the rear seat rudder control balance cables and pulley had detached from the airframe
• internal corrosion was identified within the compromised structure of the welded steel fuselage
• unsecured fasteners in the forward and rear seats
• rear-seat seatbelt assembly unbuckled and unsecured.

Rear canopy

The rear passenger canopy was located approximately 500 m to the south-east of the impact site. The proximity of the canopy in relation to the accident site, in combination with the recorded radar track of the aircraft during the final moments of the flight, indicated that the canopy most likely separated from the aircraft during the vertical descent.

Assessment of canopy photographs identified that the canopy was relatively intact, sustaining only minor damage upon separation from the aircraft and some further damage on impact with the ground. The canopy’s transparency contained two large cracks on the left and right side; originating at the forward corners of the canopy frame and extending rearward. The transparency was contained within its alloy frame. The forward part of that frame, identified as the canopy bow, had buckled in a rearward manner, likely due to impact with the ground (Figure 6). There was no evidence that the rear canopy contacted the aircraft structure, including the flight controls, following detachment.

Figure 6: Forward looking view of the rear canopy

Source: Insurance assessor image with ATSB annotations

Rear rudder control assembly

The YAK 9-UM is a tandem two-seat aircraft. Each seating position has independent rudder cables running from the rudder, through a series of pulleys, to the rudder pedals. To balance the movement of each rudder pedal position in each seat, a balance cable ran between the left and right rudder pedals. This ran through a series of pulleys to ensure that if one rudder pedal was depressed then the other would raise. Each rudder control, for both the forward and rear seating positions, was independent of each other. This means that in the event of a failure in one, the other would function appropriately.

On-site wreckage examination identified that the passenger right-side rudder balance cable pulley had separated from its mount within the airframe structure. The castellated nut, washer and accompanying split pin that would normally secure the pulley bolt to the airframe tube were not able to be located and there was no evidence that the fastener had failed due to force associated with the impact sequence (Figure 7).

Figure 7: Rear right rudder pulley, found away from the airframe.

Source: ATSB

An additional anomaly was noted with the left-side rudder pulley. Although the castellated nut was present on the bolt threads to that pulley, no split pin had been fitted. Furthermore, even if one had been fitted, the fastener arrangement would not have prevented loosening of the castellated nut (Figure 8).

Figure 8: Left side rear rudder balance cable bolt and castellated nut

Source: ATSB

Internal corrosion within tubular structure

During the on-site examination of the wreckage, corrosion was noted inside a number of airframe tubes. The rear cockpit‘s rudder balance cable pulley structure also had evidence of internal corrosion. The pilot’s seat rear mount cross-member had separated from the tubular side frames of the forward cockpit, revealing further evidence of internal corrosion. Internal corrosion was also found in the tubular steel structure of the fuselage. It was noted that there was little provision for applying and draining corrosion-inhibiting products to the internal surfaces of the tubes.

Further examination

ATSB identified other anomalies during the on-site examination of the wreckage. There was evidence of incomplete maintenance activity, with further examples of missing split-pins, in the rear-seat mounting bolts and nuts. A split-pin was also missing from the pilot’s seat lower mounting bolt securing nut, which was engaged by several threads, with the locking portion of the nut disengaged.

The rear seat was found outside the aircraft near the tailplane with the individual straps of the seatbelt assembly loose. The position of the seat indicated that significant force/s had been applied to it, raising the possibility that the rear seatbelt assembly became unclipped during the impact sequence.

However, the instructor who flew the aircraft to Latrobe Valley earlier that day reported that, on arrival, he removed a bag that had been secured via the harness to the rear seat and left the seatbelt undone in preparation for a planned 1630 flight with the pilot. If that harness was not secured by the pilot prior to the accident flight, the straps may have fouled the control stick and inhibited full and free movement in flight. From the available evidence, it was not possible to determine if that occurred.

__________

2. Civil Aviation Advisory Publication 155-1(0) defines aerobatics as manoeuvres intentionally performed by an aircraft involving an abrupt change in its attitude, an abnormal attitude, or an abnormal variation in speed.
3. The angle of attack is the angle measured between the wing chord line and relative airflow.
4. A spin is a sustained spiral descent of a fixed-wing aircraft, with the wing’s angle of attack beyond the stall angle.
5. Angle of the airflow relative to the chord of the wing.
6. A record of the current legal airworthiness status of the aircraft.

Safety analysis

Introduction

VH-YIX departed Latrobe Regional Airport, Victoria at about 1428 and climbed to 2,600 ft before turning to the north and accelerating to over 200 kt north of Moe. The pilot then began to conduct manoeuvres identified by witnesses as being consistent with aerobatics. A short time later the aircraft impacted the ground in a steep nose‑down attitude, fatally injuring the pilot.

This analysis will discuss the development of the accident, including the pilot’s qualifications and readiness for the flight. Aspects of the aircraft maintenance and associated documentation will also be detailed.

Development of the accident

Aerobatic manoeuvres

Witness reports indicated that the pilot was performing manoeuvres consistent with aerobatics, including loops and rolls, immediately prior to an abrupt loss of control.

Analysis of video footage provided by a witness indicated that VH-YIX was established in a spin when the aircraft disappeared from view below 1,000 ft above ground level (AGL). The aircraft damage and localised nature of the accident site confirmed that the aircraft collided with terrain in a right wing‑low and nose‑down attitude at high vertical speed and with little forward movement. That impact signature was consistent with the aircraft established in a spin.

Analysis of radar coverage in that area identified that an aircraft operating below about 1,800 ft above mean sea level would be below radar coverage, and therefore not identifiable on radar. The absence of radar identification of the aircraft during the latter part of the flight therefore indicated that the pilot was operating significantly below his approved 3,000 ft AGL aerobatic limit. More importantly, the aircraft was also well below the altitude that experienced YAK 9 pilots advised was required to safely recover from a spin. As such, and consistent with the observed impact signature, the spin was probably unrecoverable in the height available.

The pilot was qualified to perform basic aerobatics above 3,000 ft AGL, and the aircraft type was appropriate for the aerobatics conducted. However, while the pilot had experience conducting aerobatics, he had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. He was therefore likely unaware of its handling characteristics during such manoeuvres. Specifically, the possible pitch control sensitivities required during aerobatic manoeuvres or spin recovery in the YAK 9.

Additionally, as there was no flight manual/checklist available to the pilot, he was unable to refer to important operational information such as operating airspeeds/limitations during the flight.

In summary, the ATSB concluded that the pilot was probably not adequately prepared to conduct a solo aerobatic flight in the YAK 9.

Canopy

Numerous witnesses recalled that the rear canopy of the YAK 9 was not secure prior to take-off. Consequently, this allowed in flight air loads to slide it fully rearward along its guide rails and ultimately detach it from the aircraft. There was no evidence that the canopy struck any other part of the aircraft as it departed the airframe.

While it remains unknown if an open rear canopy may have a detrimental effect on airflow over the rear control surfaces of the YAK 9, it is unlikely to have been sufficient to cause a loss of control as it was open from the commencement of the take-off. However, the canopy’s departure from the airframe was probably sudden and could well have distracted the pilot. Given the proximity between the canopy and the wreckage location and the flightpath of the aircraft however, it was considered likely that the canopy detached during the spinning vertical descent.

Aircraft maintenance

Defects

Examination of the rear rudder balance cable pulleys identified that the associated fasteners were not correctly secured. Specifically, the required split pins were not fitted and this led to detachment of one of the castellated nuts. Despite that, the design of the pulleys is such that the bolt shank is unlikely to migrate from its installation during operation as cable tension from the rudder control is likely to keep the rudder pulley bolt in place during service.

In addition, wreckage examination also identified unsecured rear seat mounting bolts and an unsecured pilot’s seat mounting nut.

Finally, significant corrosion was identified within the steel fuselage frame. The nature and progression of the corrosion was not at a magnitude to be visually identifiable on the external airframe, however it may have presented a significant future risk to aircraft operation. Russian accredited representatives advised that internal tube anti‑corrosion measures are not applied to the YAK 9, and that no internal surfaces are coated during manufacture.

These observations, while not considered to have contributed to the accident, indicated that maintenance had not been performed on the aircraft to an acceptable standard. That had the potential to affect the future airworthiness of the aircraft.

Documentation

The loss of the maintenance release approaching Dubbo Airport meant that the written means to convey relevant maintenance information or defects was unavailable to both the instructor and the accident pilot. While this did not influence the development of the accident, operation without this document increases the risk that maintenance may be overdue, or that a defect may compromise the safety of the aircraft.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving the Yakovlev 9-UM (YAK 9), registered VH‑YIX, which occurred 19 km west‑north‑west of Latrobe Regional Airport, Victoria on 7 September 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• While conducting aerobatic manoeuvers, the aircraft entered a spin and impacted terrain.
• The pilot initiated aerobatics lower than his flight activity endorsement permitted and well below the height required to safely recover the YAK 9 from a spin.
• The pilot had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. He was therefore likely unaware of its unique handling characteristics and not adequately prepared to conduct the solo aerobatic flight.

Other factors that increased risk

• The rear canopy was unsecured before take-off and consequently separated from the aircraft during flight. This increased the risk of damage to aircraft structure, distraction of the pilot and possibly adverse handling qualities.
• Post-accident examination of the aircraft identified incomplete maintenance practices, including inadequate airframe anti‑corrosion measures and insecure primary flight controls and seat fasteners.
• The aircraft was operated without the maintenance release or the flight manual, which deprived the pilot of important operational and maintenance‑related information.

General details

Pilot details

Sources and submissions

Sources of information

The sources of information during the investigation included:

• witness interviews
• the pilot’s previous flight instructors
• interviews with YAK 9 pilots
• the aircraft logbooks and maintenance documentation
• the aircraft flight manual and documentation
• Airservices Australia and Department of Defence radar data
• the Civil Aviation Safety Authority pilot licence and aircraft documentation
• the pilot logbook
• video and audio information related to the flight.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Civil Aviation Safety Authority, Airservices Australia, Department of Defence, National Transport Safety Bureau, Interstate Aviation Committee, the maintenance provider and the pilot’s recent flying instructor and a subject matter expert in the YAK 9.

A submission was received from the pilot’s recent flying instructor. The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 19 July 2018, a Quest Kodiak 100 aircraft registered P2-NTZ experienced a nose wheel collapse during landing at Mibu Airstrip, Raicoast District, Padang Province, Papua New Guinea. The Papua New Guinea Accident Investigation Commission (AIC) is conducting an investigation into this occurrence.

As part of its investigation, the AIC requested technical assistance from the ATSB. The ATSB was asked to examine the fractured nose wheel fork to determine the failure mode and if there were any pre-existing defects. To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.

The ATSB completed the component examination and found that the assembly fractured as a result of overstress with no evidence of pre-existing defect.

The PNG Accident Investigation Commission is responsible for and will administer the release of the final investigation report into this accident. Further information regarding the occurrence can be found at www.aic.gov.pg or specific enquiries should directed to infor@aic.gov.pg.

__________
The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.

On 6 September 2018, the ATSB commenced an investigation into a safeworking irregularity between a suburban passenger train (45-E) and three rail track workers on the Up Suburban Line on 3 September 2018, about 100–200 m from Flemington Station in Sydney, New South Wales.

A protection officer and work group of three arrived at Flemington to place temporary speed restriction warning boards beside the Up Suburban Line on 3 September 2018, in conjunction with a track possession between Homebush and Redfern. Heavy rain prevented the group from immediately accessing the track.

After 25 minutes, the protection officer was contacted by the possession protection officer and advised that the track possession between Homebush and Redfern had been granted. Without conducting a safety assessment or seeking permission from the Flemington area controller, the protection officer and work group entered the rail corridor and moved along the track, towards the location where they intended to place the warning boards.  

As Sydney Trains’ Leppington to Circular Quay suburban passenger service 45-E approached Flemington station on the Up Suburban Line at 70 km/h, the train driver saw the three workers on the track. The train driver sounded the horn and applied brake, and the workers moved across to the adjacent Down Suburban Line. The incident was subsequently reported by the train driver as a ’near miss‘.

On questioning the possession protection officer about the presence of a train within the track possession area, the protection officer was reminded that the section where the work group intended to place warning boards was not within the track possession between Homebush and Redfern.

The ATSB obtained the Sydney Trains workplace investigation report and initial incident reports, audio communication between the protection officer and the area controller Flemington, CCTV camera footage from Flemington station, and interviewed the protection officer.

Based on its review of this information, the ATSB concluded that it was unlikely that further investigation of this specific occurrence would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.

Safe work on track is one of the ATSB’s SafetyWatch items. The ATSB is aware that this occurrence has similarities with a number of other occurrences in recent years in the Sydney region, and the ATSB is currently conducting other investigations of safe work occurrences. The ATSB is actively monitoring these types of occurrences.

Safety summary

What happened

At about 1040 on 19 August 2018, the train crew of Pacific National train 7MP7, travelling from Cook, South Australia to Parkeston near Kalgoorlie in Western Australia approached the points located at the eastern end of the Coonana train order location. Around 4 hours earlier, the trackside interlocking at Coonana detected that the point machine at the eastern end had not set correctly for the main line following the passage of a previous train. The colour light indicator (enhancer) situated adjacent to the point machine displayed a red light (stop indication) to approaching train crew of 7MP7.

During the approach to Coonana, the train crew of 7MP7 maintained track speed while looking for the light displayed by the enhancer ahead. When they realised that they could not see the enhancer, they braked but were unable to stop train 7MP7 before it traversed the eastern point machine travelling at 44 km/h and derailed. The two lead locomotives, unoccupied crew car and first two platforms of the lead wagon derailed, destroying around 200 m of the main and crossing loop tracks. The train crew were uninjured.

What the ATSB found

Point machines at each end of Coonana crossing loop would normally be set to allow travel along the main line. An incorrectly stored locking pin from a point clamp dislodged and caught in a mechanical pivot mechanism attached to the eastern point machine, preventing the correct movement of the points to reset for the main line after the departure of the previous train.

The ATSB found that during the approach to Coonana the train crew sought to identify and confirm the light displayed on the enhancer. While doing so, the speed of 7MP7 was not sufficiently reduced at the Location Ahead sign to ensure the train could be stopped before the facing points should the light indicator not display a green aspect. Additionally, a breakdown in verbal communication between the supervising and trainee driver resulted in a misunderstanding of the significance of not sighting the enhancer indication when predicted, and the urgency of the intended action to brake the train. Consequently, train 7MP7 approached the eastern end of Coonana at a speed where it was unable to stop before the open points.

The subsequent manipulation of locomotive control inputs in response to the situation highlighted how the on-the-job component of the Pacific National driver competency program did not adequately prepare the trainee driver to control the train in response to an emergency.

What's been done as a result

Post the derailment of 7MP7, the Australian Rail Track Corporation (ATRC) removed all point clamps from the point indicator stands and relocated them to the adjacent equipment huts at each location between Malbooma (South Australia) and Parkeston (Western Australia). Additionally ARTC have replaced all K3 searchlight units with long-range LED luminaire type units between Malbooma and Parkeston.

Pacific National (PN) introduced a SPAD reduction program and reinforced that train crews reduce speed in preparation for stopping short of facing points, until both drivers confirm recognition and understanding of indicator aspects. Additionally PN discussed with ARTC the implementation of improvements to point indicators between Kalgoorlie (Western Australia) and Cook (South Australia).

Safety message

The practice of maintaining momentum approaching a train order location, before confirming the enhancer indication, is an issue that probably affects multiple operators. The variability in the distance for the effective sighting of enhancers and targets at these safety critical locations means the available distance when an indication is sighted may be less than the effective braking distance of the train, which represents a physical gap or limitation in the system. This gap/limitation places the onus on train crews to implement a rule-based procedure to reduce speed at defined locations repeatedly, in preparation for an anomalous event where the enhancer might display a red light (stop indication).

The occurrence

At about 0320^[1] on 19 August 2018, a train crew comprising a supervising and trainee driver signed on to duty at Cook in South Australia. They were rostered to work a westbound Pacific National freight train (7MP7) to Parkeston, located near Kalgoorlie in Western Australia (Figure 1). The journey to Parkeston was the return leg of their first round trip^[2] together as a crew.

Figure 1: Referenced locations between Cook and Parkeston (Kalgoorlie)

Source: Geoscience Australia, annotated by ATSB

The crew took control of 7MP7 following its late arrival into Cook. After refuelling train 7MP7, the crew received a Train Authority^[3] (TA) from the Australian Rail Track Corporation Network Control Officer (NCO). With the trainee driver driving, train 7MP7 departed Cook at about 0347, approximately one hour later than the scheduled departure time. Shortly after, as 7MP7 approached the Koonalda Block Point,^[4] the driver performed a routine running brake test,^[5] which indicated no abnormality in the train’s braking performance. The lead locomotive intermittently lost traction en-route, activating the wheel slip alarm, causing the train crew to apply various driving techniques in an attempt to rectify the issue and restore tractive effort.

At about 0545, the crew travelled through the main line at Reid, crossing the first in a series of eastbound trains that would be stopped on the adjacent loop track at the respective crossing locations. Around the same time, the crew of an eastbound train (7PM5) were preparing to depart the Coonana loop track, about 500 km ahead. The crew of 7PM5 had completed a similar cross with the preceding westbound train to 7MP7.

To depart the loop track, a crewmember from 7PM5 operated a trackside pushbutton to motor the point machine at the eastern end of the yard to the reverse position. Once reversed, the point indicator displayed a yellow dumb-bell,^[6] signalling the points had set correctly for the crew’s departure. Shortly after, the rear of train 7PM5 cleared the points at the eastern end of Coonana and the trackside interlocking automatically controlled the point machine to return to the normal position, set for the main line.

At about 0550, the trackside interlocking detected that the point machine had not motored to the normal position within the required time. As the points were not correctly set, the light indicator (enhancer) at the eastern end of Coonana displayed a red light (stop indication) to westbound train crews.

At about 0640, the crew of 7MP7, the next westbound train, passed through the main line at Mundrabilla after crossing another eastbound train stopped on the adjacent loop track. At Mundrabilla, the trainee and supervising driver changed over, with the supervising driver moving into the driver’s position. The supervising driver continued driving through to Wilban, where the trainee driver again changed over into the driver’s position at about 0820. Shortly after, the NCO issued the next TA to the crew, authorising travel from Rawlinna through Coonana to Golden Ridge. The NCO had no information to indicate that the eastern end-point machine at Coonana had not returned to normal for the passage of 7MP7 or that the point indicator was displaying a stop light.

The trainee continued driving, crossing train 7PM5 which stopped in the loop track at Rawlinna. The trainee and supervising driver planned another driver change at Zanthus (about 39 km before Coonana), but the trainee wanted to continue toward Parkeston to gain additional driving experience and route knowledge for the track section in that direction. At about 1020, the crew passed through Zanthus, and the supervising and trainee driver continued to discuss train-handling practices for maintaining momentum on the undulating grades through the sand hills ahead.

Approaching Coonana, the In-Cab Activated Points System (ICAPS) sounded an alert that the crew were approaching a crossing location ahead. The train crew did not need to take any action to the ICAPS alert, as their TA allowed travel on the main line through that location. The train crew cross-called^[7] the TA and again discussed the typical train-handling practices for the approach. The trainee driver was also aware of an unposted temporary 80 km/h speed restriction at the eastern end of Coonana, and the need to manage train speed for that restriction. About 2,500 m from Coonana and travelling at about 115 km/h, the train passed the Location Ahead sign.

The trainee and supervising driver were both looking for the indication displayed on the eastern end enhancer, located to the left of the track ahead. From the driving position, the trainee could not discern any indication among the trackside vegetation and was waiting for the supervising driver’s call that he had sighted an indication from the observer’s position. Shortly after, the supervising driver, unable to sight any indication, calmly said to the trainee ‘brakes’. The supervising driver continued to look ahead, searching for the indication.

About 1,700 m from Coonana and travelling at 115 km/h the trainee understood the instruction from the supervisor was in relation to slowing the train in preparation for the 80 km/h speed restriction ahead. The trainee subsequently applied a minimum service airbrake application before incrementally reducing the throttle setting from notch T8 towards idle. Shortly after the supervising driver, still unable to sight an indication, realised the brake application was minimal and that the throttle setting was in power. The supervising driver told the trainee to make a full service application then, shortly after, to put the automatic brake into the emergency position.

About 1,200 m from Coonana and travelling at 110 km/h, the trainee moved the throttle control rapidly through idle to notch D8, the full dynamic braking position. Shortly after, the trainee moved the automatic brake handle toward the emergency position. About 750 m from Coonana, the supervising driver told the trainee to apply the independent brake also. Initially the trainee manipulated the independent brake handle position in order to maintain a light application before the supervising driver said to apply the independent brake fully. About 550 m from Coonana, the supervising driver left his seat and operated the End-of-Train emergency switch located on the driver’s console, in an attempt to exhaust air in the brake pipe from the rear of the train in addition to the automatic brake control setting.

The indication on the enhancer was still unsighted, but the trainee recalled the point indicator appeared to display a green arrow as they approached. Around 500 m from the points, the supervising driver saw a red light displayed on the enhancer. Shortly after, the supervising driver saw that the points were not fully set for the main line and warned the trainee to brace for a derailment (Figure 2).

Figure 2: 7MP7 approaching Coonana eastern end indicators and points.

Source: Pacific National, annotated by ATSB

At about 1045, train 7MP7 traversed the eastern points travelling at 44 km/h and derailed, destroying around 200 m of the main and crossing loop tracks. The two lead locomotives, an unoccupied crew car and wagons RQFY 58G and RRQY 733K-platforms 4 and 5 derailed all wheels (Figure 3). The train crew were uninjured.

Figure 3: Derailed locomotives NR 54 (lead) and NR 120 (trailing).

Source: Pacific National, annotated by ATSB

Post-derailment

Investigators from Pacific National and the Australian Rail Track Corporation (ARTC) attended the site after the derailment to gather evidence. ARTC undertook the onsite inspection and testing of the point machine, point control system and indicators.

Investigators identified that an unsecured locking pin from a point clamp stored on the eastern Point Indicator stand had fouled the pivot mechanism of the Point Indicator, preventing the complete travel of the throw arm and the attached point blade (Figure 4). The left point blade in the direction of travel had not closed against the stock rail, meaning the gauge face^[8] of the left running rail was not continuous through the main line. The wheel flanges of the leading locomotive split the points, resulting in the derailment.

Investigators also verified that following the departure of 7MP5 from the eastern end of Coonana, the trackside interlocking restored the enhancer to display a red light. The points commenced motoring from the reverse position toward normal, but were not detected as being locked in the normal position (set for the main line). Additionally, the point indicator attached mechanically to the points had not rotated fully 90⁰ to display a complete green arrow target. The trackside interlocking functioned as designed, with the light indication on the enhancer remaining at red and the point indicator not rotating fully.

On the morning of 23 August 2018, train services resumed via a temporary deviation track. The main line at Coonana remained closed until the completion of the track infrastructure replacement works.

Figure 4: Light and point indicators at eastern end of Coonana post-derailment.

Source: Pacific National, annotated by ATSB

__________

1. The 24-hour clock used in this report is referenced to Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Pacific National roster train crews to work trains from Kalgoorlie to Cook then return. Pacific National billet crews at Cook to rest between shifts.
3. An instruction in the prescribed format issued by the train controller in connection with the movement of a train.
4. A place where trains are not able to cross or pass but is available for the purpose of reporting or obtaining an authority.
5. Pacific National policy to carry out a brake test as soon as possible after departing the originating location or following a train crew changeover for train crew to get a feel of the braking ability of the train.
6. See Point indicator and Table 2 under Context section.
7. If the train crew consists of more than one crew member, each shall confirm and verbally call its meaning to the other crew members, and each shall obey its meaning.
8. The inner side of the running rail head, i.e. the side of the rail head where the track gauge is measured and could be contacted by the wheel flange

Context

Location

Coonana is located about 170 km east of Kalgoorlie in Western Australia at the 1610.942 km point^[9] on the Australian Rail Track Corporation (ARTC) interstate rail network. A Network Control Officer (NCO) manages train movements through Coonana from the ARTC Network Control Centre located at Mile End, Adelaide, South Australia,

Approaching Coonana from the east, the last 10 km of track is tangent, with falling grades of around 1:100 transitioning about 4 km from the points through level to primarily rising grades of around 1:200.

The environment along the train line between Cook and Kalgoorlie is comprised of predominately gently undulating terrain, with low-lying saltbush and scattered over-story of western Myall or Mulga vegetation. At Coonana, there were numerous tall trees bordering the rail corridor on the eastern approach to the enhancer (Figure 6).

Train and crew information

Train 7MP7

Train 7MP7 was an intermodal freight service operated by Pacific National between Melbourne and Perth via Adelaide. The train consisted of locomotives NR 54 (leading) and NR 120 (trailing) hauling 27 wagons for a total length of 1,639 m and gross mass of 3,702 t.

Based on an analysis of the available information, the condition and serviceability of train 7MP7 did not affect its handling in the lead-up to the occurrence, and were therefore not factors in the derailment.

Train crew

The supervising driver was a senior driver, holding a Certificate III in Transport and Logistics (Rail Operations) with around five years’ driving experience. The supervising driver had arranged a shift swap with the mentor driver, who normally worked with and tutored the trainee driver. Prior to the shift, the supervising driver and mentor driver had discussed the proficiency of the trainee.

The trainee driver commenced work with Pacific National in mid-December 2017. Following completion of the classroom component of the training in mid-February 2018, the trainee commenced the practical training (on the-job) component, operating various train services from Kalgoorlie on track sections toward Merredin to the west and Cook to the east. The trainee had driven sections of the track between Kalgoorlie and Cook for about six months, but mainly in the direction toward Cook.

The duration of the Pacific National practical training component was typically 12 months, but a planned train crewing change at the Kalgoorlie depot brought forward the trainee groups’ assessment to October 2018. The rescheduling of the assessment increased the trainee driver’s awareness of the need for additional experience in operating trains on the undulating grades toward Kalgoorlie. This provided impetus for the trainee driver continuing to drive from Zanthus, rather than changing roles with the supervising driver as originally planned.

Toxicology, medical and physiological factors

On returning to the Pacific National offices at Kalgoorlie at about 1800, the crew of 7MP7 submitted to a post-incident screening test for the presence of alcohol or drugs. Each crewmember tested negative to the presence of alcohol or prescribed drugs.

An examination of the trainee and supervising driver’s health assessment records confirmed that their health assessments were current and that the individuals met the required standard prescribed by the National Standard for Health Assessment of Rail Safety Workers. There was no evidence to suggest that any medical or physiological factors affected either crewmember’s performance leading up to or during the incident.

Fatigue

Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission (Battelle Memorial Institute, 1998). Due to these negative effects on cognitive performance, fatigue is a factor that increases the risk of transport accidents.

The crew of 7MP7 had worked train 6PS7 from Kalgoorlie to Cook the previous day (18 August 2018), signing off at about 1720. After signing off, they went to their designated accommodation in Cook and retired for the evening.

The following day, the crew were rostered to commence their shift at 0240 but, as train 7MP7 was running late, Pacific National delayed the crew’s wakeup call until about 0220. The crew commenced their shift at about 0320 on the morning of the 19 August 2018. The crew were about 7 hours and 25 minutes into their shift when the derailment occurred.

The off-duty period provided an opportunity for the crew to attain restorative sleep prior to commencing work. Each driver advised that they had a good sleep and felt rested when they commenced duty. It is unlikely that fatigue adversely affected the crew’s performance during this shift.

Environmental Conditions

The train crew reported that, on departure from Cook, the weather was cold and foggy. The fog cleared shortly after sunrise and approaching Coonana, the weather was clear. The crew advised that the position of the sun (rising directly behind them) could at times adversely affect their ability to sight an enhancer ahead. The signals at Coonana, like many signals from Cook to Parkeston, were oriented approximately due east.

Safeworking system

ARTC managed the safe movement of trains between Cook and Parkeston via a verbal communications based Train Order Working system (TOW). Before issuing a Train Authority (TA), the NCO would verify, through manual procedures, that the proposed route was clear. The NCO could then issue an authority to the train crew, who then recorded the authority on a paper based Train Authority form. The train crew reading the TA back to the NCO validated its content. The TA, once validated, then authorised the train crew to proceed between specified locations and in accordance with any additional instructions, if included.

The train crew were responsible for the setting and verification of points at the locations between Cook and Parkeston. The NCO does not have any visibility of the position of points or the status of trackside light indicators (enhancers) at the locations.

A train crew executing a TA were therefore required to comply with the instructions of the TA together with any additional trackside signs or indications. The train crew were required to implement the applicable operational rules and procedures contained in the ARTC Code of Practice for the Interstate Rail Network (CoP) and ARTC Addendum to the Code of Practice for the Defined Interstate Rail Network (Addendum).

For this occurrence, the NCO issued a sequence of four TA’s to the crew of 7MP7 for the trip from Cook. Each TA authorised the crew to travel along the main line to the next location where a cross with an opposing train would occur (Reid, Mundrabilla and Rawlinna). The Addendum required each train crew undertaking a cross at a train order location to implement specified crossing and passing procedures. The train crew were also required to comply with various Pacific National operational procedures to mitigate the potential for passing a signal at stop.

Train order locations

Between Cook and Parkeston, 22 locations were available to cross or pass trains to a maximum length of 1,800 m. Each location had the facility to operate the points via local controls (push buttons installed on the wall of the equipment tank) or remotely from locomotives equipped with an ‘In-Cab Activated Points System’ (ICAPS). Both the local and remote controls interfaced through trackside interlocking equipment to operate the facing points and the aspect displayed on the respective light indicator. The trackside interlocking also provided the auto-normalisation feature of the point machines.

Remote operation was available provided the locomotive’s ICAPS GPS detected that it was located within a set limit (window), typically a two-kilometre long strike point located five to eight kilometres from the train order location. Within this limit, the train crew could enter a selection to control the facing points ahead. The points were normally set and locked for travel through the main line, therefore a selection by the train crew was only required if the TA instructed the crew to take the crossing loop track.

Each location was similar in track configuration, equipped with trackside signage, targets and light indicators adjacent to the track. The features provided additional information to train crew approaching the self-restoring point machines^[10] located at either end (Figure 5).

Figure 5: Typical Train Order Location with Light Indicators and self-restoring points.

Source: Australian Rail Track Corporation

Trains crossing at train order locations

The Addendum contained various procedures for sequencing the crossing or passing of trains at train order locations. In the majority of cases, train crews would undertake a cross, where the authority of the first train crew train to arrive at the location required them to occupy the crossing loop track.

This required the train crew to operate the points to reverse via ICAPS, and reduce train speed toward the target speed of 35 km/h for the turnout at the points. After confirming the correct indications, they were to enter the crossing track and clear the main line.

After stopping prior to the clearance point at the opposite end of the loop, the train crew were to confirm the points ahead were correctly set for the approaching train to travel along the main line. After confirming the points, the train crew were also required to report their arrival at the location to the NCO. The train crew also communicated via UHF radio with the train crew of the approaching train to provide admittance into the location. The train crew of the approaching train were not to proceed beyond the Yard Limit Sign until they received the admittance from the train crew of the opposing train.

Predicted braking distance based on particular train type

The selected trackside location for signals, indicators and signage considered a range of factors in providing train crews with sufficient opportunity to sight and react to the trackside indications. The Train Braking Application Design Standard^[11] detailed the typical stopping distances for the particular train-type travelling at various speeds, on an applicable track gradient.

The configuration of train 7MP7 was consistent with the specified train type of a ‘1800 m long Super-freighter braking 115 km/h max’. The ARTC GW-50 brake table illustrated the calculated braking performance for this train type travelling at varying speeds and gradients (Table 1).

The table indicated that the designated stopping distance (with full service brake application to point of stop) for a train travelling at the maximum permitted track speed of 115 km/h and on the track grade approaching the eastern end of the Coonana location would be about 2,124 m.

Table 1: GW-50 Super-freighter stopping distance

Source: Australian Rail Track Corporation. Annotation by ATSB

Trackside signs

Trackside signs provided train crew with either operational or advisory information defined by the shape and colour of the particular sign. The Location Ahead sign provided operational information and was a caution sign, warning train crew of the approach and distance to a location and recognition of its designated name (Figure 6). For the ARTC TOW safeworking system, the typical approach warning distance from the Location Ahead sign to the location’s yard limit advisory sign was 2,500 m. The Addendum described requirements for train crews:

At the location sign in advance of a location equipped with light indicators and/or with point indicators.

The train shall reduce speed, and be prepared to stop before the facing points. The maximum speed may be maintained or resumed when the Train Crew has confirmed that the correct indication is displayed.

Figure 6: Coonana eastern approach Location Ahead sign.

Source: Australian Rail Track Corporation

Indicators

Point indicator

The points installed at each end of the train order locations between Cook and Parkeston were equipped with a Point Indicator, positioned adjacent to the main line and mechanically connected via rodding to the self-restoring motorised point assembly. The Point Indicator displayed a standard day/night reflectorised target, indicating to the train crew the direction the points were set (Table 2). Movement of the points operated the mechanical rodding and an attached vertical spindle that rotated the Points Indicator targets through 90⁰ so that only one target faced the oncoming train crew and the other obscured from the drivers view by being side-on. The position of the points normal or reverse determined which target displayed. The positioning of the target next to the track should afford train crew adequate sighting and convey a clear and unambiguous message about the state (direction of lie) of the attached points.

Table 2: Point indicator target aspects

To depart a crossing loop track, a member of the train crew would detrain and operate a local push button control to motor the points to the reverse position. Prior to moving off, there was ample time for the train crew to sight the target indication and confirm the correct lie of the points ahead. Similarly, a crew departing from the main line after stopping for a cross or pass would also have ample time to confirm the lie of the points ahead before moving off. In both scenarios, once the rear of the train cleared the points the trackside interlocking auto-normalisation feature would control the points to return to the normal position (set for the main line) and a corresponding green arrow target displayed on the Point indicator.

A train crew approaching a train order location should also have reasonable opportunity to sight the target indication to determine the correct lie of the points. The engineering standard Signal Sighting and Position^[12] defined the primary minimum sighting distances applicable to the Point Indicator target, relative to the approach speed of the train (Table 3). The standard indicated that the positioning of the Point Indicator target should allow the train crew a minimum approach view of 8 seconds.

For locations fitted with point indicators only, the Addendum limited the maximum permissible speed over the points to 70 km/h. The minimum sighting distance for a train travelling at 70 km/h, was 156 m in order to ensure the required 8 seconds of viewing distance. To ensure sufficient distance remained available to stop the train upon sighting the indicator, the driver needed to commence braking approaching the location, prepared for a stop at each location.

Table 3: Minimum sighting distance

Source: Australian Rail Track Corporation

The trainee recalled sighting a green arrow target on the Point Indicator when train 7MP7 was further than 550 m from the eastern end of Coonana. The points were not set for the main line and the Point Indicator had not completed a full 90⁰ rotation due to the Point Clamp pin fouling the pivot mechanism. Although the trainee recalled sighting a green arrow on the target ahead, this was not consistent with the information intended from the Point Indicator display.

Point indicators at train order locations do not confirm that the attached point machine is locked in the indicated position (normal or reverse) consequently train crews needed to slow the train to a speed where the correct target display could be confirmed and points checked, while allowing sufficient distance to stop the train if necessary.

Colour light indicators (enhancer and repeater)

The colour light indicator (enhancer) installed adjacent the Point Indicator provided an enhancement to the standard day/night reflectorised target.^[13] The enhancer provided a more conspicuous indicator that the train crew should be able to sight at a greater distance from the facing point^[14] enabling them to confirm earlier during the approach that the point machine had set and locked for the correct track. The greater sighting distance meant that if the train crew could confirm a correct indication displayed on the enhancer during the approach to the Location Ahead sign, the train crew could then maintain or resume speed, up to the maximum track speed of 110 km/h, to traverse the facing points.

The colour light indicators were typically equipped with a K3-style Searchlight unit containing an optical system of an incandescent globe, reflector, coloured roundels and lenses intended to provide long-range sighting from a distance of 2,500 m. Following the introduction of the enhancers, ARTC undertook modifications to the K3-style units to rectify significant variations in sighting distance provided between locations. ARTC also substituted the K3-style optical system with a single head colour light unit with a tricolour light-emitting diode (LED) or a multi-head colour light unit with red, yellow and green LEDs at new or upgraded enhancer or repeater installations.

The enhancer indicated the position of the adjacent points and provided additional information on the status of the points at the opposite end of that location (Table 4). Due to sighting limitations caused by topography or other obstructions at some locations, an additional colour light indicator (repeater) may be installed (about 2,500 m before the enhancer) that 'repeats' the indicator aspect (colour) of the enhancer in order to give train crews advance warning of its condition. Coonana did not have repeaters installed.

Table 4: Colour light enhancer aspects

If the points at either end of the location were correctly set for the main line (as was intended in this case), the enhancer should display a steady green light. If the points did not fully transition and set for the main line, the enhancer should display a red light (as occurred in this case). The required action to a red light is to stop and inspect the points.

As the status of the points or enhancers were not known to the NCO, the ARTC Addendum to the Code of Practice required a train crew departing from the crossing loop of a location to:

Where possible, following departure observe that the points have restored for the main line and a steady green aspect is displayed by the light indicator.

The aim of this requirement was to identify any failures before the passage of the next train. In this case, train 7PM5 was the last train to depart the eastern end of Coonana loop. However, given the length of the train, exit speed and the distanced travelled it may not have been possible for the crew to observe the points or light indicator via the locomotive driver's mirrors once the train had completely cleared the crossing loop, and the points had completed the intended function and returned to the normal position.

The train crew of the next opposing direction train (7MP7) stated that as they approached Coonana, they did not see the indication displayed by the enhancer until the train was about 500 m from the facing points at the eastern end.

ARTC engineering documentation

The optimal visibility of the aspect displayed by railway infrastructure defined as a trackside colour light signal or a colour light indicator (enhancer or repeater), of any luminaire type, is dependent on routine maintenance and the correct alignment of the light beam relative to the railway track.

The engineering standard Signal Sighting and Position specified the primary maximum distance to obtain optimal sighting, the maximum sighting distance, was 10 seconds for trackside colour light signals equipped with a standard-type luminaire. The specification of minimum and maximum distances provided drivers with reasonable opportunity to sight and react to the indication, while controlling the risk of read through to a signal in advance. While not specifically referencing being applicable to enhancers or repeaters installed under the TOW safe working system applicable to the Nullarbor Plain, the standard stipulated:

Where there is an absence of geographic markers for the driver (e.g. Nullarbor Plain) or the signal is not significant against the horizon or the sun may be directly behind the signal then the application of long range luminaries is acceptable.

The intention of providing a long-range type luminaire was therefore to provide a sighting distance greater than the typical 10 seconds at the nominated track speed.

The specification Signals–Work on Asset outlined the alignment requirements applicable to trackside colour light signals (including the Searchlight-type) and the routine servicing procedure applicable to both a signal, and enhancer/repeater lamp.^[15] The specification required the alignment of Searchlight-type signals (sighting point)^[16] to provide a sighting distance^[17] of 1,000 m on a main line with straight approach. The specification did not identify whether the signal was fitted with a standard or long-range luminaire nor if the sighting point applied to enhancers/repeaters equipped with Searchlight type units. In contrast, the ARTC documents Signalling Technical Maintenance Plans applicable to Colour Light Type signals (multi-head colour light units) fitted with incandescent or LED type luminaires specified a long-range sighting point of 400 m. The documents did not specifically reference if the sighting point applied to the similar multi-head colour light units fitted to some enhancer/repeater installations.

ARTC engineering documents specified varying sighting points (either 400 m or 1,000 m) dependent on luminaire type. Although the documents specifically related to fixed signals, applicable to safe working systems of signalled areas in the ARTC network the light indications provided by enhancer/repeater luminaires that are similar in appearance to fixed signal luminaires (Searchlight and Colour Light type) were not specifically addressed. The ARTC CoP and Addendum purposely did not classify the enhancer as a fixed signal.

Notwithstanding the related ARTC specifications, no ARTC standards or maintenance procedures contained corresponding reference to the sighting point or distance applicable to colour light indicators (enhancers/repeaters). ARTC confirmed the practice in the field was to align enhancers (and repeaters) to a sighting point 1,500 m in the rear of (approaching) the enhancer/repeater.

Pacific National conducted audits of the enhancer sighting on the east and west approaches to each location between Kalgoorlie and Cook. On each occasion, train crew recorded the distance at which they observed the light indication, together with the time of day and environmental conditions. Crews reported significant variations in the sighting distance to enhancers between each location, due to the direction of approach at a particular location, the time of day or ambient light conditions.

Observations for the western approaches identified four locations^[18] where a train crew reported difficulty in distinguishing the green light displayed on the enhancer. Observations for the eastern approaches identified four locations^[19] where sighting was difficult due to the ambient light conditions at that time of day or other environmental conditions. Each of the locations identified were equipped with K3 style Searchlight units with an optic system containing incandescent lamps. The two records for the eastern approach to Coonana indicated that in the late afternoon, with overcast conditions, the train crew undertaking the audit sighted an indication from a distance of around 2,250 m.

The drivers of 7MP7 stated that approaching Coonana, the trees adjacent to the corridor, and variations in ambient conditions, made it more difficult to sight enhancer indications at a distance, particularly the enhancers fitted with an incandescent globe such as the one at Coonana. The drivers stated that, for that reason, the eastern approach to Coonana was a particularly difficult location for sighting the enhancer from the driving positon. The drivers stated that from previous experiences, the first sighting of the light indication would usually be from the observer’s position at around 2,000 m from the points. The first sighting of the indication from the driving position would typically occur at around 1,800 m from the points.

Reported enhancer issues Cook to Parkeston

Train crews encountering issues with the operation of the trackside equipment at train order locations report the occurrence to the ARTC Network Control Officer (NCO). Following receipt, the NCO generates a Train Control Report (TCR), logs the report for attendance by maintenance staff and, depending on the nature of the issue, provides warning to other train crews via the ‘Condition Affecting the Network’ procedures.

Between April 2016 and August 2018, ARTC recorded 177 TCR reports relating to issues with trackside equipment between Cook and Parkeston. ARTC recorded ten TCRs related to issues with the enhancer at the eastern approach to Coonana where the indication was displaying red, blacked out, or cycling due to a fault. None of the TCRs related to issues associated with poor visibility of the enhancer indication.

Following the derailment of 3MP5 at Rawlinna in April 2016, Pacific National undertook an audit of sighting distances to enhancers between Cook and Parkeston. The audit identified large variance between the locations in the distance at which the crew sighted the enhancer indication. Notations against the respective enhancer attributed the variations to the type of luminaire (incandescent/LED) and time of day at which the train crew made the observation. Sighting distances recorded against the eastern approach to Coonana varied between 1,500 and 2,300 m. These observations were recorded during the afternoon in overcast to twilight conditions.

Point clamp

ARTC provided a point clamp at selected locations for use by authorised personnel (typically train crew) in the event that a failure of the points prevented them from being correctly set and locked. Once the points are set to the correct position, authorised personnel use the point clamp to secure the points for the desired route, as advised by the NCO. At crossing locations between Cook and Parkeston, point clamps were located on a spigot attached to the point indicator stand.

Post-incident, ARTC provided an image depicting the correct storage method with the point clamp placed on the spigot with the locking pin retained in position (Figure 7). However ARTC could not provide any documentation that instructed authorised personnel on the use of this storage arrangement for the point clamp, or requirements that the point clamp be secured against unauthorised use by installation of a railway ‘S’ type padlock.

Figure 7: ARTC example of correct storage arrangement for a point clamp on a point indicator stand.

Source: Australian Rail Track Corporation

At some time prior to the passage of 7MP7, the point clamp at the eastern end of Coonana was placed on the spigot incorrectly: it was not secured by a ‘S’ type lock and the locking pin was stored in a manner that allowed it to hang loose at the end of its attachment chain. The practice of storing the point clamp on the point indicator stand increased the risk of the point indicator throw arm pivot mechanism becoming fouled.

There was no record of a recent point failure where the NCO authorised the use of point clamp by train crew. ARTC maintenance records indicate the last electrical maintenance inspection of the points occurred on the 22 June 2018. There was, however, no requirement within the electrical maintenance or other inspection procedures for a routine check of point clamp positioning or security.

Pacific National systems

In-cab activated points and GPS location alert systems

The Pacific National NR-Class locomotives were equipped with interconnected ICAPS, and the Pacific National AWARE^[20] and GPS location alert systems. The ICAPS equipment facilitated train crews setting the required route at the train order location ahead from within the locomotive cab without having to stop the train at the facing points.

When ICAPS activated, a screen in the locomotive cab displayed a message showing the location name and two touch-screen buttons. An audible tone accompanied the message, alerting the driver that the system was active. If a crossing loop movement is authorised, the crew can command the points to set for the crossing loop. If a main line movement is authorised, the crew can dismiss the message and leave the points in their current position. Similarly, if the crew take no action, the points will remain in their current position (usually set for the main line).

The GPS location alert system is an enhancement to the AWARE system that provides track position information to the train crew when approaching a crossing loop or block point location. The purpose of the system is to ‘prompt the train crew to check their current limit of authority’.^[21] If the crew has already made an ICAPS selection for the loop, the alert will not activate since the crew has taken action relevant to the train authority.

The GPS location alert system displays a message on the AWARE screen when the locomotive is about 5 km from the crossing location. A single audible beep also sounds, but there is no requirement to acknowledge the message.

When a locomotive is within 3 km of the crossing location, the system sounds three audible beeps and a message on the AWARE screen. For this alert, the system requires acknowledgement within 10 seconds, using the AWARE system touchscreen located adjacent the co-driver’s position. If not acknowledged, the audible beeps continue with increasing volume until actioned or if the train has travelled 3 km past that particular crossing location.

When the locomotive is about 3 km past the crossing location, the AWARE screen displays a message identifying the name and track kilometre point for the next crossing loop. No audible tone accompanies this message nor is there a requirement for the train crew to acknowledge it.

Together, the combination of systems provide a sequence of messages and audible alerts to the train crew at each location. The systems do not (nor are they required to have) the functionality to provide real-time train location information to network control. Similarly, the systems do not provide information relating to the condition of the points or indicator ahead.

NR locomotive controls

Master controller - Throttle/Dynamic brake handle

The movement of the throttle/dynamic brake handle enables the control of engine speed (Throttle and Idle) and the application of dynamic braking (Setup and Dynamic brake). Movement of the handle toward the driver, through each of the nine available detent positions (Idle to T8) increases the locomotive traction power applied. By pushing the handle to the right through a spring-loaded gate, the driver sets up a dynamic brake application. After passing through the setup detent, the handle’s position can move smoothly through the dynamic operating range from one to eight.

In applying dynamic braking, the NR-class locomotive operations manual recommended drivers apply a 10-second delay when moving the throttle/dynamic brake handle between each of the idle and setup positions before moving into the dynamic braking zone. Pausing the handle operation acts to protect against electrical component failure and prevent excessive train forces.

Automatic brake control

Locomotive NR 54 was equipped with the Wabtec Fast Brake electronic air brake system. The Wabtec system consisted of two major components, the Handle Controller Unit (HCU) and the Pneumatic Operating Unit. The HCU provided the driver with the ability to control separately the application of train or locomotive braking through the operation of the automatic or independent brake handles respectively (Figure 8). The locomotive event logger recorded the brake pipe and brake cylinder pressures resulting from the manipulation of the HCU handles.

Figure 8: Handle control unit located in the locomotive cab to the left of the drivers position.

Source: Pacific National annotated by ATSB

The automatic brake handle had seven detent positions available through the operating range:

• Release (REL)
• Minimum Reduction (MIN)
• 70 kPa Reduction (70 kPa)
• Full Service (FULL)
• Suppression (SUP)
• Handle Off (HO)
• Emergency (EM).

The operational area between the Minimum Reduction (MIN) and the Full Service (FULL) detent comprised the normal service-braking zone. Positioning the automatic brake handle through this area resulted in typical brake pipe pressure reductions of between 50 and 150 kPa respectively.

Positioning the automatic brake handle further forward engages the detent positons of Handle Off (HO) or Emergency (EM). A driver configures the HCU in the HO position during the setup of the non-driving position whenever a locomotive is a trailing unit in a multi-unit consist or being towed ‘dead’. In the HO position, the brake pipe pressure will reduce at the service rate to 0 kPa. The locomotive brake cylinder pressure will rise to approximately 350 kPa.

The automatic brake handle, when placed in Emergency (EM), will immediately initiate evacuation of the brake pipe air, subsequently reducing the brake pipe pressure to 0 kPa. In addition to the reduction in the brake pipe pressure, placing the handle in the EM position on NR class locomotives will cause the sanding system to deliver sand to the railhead in front of the leading wheels of each bogie. Additionally, if the master controller setting was set in the dynamic braking operational range, the selection of EM will cause the automatic release of dynamic braking and the application of the air brake.

The independent brake handle had two positions available through its operating range:

• Release
• Full Application.

Moving the handle from Release toward the Full Application position increases locomotive brake cylinder pressure, dependent on the position of the handle through the application zone. Alternatively, when in the application zone, moving the handle toward Release would reduce the brake cylinder pressure.

In the Release position, no independent locomotive braking occurs but the driver has the option to release fully (Bail Off) any locomotive brake cylinder pressure increase resulting from the operation of the automatic brake handle. To Bail Off, the driver depressed the independent handle in the Release position. Similarly, depressing the handle while in the application zone could partially Bail Off the locomotive’s brake cylinder pressure corresponding to the Independent Brake Handles position.

Sense and Brake Unit

The Sense and Brake Unit (SBU) fitted to the rear vehicle of the train provided End-Of-Train information to the cab display unit in the lead locomotive and End-Of-Train emergency braking in response to a driver-initiated command. The operation of an Emergency EOT Switch located on the left side of the driver’s screen console activated an Emergency Dump Valve via the SBU, initiating the release of the brake pipe pressure from the end of the train in an emergency.

End-Of-Train emergency brake application was only available with the SBU ‘Armed’ and confirmed ‘Armed Two Way’. The NR class locomotive event logger did not record the ‘Armed’ status of the SBU.

Locomotive NR54 event logger

Data extracted from the Wabtec event logger on locomotive NR54 displayed the timing of control inputs and braking application during the approach of train 7MP7 to Coonana (Figure 9).

Figure 9: Event logger locomotive NR54

Note: DB = dynamic brake, EAB BP = train brake pipe pressure, EAB BC = Locomotive brake cylinder pressure, TMC = Traction motor current

Source: Australian Transport Safety Bureau

At about 10:41:40, around 2,500 m from the eastern end points at Coonana and passing the Location Ahead sign, the throttle control of locomotive NR54 remained set to full power (Notch T8) and train 7MP7 was travelling at 115 km/h. Around 25 seconds later, a minimum service brake application (50 kPa reduction in brake pipe pressure) commenced. The brake application was likely in response to the supervising driver’s instruction to ‘brake’. The absence of an increase in the locomotive’s brake cylinder pressure, which would typically occur with an automatic brake application, indicated the trainee likely bailed-off using the independent brake handle control.

Shortly after, the trainee rapidly moved the throttle/dynamic brake handle to maximum dynamic braking, Notch D8. The trainee also moved the automatic brake control from the minimum service position further into the service zone, exhausting additional air from the brake pipe and increasing braking effort along the train. The locomotive did not develop brake cylinder pressure due to the dynamic brake interlock functionality. The trainee’s action was likely in response to the supervising driver’s instruction to apply full service and then emergency braking. Train 7MP7 was travelling at around 110 km/h and 1,200 m from the points at Coonana.

The train speed reduced to around 70 km/h, when the trainee driver commenced an application of the independent brake causing an increase in the locomotive brake cylinder pressure. The initial independent brake application was light, with the position of the handle likely adjusted to maintain light independent braking. Around this time, the Supervising driver operated the EOT Emergency switch. Train 7MP7 was 400 m from the points at Coonana.

There was no appreciable change recorded in the rate that air exhausted from the brake pipe following the operation of the EOT Emergency switch. Around 140 m from the points, a full application of the independent brake occurred. Train 7MP7 was travelling at 50 km/h.

The event logger indicated that air continued to exhaust from the brake pipe at a relatively constant rate to a pressure of around 300 kPa immediately before locomotive NR54 derailed. At that time, the remaining air vented almost instantaneously to atmosphere level. This was almost certainly due to a break in brake pipe continuity during the derailment.

The venting rate of the brake pipe prior to the derailment is consistent with a controlled release of air at a service rate, rather than the almost instantaneous release that would typically occur with an automatic brake handle placed in the emergency position.

The braking response of the locomotive and the brake pipe pressure falling to below the 150 kPa reduction, typically attained from a full service application, indicated that the automatic brake handle was likely moved through the service zone to the ‘handle off’ position. The event logger also recorded that the locomotive maintained full dynamic braking from initiation through to the point of derailment, which would not occur following the placement of the automatic brake handle into the emergency position.

Pacific National driver training

Pacific National was an enterprise-based Registered Training Organisation, resourced with facilitators and assessors to conduct training in the workplace at multiple regional sites. The Pacific National worker competency program derived from the applicable Transport and Logistics Training Packages. The Pacific National Certificate IV in Train Driving program instructed train crew in the safe operation of Pacific National train services through a suite of core, specialised elective units of competency, and various supporting Safety Point Lessons delivered through facilitator-led and on-the-job training.

To manage risk associated with multi-site delivery, administrative and regulatory requirements were centralised with the monitoring of the programs by the regional-based line management of the facilitators at the multiple sites. The Pacific National Kalgoorlie Depot managed the delivery of the training syllabus to trainee drivers based at that location.

Competencies in defensive driving

To mitigate the potential for a train crew to pass a signal at stop or exceed their limit of authority, the core and specialist units included training on topics related to the Identification and Response to Signals and Trackside Signs, and Defensive Train Handling Techniques and Strategies. The training associated with defensive train handling encouraged a conservative approach requiring the driver to be aware of the risks and to implement safety actions that suit the environment. Defensive driving relied on the driver knowing the route thoroughly and understanding the capabilities of the tractive effort of the locomotives, and the braking capacity of the train and rolling stock operated.^[22]

The associated Single Point lessons provided train crew with a variety of proactive strategies to implement when approaching safety critical situations. Single Point lessons included:

• Active identification of a Stopping Location
• Safety Critical Zone, Approach Speeds & In-Cab Activities – Mainline Operations
• Active Team Work
• Signal Passed at Danger Commandments.

The safety critical zone related to a set time or distance from a known area of increased risk, such as a stopping location, or limit of authority. While in a safety critical zone, train crew were to direct their attention and actions toward safety critical tasks and the implementation of defensive driving and train-handling techniques, to ensure that they controlled train speed during the approach to stop prior to the designated stopping point. The active teamwork strategies reinforced the importance of shared responsibility to ensure safety would not be compromised by any action, inaction, miscommunication or misunderstanding between crewmembers.

Although Pacific National promulgated these lessons within the organisation, the train crew of 7MP7 maintained track speed at the Location Ahead sign and into the safety critical zone at the eastern end of Coonana.

Competencies in operating a train and responding to abnormal conditions and emergencies

Core and specialist units of competency included respectively, responding to abnormal conditions and emergencies when driving a train and driving a train to operational requirements. The delivery strategy for the training activities included a mixture of facilitator-led activities (eight and 16 hours’ duration respectively) and on the job practice/work experience supervised by a mentor driver (30 and 184 hours’ duration respectively).^[23]

The training delivery comprised three streams:

• Theory and activities in the training room environment.
• Practicals/learning on site and on the equipment to gain familiarisation prior to operating.
• The on-the-job learning component, with trainees performing the task of driving a train supervised by a mentor driver.

The training room component provided trainees with an understanding of the fundamentals of operating a train and to recognise, report and manage an abnormal situation or emergency. Abnormal situations were identified as incidents or issues during train operations that required an alteration to behaviour, mindset or the performance of an action to correct, but were not life-threatening. Emergencies were incidents that resulted in major impact to the network operations and infrastructure or had the potential for a fatality. The context of the training in responding to emergency and hazardous situations focused on reporting the emergency to the network manager, Pacific National or emergency services. Following completion of the training room component, the trainee transitioned into the on-the-job component.

Trainees were assigned to a mentor driver, working various train services and routes to obtain the necessary competencies in operating rolling stock to Pacific National’s operating requirement. The mentor driver guidelines^[24] detailed the expectations of the mentor driver and the training plan for the trainee during the on-the-job component. At the completion of the on-the-job component, a Driver Trainer assessed the trainee against a verification of competence checklist (VOC).^[25] The mentor driver should have discussed all parts of this checklist with the trainee to determine that they were both satisfied that all aspects were understood before the assessment by the driver trainer commenced.

The VOC section covering train management on the main line included an assessment task on the operation the automatic brake handle. A driver undergoing assessment was to perform a split, cycle, balance, full service and emergency application. The emergency application included a notation ‘can simulate’. Pacific National advised it did not carry out practical (on-the-job) training in controlling a train when responding to an emergency event, due to operational practicalities and the potential risk to a train if the training was conducted during normal train operations.

Trainees recorded their experiences gained and the demonstration of practical competencies during the on-the job component in a logbook. A variety of assessment processes determined the trainee’s verbal/written knowledge and the practical application of the knowledge/skills for the competency.

Pacific National worker competency programs instructed and assessed the competency of a trainee in responding to abnormal conditions and emergencies through off-the-job training and ad-hoc discussions during on-the-job training between the trainee, mentor driver and finally the assessor. Trainees and assessors recorded the undertaking of these discussions in the trainee’s individual logbook and VOC to provide evidence the training provided, and the assessment of the trainee’s understanding of the theoretical execution of the competency.

Pacific National provided records of the off-the-job training component for the driver of 7MP7 but were unable to verify the content, or if delivery of the on-the-job discussions related to the automatic brake operation competency, occurred prior to the 19 August 2018 accident.

Previous occurrence

The ATSB investigated a similar derailment of train 3MP5 at Rawlinna, Western Australia on 21 April 2016 (RO-2016-005).

Train 3MP5, travelling from Melbourne to Perth, derailed while traversing the eastern end points at Rawlinna. The points failed to fully restore to the normal position (set for the main line) after the previous train departed the loop track, leaving the points in an unsafe open positon. The colour light point indicator (enhancer) worked as designed by displaying a red light when the points were unable to be detected and locked in a safe position. There were minor injuries sustained by the crew.

The ATSB found that the driver’s expectation that the system was likely set for the main line contributed to train 3MP5 travelling at a speed where it could not be stopped before the open points. Additionally, it was likely a common practice for drivers to approach crossing locations without slowing when authorised for the main line. Compounding this was the points enhancer sighting distance being less than the effective braking distance of trains travelling at line speed, thereby increasing the risk of overrun if not displaying a green aspect.

__________

9. Distance in track kilometres from a reference point located at Coonamia near Port Pirie, South Australia.
10. A qualified employee sets the self-restoring point machine to the required lie prior to the passage of a rail vehicle. The self-restoring point machine automatically returns to the default position following the passage of the rail vehicle.
11. Australian Rail Track Corporation, Standard Train Braking Application design, ESD-05-03, version 1.1, 21 August 2018
12. Australian Rail Track Corporation Engineering (Signalling) Standard ESC-04-01 Signal Sighting and Position, Version 1.4, 27 October 2010, pp 5.
13. Self-Restoring Point system upgrade initiated by Australian Rail Track Corporation late 1998.
14. Blades of the point face toward approaching rail traffic.
15. Enhancer lamps addressed separately due to specific requirement to change out enhancer lamps at 12 weekly intervals.
16. Sighting point is the point in rear of (approaching) a signal at which the driver of a train is first able to view the signal.
17. Sighting distance is the distance between the sighting point and the signal to which it applies. Sighting distance is not considered as part of the train braking distance when determining the spacing of signals.
18. Denman, Hughes, Reid, Mundrabilla
19. Curtin, Chifley, Zanthus, Naretha
20. Australia Wide Augmented Radio Environment System, a touch screen communications system. An AWARE screen is provided for both the driver and observer (co-driver) positions in the locomotive cab.
21. Pacific National Information Bulletin No. 54A, AWARE Train Radio System, GPS Location Alerter – Driver Information System.
22. Pacific National TLIIC4019 Drive train to operational requirements, page 8
23. Pacific National Learning and Assessment Strategy TLI42615 Certificate IV Train Driving
24. Mentor driver guideline developed for Perth Drivers Depot.
25. Pacific National Driver Mainline Verification of Competence (VOC) Combined Checklist, Version 2.1 November 2016.

Safety analysis

Point indications

An incorrectly secured locking pin from a point clamp stored on the point indicator stand fouled the indicator pivot mechanism, preventing the self-restoring point machine from motoring the points fully to the normal position (set for the main line). The practice of storing the point clamp on the point indicator stand increased the risk that the moving point indicator throw arm pivot mechanism could become fouled and prevented from operating as designed.

The points were in an unsafe condition for the passage of rail traffic, causing the enhancer to display a red light (stop indication). The fouled pivot mechanism also prevented the point indicator from rotating fully to display a complete green arrow target. (However, it did rotate enough for the green arrow to be a prominent display to the driver.)

There was no automated system to alert the network control officer (NCO) to the condition of the points or enhancers at the train order locations between Malbooma and Kalgoorlie. Around 2.5 hours after the trackside interlocking at Coonana detected that the points had not correctly set, the NCO issued an authority for the crew of train 7MP7 to travel from Rawlinna to Golden Ridge, passing through the main line at Coonana.

The points at train order locations were normally set for the main line, with corresponding green light displayed on the enhancer and green arrow on the point indicator target. Indications other than green should only display following the initiation of crossing or passing procedures by a train crew or when a failure has occurred, such as the points were not correctly set. The timely identification and response to an abnormal indication relied on the actions of the train crew to either sight the red indication at a distance greater than 2,500 m or applying the organisations’ rules and procedures to ensure there was sufficient distance available to stop their train safely should the enhancer indication be at red or blacked out.

The layout of Coonana was typical of all train order locations between Malbooma and Parkeston. ARTC provided a location ahead sign at 2,500 m (nominal braking distance) and an enhancer that theoretically should be visible by crew at a distance of around 2,500 m. The drivers stated that due to the trees adjacent to the corridor combined with variations to ambient conditions and the luminaire type (incandescent globe) used at Coonana, made sighting the enhancer more difficult and first sighting of the indication would usually be from the observer’s position at around 2,000 m from the points. The enhancer at Coonana displayed a red light, which the crew stated did not come into view until train 7MP7 was around 500 m from the points, after the trainee driver could see the Points Indicator.

Generally, the conspicuity of a signal is determined by its size and intensity, its contrast with the surrounding environment, and the visual angle at which it is perceived.^[26] It is likely a combination of enhancer luminaire type (incandescent globe), beam alignment, trackside vegetation, ambient lighting and other environmental conditions present at the time adversely affected the conspicuity of the enhancer indication at the eastern approach to Coonana during the approach of 7MP7.

Although sighting the light indicator aspect at 2,500 m or greater is optimal, audits of the sighting points at train order locations found significant variation in distance existed, dependent on the type of luminaire and environmental conditions at the time. Generally, light indicators fitted with LED type luminaires were more conspicuous to the approaching crew providing a greater sighting distance. However, if the train crew could not confirm the light indicator aspect during the approach to the Location Ahead sign, rules and operational procedures required the crew to reduce speed at the sign and be prepared to stop before the facing points until the light indicator aspect could be confirmed. During the approach of 7MP7 this action was delayed until the train was around 1,700 m from the facing points, less than the stopping distance required.

Train-handling factors affecting train crew actions

Given the significant distance required to stop a freight train travelling at main line speeds, the vigilance of the crew is essential to ensure that indications, trackside signs and other cues are perceived and actioned appropriately to enable effective train handling. Having established that the train crew had trouble in sighting the enhancer indication and that a reduction in train speed did not commence until around 1,700 m from the points, the remaining analysis focuses on factors influencing the actions of the trainee and supervising driver in the delayed response to cues.

After departing Cook, train 7MP7 travelled along the main line through each of the 16 train order locations before approaching Coonana. The enhancer indication (green light) displayed the correct route had set at each location traversed. With the correct route set, the train crew were able to maintain track speed through the majority of the locations, reducing speed en-route where required to comply with speed restrictions or when crossing an opposing train.

During crossing or passing procedures, train crews of the first train approaching a train order location would be cognisant that they were nearing the limit of their authority, requiring them to stop. Crews would also be preparing to operate point controls to traverse a turnout if their train was to occupy the loop track. In both situations, train crew were actioning instructions contained in their latest train authority (TA) and were therefore conscious of the requirement to reduce train speed toward achieving target values.

Train crews of the second train approaching a location where a cross/pass was to occur were also actioning instructions on their respective TA. Communications between the train crews provided confirmation to the approaching train that the points were set correctly. In each case, the train crews were responding to specific cues requiring an immediate action to reduce train speed approaching a location.

Where the TA authorised travel through a location where no cross or pass was scheduled, the respective organisation’s rules required the train crew to reduce speed at the ‘location ahead’ sign and be prepared to stop before the points, unless they had sighted and confirmed the enhancer displaying a correct indication for the intended route.

The train crew’s experiences in 7MP7 that morning were that the majority of locations did not require a reduction in train speed during the approach. This, coupled with the previous experience that the enhancer at the eastern end of Coonana was difficult to detect and would typically not come into view by both crewmembers until around 1,800 m from the points, probably contributed to the delayed defensive driving actions in response to an unsighted indication and a low expectancy of encountering a restricted signal.

Systems where vigilance tasks (reducing speed at the location ahead sign) are associated with a low likelihood of an outcome (such as there being a restricted indication displayed) tend to produce lower levels of response compliance. High false-alarm rates, where compliance rarely leads to the avoidance of an actual risk, lead to ‘cry wolf’ phenomena, where individuals start ignoring the warnings.^[27], ^[28] As such, the low incidence of unexpected restricted indications at these locations reduces the likelihood of train crews rigorously complying with the organisations’ rules and procedures to reduce speed to target values approaching a location.

This is consistent with other investigations of rail accidents, such as the UK Health and Safety Executive examination of the Ladbroke Grove rail accident, which found:

The chance of human error can be considered to be enhanced where drivers have a high level of expectation regarding the likely signal aspects which will be displayed.

Focussed attention

Human information processing is limited in that each person has finite mental or attentional resources available to attend to information or perform tasks at any particular time. In general, if a person is focusing on one particular task, then their performance on other tasks will be degraded.^[29]

Approaching Coonana, the supervising driver focussed attention on sighting the enhancer, predicting that it would come into view, from his position in the locomotive cab, around 500 m after passing the Location Ahead sign. From previous experience, the supervising driver described the task of identifying the incandescent aspect of the enhancer as very difficult, requiring train crew to scan constantly to identify it amongst the background. Attention to this task likely reduced the supervising driver’s awareness of the control inputs and the speed of the train as it passed the Location Ahead sign and approached the points.

The trainee driver focused attention on identifying the speed restriction ahead and on maintaining the train’s momentum in preparation for the rising grades ahead. The trainee had only previously experienced one instance of an abnormal indication displayed on an enhancer. On that occasion, the train was already slowing in preparation to travel along the main line to cross a train in the crossing loop.

Braking actions

Train 7MP7 approached the Location Ahead sign under power at a speed of 115 km/h and no action was taken to reduce power or brake until the call from the supervising driver. The trainee’s previous experiences approaching train order locations, limited route knowledge of the track ahead and understanding that the supervising driver would be the first to identify the enhancer indication likely influenced the trainee’s actions.

When responding to the supervising driver’s instruction to put the automatic brake handle into the emergency position, the trainee’s response of rapidly placing the throttle into the full dynamic position and operating the automatic brake handle to the notch corresponding to the ‘handle out’ position was inconsistent with the action the supervising driver had called for.

Although not placing the automatic brake handle in the emergency position as instructed, the trainee’s action in moving the throttle to the full dynamic position with the brake handle in the ‘handle out’ position resulted in the application of braking effort similar to a service rate of application, while maintaining full dynamic braking on the locomotives. Placing the handle in the emergency position would have resulted in a more rapid reduction in brake pipe pressure but would have also disconnected the additional dynamic braking effort applied by the locomotives.

In-cab communications

The transfer of concise and explicit information between train crew is essential to identify and respond to abnormal or emergency situations promptly, especially when one of the crew is undergoing on-the-job training. Oral communication is imperfect, and meaning is derived both from what is said and how it is said, as well as the nature of the interpretation of the receiver. As noted by Salas, Sims and Burke (2005), ‘very often, individuals will receive very different messages when hearing the same communication because of their own perspectives and biases’.^[30] Barriers to effective communication also arise from distraction, stress, incomplete messages and/or ambiguous wording.^[31] Lack of common experience, task proficiency and situational awareness additionally impede effective communication of messages between supervisor and trainee.^[32]

Due to a roster change with the trainee’s assigned mentor driver, the trainee and supervising driver were working together as train crew for the first time. During the trip from Cook, the supervising driver provided instruction to the trainee on driving techniques and addressing issues experienced with locomotive wheel slip without any misunderstanding of the meaning of the communication between the parties.

Approaching Coonana, the supervisor intended to communicate that the he was unable to sight the enhancer, and that the trainee needed to brake urgently, and substantially. The trainee did not understand the call in this way, interpreting the instruction as being related to reducing speed for the 80 km/h restriction ahead. The trainee subsequently applied a minimum 50 kPa brake application and reduced the throttle power setting. The trainee recounted that the supervising driver was very calm when giving the instruction to brake, and did not appear convey any sense of alarm when speaking. The trainee likely perceived the verbal and non-verbal characteristics of the supervising driver’s communication as routine, and the inability to sight the enhancer indication as inconsistent with a possible impending emergency.

In this case, a breakdown in verbal communication between the supervising and trainee driver resulted in a misunderstanding of the significance of not sighting the enhancer indication, and the urgency of the intended action to brake the train.

A widely practiced approach for supporting effective communication is the use of standardised calls and terminology. An example of this is air traffic control clearances, which are required to adhere to standardised content and structure.^[33] Using standard terminology for known, predictable procedures and scenarios reduces the ambiguity of spoken messages. It also provides operational personnel with a standardised lexicon for communicating urgent messages and instructions when identifying and responding to an abnormal event or emergency.

Task competence

Responding to abnormal conditions and emergencies is a core competency. Trainees are required to undertake a minimum of 8 hours of practicals/learning on the equipment to gain familiarisation and 30 hours of on-the-job operation of a train. Although the training program specifies a practical component to the competency, Pacific National advised that they do not provide any practical training to trainee drivers in the application of emergency braking either in a simulator, on a locomotive (static or moving) or during the operation of a train.

The importance of providing a trainee with opportunity to practice new skills is well-established. However, unstructured practice without objectives, appropriate stimulation, and useful feedback has been shown to be counterproductive.^[34] Research in aviation shows that training in abnormal and emergency events improves flight crews’ responses to these situations.^[35] In a rail context, an abnormal or emergency event might call for heavy brake application.

The absence of equipment-based practicals/learning to gain familiarisation and the on-the-job operation/simulation as part of the Pacific National Certificate IV in Train Driving competency program potentially removes an important learning opportunity in preparing trainee drivers to control a train in response to abnormal situations or in an emergency.

__________

26. O'Brien, K. A., Cole, B. L., Maddocks, J. D., & Forbes, A. B. (2002). Color and defective color vision as factors in the conspicuity of signs and signals. Human factors, 44(4), 665-675.
27. Sorkin, R. (1989), Why Are People Turning Off Our Alarms? Human Factors Bulletin, 32, pp. 3-4.
28. Breznitz, S. (1983), Cry Wolf: The Psychology of False Alarms, Lawrence Erlbaum Associates, Mahwah, NJ.
29. Kahneman, D. (2011). Thinking Fast and Slow. Farrar, Straus & Giroux: New York.
30. Salas, E., Sims, D. E., & Burke, C. S. (2005). Is there a “big five” in teamwork?. Small group research, 36(5), 555-599.
31. Kirby, J (1997). Crew Resource Management (CRM) PowerPoint presentation. A presentation of the Salt Lake City Flight Standards District Office (FSDO).
32. Civil Aviation Safety Authority (2019). Resource booklet 4: Communication. In Civil Aviation Safety Authority Safety Behaviours: Human Factors for Pilots (2nd Edition). Australian Government Publishing.
33. Rantanen, E. M., & Kokayeff, N. K. (2002, September). Pilot error in copying air traffic control clearances. In Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 46, No. 1, pp. 145-149. Sage CA: Los Angeles, CA: SAGE Publications.
34. Cannon-Bowers, J.A., Rhodenizer, L., Salas, E., & Bowers, C.A. (1998). A framework for understanding pre-practice conditions and their impact on learning. Personnel Psychology, 51, 291-320.
35. Burian, B. K., Barshi, I., & Dismukes, K. (2005). The challenge of aviation emergency and abnormal situations. NASA/TM-2005-213462. NASA.

Findings

From the evidence available, the following findings are made with respect to the derailment of train 7MP7 at Coonana, WA on 19 August 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• An incorrectly stored lock pin from a point clamp fouled the indicator’s throw arm pivot mechanism, preventing the points from auto-normalising.
• The practice of storing the point clamp on the point indicator stand increased risk of the point indicator throw arm pivot mechanism becoming fouled.
• The speed of 7MP7 was not reduced sufficiently at the Location Ahead sign to ensure the train could stop before the facing points should the light indicator not display a green aspect.
• A breakdown in verbal communication between the supervising and trainee driver resulted in a misunderstanding of the significance of not sighting the light enhancer, and the urgency of the intended action to brake the train.

Other factors that increased risk

• The combination of enhancer luminaire type, positioning, and trackside vegetation likely reduced the conspicuity of the light indicator to the train crew of 7MP7.
• The driver competency program did not adequately prepare the trainee driver to control the train in response to an emergency.

Other findings

• The east end Light Indicator (enhancer) displayed a red lamp to the train crew.
• It is unlikely a rolling-stock condition contributed to the derailment.
• There was no evidence to suggest that any medical or physiological factor affected the train crew’s performance leading up to or during the incident.
• It is unlikely that fatigue adversely affected the train crew's performance during this shift.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

The initial public version of these safety issues and actions are provided separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence

ARTC

Post the derailment of 7MP7, Australian Rail Track Corporation (ARTC) removed all point clamps from the point indicator stands and relocated them to the adjacent equipment huts at each location between Malbooma (South Australia) and Parkeston (Western Australia). Additionally ARTC have replaced all K3 searchlight units with long-range LED luminaire type units between Malbooma and Parkeston.

Pacific National

Pacific National introduced a SPAD reduction program and reinforced that train crews reduce speed in preparation for stopping short of facing points until both drivers confirm recognition and understanding of indicator aspects. Additionally PN discussed with ARTC the implementation of improvements to point indicators between Kalgoorlie (Western Australia) and Cook (South Australia).

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• Pacific National
• Train crew of 7MP7

References

Australian Rail Track Corporation, Addendum to the Code of Practice for the Defined Interstate Rail Network, Revision 5.0, 1 July 2018.

Australian Rail Track Corporation, Code of Practice for the Defined Interstate Rail Network, Volume 3, Operations and Safeworking, Part 1 Rules, ARTC Version 3.0, 1 July 2018.

Australian Rail Track Corporation, Engineering (Signalling) Standard, ESC-04-01 Signal Sighting and Position, Version 1.4, 27 October 2010, pp 5.

Australian Rail Track Corporation, Specification, Signals – Work on Asset, Issue 1.1, 4 May 1999.

Australian Rail Track Corporation, Standard Train Braking Application design, ESD-05-03, version 1.1, 21 August 2018

Australian Rail Track Corporation, Train Braking Application Design Standard, ESD-05-03, Version 1.1, 21 August 2018.

Australian Rail Track Corporation, Signalling Technical Maintenance Plans, Signal Colour Light (Incandescent Type) Generic, Service Schedule SS07 12 01 01

Australian Rail Track Corporation, Signalling Technical Maintenance Plans, Signal Colour Light (LED Type) Generic, Service Schedule SS 07 12 11 01

Breznitz, S. (1983), Cry Wolf: The Psychology of False Alarms, Lawrence Erlbaum Associates, Mahwah, NJ.

Burian, B. K., Barshi, I., & Dismukes, K. (2005). The challenge of aviation emergency and abnormal situations. NASA/TM-2005-213462. NASA.

Cannon-Bowers, J.A., Rhodenizer, L., Salas, E., & Bowers, C.A. (1998). A framework for understanding pre-practice conditions and their impact on learning. Personnel Psychology, 51, 291-320.

Civil Aviation Safety Authority (2019). Resource booklet 4: Communication. In Civil Aviation Safety Authority. Safety Behaviours: Human Factors for Pilots (2nd Edition). Australian Government Publishing.

Conference on Railway Engineering, Wollongong, 10 -13 November 2002, RTSA Trans Australian Railway Self Restoring Point System, E.N Fletcher and R.B Kempster, Australian Rail Track Corporation.

Department of Transport and Regional Services, Code of Practice for the Defined Interstate Rail Network, Operations and Safeworking Part 1: Rules, ARTC Version 3.0, 1 July 2018.

Kahneman, D. (2011). Thinking Fast and Slow. Farrar, Straus & Giroux: New York

Kirby, J (1997). Crew Resource Management (CRM) PowerPoint presentation. A presentation of the Salt Lake City Flight Standards District Office (FSDO).

O'Brien, K. A., Cole, B. L., Maddocks, J. D., & Forbes, A. B. (2002). Color and defective color vision as factors in the conspicuity of signs and signals. Human factors, 44(4), 665-675.

Pacific National (NSW) Pty Ltd, Cv40-9i NR Class Locomotive Operators Manual, Version 2.0

Pacific National Accredited course TLIC2078, Learners Guide Part 4 Responding to Network Signals and Indicators/Signs, Version 3.2 10 September 2018.

Pacific National Learning and Assessment Strategy Certificate IV Train Driving, 8 December 2017

Pacific National Learners Guide, TLIC4019 Drive train to operational requirements, Version 3.2, 10/09/2018

Pacific National Learner Guide, TLIC2078 Identify and respond to signals and trackside signs, Version 3.2, 10/09/2018

Pacific National Learners Guide, TLIF4110 Respond to abnormal situations and emergencies when driving a train, version 3.2, 12/09/2018

Pacific National Information Bulletin No. 54A, AWARE Train Radio System, GPS Location Alerter – Driver Information System.

Pacific National Mentor Driver Guidelines, Perth Drivers Depot

Pacific National Driver Mainline Verification of Competence (VOC) Combined Checklist, Version 2.1 November 2016

Rantanen, E. M., & Kokayeff, N. K. (2002, September). Pilot error in copying air traffic control clearances. In Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 46(1), pp. 145-149. Sage CA: Los Angeles, CA: SAGE Publications.

Salas, E., Sims, D. E., & Burke, C. S. (2005). Is there a “big five” in teamwork?. Small group research, 36(5), 555-599.

Sorkin, R. (1989), Why Are People Turning Off Our Alarms? Human Factors Bulletin, 32, pp. 3-4.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Australian Rail Track Corporation, Pacific National, train crew of 7MP7 and the Office of the National Rail Safety Regulator.

Submissions were received from the Australian Rail Track Corporation, Pacific National, train crew of 7MP7 and the Office of the National Rail Safety Regulator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 18 August 2018, intermodal freight train YC77, operated by Aurizon, was en route from the Acacia Ridge Intermodal Terminal in Brisbane, Queensland. The train was powered by a diesel electric locomotive and one of its wagons contained a stack of three empty flat racks. During transit, the collapsible, rear end wall of the top flat rack extended upwards. This end wall contacted the Elm Street overpass on approach to Cooroy, and pulled down the high voltage overhead line equipment (OHLE). As a consequence, 1.3 km of OHLE was pulled down.

What the ATSB found

The ATSB found that personnel at the Acacia Ridge terminal did not check the collapsible end walls of the flat racks were secured on arrival at the terminal and after the flat racks were loaded onto YC77. In addition, Aurizon, did not have an effective system in place for ensuring personnel required to check the securing of unusual loads (such as empty flat racks) prior to departure had sufficient knowledge of their responsibilities, and had ready access to relevant procedures, guidance and checklists.

On multiple occasions following the dewirement, train crew accessed the exclusion zone associated with the close proximity of the extended end wall of the flat rack to the OHLE, prior to the wires being isolated and earthed on site. Network control centre personnel did not advise train crew of the status of the OHLE during the emergency response period, and Queensland Rail (QR) did not have an effective process in place to ensure that safety-critical actions were co-ordinated and completed when multiple network control officers were involved in responding to an OHLE emergency.

The ATSB also found that following the dewirement the driver and network control officer (NCO) did not follow required protocols for driver only operations (DOO) prior to the driver leaving the locomotive cabin, and Aurizon did not provide drivers with ready access to QR’s procedures for DOO and OHLE emergencies when they were operating on the QR network.

What's been done as a result

Aurizon has updated processes and checklists in relation to flat racks, with further theoretical training undertaken for loading personnel at Acacia Ridge in relation to securing requirements. In addition, Aurizon is currently undertaking a program to increase mobility of access to its safety management system (including relevant procedures and checklists). For driver only operations, Aurizon has commenced drafting a procedure for use on its own network, with a checklist for emergencies affixed to 2800 class locomotives that operate on the North Coast Line, at sign-on locations and attached to train lists.

QR has mandated the use of the network control officer (NCO) checklist for OHLE emergencies, and is currently reviewing related aspects of its emergency response procedures. In addition, QR have provided further training to both NCOs and train crew in relation to identifying objects in close proximity to OHLE and applicable exclusion zones. NCOs have also undertaken DOO emergency procedure refresher training.

Safety message

This occurrence has highlighted the importance of having checklists for rarely conducted tasks and emergency response tasks in the rail environment, and ensuring these checklists are readily available and used by operational personnel. This includes checklists for loading and securing personnel, rail traffic crew and network controllers.

The occurrence

Overview

On 18 August 2018, intermodal freight train YC77, operated by Aurizon, was scheduled to depart from the Acacia Ridge Intermodal Terminal in Brisbane, Queensland to the Portsmith freight terminal near Cairns, Queensland. The train was powered by a diesel electric locomotive and one of its wagons contained a stack of three empty flat racks.^[1]

During transit, the collapsible, rear end wall of the top flat rack extended upwards. At about 2102,^[2] this end wall contacted the Elm Street overpass on approach to Cooroy, and pulled down the high voltage overhead line equipment (OHLE).

Arrival of flat racks at freight terminal

On 14 August 2018, a freight forwarding company booked four 40 ft empty flat racks to travel by Aurizon train from Acacia Ridge to Portsmith. When booking, the freight forwarding company advised Aurizon by email that the flat racks would travel as a nest of three (stacked on top of each other) and a single. It also advised that the end walls of the nest of three had been chained down.

Sub-contractor truck drivers collected the flat racks from the freight forwarding company and delivered them to Aurizon’s Acacia Ridge terminal in two consignments on 17 August.

When the two trucks arrived at the freight terminal, the Acacia Ridge terminal coordinator instructed the drivers to proceed to the container pad. The terminal coordinator did not visually inspect the loading of the consignments. The truck drivers parked at the container pad, where a heavy forklift driver unloaded the consignments.

A subsequent review of closed-circuit television (CCTV) footage of the delivery of the empty flat racks showed that the nest of three flat racks were not secured by straps or chains.

Loading of flat racks onto train YC77

On 18 August 2018, YC77 was assembled at the Acacia Ridge terminal. In relation to the empty flat racks, loading and inspection activities included:

• At about 1100, the Aurizon heavy forklift driver loaded the nest of three flat racks onto a flat wagon and the single flat rack onto a separate flat wagon. Securing was limited to spigots securing each nested flat rack to each other, and securing the bottom flat racks to their respective wagons. The flat rack end walls were not secured.
• At about 1530, once train loading was complete, two Aurizon train pinners^[3] inspected the loading and securing of freight on all the wagons. A Form 04 (Loading and securing advice) was issued at completion, verifying the loading on the train was safe for travel.
• At about 1715, two Aurizon freight operators^[4] conducted a train safety test, checking wagon integrity and correct train brake operation. A Form SW57 (Train inspection / repair certificate) was issued at completion, certifying the train as fit for travel.
• At 1749, YC77 departed Acacia Ridge yard, during which an Aurizon freight operator conducted a slow speed roll-by examination for train defects.

These activities did not identify any problems with the empty flat racks.

Departure of train YC77

YC77 was planned to travel from Acacia Ridge (12.181 km)^[5] to Portsmith (1,677.088 km) on Queensland Rail’s (QR’s) North Coast Line.^[6] This involved operating on track that had OHLE from Acacia Ridge to Rockhampton (638.790 km).

There was no indication of any problems or concerns with the operation of the train on its journey between Acacia Ridge and when it passed through Yandina (112.790 km) at 2043. CCTV footage from a sample of stations showed that the rear end wall of the top nested flat rack remained in the down position up until the train passed Yandina, and it moved to being extended upwards at some point prior to reaching Eumundi (122.100 km) at 2049. Figure 1 shows a map of the Brisbane rail network with the departure point and the area of the occurrence highlighted.

Figure 1: Brisbane rail network showing departure point and occurrence location

The image shows stations and their distance from Roma Street Station in Brisbane.
Source: Queensland Rail, annotated by the ATSB

Overhead line equipment circuit breaker trips

At 2048, after passing North Arm (117.710 km), a trip of the OHLE circuit breaker occurred, automatically de-energising^[7] the electrical section from Woombye (100.690 km) to Traveston (150.310 km). The fault locator indicated to the electric control operator (ECO)^[8] at QR’s Brisbane rail management centre (RMC) that the trip had occurred at 119.500 km.^[9]

Given that train YC77 was in the estimated area of the circuit breaker trip at that time, the ECO requested the universal traffic control (UTC 7)^[10] network control officer (NCO) to confirm the status of the OHLE with the driver. At that time, the northside relief NCO was monitoring and controlling UTC 7 (see Network control). At 2052, the northside relief NCO contacted the driver of YC77, and the driver advised observing nothing unusual. After receiving this information, the ECO reset the OHLE circuit breaker, which held closed. The reset of the circuit breaker re-energised the high voltage OHLE. The ATSB subsequently identified that this first OHLE circuit breaker trip occurred at about 119.613 km, the location of YC77 at the time Figure 2 (see Sequence of circuit breaker trips).

Figure 2: Approximate location of first OHLE circuit breaker trip

Source: Queensland Rail, annotated by the ATSB

At 2052, a track circuit showed ‘occupied’^[11] three track sections^[12] behind YC77, followed at 2053 by a second trip of the OHLE circuit breaker (Figure 3). The ECO identified that the fault locator did not work on this occasion, which meant the fault could have occurred anywhere on the Woombye to Traveston electrical section. At that time, in addition to YC77, there were two other trains within this electrical section.

Figure 3: Approximate locations of second and third OHLE circuit breaker trips

Source: Queensland Rail, annotated by the ATSB

The ECO contacted the UTC 7 NCO workstation, and the northside relief NCO advised that, although there were intermittent track circuits showing as occupied, there were no trains in those areas. As there were no in-field reports of OHLE abnormalities, the ECO reset the OHLE circuit breaker at 2056, which held closed. The ATSB subsequently identified that this second OHLE trip occurred at about 125.248 km, the location of YC77 at the time.

Over the following 5-minute period, a further two occupied track circuit indications occurred in different track sections behind YC77.

At 2101, a third trip of the OHLE circuit breaker occurred, and a telemetry^[13] failure occurred at Sunrise (124.230 km). The fault locator indicated to the ECO that the trip had occurred at 130.170 km, to the south of the Elm Street overbridge (130.750 km). The ATSB subsequently identified that this third OHLE trip occurred at about 129.1209 km,^[14] the location of YC77 at the time.

Dewirement near Cooroy

At 2102, train YC77 was entering Cooroy. It passed under the Elm Street overbridge at a speed of about 42 km/h, which was under the maximum permitted speed of 50 km/h. Subsequent inspection found that the extended rear end wall of the top nested flat rack hit the underside of the bridge, and pulled down the high voltage OHLE wires (see Site inspection), resulting in a dewirement.^[15]

Examination of CCTV footage showed that, as the train passed through Cooroy, the rear end wall of the top nested flat rack was still in the extended position. In addition, the OHLE, including copper wires, was entangled on the wagon and dragging along the station platform (Figure 4).

Figure 4: CCTV footage at Cooroy station showing the flat racks with the extended end wall and OHLE wires that had been brought down

Source: Queensland Rail

At 2103, the ECO contacted the UTC 7 NCO workstation and advised the UTC 7 NCO, who had returned from a meal break, of the third circuit breaker trip. The ECO noted that YC77 may have had ‘a rope or something’ that was touching the OHLE. The NCO advised the ECO that a track fault had occurred, this time coinciding with the location of YC77. The ECO did not attempt a further reset of the OHLE circuit breaker.

At 2104, the UTC 7 NCO contacted the driver of YC77. The driver advised that, as the train passed through Cooroy station, the OHLE appeared to be ‘really loose’. The UTC 7 NCO acknowledged this report. The NCO also provided the driver clearance to proceed to outside Pomona (139.980 km), and advised the driver that the train may need to be examined, because the issue seemed to be following it.

At 2106, the UTC 7 NCO instructed the driver of YC77 to stop the train ‘straightaway’. The driver stopped the train at 134.493 km, between Cooroy and Pomona. At 2107, the driver contacted the UTC 7 NCO workstation and advised the northside relief NCO, who was now assisting the UTC 7 NCO, of the train’s location.

At 2107, the UTC 7 NCO instructed the driver of a southbound electric passenger train X906 to stop the train immediately. That train was near Woondum and scheduled to pass through the Traveston neutral section into the de-energised section 4 minutes later.

Post-dewirement activities

Where the train stopped, the OHLE was still in place. However, the extended end wall of the top nested flat rack on YC77 was still extended upwards and in close proximity to the OHLE contact wire. Although the OHLE was de-energised, a potential hazard still existed.

After the train stopped, there were a number of communications and activities involving the driver, network control personnel and emergency services personnel to assess and manage the situation. These activities included:

• At 2107: The northside relief NCO instructed the driver to walk and check the train, as there were concerns ‘…something might be sticking up from the train [towards the OHLE]…’. The driver confirmed this instruction. The northside relief NCO did not advise the driver of the electrical status of the OHLE.
• At 2111: The Queensland Police Service (QPS) contacted the RMC on the emergency phone line, and advised the southside train control leader (TCL) that the OHLE was down at Cooroy station. The QPS also advised that a witness observed ‘… wires on top of the train [YC77] that went through’.
• At 2115: The northside relief NCO attempted to contact the driver of YC77 by radio. There was no response as the driver was outside, inspecting the train.
• At 2119: The QPS again contacted the RMC by emergency phone, requesting that the OHLE be turned off in the area around Cooroy to help the police manage the scene. The caller noted that police on the scene reported that wires were down across fences and the pedestrian footbridge (north of the Elm Street overbridge). The southside TCL warned that, although the OHLE was de-energised, it was still not yet electrically safe until it was earthed and isolated at the site.
• At 2120: The UTC 3 NCO^[16] called the driver of YC77’s mobile phone and advised that the police had confirmed the OHLE was down. The driver advised the UTC 3 NCO of the general nature of the problem, after having walked the length of the train. The driver indicated there was a problem with one of the wagons on the train that was extending upwards towards the OHLE (Figure 5).^[17] During the conversation, the UTC 3 NCO handed the phone to another network control person to clarify the situation with the driver, who advised it would be easiest to explain the situation by sending some photos. The driver returned to the locomotive cabin soon after.
• At 2133: The UTC 3 NCO called the driver’s mobile phone to confirm whether the driver was in a safe place. The driver confirmed being in the locomotive cabin, but advised needing to leave the cabin to email photos of the flat rack to the RMC (due to problems with mobile phone data reception). The driver sent the photos soon after this conversation.
• At 2145: The day of operations coordinator (DOOC) instructed staff at the RMC to commence the ‘DOOC & TCL Incident and Emergency Tool’ checklist.
• At about 2200: A protection officer associated with a prior planned track closure to the north of the accident site arrived at the locomotive. The driver of YC77 left the locomotive cabin to talk to the protection officer, who then left the driver and inspected the train.
• At 2252: The rail operations response unit (RORU) QR commander arrived at Cooroy to take over coordination of the accident. After meeting with the onsite police, the QR commander allowed the police to proceed to the locomotive to perform drug and alcohol testing of the driver. The driver of YC77 left the locomotive cabin in order to be tested.
• At about 2307: The QR commander and a RORU officer attended the locomotive. The driver of YC77 left the locomotive cabin to accompany them as they inspected the train.
• At 2308: A QR OHLE linesman advised the ECO that the OHLE was intact above YC77.
• Early the following morning: A new driver relieved the driver of YC77, who left the locomotive cabin for changeover purposes. The new driver then entered the locomotive cabin of YC77.
• At 0300 (6 hours after the dewirement): The nominated person^[18] issued a Form C (Permit to Work), confirming the OHLE at Cooroy station and above YC77 had been isolated, tested and earthed.

Figure 5: Flat rack end wall in the extended position in close proximity to the OHLE

Source: Queensland Rail

Consequences of the dewirement

As a result of the dewirement, OHLE was brought down from 130.181 km to 131.447 km (about 1.3 km). High voltage wires, insulators and cantilever arms contacted the ground. Given the level of damage, the occurrence met the definition of an accident, as defined by the Transport Safety Investigation Act 2003.

There were no injuries. Although there were no people on the Cooroy station platform at the time of the dewirement, a southbound passenger train was scheduled to arrive about 30 minutes later.

Repair works were completed at 2215 on 20 August 2018, with the track reopened through Cooroy at 2301, 50 hours after the accident. During this period, all trains through the area were suspended.

__________

1. Flat rack: a type of shipping container used for over dimension loads. The end walls could be collapsed to allow stacking (nesting) when empty.
2. All time references in this report are in local time (Eastern Standard Time).
3. Train pinner: a heavy forklift driver who inspected the loading and securing of freight on a train.
4. Freight operator: conducted shunting, train pre-departure tests and roll-by examinations.
5. Distances were measured from Roma Street station, Brisbane (0.000 km).
6. The North Coast Line ran from Roma Street station to Cairns station (1,680.940 km).
7. De-energised: the opening of high voltage circuit breakers disconnecting electrical energy.
8. Electrical control operator (ECO): person who monitored and controlled the OHLE systems on the QR network.
9. The fault locator was not always accurate (see Electric control room procedures during OHLE emergencies).
10. UTC 7: Brisbane’s QR Citytrain network was divided into 10 sectors for train control purposes. UTC 7 managed sections of the North Coast Line that included North Arm to Cooroy.
11. A track circuit unexpectedly showing occupied may occur in instances of OHLE faults, where high voltage contacts the rail.
12. Track section: a section of railway track between two locations (such as between two stations).
13. Telemetry: equipment used for encoding / decoding electronic commands between the RMC and in-field signalling equipment.
14. This location was 1,209 m past the 129 km peg (see Sequence of circuit breaker trips).
15. Dewirement: a situation in which the contact wire and / or catenary wire of the OHLE has detached from supporting structures, resulting in high voltage power lines sagging or contacting the ground, potentially touching trackside equipment.
16. UTC 3 NCO: the NCO allocated to the neighbouring UTC workstation to UTC 7. UTC 3 managed the North Coast Line from Sunshine (13.240 km) to Beerburrum (64.610 km) and, the Redcliffe Peninsula Line.
17. The driver had not seen flat racks before and had difficulty describing the nature of the problem.
18. Nominated person: a competent worker who switched, tested and applied local earths to OHLE, before issuing Form C.

Context

Track and network information

General

The North Coast Line consisted of 1,680 km of railway between Brisbane and Cairns, Queensland. Queensland Rail (QR) owned and managed 1,567 km of the North Coast Line, including the section from Brisbane through North Arm to Pomona (Figure 1).

Constructed in 1891, the section from North Arm to Cooroy (crossing the Blackall Range), was extensively realigned and regraded in 1988, in preparation for electrification. The new alignment increased the distance between North Arm and Cooroy. In addition, the track was lowered underneath several existing overbridges to provide clearance for the high voltage overhead line equipment (OHLE), including under the Elm Street overbridge at Cooroy.

Overhead line equipment (OHLE)

In OHLE-based electrified railways, traction power is supplied to electric locomotives and train units through a train-borne pantograph contacting the OHLE contact wire. The traction power circuit is completed by the current passing from the locomotive through the wheels of the train, into the rail and back to the feeder station and earth. Figure 6 indicates the major OHLE components.

Figure 6: QR mainline electrification OHLE components

Image is of mainline electrification (autotransformer) OHLE components. Of particular note are the high voltage components, considered live at 25 kV, specifically, the catenary wire, contact wire, feeder wire, droppers, cantilevers and register arms.

Source: ATSB

QR’s mainline electrification adopted an autotransformer type system for OHLE supply at 25 kV alternating current (AC).

The OHLE’s lowest point above a train was the contact wire, which was at a nominal height of 4,900 mm above rail level. To allow for temperature-related expansion and contraction, and the effects of wind, the wires were kept tensioned by pulleys and weights placed at about 1.6 km intervals.

For general operations, the loads on trains were required to be a maximum of 3,820 mm above rail level. An authority to travel could be granted for heights up to 3,950 mm in electrified territory. However, QR advised that on the North Coast Line a special exemption for container traffic (including flat racks) allowed loads to reach up to 4,080 mm above rail level.

OHLE contact wire heights

Although the OHLE contact wire was set at a nominal height of 4,900 mm above rail level, this height was increased or decreased for clearance purposes; for example, over level crossings and under overhead bridges. As discussed in Flat rack containers, the height of an undamaged extended end wall on the top flat rack of a nest of three flat racks was about 4,845 mm above rail level, although that height would vary to some extent with the movement of a train.

OHLE contact wire heights were routinely measured by QR using a track recording vehicle, with the last survey conducted in the region of the dewirement on 14 June 2018, 2 months before the dewirement. Between Yandina (112.790 km), where the rear end wall of the top nested flat rack was last observed on closed-circuit television (CCTV) to be collapsed down, and Eumundi (122.100 km), where the rear end wall was first observed to be extended up, the OHLE contact wire height dropped to or below 4,845 mm at a number of locations. These are shown in Table 1 (in white rows).

Table 1: OHLE contact wire low points (in white rows) and location of key events (in blue rows) between Yandina and Cooroy

Due to realignment of the line in 1988, the distance between the 129 km and 130 km pegs was 1,656 m. Therefore 129.1209 refers to 1,209 m beyond the 129 km peg and 447 m prior to the 130 km peg. Similarly, 129.1267 refers to 1,267 m beyond the 129 km peg and 389 m prior to the 130 km peg.

As indicated in Table 1, the contact wire at the Elm Street overbridge was 4,349 mm above rail level. This was the lowest contact wire height between Yandina and Cooroy. The Elm Street overbridge itself was 4,816 mm above rail level.

Sequence of circuit breaker trips

The ATSB examined the available evidence to determine the most likely locations of the train when the three circuit breaker trips occurred. Relevant details, summarised in Table 1, included the following:

• The first OHLE circuit breaker trip occurred at 2048, and it registered on the ECO’s fault locator at 119.500 km. The closest contact wire low point was at 119.637 km. After considering the data logger data, the most likely location of the wagon of nested flat racks on YC77 when the circuit breaker tripped was determined to be 119.613 km, just prior to the 119.637 km low point. As the OHLE height dropped to 4,844 mm above rail level at that location, it would have allowed direct contact with the extended end wall of the top nested flat rack, resulting in the tripped OHLE circuit breaker de-energising the electrical section.
• The last contact wire low point prior to 119.637 km low point was at about 118.782 km (4,845 mm). Therefore, it is very likely that the unsecured end wall of the top nested flat rack raised somewhere between 118.782 km and 119.613 km.
• Although further OHLE contact with the extended rear end wall of the top nested flat rack would have occurred at about the 121.075 km low point and 122.581 km low point, these contacts did not result in circuit breaker trips as the electrical section was still de-energised. ATSB analysis determined that when the ECO reset the tripped circuit breaker at 2052, re-energising the OHLE, YC77 was at about 124.100 km.
• The second OHLE circuit breaker trip occurred at 2053; however, the ECO’s fault locator could not determine the location of the trip on this occasion. ATSB analysis determined that the wagon of nested flat racks was near 125.200 km at this time. There were no areas of OHLE contact wire at or below 4,845 mm at this location. However, the OHLE contact wire did lower to 4,853 mm at 125.248 km, reducing the air gap between the extended end wall of the top nested flat rack and the OHLE contact wire to 8 mm. It is almost certain that either the OHLE arced across this air gap,^[19] or the end wall contacted the OHLE, resulting in the tripped OHLE circuit breaker de-energising the electrical section.
• Although a further OHLE contact with the extended end wall of the top nested flat rack would have occurred at about 126.354 km (4,838 mm low point), this contact did not result in a circuit breaker trip as the electrical section was still de-energised. Analysis determined that when the ECO reset the tripped circuit breaker at 2056, re-energising the OHLE, YC77 was at about 127.400 km.
• The third and final circuit breaker trip occurred at 2101, and it registered on the ECO’s fault locator at 130.170 km. The closest contact wire low points were at 130.136 km and 129.1267 km (389 m prior to the 130 km peg). After considering the data logger data, the most likely location of the wagon of nested flat racks on YC77 when the circuit breaker tripped was determined to be 129.1209 km, ^[20] just prior to the 129.1267 km low point. As the OHLE height dropped to 4,842 mm above rail level at that location, it would have allowed direct contact with the extended end wall of the top nested flat rack, resulting in the tripped OHLE circuit breaker de-energising the electrical section.

Train and train crew information

Train information

Aurizon train YC77 consisted of one 2800 class diesel electric locomotive hauling 32 container wagons. It was 659 m long, and had a total mass of 1,465 t. Although travelling on an electrified network, the locomotive did not use the OHLE to gain tractive power.^[21]

The train was fitted with a data logger, and information from the data logger has been included in the report where relevant.

Flat rack containers

Flat racks were a type of shipping container, designed for oversized loads that could not fit within the normal profile of an enclosed side / top container. The end walls (if fitted) could be extended up or collapsed down. The advantage of collapsible end walls was their ability to be stacked flat on top of each other (or nested) when empty, allowing for efficient transportation. Flat racks were available in 20 ft or 40 ft lengths.

Flat racks with collapsible end walls were fitted with leaf spring or coil assistance for ease of raising. Once extended, two locking pins could be manually engaged to secure each end wall in the raised position. When collapsed, two twist locks (one on each side) could be manually engaged to secure each end wall in the down position (Figure 7). In addition, four spigots secured each flat rack to a flat rack below when nested, or to a flatbed rail wagon for transportation.

Figure 7: Twist lock mechanism for flat rack end wall

Source: ATSB

When travelling empty, Aurizon’s document SAF/STD/022/SWK/BUS (Loading and securing of freight manual) required flat racks to have all four twist locks engaged. It also required an additional chain or two web straps over each end wall of the top nested flat rack. This ensured that the leaf spring / coil raise assist end walls could not extend upwards during transit.

The flat racks on YC77 were Domino Seadeck 40 ft long type, similar to those shown in Figure 8. The collapsible end walls had leaf spring assist. A warning decal on the flat racks instructed the use of twist locks when a flat rack was travelling empty.

Figure 8: Flat rack containers

Image shows a flat rack with extended end walls (foreground) and flat racks with end walls collapsed (background) to enable stacking (nesting). Location of supplied securing methods when end walls were extended (locking pins) and collapsed (twist locks) are also shown.

Source: Mission & Relief Logistics, annotated by the ATSB

The height of a nest of three flat racks with the end walls collapsed, loaded on a flat wagon, was about 2,895 mm above rail level. The height of an undamaged extended end wall on the top flat rack of a nest of three flat racks was about 4,845 mm above rail level.

Train crew information

Train YC77 was crewed by a single train driver (see Driver only operations information). The driver had 7 years driving experience. This included commencing as a trainee driver with Australian Railroad Group^[22] at Cloncurry (Queensland), then conducting train driving duties at Geraldton (Western Australia) and Rockhampton (Queensland), prior to being based at Acacia Ridge from January 2017.

Train performance and environmental conditions

A review of the train’s data logger determined that the driver of YC77 followed sound train handling principles, including complying with maximum speed limits, between Yandina and the location of the dewirement. Between Yandina and shortly before 119.613 km, the location where the first circuit breaker trip occurred (see Sequence of circuit breaker trips), the speed of YC77 was held consistently between 75 and 80 km/h.

A review of Bureau of Meteorology data determined that maximum wind speeds at the time of the occurrence were under 10 km/h.

Site inspection

Onsite inspection by the ATSB on 19 August 2018 found scrape marks on the underside of the Elm Street overbridge. A broken OHLE contact wire found near the bridge had blue paint marks, identical to the colour of the top nested flat rack. Colourbond fencing on the southern side of the Elm Street overbridge was also damaged.

An inspection of the train where it had stopped (134.493 km) found damage limited to that of the extended rear end wall of the top nested flat rack. The end wall had minor damage and had been bent backwards, consistent with contact damage with the Elm Street overbridge. The height of the damaged extended end wall was 4,740 mm above rail level, slightly less than its expected undamaged height of 4,845 mm.

Analysis determined that the distance between the damaged extended end wall of the top flat rack and the OHLE contact wire at the location where the train stopped was about 210 mm (Figure 9).

No web straps or chains secured the end walls of the top flat rack on the nest of three flat racks or the end walls of the single flat rack. In addition, neither of the top two flat racks on the nest of three had their twist locks engaged. A significant amount of rust was present on the twist lock mechanisms, indicating they had not been engaged for a significant period of time. The spigots securing the bottom flat rack to the wagon, and each flat rack to the one below, were in place.

Figure 9: Nest of three flat racks on train YC77, showing the damaged extended rear end wall

Image shows the extended end wall of the top nested flat rack, loaded on wagon BAZY 47520. The distance between the end wall and the OHLE contact wire is about 210 mm.

Source: ATSB

Although the OHLE above the train was intact, some wires from the OHLE that had been pulled down were entangled in parts of the train, as shown in Figure 10.

Figure 10: Part of train YC77 showing OHLE wires in contact with the train

Source: ATSB

Train loading and securing information

Loading and securing process

The Acacia Ridge Intermodal Terminal was located in the southern suburbs of Brisbane, and was owned and operated by Aurizon (Figure 11). The terminal handled the transhipment of road freight to rail transport and vice versa.

Figure 11: Acacia Ridge Intermodal Terminal

Image shows the location of the checkpoint (freight processing office), container pad, rail pad and marshalling yard at Acacia Ridge Intermodal Terminal.
Source: Google Earth, annotated by the ATSB

After arriving at the security gatehouse, incoming road freight proceeded to the freight processing office and the delivering truck driver presented relevant paperwork to the terminal coordinator. If it was deemed an unusual load,^[23] the terminal coordinator was required to check the load to ensure it was correctly secured for rail travel. If secured correctly, the terminal coordinator directed the trucks to the rail pad for train loading, or to the container pad for short-term storage. If loading was found to be incorrectly secured, the terminal coordinator would not be accept the load until the issue had been fixed by the delivering truck driver.

A heavy forklift driver unloaded loads from trucks and either stored them as required on the container pad, or placed them directly onto wagons at the rail pad. After loads had been placed on the wagons, pinners ensured the loads were correctly secured. Freight operators shunted the wagons from the rail pad to the marshalling yard, where the train was finalised for departure.

Loading and securing procedures

Aurizon had several documents that contained procedures associated with the loading and securing of loads. A comprehensive and detailed 242-page document 07-STD-022-SWK (Loading and securing of freight manual), and supporting checklists, were provided to assist staff. The manual provided guidance on how to secure a wide range of loads.

The procedure for securing empty flat racks was included in the loading and securing manual, within a number of other instructional dot points. As noted in the manual, the procedure required that each collapsed end wall on the top flat rack of a nest of flat racks was to be secured by either one chain or two web straps, and the two fitted twist locks. The maximum height above rail level for nested flat racks loaded on a flat wagon was not to exceed 3,165 mm.

In addition to the loading and securing manual, checklist 14-FRM-017-INT (Loading & securing checklist – Flat-racks) provided guidance on the securing of nested empty flat racks. This guidance was consistent with the content of the manual.

Other documents outlined the roles and responsibilities for personnel involved in ensuring loads were appropriately secured. More specifically:

• Work instruction 14-WI-011-INT (Loading & securing – Inspection of incoming loads at terminals) provided instructions on inspecting unusual incoming loads. It stated that the terminal coordinator was to inspect any load that was not a 20 ft or 40 ft container to ensure the loading met the requirements of the loading and securing manual, using the relevant checklist.
• Work instruction 07-WI-013-ACR (Train pinning: Work method statement) provided instructions for the pinners. The stated purpose was ‘when rail wagons have been loaded, the containers have to be secured and pinned up’. The stated process included walking around both sides of the train and pinning all manual spigots and checking for any non-conformances. The list of potential non-conformances included ‘unsecured loads’. However, the instruction did not provide guidance on how this was to be identified. There was no reference to the loading and securing manual or related checklists for unusual loads.

The loading and securing manual and associated checklists were stored on Aurizon’s intranet system ‘iN-Gauge’. Hard copies were not readily available.

If an incoming load was deemed unusual, the terminal coordinator would inspect the loading and securing arrangements as per the loading and securing manual and the relevant checklist, after accessing iN-Gauge. Computer access to iN-Gauge was available in the freight processing office.

On encountering an unusual load while pinning a train, pinners were required to return to the office, access iN-Gauge, find and print the relevant checklist, and recommence the loading and securing inspection.

All interviewed personnel advised that flat racks were rarely encountered at the Acacia Ridge terminal.

Loading and securing training

Aurizon provided training and assessment for loading and securing of flat racks to personnel with these responsibilities. This training included an on-line course, which contained extensive and complex loading and securing instructions for a variety of different types of loads.

Personnel were also required to sign an acknowledgement sheet that they had received a particular instruction (such as 14-WI-011-INT for inspection of incoming loads or 07‑WI-013-ACR for train pinning) and received a training session on the instruction, which included a small number of competency assessment questions.

Neither the on-line, nor the work instruction training, contained practical instruction or assessment.

Loading and securing personnel

The personnel involved in the loading and preparation of train YC77 included the following:

• The terminal coordinator on duty when the flat racks were delivered had 7 months’ experience in the role and was previously employed as a heavy forklift driver. Although reporting that it was a busy evening when the flat racks were delivered, the terminal coordinator felt alert at the time of the flat rack delivery.
• The heavy forklift driver who unloaded the truck on the night of delivery, and loaded YC77 the following morning, had two 2 years’ experience in the role, as well as previously working as a heavy forklift driver with another rolling stock operator. The forklift driver also performed pinner duties on a rotational basis.
• Two pinners inspected YC77 prior to handover to the freight operators. Pinner no. 1 was a temporary contractor with the heavy lift section. The 6-month contract period ended shortly after the accident. Pinner no. 2 had 5 years’ experience as a heavy forklift driver and had also acted in the terminal coordinator position.

Table 2 summaries Aurizon’s records of the training received by each of these personnel for the loading and securing of freight. Although most of the personnel had conducted the detailed, online course, there was no record to indicate that pinner no. 1 had completed this training.

Table 2: Loading and securing of freight training records (date completed)

Aurizon was unable to provide evidence that the terminal coordinator, pinner no. 1, or pinner no. 2 (who had previously acted as a terminal coordinator) had received work instruction training for 14‑WI-011-INT. In addition, Aurizon was unable to provide evidence that pinner no. 1 had received work instruction training for 07-WI-013-ACR.

During interview, the terminal coordinator, pinner no. 2 and heavy forklift driver agreed that the terminal coordinator was responsible for checking flat rack securing on arrival at the Acacia Ridge terminal. However, the terminal coordinator and pinner no. 2 said they understood this was limited to Aurizon loading only, not that received from external customers.

In terms of checking loads after they were lifted onto the wagons, pinner no. 2 and the heavy forklift driver said they understood that checks during pinning were limited to ensuring the provided securing was tight. Pinner no. 2 added that they assumed securing was not required if it was absent. Both pinner no. 2 and the heavy forklift driver advised that they were not aware of guidance material for checking unusual loads.

Form 04 (Loading and securing advice), which was issued on completion of train pinning, advised that further loading and securing checks were to be performed. Aurizon’s manual SAF-SPC-SWK-0048 (Testing of trains) advised these checks were to be conducted during a train safety test. In addition, form FDB819A (Loading and securing non-compliance report) was to be completed in instances of unsecured loads identified during a train safety test, shunting or roll-by examination. Freight operators performed all of these duties. However, Aurizon advised that freight operators were not qualified to perform loading and securing checks, nor were they required to do so.

Previous occurrences

Aurizon and its predecessor companies had previously reported two notifiable occurrences that involved load irregularities involving flat racks.

In January 2012, the collapsible end wall of a flat rack on Interail (QRNational) train 5MB7 collided at speed with a timber overpass north of Wauchope, New South Wales. The collapsible end walls were not secured with twist locks and chains or web straps. QRNational recommended that further training tools and information guides be developed for the transport of flat rack containers.

In April 2018, a 10,000 L polyethylene water tank fell from Aurizon train YU55 at Kinkuna (south of Bundaberg, Queensland). The loss was not identified until the train had travelled a further 211 km to Mount Miller (north of Gladstone, Queensland). Three remaining water tanks on the flat rack were also insufficiently secured. This incident related to flat rack loading and not the securing of end walls. However, the investigation report by Aurizon included the following findings:

•  non defined process to ensure every flat rack checked by [the terminal coordinator] prior to unloading off [incoming road] vehicle

•  lack of awareness / ownership of chain of responsibility by driver / loader / [terminal coordinator]

•  insufficient practical load restraint training and awareness for Aurizon staff.

Aurizon recommended delivery of further training, both theory and practical, in relation to ‘sufficient load restraint for out of scope loads’. Delivery was to occur by 31 May 2018. There was no evidence that this training occurred prior to the dewirement at Cooroy on 18 August 2018.

Rail management centre information

General

Queensland Rail’s (QR’s) rail management centre (RMC) was located on the northside of Brisbane. The RMC housed the QR Citytrain network control centre for controlling and monitoring trains, and the electric control room for controlling and monitoring OHLE supply. Both were required to interface with each other to ensure safe operation of the QR Citytrain network.

Network control

QR’s Citytrain network control operated from Tamaree^[24] to the north, Varsity Lakes and Acacia Ridge to the south, and Rosewood to the west. It was divided into nine universal traffic control (UTC)^[25] areas for train control and monitoring purposes, with a tenth used during busy periods. The UTC 7 workstation managed the North Coast Line^[26] between Glasshouse Mountains and Tamaree, which included Cooroy. The neighbouring UTC workstation, UTC 3, managed the North Coast Line from Sunshine to Beerburrum, and the Redcliffe Peninsula Line (Figure 12).

Figure 12: North Coast Line QR Citytrain universal traffic control boundaries

Image shows the location of the UTC 3 and UTC 7 boundary, between Beerburrum and Glasshouse Mountains. 
Source: TRANSLink, annotated by the ATSB

Network control officers (NCOs) operated the UTC workstations. The NCOs were supervised and assisted by two train control leaders (TCLs). The TCLs were senior, experienced NCOs, each of which was allocated supervision of either the northside or southside NCOs. Two experienced, relief NCOs provided additional support to the NCOs, for example, during breaks. Relief NCOs were, like the TCLs, allocated to either the northside or southside. The day of operations coordinator (DOOC) was a senior, experienced NCO, who provided overall supervision of the network control centre, including of the NCOs and TCLs (Figure 13).

Communication between train control and train crews was normally by radio. TCLs monitored and answered the QR staff, emergency services and members of the public emergency telephone.

Figure 13: Network control centre showing the train control leader and relevant network controller positions

The image is taken from the approximate boundary between northside and southside halves of the network control centre. The southside NCOs and TCL are located to the left of the image (out of frame).

Source: ATSB

Overhead line equipment control

An electric control room situated at the RMC was used for monitoring and controlling the QR high voltage OHLE systems. An electric control operator (ECO) monitored and controlled the OHLE via a supervisory control and data acquisition system (SCADA).^[27] An electronic event log provided information to the ECO of electric traction system alarms, issues and associated actions. The ECO workstation was also fitted with a UTC mimic panel. This panel enabled the ECO to monitor the real-time location of train movements within the electrified areas of the QR network (Figure 14).

Figure 14: Electric control operator workstation

Source: ATSB

The electric control room was segregated from the network control centre and NCOs, with communications between these areas undertaken by telephone. The ECO was able to monitor NCO radio conversations with train crew, but was not able to communicate directly to train crews. Therefore, if an ECO needed to communicate with a train crew, they were required to telephone the NCO, who would then pass on the message.

RMC personnel

In terms of the personnel on duty at the time of the accident:

• The NCO allocated to UTC 7 workstation qualified as an NCO on the northside UTC workstations just over 18 months prior to the dewirement.
• The northside relief NCO qualified as an NCO assistant 13 years previously, and qualified as an NCO in 2009
• The southside TCL had 36 years’ experience in the RMC, and was qualified as a TCL for both northside and southside UTC workstations.
• The northside TCL commenced as an assistant NCO in the Brisbane freight network control centre 21 years previously, later transferring to the RMC and becoming a TCL about 3 years prior to the dewirement.
• The DOOC, who commenced his shift at the time of the dewirement, had previously been an NCO and a TCL, and had been acting in the DOOC role for about 2 years.
• The ECO initially qualified as a high voltage OHLE substation electrician, and then qualified as an ECO about 3 years prior to the dewirement.
• The UTC 7 NCO, northside relief NCO, ECO and DOOC all stated that they felt alert at the time of the dewirement and emergency response. Although they stated that their workload was high during the emergency response, they felt it was manageable.

Emergency procedures

As a prescribed electricity entity, QR was required to have a discrete safety management system (SMS) for managing electrical safety risks.^[28] QR standard MD-13-73 (Electrical safety management plan (ESMP) for declared electrical entity works) complied with this legislative requirement. A further ten supporting documents comprising of standards, instructions, procedures, plans and checklists were provided to guide personnel during OHLE emergencies.^[29] These guidance materials included responsibilities and actions for the ECO, NCO, DOOC, train driver (including when appointed as onsite coordinator), nominated person and QR commander.

Electric control room procedures during OHLE emergencies

The QR procedure MD-11-4403 (Electric control room) provided guidance to ECOs about how to respond to OHLE circuit breaker trips. Outside a ‘high risk area’,^[30] (including between Eumundi and Cooroy), the ECO could reset a tripped OHLE circuit breaker after 1 minute, after reviewing all available information. Provided the reset OHLE circuit breaker remained closed, no further action was required. However, train crews were to be requested to remain vigilant for OHLE abnormalities.

A ‘persistent’ fault was defined as one which resulted in an immediate circuit breaker trip after the circuit breaker was reclosed. The procedure stated that persistent faults:

… may involve dewirement or objects hanging from the OHLE. Re-energisation of traction OHLE under these conditions may expose people in the vicinity of the fault to the risk of contact with live OHLE and serious injury or electrocution…

Accordingly, the procedure stated that in this circumstance the circuit breaker was not to be reclosed. The procedure also stated:

Should the ECO receive indications of persistent traction faults with non-electric trains on section, the ECO shall immediately arrange for blockage to all traffic to be applied to the affected area.

In addition to a dewirement or objects hanging from the OHLE, the procedure stated that another potential source of persistent faults was over-dimensional loads.

Although the circumstances which occurred on 18 August 2018 did not strictly meet the definition of a persistent fault, they did involve recurring faults close together. The ECO effectively followed the same procedure.

In instances of non-life threatening emergencies, the ECO was to:

• de-energise the OHLE between the two adjacent neutral sections^[31]
• arrange a block to all trains [by the NCO] to the affected section
• warn onsite personnel [through the NCO] to maintain a 3 m exclusion zone of the OHLE and anything in contact with it
• arrange OHLE staff to attend.

During the events on 18 August 2018, the neutral sections were located at Woombye and Traveston, requiring de-energisation of 50 km of OHLE. The ECO de-energised the section and arranged for a block to all trains. However, based on the available evidence, the ECO did not ensure the NCO had communicated the dangers of the OHLE to the driver of YC77.

In terms of identifying the location and reasons for circuit breaker trips, MD-11-4403 noted that the fault locator function was not always accurate. In addition, the ECO advised that unidentified causes for OHLE circuit breaker trips on the North Coast Line were common. The area north of Caboolture (50.390 km) was predominantly bushland, with OHLE circuit breaker trips commonly attributed to wildlife and tree branches.

Network control centre procedures during OHLE emergencies

During a confirmed high voltage OHLE emergency, QR procedure MD-11-33 (High voltage (HV) electric traction infrastructure emergency module EP1-04) was to be followed. The procedure outlined some general safety rules, including:

Electric traction exposed lines and equipment (and any objects in contact with exposed equipment) shall be treated as live and dangerous…

Maintain minimum 3 metre exclusion zone from all electric traction exposed lines and equipment (and any objects in contact with exposed equipment) and keep others away. Situational hazards may require a much greater exclusion zone...

Do not approach unless advised safe to do so by the relevant Network Control Centre.

The procedure outlined required actions for a wide range of personnel, including NCOs and ECOs. It stated:

Even when the Electric Control Operator (ECO) has informed the Network Control Officer (NCO) that the overhead line equipment (OHLE) has been de-energised, it is still NOT electrically safe until the Queensland Rail Nominated Person (NP) has isolated, tested de-energised and earthed the HV [high voltage] Electric Traction Infrastructure and issued a Form C or a Form D Permit to Work.

In addition to communicating dangers and safety requirements of the OHLE to onsite personnel, the NCO was to place track blocks^[32] on the affected sections of track.

Hard copies of the emergency procedures were readily available at NCO workstations. In addition, QR provided NCOs with a supporting checklist, MD-17-482 (NCO incident and emergency response tool), for quick reference during an emergency. This checklist was introduced in 2017 and included three sections: immediate actions, communication and emergency response. Items specific to OHLE electrical safety were highlighted in red in each section. These highlighted sections included:

• immediate actions: confirm OHLE status
• communication: reinforce current OHLE status to train crew and emergency services, with status updates as required
• emergency response: advise on OHLE status (de-energised, isolated, earthed, tested) (see Electrical safety).

Under the last item, the checklist stated:

Ensure Emergency Services are aware that the OHLE can only be considered safe when this [de-energised, isolated, earthed and tested] has been completed.

QR advised the ATSB that this checklist was a guide only, and was ‘not required to be completed by the network controllers during the course of an incident’. One TCL indicated it was better to use experience than a checklist, and the other thought that checklists assisted in ensuring tasks were completed. Several NCOs stated that no checklist for the NCOs existed, with one stating they would be helpful for those new to the role. The UTC 7 NCO did not complete a checklist during the 18 August 2018 emergency response.

In terms of the procedures and guidance for other personnel:

• There was no specific procedures or guidance for NCOs allocated to neighbouring UTC workstations to that dealing with an OHLE emergency, and no specific procedures or guidance for the relief NCOs.
• TCLs were not provided with specific procedures or guidance to assist in process coordination during times of an emergency. A mandatory checklist, MD-17-486 (OHLE incident – DOOC and TCL incident and emergency tool), for both the TCL and DOOC existed; however, the main focus of this checklist was effective stakeholder engagement and the organisation of alternate passenger transport. One entry related to ensuring emergency services were aware of OHLE dangers, and another related to arranging assistance for the NCO dealing with the emergency. Neither of these two action items were marked as completed during the 18 August 2018 emergency response, although the southside TCL did warn the QPS communications centre of the OHLE dangers onsite at Cooroy (see Post-dewirement activities).
• Procedural guidance for the DOOC during an OHLE emergency was limited to stakeholder communications, declaring an emergency, activating a QR commander to manage the accident site, and providing general assistance.

In terms of responsibilities during an emergency response, the DOOC advised that the TCLs provided supervision and handled operational incidents, with the DOOC’s role limited to communication with stakeholders. One of the TCLs noted ‘… everyone knows what goes on [during an incident]’, with the DOOC providing oversight. The other TCL believed the DOOC was responsible for coordination and decisions. Several personnel noted that NCOs commonly divided tasks among themselves when handling an incident.

During interview, most of the network control personnel felt that the emergency response on 18 August 2018 was well managed, with good teamwork and utilisation of previous experiences.

The UTC 7 NCO recalled being in charge of handling activities associated with train YC77, with the only assistance being from the southside TCL (although UTC 7 was under the northside TCL’s supervision). Audio recordings of communications indicated that the UTC 7 NCO had limited communications with the driver of YC77 after the dewirement, and was occupied with other train control duties during the emergency response period, including managing other trains and answering phones. The UTC 7 NCO was unaware the driver was instructed to inspect the train by another NCO.

The southside TCL recalled having minimal involvement during the emergency response, limited to answering the emergency phone, and thought the northside TCL likely assisted the UTC 7 NCO.

The northside TCL, in charge of supervising the UTC 7 NCO, felt that the NCO ‘probably’ managed the accident train. After a review of all available evidence, the ATSB could not determine what involvement the northside TCL had during the emergency response.

Procedures for onsite personnel

MD-11-33 also outlined procedures for other personnel, such as the train crew. The procedures relating to rail traffic crew (RTC) included:

Stay on the radio to NCO and await instructions…

Advise passenger/RTCs to remain on the train until further notice if it is safe to do so

Do not leave the train until the NCO confirms it is safe to do so…

MD-11-30 (Rail emergency response module EP1-01) outlined additional procedures. It stated that, in the initial stages, the NCO would appoint an onsite coordinator to take control of the scene. After declaration of an emergency by either the DOOC or business operations shift supervisor, a QR commander could be activated to attend onsite and take over coordination of the scene from the onsite coordinator.

The QR commander’s duties included:

• onsite point of contact
• conducting site assessment for hazards
• (as an authorised person) receiving Form C from the nominated person
• communicating the limits of electrical safety to onsite teams.

During the emergency response on 18 August 2018, the driver of YC77 was initially appointed the onsite coordinator, with the QR commander taking over after arriving at the site at 2252. The QR commander then contacted the ECO, who confirmed that the OHLE was de-energised from Traveston to Woombye but was not yet isolated. The ECO further advised that OHLE personnel were yet to determine what earthing requirements were required in the vicinity of the train itself.

Shortly afterwards, the QR commander met with the QPS who were required to conduct alcohol and drug testing of the driver of YC77.^[33] Although the QPS were empowered to enter exclusion zones in the event of an emergency (to direct evacuations and exclude persons from premises),^[34] this did not apply to conducting post-accident drug and alcohol testing. The QR commander allowed the QPS to attend the locomotive of YC77, requiring the driver to leave the locomotive cabin.

Previous occurrence involving an emergency response

On 31 January 2013, a Queensland Rail (QR) passenger train (T842) failed to stop at the Cleveland station platform (due to problems with braking system effectiveness) and collided with the end-of-line buffer stop, the platform and the station building at a speed of about 31 km/h. There were 19 people on board the train (including the driver and a guard); three people were on the platform and five were in the station building. During the collision sequence, the train contacted an OHLE mast resulting in a dewirement, with wires brought down onto the train and platform.

It was identified that during the emergency response the guard (after communicating with network control) had assisted two passengers to evacuate the train before the OHLE was made electrically safe. In its investigation report,^[35] the ATSB made the following finding:

During the period immediately following the collision there were a series of communication issues which resulted in incomplete information being provided to key personnel. This resulted in the train control operator and train guard miscommunicating the status of the downed overhead power lines, leading to the guard permitting some passengers to exit the train before emergency services had ensured it was safe to do so.

At the time of the 2013 accident, QR had not provided NCOs with a checklist for responding to an emergency such as an OHLE dewirement. The ATSB report provided discussion about the relevance of checklists and the handling of the emergency response by the network control centre, including:

With no quick reference decision aids or checklists to refer to, train control personnel were required to interpret ambiguous and incomplete information about a complex situation, based solely on voice communications from a remote location...

The use of standardised procedures for emergencies enables personnel to use rule-based decisions to react quickly and effectively to contain a situation. It permits the considered design of procedures by experts to be efficiently implemented by operators, and has the potential to mitigate the effects of inexperience and misunderstanding of an event. However, the effectiveness of these procedures is influenced by familiarity with, and accessibility of the procedures. In this case, the train control personnel had no quick reference guides or checklists to assist in diagnosing the situation (to then determine which module would apply), nor was the document organised in a way that facilitated ease of identification of required actions and their sequencing…

The investigation established that some train control personnel referred to the Derailment procedure, whilst another followed the Overhead Line Equipment Emergency procedure. Other staff did not make use of the specification [relating to OHLE emergencies], but instead relied on memory and experience to guide their actions. In some instances, this resulted in a lack of clarity as to allocation and priority of responsibilities and tasks, as well as some ineffective communications…

The train control operator continued to provide control services to the other lines under his control … there was no initiation of processes to reallocate [his] extraneous tasks in order to enable him to focus on the emergency response to this event, nor was there any consideration for this to occur documented within the emergency procedures.

The effective management of an emergency situation from a location remote to the event presents a number of challenges for the train control staff, primarily related to ensuring that timely and accurate information is available, communicated, and understood, and that the response is handled in an efficient and coordinated manner. To that end, it is critical that standard procedures are in place, but it is equally critical that those procedures are designed to accommodate human performance limitations in conditions of high stress and/or workload, and that they are well understood through staff training and well-practised through field based and desk-top exercises.

On 31 January 2003, a passenger train derailed at Waterfall, New South Wales. The special commission of inquiry^[36] provided a detailed discussion about emergency response activities. The commission report stated:

The rail industry needs to develop checklists for its staff to follow in the event of a particular kind of incident, such as a derailment. For example, the train driver should have a simple checklist identifying the information which he should immediately communicate to the RMC [rail management centre]…

Other railway personnel need to have checklists identifying clearly and precisely what they are required to do in the case of an emergency and the order in which things are to be done…

Such checklists should be provided as part of the ICS [incident command system]… They should be on a sheet in the driver’s cabin, guard’s compartment or signaller’s or train controller’s work station.

Accordingly, the commission recommended that the RailCorp [the rolling stock operator and rail infrastructure manager] emergency response plan should include action checklists for each relevant employee.

Overhead line equipment safety information

Description

The autotransformer system used by QR consisted of a feeder wire that was energised at 25 kV AC (-25 kV), but at opposite phase;^[37] that is, 180⁰ to the contact wire (+25 kV). Although supply to trains remained at 25 kV AC, this system introduced an additional nominal phase-to-phase^[38] voltage of approximately 50 kV AC. This was in addition to the 25 kV AC phase to neutral^[39] in comparison to ground; that is, the return rails (0 kV). An additional earth wire electrically connected adjacent OHLE structures, to ensure safe return to ground in the event of a failed earth bond on a single structure.

The advantage of the autotransformer system was the ability to energise further distances due to the higher 50 kV AC feed, halving the number of high cost feeder stations.

Electrical safety

The Queensland Electrical Safety Regulation 2013 stipulated exclusion zones that applied to untrained persons in relation to high voltage overhead uninsulated electric lines. In instances where the phase-to-phase voltage was approximately 50 kV, as for the OHLE in the Cooroy precinct:

• the exclusion zone between an untrained person and the overhead line was 3,000 mm
• the exclusion zone between a vehicle operated by an untrained person and the overhead line was 2,100 mm.

The regulation stated that a person ‘comes within an unsafe distance of an overhead electric line if the person is within the exclusion zone’. An untrained person was a person who was not technically proficient or experienced with the OHLE. Train drivers and emergency services personnel would generally be classified as untrained persons.

In instances where exclusion zones were not reasonably practical to achieve, the regulation allowed an organisation to reduce the distance after a risk assessment and control measures had been implemented. For the purposes of a vehicle operated by untrained persons, QR advised the ATSB that its nominated exclusion zone was 300 mm, accounting for arc distance and a safety margin.

In other words, if the rolling stock or anything being carried by the rolling stock was within 300 mm of the OHLE, then it was within an unsafe distance. Accordingly, an exclusion zone then applied to the rolling stock, such that an untrained person could not approach within 3,000 mm of the rolling stock. A person who was still on the rolling stock from before it entered the exclusion zone was still in effect in a safe place. However, if they attempted to leave the rolling stock, they would be entering an exclusion zone. Appendix A – Dangers associated with high voltage overhead line equipment (OHLE) in dewirements provides further details of the hazard associated with OHLE following dewirements, including touch potentials (a person touching the ground and the rolling stock) and a step potential (a person being in close proximity to the rolling stock with both feet on the ground).

In the case of the 18 August 2018 dewirement, as the rear end wall of the top nested flat rack extended into the 300 mm exclusion zone associated with the rolling stock, the end wall and train YC77 were subject to an exclusion zone for untrained persons of 3,000 mm.

As noted in Network control centre procedures during OHLE emergencies, QR procedure MD‑11‑33 prohibited entry to exclusion zones until the high voltage OHLE was electrically safe, by being de-energised, isolated, tested and earthed. More specifically:

• De-energised: the opening of high voltage circuit breakers, either automatically by excess current or manually by the ECO, to disconnect electrical energy. This did not guarantee the electrical energy had been discharged from the OHLE.
• Isolated: the opening and, lock and tag out of isolation switches, to disconnect all possible sources of electrical energy to the section of OHLE, including by unintentional energisation. This was performed by the nominated person in the field.
• Tested: confirmed the isolated section of OHLE had been de-energised. This was performed by the nominated person in the field.
• Earthed: the isolated section of OHLE was connected to the general mass of the earth, to ensure discharge of any residual energy. This ensured the OHLE could not be made live from external sources, for example, other live wiring. This was performed by the nominated person in the field.

Once earthing was confirmed, the nominated person could issue a Form C (Permit to work) to an authorised person. It was at this point that the section of high voltage OHLE nominated on the Form C was considered electrically safe, allowing entry to the exclusion zone.

In the case of the 18 August 2018 dewirement, the OHLE was de-energised at 2101, just prior to the dewirement. The nominated person issued the first Form C at 0300 the morning after the dewirement. The QR commander delegated the receipt of Form C from the nominated person to the accompanying rail operations response unit (RORU) officer, who was also qualified as an authorised person.

Instruction and training of OHLE dangers for QR personnel

QR provided general guidance regarding the hazards associated with OHLE in various procedures and other documents. In addition to MD-11-33, this included the MD-14-36 (General appendix) and MD-10-191 (Electric traction systems) manuals. The general instructions section of the general appendix stated:

All employees and contractors shall constantly bear in mind the ever present danger of electrocution from the high voltage overhead line equipment in electrified areas. It is dangerous for anyone to touch, or to come into close proximity of, live overhead line equipment.

Similarly it is dangerous to allow any object to touch or to come close to live equipment.

Note: Always treat overhead line equipment as live until it has been ascertained that the equipment has been made safe for persons to approach or to come into contact with it.

Although the documents used by network control personnel and other operational personnel provided guidance regarding the 3,000 mm (or 3 m) exclusion zone between a person and OHLE, none of the documents provided clear guidance on the additional aspect of the 300 mm exclusion zone between a vehicle and OHLE.

NCOs completed OHLE safety training, including TLIF2080 (Safely access the rail corridor), when initially appointed to their position. This unit of competency was reassessed as part of periodic NCO competency reassessments. TLIF2080 training included dangers associated with objects in close proximity to OHLE, but did not provide an indication of a safe gap distance between rolling stock or objects on rolling stock and the OHLE. NCO duties did not include in-field operations.

QR commanders completed authorised person training, which allowed them to receive a Form C when OHLE was made electrically safe. Authorised person training included dangers associated with objects in close proximity to OHLE, but did not provide an indication of a safe gap distance between rolling stock or objects on rolling stock and the OHLE.

Instruction and training of OHLE dangers for train crew

Aurizon advised that the driver of YC77 completed OHLE safety training in January 2014, as part of the nationally-recognised unit of competency TLIF2080C (Safely access the rail corridor), while based in Geraldton, Western Australia. There was no OHLE fitted in Geraldton. Although the training included dangers associated with objects in close proximity to OHLE, it did not provide an indication of a safe gap distance between rolling stock or objects on rolling stock and the OHLE.

A review of the driver’s last reassessment of competence found a single question in relation to OHLE safety during a dewirement emergency. In addition, the driver operated diesel locomotives only, which did not rely on OHLE for traction purposes. The driver reported never having been in a dewirement occurrence before.

Although Aurizon drivers did not work for QR, they were required to follow QR procedures while operating a train on the QR network. The driver of YC77 was aware QR documents were available on Aurizon’s iN-Gauge intranet service, but was not sure which document contained the OHLE emergency procedures. There was no computer access available on board YC77. Therefore, the driver did not have access to enable referral to the procedure at the time of the emergency response.

Recognition of OHLE danger presented by extended flat rack end wall

During interviews after the dewirement, it was apparent that almost all network control centre personnel handling the emergency response, the QR commander and the driver of YC77 did not recognise the hazard associated with the extended end wall of the flat rack being close to the OHLE. The general belief was that OHLE dangers were limited to the site of the actual dewirement at Cooroy, about 3 km behind where YC77 stopped. As the OHLE was still erect above YC77, most personnel on the evening of the accident felt it was in a safe state.

Driver only operations information

General

Driver only operations (DOO) was a train crewing configuration where a single driver operated the train without the presence or assistance of any other on-board personnel.

On the QR network, Aurizon operated DOO services between Acacia Ridge and Townsville on the North Coast Line (1,353 km), Fisherman Islands and Ebenezer on the West Moreton system (79 km), and Stuart and Mount Isa / Phosphate Hill on the Great Northern Railway (1,032 km). Further, on its own network, Aurizon advised it operated DOO services between the nearest depot and ports on the Moura, Blackwater, Goonyella and Newlands coal systems.

The Queensland Work Health and Safety Regulation 2011, and an accompanying Code of Practice,^[40] required that the movements of remote or isolated workers^[41] be monitored, including ensuring adequate communication methods were maintained.^[42] Train drivers in a DOO configuration would generally be classified as remote or isolated workers. The purpose of these requirements was to ensure timely assistance in the event of an emergency or incapacitation.

QR emergency procedures for driver only operations

The North Coast Line was subject to open access by third party operators. A formal access agreement and interface risk management plan (IRMP) arranged access by Aurizon on QR’s network. The IRMP detailed interface risks and resultant controls between QR as the rail infrastructure manager^[43] and Aurizon as the rolling stock operator.^[44] QR provided Aurizon access via a customer portal to all relevant sections of QR’s SMS, in connection with the risk controls nominated in the IRMP. Aurizon arranged access to QR documents for its personnel via its own intranet system ‘iN-Gauge’.

According to the QR IRMP, risks to drivers trackside when in a DOO configuration were to be managed in accordance with the DOO emergency procedure within QR’s MD-14-36 (General appendix). The procedure stated that when a train had been stopped due to an accident, obstruction or exceptional circumstances, drivers would secure their train from uncontrolled movement, and complete form MD-15-457 (Authority for driver only rail traffic driver to leave locomotive) with the NCO prior to leaving the locomotive cabin to investigate the nature of the problem. The procedure also stated:

Instructions must not be given to the rail traffic driver to take any action that could affect his/her personal safety or the safety of the train.

QR introduced form MD-15-457 in November 2015 (replacing an earlier form, no. 22513). The form required the driver and NCO to describe the details of the train, the location and the situation and agreed reporting times (to ensure effective communication was maintained with the driver at all times they were outside the locomotive cabin). A maximum reporting interval of 15 minutes was nominated by the DOO procedure. In the event of a loss of communication, the NCO was to assume an emergency existed and immediately arrange assistance (for example, from emergency services).

Aurizon emergency procedures for driver only operations

Aurizon’s procedures stated that, in the event of an emergency, drivers were to refer to emergency checklist 16-FRM-012-COM (Duty card train crew) for immediate actions, including when vacating a locomotive cabin. There was no reference to the DOO procedure or requirements on the duty card.

Aurizon drivers carried an on-the-spot risk assessment tool called Stop! Take time and switch on. This tool was used to identify hazards and control risks, prior to performing an unusual or non-routine task, for example, vacating a locomotive cabin at an unusual location. Aurizon advised that, although this tool had a supporting instruction, this instruction was withdrawn following the 18 August 2018 dewirement.

Although form MD-15-457 contained a ‘situation report’ section, neither it, nor QR’s DOO emergency procedure, required an on-the-spot assessment of hazards and control of risks prior to the locomotive cabin being vacated.

Access to relevant procedures and forms

In order to be able to complete form MD-15-457, hard copies needed to be provided in the locomotive cabin. No forms were stored on train YC77.

Access to Aurizon’s duty card, QR’s DOO procedure and form MD-15-457 were limited to Aurizon’s iN-Gauge intranet service. There was no computer access available on board YC77. Therefore, the driver did not have access to these documents at the time of the emergency response, or any time while undertaking driving duties.

The driver reported not having seen form MD-15-457 before, instead referencing the older form (no. 22513), which was withdrawn almost 3 years previously. The driver was aware QR documents were available on Aurizon’s iN-Gauge intranet service, but was not sure which document contained the DOO procedure.

Application and knowledge of DOO emergency procedures

Based on a review of recorded voice communications, neither the driver of YC77 nor multiple NCOs followed QR’s DOO procedure during the emergency response. The driver of YC77 left the locomotive cabin on five occasions during the emergency response (two in the absence of any other personnel), without completing form MD-15-457. The NCO was not advised on all occasions, no agreed report back times were agreed and, a mobile phone was used as the method of communication.

During interview, it was found that knowledge of the DOO procedure was well known among network control centre personnel. Some personnel noted that it was difficult to identify if a train was operating in a DOO configuration. However, based on a review of recorded voice communications, there was no evidence that the driver of YC77 or the NCOs discussed the type of crewing arrangement during the emergency response.

Although the DOO procedure was included in initial NCO training, it was not contained within the NCO periodic reassessment of competency. Of the network control centre staff interviewed, one had seen a DOO form, and another two advised not having issued such a form for more than 10 years.

The driver reported being aware of the QR DOO procedure, but could not recall being trained in its use. Periodic driver reassessments of competence did not contain the DOO procedure. The driver further advised of not having been in a situation requiring its use in almost 5 years.

Driver only operations on the Aurizon network

During investigation, the ATSB found that both Aurizon and third party operators operated DOO services extensively on the Aurizon owned network in Queensland. As a rail infrastructure manager, Aurizon was required to provide third party operators with access to relevant sections of its SMS documents, which controlled risks while operating on its network. Although referenced within the Aurizon risk assessments, the ATSB found that no DOO procedure existed for the Aurizon owned portion of the North Coast Line.

In November 2015, when QR made changes to the DOO form in use on its network, Aurizon issued an advice notice to staff advising of QR form no. 22513 being replaced by QR form MD-15-457. In addition, Aurizon (with the withdrawal of form no. 22513), elected to adopt an existing form (SW12, which was used for a variety of purposes), to be used when operating DOO on its own network. This advisory notice was withdrawn from circulation on 19 February 2016.

Despite changing to a different DOO form on the Aurizon network, Aurizon advised that no documents within its SMS were altered to reflect this change.

To ensure correct implementation of the altered DOO procedural form requirements on both the QR and Aurizon networks, Aurizon recommended follow-up inspections and auditing of the process. Aurizon could not provide evidence this had occurred.

__________

19. For further information regarding the ability for high voltage to arc across air gaps, see Appendix A.
20. The distance between the 129 km and 130 km measured 1,656 m. Therefore 129.1209 refers to 1,209 m beyond the 129 km peg and 447 m prior to the 130 km peg.
21. A diesel electric locomotive uses a diesel motor driving generators or alternators to generate electric current to the traction motors.
22. Australian Railroad Group was rebranded as Aurizon on 1 December 2012.
23. Unusual load: in relation to intermodal freight, referred to freight that was not a 20’ or 40’ closed side container.
24. Tamaree was the boundary between the Citytrain and regional network control centres. It was located one track section north of Gympie North.
25. Universal traffic control (UTC): QR designed train control system for remote controlled signalling territory.
26. The North Coast Line was referred to by supplementary names, i.e. Caboolture line and Sunshine Coast line, for passenger purposes.
27. SCADA: refers to a computer system that monitors and controls a process. In the case of the QR OHLE, the process was transmission and distribution, with elements including substations, transformers and other OHLE related electrical assets.
28. Electrical Safety Act 2002 (Qld), s. 67; Electrical Safety Regulation 2013 (Qld), rr. 233–234.
29. OHLE emergency: an occurrence involving OHLE, which has the potential to cause injury, loss of life or property damage.
30. High risk area: these areas included major construction sites, Brisbane CBD stations and major rail yards and depots.
31. Neutral section: a location within the OHLE consisting of insulators and earthed equipment. It ensured two adjacent electrical sections were kept electrically separated during the passage of the pantograph on an electric train.
32. Track block: an electronic command placed on the track section by the NCO, preventing entry to the track section. In remote controlled signalling territory, this would place signals allowing entry to the track section at red (stop).
33. Rail Safety National Law 2012, s. 126; Transport Operations (Road Use Management) Act 1995 (Qld), s. 80.
34. Public Safety Preservation Act 1986 (Qld), s. 8 & Schedule.
35. ATSB RO-2013-005, Collision of passenger train T842 with station platform, Cleveland, Queensland, 31 January 2013.
36. McInerny PA 2005, Special Commission of Inquiry into the Waterfall Rail Accident, Final Report, Volume 1.
37. Phase: an expression of relative time difference between or among AC voltages having the same frequency.
38. Phase to phase: the voltage measured between two single phase feeds, i.e. between the contact and feeder wires.
39. Phase to neutral: the voltage measured between a single phase feed and the unpowered neutral, i.e. between either the contact wire or feeder wire, and the return rail.
40. Managing the work environment and facilities, Code of Practice, 2018.
41. Remote or isolated workers were those that performed work isolated from the assistance of other persons due to the location, time or the nature of the work.
42. The Code of Practice specifically excluded mobile phones as a method of communication due to unreliability of signal.
43. Rail infrastructure manager (RIM): a person who has effective control and management of the rail infrastructure (e.g. track, signalling, OHLE and supporting components). Source: Rail Safety National Law 2012, s. 4.
44. Rolling stock operator (RSO): a person who has effective control and management of the operation or movement of rolling stock on rail infrastructure (e.g. locomotives and wagons). Source: Rail Safety National Law 2012, s. 4.

Safety analysis

Introduction

Aurizon freight train YC77 departed Acacia Ridge Intermodal Terminal with one of its wagons containing a stacked nest of three empty flat racks. During its journey, the rear collapsible end wall of the top flat rack extended upwards (reaching a height of about 4,845 mm). The top of this end wall impacted the underside of the Elm Street overbridge (a height of 4,816 mm), just prior to Cooroy Station, and pulled down overhead line equipment (OHLE). The dewirement resulted in a significant amount of damage to 1.3 km of OHLE, and the consequences could have been much worse had passengers been on the Cooroy Station platform at the time of the accident.

Analysis of closed-circuit television (CCTV) footage, OHLE circuit breaker trips and related information determined that the rear end wall very likely raised upwards at some point between 118.782 km and 119.613 km, and then remained in the extended position until hitting the Elm Street overbridge (130.750 km).

YC77’s data logger indicated that the train’s speed was consistently between 75 and 80 km/h for an extended period immediately prior to the rear end wall of the flat rack extending upwards. It is therefore likely that running at this speed for an extended period eventually resulted in the unsecured rear end wall raising from passing wind resistance, assisted by the flat rack’s leaf spring raise-assist design. There was no evidence that the driver’s actions on approach to Cooroy Station, problems with the serviceability of the train or excessive wind conditions contributed to the accident.

This analysis focuses on the loading and securing of the flat racks on YC77 and reasons why the load was not effectively secured. In addition, it considers the control of hazards at the accident site following the dewirement and aspects associated with driver only operations (DOO) procedures.

Loading and securing of freight

Delivery of flat racks to Aurizon

The freight forwarding company advised the rolling stock operator 4 days prior to the accident that a set of four flat racks were to be delivered for rail transport and that the end walls of the nest of three flat racks were secured by use of chains.

Based on CCTV evidence, the ATSB identified that neither of the end walls on the top flat rack on the nest of three were strapped or chained when delivered, as required for rail travel. The ATSB’s inspection after the dewirement found no evidence that chain or straps had been in place at either end of the flat rack to provide an additional means of restraint. In addition, the ATSB identified that the twist locks to lock the end walls of the top two flat racks in the down position were not engaged, and given the condition of the twist locks it is unlikely they had been locked for some time. It also seems very unlikely that the twist locks could have moved during transit, or that anyone would have unlocked them prior to transit.

In summary, the nested set of three flat racks were delivered to the Acacia Ridge terminal without the collapsible end walls of the top nested flat rack being secured for rail travel. The ATSB did not examine the reasons why the flat racks were delivered in an unsecured state, instead focussing on the controls the rolling stock operator had in place to ensure the security of loads on its train.

Inspection of flat racks during delivery and loading

According to Aurizon’s procedures, securing of the end walls of any flat racks travelling as freight were to be checked twice prior to the departure of a train. The terminal coordinator was required to check the flat racks when they were first delivered, and the pinners were required to check the security of any loads (including flat racks) after they had been loaded onto a wagon.

In this case however, the terminal coordinator did not check the securing of the flat racks on arrival at the terminal and, consequently, the flat racks were loaded onto YC77 in an unsecured state. The terminal coordinator (and another person who sometimes acted in the role) advised they were not aware of the requirement to inspect loading from external freight forwarding companies.

Similarly, the pinners did not check for the absence of chains or web strapping during the securing inspection, and consequently the flat racks departed Acacia Ridge in an unsecured state. Personnel who performed this task stated they believed checks during pinning were limited to ensuring any provided securing was tight, rather than checking what securing was absent (such as straps or chains). However, the investigation could not determine the exact reasons why the twist locks on the top two nested flat racks were not identified as disengaged during the securing inspection. The twist locks on the top flat rack would have been almost 3 m above the ground, but the position of the handles (which indicated whether the twist locks were engaged) should still have been visible from the ground.

Unusual load responsibilities and access to guidance material

The terminal coordinator and pinners’ limited understanding with regard to their responsibilities for checking unusual loads highlighted issues relating to training and continued competency assessments in the roles.

Aurizon was unable to provide evidence that the terminal coordinator or another person who had performed that role had received training in the instructions for the terminal coordinator role. Although one of the pinners and the heavy forklift driver had received training in the work instruction for pinning, that work instruction provided limited detail regarding what type of checks of unsecured loads were required and it did not refer to the relevant checklists.

These personnel had received the on-line loading and securing of freight training course, which provided extensive complex instruction on securing of unusual loads. However, it was conducted up to 14 months previously for some personnel. All interviewed personnel advised that flat racks were rarely encountered at the Acacia Ridge terminal. As any such instructions were rarely used, it was likely their accurate recall was diminished by the time they were required to be used.

Issues with knowledge of flat rack securing requirements had been identified after two previous accidents involving inadequate securing of unusual loads. Although Aurizon had recommended that staff undertake further theory and practical training, this training had not occurred prior to the 14 August 2018 dewirement.

In addition to the effectiveness of the training, the ATSB also identified problems related to access to relevant guidance material. Given the low frequency that each type of unusual load was encountered, ready access to checklists or other guidance material would help ensure familiarisation with the relevant procedures at the relevant time. Although Aurizon provided access to manuals, instructions and checklists through its intranet site ‘iN-Gauge’, this was problematic for several reasons:

• The Loading and securing of freight manual (07-STD-022-SWK) contained 242 pages, with instructions to secure empty flat racks appearing on one page within a number of other instructional dot points. This limited the ability to source relevant information quickly and easily.
• Although checklists for unusual loads were available on-line, and referenced in the work instruction for inspecting incoming loads, Aurizon stated they were not readily available in hard copy. As such, each time a pinner encountered an unusual load, and wanted to refer to guidance material, they would have been required to return to the office, find and print a checklist and recommence a train inspection. This was unlikely to occur.
• As already noted, the work instruction for train pinning did not refer to the available checklists for checking unusual loads. In addition, personnel who performed that role reported they were not aware any guidance documentation existed.

Therefore, based on the available evidence, the ATSB found that Aurizon did not have an effective system in place for ensuring personnel required to check the securing of unusual loads (such as empty flat racks) prior to departure had sufficient knowledge of their responsibilities, and had ready access to relevant procedures, guidance and checklists. Had these problems been addressed, it is likely that the checking of unusual loads would have been more effective.

Electric control information anomalies

YC77 departed Acacia Ridge at 1749, and the first indication of a problem to the rail management centre occurred at 2048 when the first OHLE circuit breaker trip occurred. The dewirement did not occur for another 14 minutes. Accordingly, the ATSB considered the potential opportunity for the problem with YC77’s load to have been detected during this period prior to the dewirement.

In non-high risk areas such as Yandina to Cooroy, the electric control operator (ECO) could reset OHLE circuit breaker trips after 1 minute, after reviewing all available information. Provided the reset OHLE circuit breaker remained closed, no further action was required. During the event sequence, the ECO reset two separate occurrences of OHLE circuit breaker trips. The third occurrence, 13 minutes after the first, was not reset. Although these three OHLE circuit breaker trips occurred on the same electrical section, the information presented to the ECO to assist decision making was conflicting and ambiguous. More specifically:

• The driver of YC77 reported observing nothing unusual after the first OHLE circuit breaker trip.
• The fault locator (which may be inaccurate) did not operate for the second OHLE circuit breaker trip. Therefore, the location of this trip was unknown, encompassing a 50 km section of track on which three trains were operating.
• During each of the first two OHLE circuit breaker trips the circuit breaker reset held closed, suggesting there was not a persistent fault (which would have provided a more obvious indication of an over-dimensional load).
• Until the dewirement, multiple track circuit occupied indications (which are occasionally associated with OHLE traction faults) were either not near the location of YC77, or they did not coincide with OHLE circuit breaker trips.
• OHLE circuit breaker trips on the North Coast Line were not uncommon and were often attributed to wildlife and tree branches touching the OHLE.

With consideration of the available information during the sequence of events leading up to the dewirement, the ECO followed the correct procedure, with no firm indication until after the third OHLE circuit breaker trip that YC77 was the probable reason for the observed indications.

Post-dewirement response

Entries into an exclusion zone

High voltage electricity is a significant hazard, and a primary risk control to ensure safety prior to the equipment being made electrically safe is the implementation of exclusion zones. In relation to QR’s OHLE, the following exclusion zones applied for untrained persons (such as train crew):

• 3 m between an untrained person and the overhead line
• 3 m between an untrained person and the train and objects on the train if an object was within 300 mm of the overhead line.

Exclusion zones applied at two locations following the dewirement at Cooroy. The first was in the Cooroy Yard precinct, in the area of the actual dewirement. The second was near where YC77 stopped. As the end wall of the top nested flat rack extended within 300 mm of the OHLE, the train was subject to an exclusion zone of 3 m.

In this case, the actual risk around the train was relatively low as the OHLE had been de-energised. However, the OHLE had not been made electrically safe, and there was the potential for the OHLE to be inadvertently re-energised by the ECO, dewired OHLE contacting external supply authority lines, or an electric train entering into the de-energised electrical section from an adjacent live section. In the case of the latter, an electric passenger train was scheduled to enter the de-energised electrical section 9 minutes after the dewirement.

If the OHLE had been re-energised, the likelihood of arcing over a 210 mm air gap was also relatively low. However, initially no-one knew the exact nature of the problem. It is acknowledged that in circumstances of an OHLE circuit breaker trip of an unknown cause, with no immediate indication of a problem, it is impractical to not allow an external inspection of the OHLE by train crew prior to the OHLE being made electrically safe (assuming the train crew first conduct an inspection from their cab prior to leaving the train). However, in this instance there had been sufficient evidence to indicate either a dewirement or, at the very least, some part of YC77 had been intermittently contacting the OHLE. The distance from that object to the contact wire after the train stopped, or the extent to which the train had pulled down wire close to where it had stopped, was unknown.

Therefore, even though the actual level of risk (determined after the emergency response) was relatively low, during the emergency response the risk level was unclear and the situation should have been treated as if there was a genuine level of risk. Accordingly, no-one should have approached the train (or exited the train) until the applicable exclusion zone could be determined or until the OHLE at that location had been made electrically safe (that is, de-energised, isolated, tested and earthed). The extent of the damage was not determined until an OHLE linesman inspected the area about 2 hours after the dewirement. The process to make the OHLE electrically safe around the train was not completed until 6 hours after the dewirement occurred.

Initially the driver entered the exclusion zone by exiting the locomotive to conduct an inspection of the train, under instruction from a network controller officer (NCO) and before the police had advised that wires had been pulled down. After the driver sighted the extended end wall, the exact distance of the gap between the end wall and the contact wire was still unknown. When inspected from the ground at night, it would have been difficult to estimate the gap accurately. The prudent course of action at that stage would have been to assume the end wall was within 300 mm of the OHLE, and therefore an exclusion zone of 3 m applied around the train.

The ATSB determined that the driver of YC77 and other train crew then entered this exclusion zone on multiple other occasions before the OHLE was made electrically safe. More specifically:

• the driver proceeded to a location to improve mobile phone data reception and send photos to the rail management centre
• the driver met with a protection officer, associated with an unrelated track closure
• the driver undertook post-accident drug and alcohol testing with the Queensland Police Service
• the driver accompanied the QR commander and other personnel while they inspected the train
• the driver changed with a relief driver.

The ATSB could not determine if the police, QR commander or other personnel also entered the exclusion zone associated with YC77 while interacting with the driver.

Recognition of the risk associated with dewired OHLE

During an OHLE emergency, the NCO was required to advise the OHLE status to train crew and onsite personnel. A report to the network control centre confirming there had been a dewirement at Cooroy and possible OHLE contact with YC77 was received 9 minutes after the dewirement occurred. That information was not passed to the train driver for a further 9 minutes, after an NCO had already instructed the driver to leave the locomotive and inspect the train and OHLE for damage. At no stage during the emergency response was the driver advised that, although the OHLE was de-energised, it was still not electrically safe.

These omissions of key actions appeared to be associated with limited recognition that a potential problem existed at the train, and problems with the coordination of actions between multiple network control personnel.

In terms of the limited recognition of the potential risk, the general belief of interviewed personnel was that OHLE dangers were limited to the site of the actual dewirement at Cooroy, about 3 km behind YC77. The fact that there was known to be significant damage to the OHLE at Cooroy may have focussed their attention on that area. There was limited expectation that a problem could also exist where the train was located, even though it was recognised that the train may have had an object that had been contacting the OHLE.

Although training for the driver of YC77, NCOs and QR commander included dangers associated with objects in close proximity to OHLE, due to the danger of arcing, it did not provide an indication of the appropriate safe gap distance in this situation (that is, 300 mm). This limitation in the training materials may have reduced their ability to recognise the danger posed. Nevertheless, a conservative approach should have determined the gap was problematic, even if the safe gap distance was unknown.

Co-ordination of network control activities post dewirement

In terms of the coordination of actions during the post-dewirement response, there was no single assigned person who was in charge of coordinating activities and managing the ongoing issues as they related to the dewired high voltage OHLE. Although it is not unusual for tasks to be conducted by multiple personnel in an emergency, in this instance the allocation of tasks appeared to rely on an informal division of tasks, teamwork and previous experience.

This resulted in a situation where the UTC 7 NCO, who was responsible for managing YC77, was conducting a number of tasks involving other trains. Meanwhile, at least two other NCOs communicated with and provided instructions to the driver of YC77, including an instruction to inspect the train, without the knowledge of the UTC 7 NCO.

One means of ensuring an effective response is having very clearly defined roles, responsibilities and required actions for different personnel. A review of procedural documentation found that allocation of safety critical tasks during OHLE emergencies was not clear, particularly in relation to the roles of NCOs on neighbouring workstations, relief NCOs and the train control leaders (TCLs). It is recognised that emergencies can take many forms and procedures need to have some flexibility regarding the specific roles of each position in any specific emergency. Nevertheless, ensuring that one person is coordinating all the required actions and ensuring they are completed is essential.

Another means of ensuring an effective response is the use of checklists. Although a mandatory checklist for OHLE emergencies applied for the day of operations coordinator (DOOC) and TCL, this was of limited safety value, as it dealt more with stakeholder management aspects. QR had recently developed a second checklist that summarised NCO responsibilities during an OHLE emergency, which was underpinned by a number of standards, procedures and instructions. It included three entries related to advising electrical safety status to onsite personnel. This checklist was not used or referred to by the UTC 7 NCO or other personnel, and QR advised that its use was optional.

Emergency responses can involve high workload, distractions and interruptions, time pressure, ambiguous sets of information and stress. There can be many different tasks and objectives to achieve, and many people involved in gathering information and conducting the required actions. Such environments provide an ideal opportunity for omission errors to occur. As Hales and Pronovost (2006) explain, cognitive function can be compromised under stressful conditions, particularly in complex, high-intensity environments (such as a network control centre). These authors noted that checklists have the capacity to summarise masses of information that need to be recalled rapidly under challenging circumstances.

Reason (1990) also noted the potential for omission errors associated with the limitations with prospective memory, where an intended task can be forgotten during the interval between intention to perform the task and its execution (due to interruptions or competing priorities). He further noted checklists can assist in reducing these error types when under stressful conditions, such as an emergency response, by acting as a memory aid, thereby ensuring all required steps are completed.

Similarly, it is worth noting that the RISSB guideline document Rail emergency management planning stated:

Maintaining ‘quick references’ is recommended to support response and recovery. In the initial onset/identification of the emergency, Procedures or Action Cards and Checklists should detail immediate and important actions to help workers at all levels perform effectively.

There are two types of checklists that are useful in this regard. The first is ‘read-do’, where the checklist item is read and the action performed, which is particularly useful when performing an infrequent task (Dismukes and Berman 2010). The second is ‘flow-then-check’, where a number of actions are performed from memory, then verified as completed through a checklist. As such, there are two opportunities for ensuring the required procedure has been followed (Dismukes, Berman and Loukopoulos 2007).

Due to the benefits of checklists during an emergency response, the Australian Manual of Air Traffic Services,^[45] used by both civil and military air traffic control, includes a series of checklists for controllers to use when responding to in-flight emergencies. The manual stated that on notification of the emergency, the checklist actions were to be initiated and the checklist items were to be continually reviewed to ensure all actions had been completed.

QR are to be commended for developing a checklist for NCOs to use for responding to an emergency. However, not making its use mandatory, or ensuring that NCOs continually refer to the checklist during an emergency response, provided a missed opportunity to capture important errors of omission.

Driver only operations procedures in an emergency

Another set of emergency response procedures that should have been applied on this occasion related to driver only operations (DOO). These procedures required that, before a driver left the locomotive following an accident or similar event, they would discuss the situation with network control and establish a report interval.

The DOO procedures were generic in nature and did not require discussion of OHLE safety specifically. However, if the procedures were formally applied, they provided an opportunity for a driver and network control personnel to consider the situation and relevant hazards.

In the case of the 18 August 2018 dewirement, multiple NCOs and the driver did not follow QR’s DOO procedure for leaving the locomotive cabin. On the five occasions that the driver left the locomotive during the emergency response, not all were advised to the NCO. Of those that were, no report back time was agreed or appropriate method of communication formalised.

In terms of potential reasons why the procedure was not followed:

• Queensland Rail (QR) provided access to their DOO and OHLE emergency procedures to Aurizon, via a customer portal. Aurizon arranged personnel access to these via its intranet system ‘iN-Gauge’. However, no computer access to the iN-Gauge intranet was available on board YC77. Therefore, the driver was unable to access these procedures and associated forms in an emergency, when required for use.
• The driver of YC77’s recollection of the DOO procedure was incomplete, having not referred to it for almost 5 years. Where memory of procedures is degraded, ready access to procedural documentation is important to ensure they are followed.
• Aurizon provided a duty card in the form of an emergency checklist for drivers in the event of an emergency. However, a hard copy was not provided and there was no reference within the on-line checklist to the DOO procedure or requirements.
• Aurizon provided a hard copy on-the-spot risk assessment tool for drivers to use prior to performing a non-routine task, for example, an unplanned exit of the locomotive cabin. There was no reference to the DOO procedure or requirements within this tool.
• Although network control centre personnel knew of the DOO procedure, it was rarely used. The NCOs also were not aware of the crewing arrangements on board YC77, although this could have been clarified in the initial communications with the driver after the train had stopped.
• In summary, Aurizon did not provide drivers with ready access to QR’s DOO procedures for when they were operating on the QR network. The same problem applied with access to QR’s OHLE emergency procedures. Limited access, knowledge of existence and supporting document prompts to follow for the DOO and OHLE procedures increased the likelihood of these procedures not being followed during the emergency response. In the case of the DOO procedure, this increased the risk that, had the driver of YC77 required emergency assistance, there may have been a significant delay in recognition and response.

In addition, there was no procedural document for DOO on the Aurizon-controlled section of the North Coast Line. A number of rolling stock operators, including those that also operated DOO services, accessed this track. As such, although Aurizon had adopted a generic form for DOO on its network in November 2015, there was no underlying procedure to instruct its use, or emergency procedures to be followed, in the event of a DOO train emergency.

__________

45. Manual of Air Traffic Services (MATS): MATS is a joint document of the Department of Defence (Defence) and Airservices Australia (Airservices) and is based on the rules published in the Civil Aviation Safety Authority Civil Aviation Safety Regulations Part 172 – Manual of Standards (MOS) and the International Civil Aviation Organization (ICAO) standards and recommended practices, combined with rules specified by Defence and Airservices.

Findings

From the evidence available, the following findings are made with respect to the dewirement involving freight train YC77 that occurred at Cooroy, Queensland on 18 August 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• As freight train YC77 approached Eumundi, the rear collapsible end wall of the top nested flat rack raised up, resulting in multiple arcs and contacts with the overhead line equipment, which ultimately resulted in the dewirement at Cooroy.
• The nested set of three flat racks and a single flat rack were delivered to the Acacia Ridge Intermodal Terminal without the collapsible end walls of the flat racks being secured for rail travel.
• Personnel at the Acacia Ridge Intermodal Terminal did not check the collapsible end walls of the flat racks were secured on arrival at the terminal and after the flat racks were loaded onto freight train YC77, and the train departed without these end walls being secured.
• Aurizon did not have an effective system in place for ensuring personnel required to check the securing of unusual loads (such as empty flat racks) prior to departure had sufficient knowledge of their responsibilities, and had ready access to relevant procedures, guidance and checklists. [Safety issue]
• Although the electric control operator was provided with indications of overhead line equipment faults in the minutes prior to the dewirement, the pattern of information presented was ambiguous and did not enable the reason for the trips to be easily identified.

Other factors that increased risk

• On multiple occasions following the dewirement, train crew accessed the exclusion zone associated with the close proximity of the extended end wall of the flat rack to the overhead line equipment, prior to the wires being isolated and earthed on site.
• Multiple personnel did not recognise the potential risk associated with part of YC77 being very close to the OHLE after it stopped. In addition, network control centre personnel did not advise train crew of the status of the OHLE during the emergency response period.
• Queensland Rail did not have an effective process in place to ensure that safety-critical actions were co-ordinated and completed when multiple network control officers were involved in responding to an overhead line equipment emergency. [Safety issue]
• Following the dewirement, the driver and network control officer did not follow required protocols for driver only operations prior to the driver leaving the locomotive cabin.
• Aurizon did not provide drivers with ready access to Queensland Rail’s procedures for driver only operations and overhead line equipment emergencies when they were operating on the Queensland Rail network. In addition, Aurizon did not have procedures for driver only operations that applied to its own network. [Safety issue]

Safety issues and actions

Unusual loads responsibilities and guidance material

Issue number: RO-2018-011-SI-01

Safety issue description: Aurizon did not have an effective system in place for ensuring personnel required to check the securing of unusual loads (such as empty flat racks) prior to departure had sufficient knowledge of their responsibilities, and had ready access to relevant procedures, guidance and checklists.

Access to QR procedures and existence of Aurizon documents

Safety issue: RO-2018-011-SI-02

Safety issue description: Aurizon did not provide drivers with ready access to Queensland Rail’s procedures for driver only operations and overhead line equipment emergencies when they were operating on the Queensland Rail network. In addition, Aurizon did not have procedures for driver only operations that applied to its own network.

Process for co-ordinating network control activities during an emergency response

Safety issue: RO-2018-011-SI-03

Safety issue description: Queensland Rail did not have an effective process in place to ensure that safety-critical actions were co-ordinated and completed when multiple network control officers were involved in responding to an overhead line equipment emergency

Safety action not associated with an identified safety issue

Additional safety action by Queensland Rail

In July 2020, Queensland Rail (QR) advised that it had taken the following proactive safety action in relation to driver only operations (DOO) on its network:

Post this incident occurring, Queensland Rail has re-enforced the understanding of requirements relating to driver only operations and delivered training in this area to key Network Control employees. An assurance activity for Quarter 2 of the 20/21 financial year has been scheduled to verify improvements in this area.

This training was in the form of a tool box talk, delivered in March 2019, and included the DOO emergency procedures and issuance of form MD-15-457 (Authority for driver only rail traffic driver to leave locomotive).

In August 2020, QR also advised that it had:

…issued an Important Safety Notice [ISN] to Rail Traffic Crew [train drivers and guards] addressing identifying emergency situations involving OHLE.

This ISN, issued in August 2020, advised train crew that in the event of an overhead line equipment (OHLE) issue, they were to:

• confirm the status of the OHLE with the network control officer (NCO)
• remain within the train and advise the NCO in the case of a suspected dewirement or high voltage earth alarm on the train
• if while inspecting a train an object or rolling stock was found to be within 300 mm of the OHLE, apply an exclusion zone of 3 m around the rolling stock, until the OHLE has been de-energised, isolated and earthed.

QR document MD-11-30 (Rail Emergency Response Module EP1-01), required that a comprehensive review / debrief be undertaken after an emergency on QR’s network. This was to include all affected QR operational staff, with an invitation to attend extended to emergency services and a representative from the third party operator, in this case Aurizon. The purpose was to review the effectiveness and identify improvements in the emergency response and recovery process.

QR advised that it did not undertake a debrief after the Cooroy dewirement response. However, it noted that there were some informal discussions between network control personnel after the occurrence. In addition, QR advised that it typically did conduct debriefs for multi-agency emergencies, and provided examples of three other incidents in 2018-2019 where these occurred. It also advised that:

Post this incident occurring, Queensland Rail has re-enforced the importance of a conducting a formal debrief for incidents involving multi-agency emergencies.

General details

Train details

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Aurizon (train operator)
• Acacia Ridge Intermodal Terminal personnel
• the driver of train YC77
• Queensland Rail (QR) (infrastructure manager)
• rail management centre personnel
• the QR commander.

References

Dismukes RK & Berman BA 2010, Checklists and monitoring in the cockpit: why crucial defences sometimes fail, National Aeronautics and Space Administration Technical Memorandum NASA/TM-2010-216396.

Dismukes RK, Berman BA & Loukopoulos LD 2007, The limits of expertise: Rethinking pilot error and the causes of airline accidents, Ashgate Aldershot UK.

Hales BM & Pronovost PJ 2006, ‘The checklist – a tool for error management and performance improvement’, Journal of Critical Care, vol. 21, pp. 231–235.

Reason JT 1990, Human error, Cambridge University Press Cambridge, UK.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Queensland Rail, Aurizon, the driver of train YC77, Acacia Ridge Intermodal Terminal personnel, network control personnel, the QR commander and the Office of the National Rail Safety Regulator (ONRSR).

Submissions were received from Queensland Rail (primarily safety action), Aurizon (safety action only) and the terminal coordinator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Dangers associated with high voltage overhead line equipment (OHLE) in dewirements

Although voltage is required to force an electric current to flow in a circuit, electrical dangers to the human body are the result of an electric current passing through it, not the voltage. Voltages as little as 50 V AC are capable of overcoming the human body’s limited resistance to electric current, with severity of injuries increasing as voltage and thereby corresponding electric current increases.^[46] Electrical safety guidance material states that a current of 2 Amperes is capable of stopping the heart and causing severe burns to internal organs.^[47]

Under fault conditions (that is, a short circuit), current flow directly to rail or earth could reach thousands of Amperes due to a shortened pathway with less resistance than the normal electric circuit. A dewirement situation could result in such a short circuit where OHLE touched or came in close proximity to a train. This could allow current to flow directly through the metallic wagons or locomotive, into the rails. The greatly increased amperage would result in the circuit breaker for the electrical section tripping to protect OHLE from overheating or causing an electric shock. In this situation, the potential danger posed to personnel during fault conditions includes both touch and step potentials.

A touch potential occurs when a person is touching an object electrified under fault conditions and the earth. An example is holding the handrails on the egress ladder of a locomotive, with one or both feet on the ballast. As electric current will flow from a point of high voltage to low voltage, the voltage difference between the person’s hand (high voltage) and feet (low voltage) causes a large electric current to flow through their body to earth as part of the short circuit (Figure A1).

Figure A1: Touch and step potentials

Image shows both a step potential body current (left) and a touch potential body current (right), resulting from a fault condition.

Source: Voltage Lab

A step potential occurs when high voltage OHLE, or an item touching OHLE, is touching the ground, causing a current to flow through the ground to the rail or another return / earth path back to the substation. The ground voltage reduces as the distance increases from the point of contact the short circuit makes with the ground. This can cause a difference in voltage between a person’s feet standing nearby, where one foot is closer to the short circuit and thereby at higher ground voltage than the other foot. This may cause an electric current to flow from one foot through the body to the other foot (Figure A1).

Due to the high voltages of OHLE and resultant high electric currents, rubber-soled shoes may not provide protection for either touch or step potentials. All materials have a ‘breakdown voltage’, at which point a highly resistant material will lose its insulating abilities and become conductive. Similarly, high voltage OHLE can create an arc, where high voltage causes a breakdown of the air gap between an electric conductor and a conductive earthed component, allowing electricity to ‘jump’ across the air gap. The distance that electricity can arc across an air gap is dependent on a number of factors including voltage level, humidity and air pressure.

These dangers are well recognised, with rail infrastructure managers often investing in marketing campaigns to warn members of the public of the danger presented by high voltage OHLE. Figure A2 is one such example.

Figure A2: Queensland Rail’s ‘High Voltage Can Jump’ public awareness campaign

Image of Queensland Rail’s stand at the 2019 Brisbane Exhibition, highlighting the dangers of electrical arc from high voltage OHLE. The campaign was widespread throughout Brisbane, including significant display materials at Brisbane’s Central station.

Source: ATSB

__________

46. Managing electrical risks in the workplace, Code of Practice (Qld), 2013.
47. Ruschena, R 2012, ‘Chapter 23.1: Electricity’, in OHS Body of Knowledge, Tullamarine, Vic.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the afternoon of 17 August 2018, the pilot of a Kawasaki Heavy Industries BK117 helicopter, registered VH-JWB, was conducting fire-bombing operations approximately 9 km west of Ulladulla, New South Wales (NSW).

The pilot was on the third flight for the day and was conducting repeated water bombing of a fire on Plot Road, Woodburn, NSW. On the fifth fire-bombing circuit, at this location, the pilot filled the slung Bambi Bucket (bucket) without incident from a nearby dam and departed towards the fire area. Shortly after, the aircraft diverted off course, the bucket and longline became caught in trees and the helicopter collided with terrain. The pilot was fatally injured and the helicopter was destroyed.

What the ATSB found

The ATSB found that it was likely the pilot suffered an incapacitating medical event. As a result, the pilot unintentionally diverted off track, leading to the bucket becoming tangled in the trees and causing the helicopter to collide with terrain.

The pilot’s post-mortem identified a focus of acute inflammatory change in the heart muscle, a condition known as lymphocytic myocarditis. This condition is capable of causing sudden impairment or complete incapacitation. The pilot is unlikely to have known they suffered from this condition. There are no risk factors for the development of this condition and it cannot be detected by medical screening.

The pilot’s post-mortem also identified coronary heart disease which is also capable of causing sudden impairment and incapacitation. This condition was being effectively managed by medication.

Despite the pilot suffering from these two heart-related conditions, there was insufficient evidence to determine if they contributed to the accident.

The ATSB also determined that the pilot was known to use an over the counter medication for the treatment of hay fever that, although labelled as non‑sedating, was not approved for use while conducting flying operations.

Finally, the pilot did not wear the upper torso restraint correctly. Although on this occasion the accident was unsurvivable, the use of such a shoulder harness restraint generally reduces the likelihood of fatal head injuries.

Safety message

Pilots are reminded that some medical conditions may be undetectable by the normal aviation medical screening process. Pilots should remain vigilant for any medical symptoms which may be the precursor to a more serious medical event.

Pilots should also exercise caution when using over-the-counter medications as their availability does not mean they are automatically safe for use while conducting aviation activities.

The occurrence

On 17 August 2018, a Kawasaki Heavy Industries BK 117 (BK 117),^[1] registered VH-JWB (JWB), was performing aerial work in the Ulladulla area, New South Wales (NSW). The operator had been tasked by the NSW Rural Fire Service (RFS) to support fire-fighting activities in the Bombaderry area, near Nowra, on 15 August 2018, then in the Ulladulla area from the afternoon of 16 August 2018 (Figure 1). The fire-bombing operations were being flown out of the Milton Showground during the day, with the fire-bombing aircraft flown back to Nowra, for overnight parking.

Figure 1 - Accident location

Source: Google Earth, annotated by the ATSB

On the morning of 17 August 2018, JWB departed Nowra for the Milton Showgrounds. The pilot was the sole occupant and conducted a number of flights that day, refuelling from the showground at 1030 Eastern Standard Time^[2]

In the afternoon, JWB and another BK 117, VH-FHB (FHB), were tasked to assist ground‑based fire crews extinguish fires near Plot Road, Milton (Figure 2). Both helicopters were operated with a Bambi Bucket^[3] (bucket) on a longline.^[4] The operation involved flying circuits between the fire area and a nearby dam, where the buckets were re‑filled with water.

Figure 2 - Area of operations

Figure 2 shows the area of operations with circuit direction arrows that are indicative of the average track of JWB during the previous 4 circuits.

Source: Google Earth, annotated by the ATSB

At 1400 the RFS Air Attack co-ordinator conducted an ‘operations normal’ radio call with all aircraft operating in the Ulladulla fire area. The pilot of JWB responded normally and did not report any difficulties.

At about 1407, the pilot of FHB observed JWB’s pilot fill the bucket at the dam before releasing a small quantity of water, consistent with normal operations. JWB then departed the dam in a south‑easterly direction towards the fire.

The pilot then moved FHB over the same dam to fill its bucket. On completion of filling the bucket, the pilot looked for JWB but could not sight the helicopter.

A witness on Plot Road, approximately 100 m east of the accident site, observed JWB tracking in a north-easterly direction, contrary to the established flight pattern. A number of witnesses in the same area then observed the bucket and longline become tangled in trees at the edge of a clearing, and the helicopter collide with terrain (Figure 3). The pilot was fatally injured and the helicopter was destroyed.

_________

1. The Kawasaki Heavy Industries BK 117 is a twin-engine medium utility–transport helicopter jointly developed and manufactured by Messerschmitt-Bölkow-Blohm of Germany and Kawasaki of Japan.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
3. A Bambi Bucket, also known as a helicopter bucket, is a specialised bucket suspended on a cable carried by a helicopter to deliver water for aerial firefighting.
4. A longline is a long cable suspended from a hard point on the belly of the aircraft and connected to an external load such as a Bambi Bucket.

Context

Pilot information

General information

The pilot was a New Zealand citizen who had flown in several countries and had experience on numerous helicopter types. They held a valid Commercial Pilots Licence (Helicopter) that was initially issued by the Civil Aviation Authority of New Zealand, in June 1987 and then converted to an Australian licence by the Civil Aviation Safety Authority in October 1998.

The pilot held a Class 1 aviation medical certificate, valid until 5 June 2019, with a restriction requiring reading correction to be available whilst exercising the privileges of the licence.

The pilot’s logbook, combined with the operator’s flying record, showed a total flying experience of approximately 7,750 hours. The pilot had approximately 1,300 hours experience operating the BK117 and in excess of 3,000 hours of longline experience.

The pilot last completed an aerial application rating proficiency check on 9 August 2018, which was valid until 31 August 2020, and included Bambi Bucket operations. The pilot was qualified to conduct helicopter fire operations and had a low-level rating and a sling operations endorsement. The pilot’s logbook contained evidence of fire operations first being conducted in 1997. The pilot obtained an Agricultural Pilot (Helicopter) Rating Grade 2 from the Civil Aviation Safety Authority Australia in March 2003.

Fatigue assessment

The ATSB assessed whether the pilot may have been fatigued at the time of the accident. The pilot’s start times, rest time available, accommodation facilities, environmental factors and workload associated with the task were all reviewed. From the evidence available it was considered unlikely that the pilot was experiencing a level of fatigue known to affect performance.

Meteorological information

Bureau of Meteorology data was available from an automatic weather station located on the coast at Ulladulla, approximately 9 km east of the accident site. One-minute observations at the time of the accident indicated that the wind was from the south-east, between 8‑10 kt.

The other pilot operating in company with JWB at the time of the accident similarly reported the wind to be about 10 kt from the south‑east, which was roughly in the direction of the up-wind leg of the fire-bombing circuit.

Visibility was estimated to be in excess of 5 km by another pilot operating in the same area. Photographs taken shortly after the accident were consistent with that visibility assessment. Other pilots reported that the conditions were good for fire-bombing operations, with no turbulence or visibility issues.

Aircraft information

General

The Kawasaki Heavy Industries BK117 helicopter is a multi-purpose, twin-engine, skidded, medium helicopter with ten seats in the basic configuration.

Airworthiness and maintenance

The helicopter was built in 1994 and operated in Japan before being imported to Australia in 2015. A Certificate of Airworthiness inspection was completed on 24 September 2015. JWB had a current maintenance release, issued on 5 September 2017 and was valid for a period of 300 hours or 12 months, whichever occurred sooner.

The helicopter was maintained in accordance with an approved System of Maintenance. A general maintenance review was conducted on the helicopter’s history since being imported into Australia. This review did not identify any anomalies with the aircraft’s maintenance. At the time of the accident, there were no outstanding defects or maintenance requirements.

Weight and Balance

It was calculated that at the time of the accident the aircraft’s weight and balance were within the operational limits for the helicopter.

Engines

The helicopter was powered by two Lycoming (now Honeywell) LTS101-750B-1 engines. The engines were initially examined on site by the ATSB and also subject to detailed disassembly and technical examination by the manufacturer (see the section titled Wreckage examination).

Hydraulic System

The hydraulic system consists of two independent subsystems of which construction, function and performance are identical.

Bambi Bucket

JWB utilised a Bambi Max bucket that is a lightweight, low‑power draw, quick‑operating multiple drop valve Bambi Bucket. The bucket was attached to the helicopter cargo hook via a 130 ft longline. The pilot controlled the bucket using a push button switch mounted on the cyclic.^[5]

Cargo Hook

JWB was fitted with an Indraero Siren Equipment cargo hook. The hook allows external cargo to be released via a collective^[6] ‑mounted electrical switch. In addition, a foot‑activated manual release lever was located to the right of the pilot’s tail rotor pedal. This lever was used to release cargo in the event of an emergency or failure of the electrical release system.

During the course of the investigation, the ATSB was informed that the pilot sometimes operated with the circuit breaker for the electrical hook release pulled. The operator advised that the company procedure was to fly with the circuit breaker in and the electrical hook switch armed during flight. Additionally, even if the pilot had flown with this circuit breaker pulled, they would still have had the foot‑activated manual release lever available in the event of an emergency.

Operational information

The pilot of FHB commented during interview that each time JWB was overhead the fire‑bombing area there was a substantial level of clearance between the bucket and the trees. This pilot estimated that water was consistently dropped from JWB at about 6‑9 m above the trees.

None of the ground or airborne crews heard any radio transmissions from JWB immediately before the accident. During water bombing operations it is standard practice to make a radio call when leaving the circuit for any reason, to inform other airborne assets of the helicopter’s tracking.

Ground fire-fighting crews were also operating in the immediate area. Those personnel advised that there were no other spot fires in the immediate area. Additionally, the crew of the air attack helicopter reported to the ATSB that when they came into land at the accident location minutes after the accident, they did not see any fire in the area that may have caused JWB to turn away from the circuit.

Fuel

JWB and the other helicopters on task, had all refuelled using Jet A1 fuel from the same onsite tanker based at the Milton Showgrounds. In addition, other helicopters operating in the area were using fuel from the same source and there were no reported issues with fuel quality. Fuel records confirmed the fuel on-board the tanker conformed to the relevant specification.

JWB had refuelled twice from the tanker on the day of the accident with the last refuel of 435 litres conducted approximately 2 hours and 20 minutes prior to the accident. Considering the helicopter’s fuel consumption rate, there was adequate fuel onboard at the time of the accident.

Wreckage and accident site information

Accident site

The accident site was located 9 km west of Ulladulla, New South Wales. The wreckage of JWB was approximately 200 m from the average circuit path and the aircraft final track was estimated to be 90° off the circuit direction (Figure 2).

The main cabin of the helicopter was found inverted in a clearing with the bucket and longline still attached (Figure 3). The bucket and longline were caught in a 22 m tall tree at the edge of the clearing.

Rub marks from the longline were found on the trunk of the tree that the bucket was hanging from. These marks indicated the bucket snagged the tree at least 13 m down from the top of the tree.

In the later part of the circuit the helicopter bucket would normally have a minimum of 6–9 m clearance above the treetops. Taking this into account, and the tree contact 13 m below the canopy, the bucket was at least 19–22 m lower than expected when it snagged the tree and brought the helicopter down.

Figure 3 - Accident site and wreckage
 

Source: ATSB

The bucket, while suspended from the tree, still contained a large quantity of water. After removal, examination of the bucket showed that the cable required to operate the drop valve had broken at the attaching point to the motor, either during the accident sequence or as the bucket was removed from the tree. However, during post‑accident repairs the main valve was tested and found to be serviceable.

Wreckage examination

The ATSB examined the wreckage and did not identify any pre-existing aircraft defects that may have contributed to the accident sequence. The aircraft and all its components were accounted for at the accident site. There was no evidence of fire.

There was extensive damage to the fuselage with heavy vertical compression evident. One main rotor blade detached, while the other three remained attached to the head, with varying degrees of damage due to contact with the airframe and terrain. The vertical fin, including the tail rotor assembly, intermediate and tail rotor transmissions, fractured from the tail boom at the lower section of the vertical fin. The horizontal and vertical stabilisers had been struck by the main rotor blades multiple times.

Consistent with normal firefighting operations, the pilot door was not fitted at the time of the accident. The cabin doors were forced from their closed position due to impact forces.

All flight controls were observed to be connected at the time of the accident and did not indicate any pre-existing defects. There was no visible damage to the cockpit controls.

Several circuit breakers in the overhead panel were found in the ‘tripped’ position, including the cargo hook, annunciator warn and main rotor RPM warning. However, due to the nature of the accident sequence, these circuit breakers may have tripped due to impact forces.

The serviceability of the cargo hook mechanical release mechanism was verified after disconnecting the cargo hook from the helicopter. This was necessary due to the damage at the hook end of the actuating cable.

The ATSB tested the hook assembly electrically with the use of another BK117 and it was found to be serviceable. The hook was cycled a number of times and released and relatched without any anomalies observed.

Each engine assembly was examined on-site and found to be complete, with no evidence of pre‑accident defects that influenced the accident.

Both engines were removed from the wreckage and shipped to the manufacturer in the United States for detailed examination under the supervision of the United States National Transportation Safety Board.

The disassembly and examination of the engines identified that the type and degree of damage was indicative of both engines rotating and operating normally at the time of impact. No pre‑existing conditions were noted that would have affected their operation.

Examination of the tandem hydraulic unit assembly showed three of the four filter bypass indicators in the ‘popped’ condition. An examination of the filters in each location showed them to be clear of blockages and debris. Consequently, the ‘popped’ indicators were probably impact related. The fluid level indicators for each reservoir showed that both systems had adequate fluid to operate.

While moving the wreckage upright, approximately 100 litres of fuel leaked from JWB. This fuel was clear in appearance and indicated sufficient fuel on-board for use.

Recorded information

The aircraft was not fitted with a flight data recorder or a cockpit voice recorder and neither were required.

A Spidertracks system was installed in the helicopter. Spidertracks provides a real-time flight tracking service using satellite communications. The device reports position and groundspeed at a pre-set time interval, in this case every 2 minutes.

The last recorded point for JWB was at 1408 (Figure 2). At that time, the helicopter was departing the dam, where it had just taken on water, and was heading towards the fire ground. This was consistent with previous circuits.

Medical and pathological informational

Post-mortem examination

The forensic pathologist who conducted the post-mortem examination concluded that the pilot succumbed to injuries sustained during the accident sequence. The examination also identified a widespread area of acute lymphocytic myocarditis, likely of viral origin, and ischaemic (coronary) heart disease. The examining pathologist noted that the myocarditis and/or coronary heart disease found during the post-mortem may have caused sudden incapacitation.

The post-mortem also identified injuries to the pilot’s left arm and both hands. Specialist opinion was that this injury pattern evidence was inconclusive in determining whether the pilot was manipulating the flight controls at the time of the accident.

No witness marks were identified during the examination to indicate the pilot was wearing the available upper torso restraints over the shoulders and the time of the accident.

Finally, toxicological examination identified that a level of 5 per cent carboxyhaemoglobin was present in the pilot’s blood (see the section titled Carbon monoxide below). No other substances were identified that were likely to have impaired the pilot’s performance.

Lymphocytic myocarditis

Lymphocytic myocarditis (myocarditis) is an inflammatory change in the heart muscle, usually caused by an acute viral infection. Acute viral myocarditis can involve a period with mild early symptoms which can be followed by chest pain, heart rhythm abnormalities, heart failure, or sudden cardiac death. Myocarditis may also have a sudden onset with no early mild symptoms. The signs and symptoms of myocarditis vary, depending on the cause of the disease. Common myocarditis signs and symptoms include:

• chest pain
• rapid or abnormal heart rhythms (arrhythmias)
• shortness of breath, at rest or during physical activity
• fluid retention with swelling of the legs, ankles and feet
• fatigue
• other signs and symptoms of a viral infection, such as headache, body aches, joint pain, fever, sore throat and/or diarrhoea

The ATSB engaged two external aviation medicine specialists (consultants A and B), to provide advice regarding the pilot’s health, medications and medical conditions in relation the accident sequence.

The consultants advised that the standard aviation medical examination procedure would not have detected myocarditis. Myocarditis cannot be detected by medical screening, and there are no risk factors for the development of viral myocarditis. The only avenue for prevention is for pilots to self-monitor for any symptoms or signs of illness prior to and during each flight.

Advice was sought from the medical consultants as to the likelihood of the pilot having symptoms of the condition based on the post-mortem report. Consultant A, in conjunction with a cardiologist, reported that the presence of a focus of acute myocarditis in the pilot was a finding ‘likely to have functional significance for the risk of sudden impairment or sudden complete pilot incapacitation.’ Consultant A also stated that viral infections of all kinds are often characterised by quite severe illness developing suddenly, sometimes with early mild symptoms. They also advised that the risk of cardiac arrhythmia due to viral myocarditis and the apparent cessation of pilot control inputs were strongly suggestive of severe and sudden loss of situational awareness and/or loss of consciousness occurring as a result of myocarditis in the final moments of the flight.

Consultant B reported that it was possible the myocarditis was an incidental finding in the post‑mortem and did not cause any symptoms. However, they also advised that it was equally possible the pilot was suffering some medical incapacitation from this condition, however there was no evidence for this prior to the flight.

Coronary heart disease

Coronary heart disease describes a condition where narrowing of the coronary arteries by fatty deposits in the artery walls, or hardening of the arteries, causes a reduction of the blood to the heart muscle, reducing the oxygen supply. If this condition causes a blockage to one of the major arteries supplying blood to the brain, a stroke can occur. Depending on the part of the brain affected, sudden incapacitation and the inability to operate an aircraft may result.

Common symptoms of this disease include:

• chest pain
• dizziness
• shortness of breath
• decreased ability to function normally

The ATSB medical consultants advised that the pilot had undergone an aviation medical examination, including an electrocardiogram, by an aviation medical examiner three months prior to the accident and was found to be fit to fly. In addition, consultant A advised that the pilot’s medical examination and medical certification processes were appropriate and took into account the effective management of cardiovascular risk factors.

Opinion was sought from the consultants on the potential for the condition to have influenced the accident. They commented that coronary artery disease of the level found at post-mortem is often found in healthy people and can be regarded as part of the normal degenerative process of aging. The presence of calcification indicated that the pilot’s heart disease was longstanding and would not necessarily have caused symptoms.

Consultant A also commented that coronary artery narrowing without evidence of inadequate blood supply was reported at post-mortem, but the changes were longstanding and unlikely to have caused symptoms.

Observed behaviour

Several people were interviewed as part of the investigation who had contact with the pilot on the day of the accident and during the days immediately preceding the accident. With one possible exception, all commented that the pilot was generally well and in good spirits.

Following a lunch break on the 16 August, the pilot was observed having difficulty writing down the latitude and longitude of a new task location. The pilot was passed the latitude and longitude three times over the radio and the pilot was observed to write part of the numbers correctly, part incorrectly or just stop writing mid sequence. The latitude and longitude was described as being passed via the radio very clearly.

The observer knew the pilot in a professional capacity and had witnessed the pilot landing, taking off and attending briefings that day and the previous day with no indications the pilot was having any difficulties. The observer made comment that, when the pilot had difficulty writing down the latitude and longitude, nothing in the pilot’s movement, speech or facial expression appeared unusual.

With regard to this observation of apparent impairment, consultant A commented that it may have been associated with myocarditis-related arrythmia or transient ischaemic attack.

Consultant B commented that this apparent episode of confusion was non-specific and while it could be attributed to myocarditis, or the effects of heart disease, it could also have been unrelated.

Medication

During the wreckage examination four prescription medications and one over the counter antihistamine medication were found with the pilot’s possessions. It was confirmed with the pilot’s designated aviation medical examiner (DAME) that all four prescription medications had been taken by the pilot for a number of years and were consistent with their age and health. It was reported by a family member that the pilot did not suffer any side effects from the prescription medications.

Opinion was sought from medical consultant A, in conjunction with an aviation cardiologist, whether the medications could have influenced the accident. The potential for side effects such as sedation and drug interactions, were all considered and excluded by these specialists. The potential for cardiac irregularity due to an interaction between one of the antihypertensive drugs and the antihistamine was also assessed as very unlikely.

The antihistamine medication was for the treatment of hay fever and the pilot’s DAME was not aware of its use. The active ingredient of this medication is listed in the CASA guidance as prohibited. It was reported that the pilot was known to suffer from hay fever and used this medication to treat the symptoms.

Medical opinion regarding the possible sedating side effects of this medication was that, while some people experience sedation when taking this non-sedating antihistamine, this was recognisable on taking the first dose. The pilot was known to have been taking this medication regularly, so any adverse effects on the day of the accident were considered unlikely.

Carbon monoxide

Carbon monoxide (CO) is a colourless, odourless and tasteless gas. It is the by-product of the incomplete combustion of materials containing carbon. The Agency for Toxic Substances and Disease Registry (2012) stated that CO is produced from both human-made and natural sources.

When inhaled, CO is absorbed into the bloodstream where it readily binds with the haemoglobin to form carboxyhaemoglobin (COHb). The binding affinity of CO for haemoglobin is 200-300 times stronger than that for oxygen. Therefore, CO reduces the oxygen carrying capacity of the blood.

An individual’s COHb levels increase as the duration and intensity of the CO exposure increases.

Normal levels of carbon monoxide and effects

There have been a considerable number of studies examining CO exposure, though very few regarding such exposure in helicopters.

Hampson et al. (2007) cited various publications that indicated that there were differing views regarding the correlation between COHb levels and a patient's clinical symptoms.

Further, when comparing the COHb levels detected in individuals, Rathore and Rein (2016) highlighted that it was important to note that ‘both the concentration and length of time are key distinguishing factors. It is vital to note however that individuals exposed to the same source simultaneously can exhibit differing levels of COHb’. Taking this into consideration, when discussing the normal levels of CO contained in an individual’s blood, Consultant B stated that:

Normal levels of carbon monoxide in non-smokers are less than 2-3%. Smokers may have elevated levels around 3-5% or even as high as 9%, depending on number of cigarettes smoked and time since last cigarette smoked.

A police forensic pharmacologist involved in a previous ATSB investigation^[7] reported similar levels, where a non-smoker’s maximum COHb level would be around 5 per cent, while smokers could have levels up to 10 per cent and up to 16 per cent for heavy smokers.

While the research shows some variability in what was considered to be the normal production of CO without occupational exposure, generally less than 3 per cent COHb saturation was considered normal for non-smokers. For smokers, levels up to 10 per cent, or even more were expected.

Recognising the potential for variability, physical symptoms and cognitive effects of CO exposure generally start to occur at COHb levels of around 10 per cent. These include headaches, nausea, dizziness, confusion, and disorientation.

ATSB report AO-2017-118 contains further details on the effects of CO.

Possible sources

Aviation fuels contain carbon so exhaust gasses are a source of carbon monoxide that can potentially enter the cabin during flight. Piston engines produce the highest concentrations of CO, however turbine engines also produce CO (Salazar).

Based on the configuration of the helicopter, with the engines above and behind the cabin as well as the cabin doors closed, it was considered unlikely for significant exhaust gasses to enter the cabin, even with the pilot door removed.

Carbon monoxide is also produced during combustion from bushfires. Studies have been conducted regarding the effect of the smoke on firefighters on the ground, however there is no data in relation to pilots conducting airborne firefighting. One study conducted by Reinhardt and Ottmar (2004) found 5‑10 per cent of firefighters exceeded exposure standards for respiratory irritants, of which carbon monoxide is one, while attending bushfires.

In a study conducted by MacSween et al (2019) it was noted that emissions and subsequent exposure levels were highly variable over the duration of a burn. Carbon monoxide levels present during fire-fighting activities depend on numerous variables, including fuel properties, temperature, moisture, ventilation of the area and proximity to the fire (De Vos, et al, 2008). The pilot was operating at varying altitudes and proximity to the fire and considered to be further from the fire source than ground-based firefighters.

The pilot’s smoking history was also examined. The pilot had been a non-smoker for more than 20 years and it was considered by consultant B to not be a factor in the elevated levels of CO found in the toxicology. 

In summary, the source of the pilot’s slightly elevated CO could not be determined.

Medical opinion

The forensic pathologist, who performed the post-mortem, considered the level of carbon monoxide found in the pilot’s blood was unlikely to have had an effect on the pilot’s ability to fly the helicopter.

Consultant B reviewed the results of the CO testing and the post-mortem report. Taking into account the circumstances of the accident and the CO level found in the pilot’s toxicology, they similarly concluded it was extremely unlikely that the level of CO in the pilot’s blood would have affected their operation of the helicopter.

Survival aspects

Due to the inverted nature of the accident and resulting vertical compression of the fuselage, the accident was not considered survivable.

It was noted, however, that evidence from the first responders showed the upper torso restraint (UTR) was worn incorrectly. The UTR was fastened around the pilot’s waist rather than over the shoulders, meaning the upper torso was unrestrained. A photograph from a previous flight also showed the pilot with the UTR being worn in the same manner as found in the accident flight.

Related occurrences

The ATSB report Pilot incapacitation: Analysis of medical conditions affecting pilots involved in accidents and incidents examined medical conditions and incapacitation events between 1 January 1975 and 31 March 2006. This report concluded that the majority of pilot incapacitation events do not involve a chronic or pre-existing medical condition. That is, they are largely unforeseeable events, often involving acute illnesses or injury. Of the 10 accidents that resulted in fatalities, all involved single-pilot operations and in half of these, heart conditions were identified as a significant contributing factor.

The ATSB safety education publication Pilot incapacitation occurrences 2010–2014 (AR‑2015‑096) documents recent pilot incapacitation occurrences in high capacity air transport, low capacity air transport, and general aviation to help educate industry about the causes and risks associated with inflight pilot incapacitation. Part of the safety message reminded pilots to assess their fitness prior to flight. Assessment of fitness includes being aware of any illness or external pressures they may be experiencing.

ATSB investigation AO-2015-145: Flight crew incapacitation – Lake Macquarie Airport, NSW, on 15 December 2015

On the morning of 15 December 2015, a SOCATA TBM 700, aircraft, registered VH-YZZ, departed Gold Coast Airport, Queensland for Lake Macquarie Airport, New South Wales. On board were the pilot and one passenger.

The flight to Lake Macquarie was uneventful. However, when the aircraft was just about to land on the runway the pilot started to feel ‘woozy’ and, shortly afterwards, lost consciousness. The aircraft impacted the runway, bounced and impacted the runway a second time before the pilot regained consciousness. The pilot and passenger were not injured during the accident and exited the aircraft. Medical tests and monitoring after the accident found that the loss of consciousness was due to a previously undiagnosed heart condition.

___________ 

5. Cyclic: a primary helicopter flight control that is similar to an aircraft control column. Cyclic input tilts the main rotor disc, varying the attitude of the helicopter and hence the lateral direction.
6. Collective: a primary helicopter flight control that simultaneously affects the pitch of all blades of a lifting rotor. Collective input is the main control for vertical velocity.
7. See AO-2017-118 at www.atsb.gov.au.

Safety analysis

Introduction

During daytime fire-bombing operations the aircraft deviated off track without making a radio call, flew too low and caught the bucket in trees resulting in a collision with terrain.

Site and wreckage examination did not identify any defects or anomalies that might have contributed to the accident. The following analysis will focus on possible reasons why the aircraft diverted off track as well as medical and survivability aspects.

Pilot incapacitation

The pilot of JWB was familiar with the area of operations and the conditions on the day, having flown several circuits in the area that afternoon. No weather or mechanical issues were identified during the course of the investigation that could have influenced the accident.

The absence of any communication by the pilot after filling the bucket for the final time was unusual as it was standard practice to make a radio call when leaving the circuit for any reason and was a simple action to perform.

At any time during the flight the pilot had the option to dump the water and/or release the bucket and longline in total from the aircraft hook should circumstances have required it. However, this action was not completed by the pilot. Had the observed flight deviation been the result of the pilot responding to a mechanical issue, dumping the water and/or releasing the bucket would have increased the aircraft performance and made dealing with a mechanical malfunction easier.

If the pilot was attempting an emergency landing, then it would be expected that they would have tracked for one of the nearby suitable landing areas and, depending on the emergency, dumped the water and/or released the bucket and made a radio call. The area the accident occurred in was not a suitable emergency landing site due to the slope of the terrain and surrounding obstacles. In addition, the pilot did not perform any of the expected actions associated with an emergency. Therefore, it was considered unlikely that the pilot was attempting an emergency landing at the time of the accident.

The on-site assessment indicated that JWB was at least 19–22 m lower than expected at the time the bucket caught in the trees. The bucket and longline contacted the tree at least 13 m below the top of the tree. The pilot was aware of terrain having completed four circuits in the area and was on the fifth at the time of the accident. In addition, the pilot had been observed flying with a substantial level of clearance between the bucket and the trees on previous circuits.

With the pilot’s extensive experience working with a longline and at low level, as well as several standard pilot actions that were missing, it is unlikely that the pilot knowingly diverted off track, did not make a radio call and flew significantly lower than was safe resulting in the bucket snagging in the trees and the helicopter colliding with terrain.

In the absence of any mechanical issue, and considering the significant, unannounced tracking and height deviation from the normal operating procedure, the evidence indicated that the pilot probably suffered an incapacitating event. Due to this event the pilot unintentionally diverted off track, was unable to make a radio call and was unable to react to the low altitude of the helicopter. This led to the bucket becoming tangled in the trees and caused the helicopter to collide with terrain.

Possible sources of incapacitation

Although 5 per cent carboxyhaemoglobin was present in the pilot’s blood, the level was considered by medical specialists to be too low to have affected the pilot’s ability to operate the helicopter. Recognising the potential for individual variability, the conclusions of the specialists were consistent with research that indicated about 10 per cent carboxyhaemoglobin was generally required to produce adverse effects. As such, it was considered unlikely that carbon monoxide was the source of pilot incapacitation.

Lymphocytic myocarditis

Both medical consultants engaged by the ATSB agreed that myocarditis may have a sudden onset with no initial mild symptoms. In addition, the signs and symptoms of myocarditis vary depending on the cause of the disease and can include sudden incapacitation.

However, the consultants’ opinion differed in relation to the strength of the link between this specific condition and the outcome of the flight. Consultant A stated that the presence of a focus of acute myocarditis in this pilot was a finding likely to have functional significance for the risk of sudden impairment or sudden complete pilot incapacitation. However, consultant B concluded that it was possible that the pilot was suffering some medical incapacitation from myocarditis or heart disease or other causes that were not identified.

Due to the variation between the specialist conclusions, the ATSB was unable to determine if the effects of myocarditis contributed to the accident.

Coronary heart disease

Both medical consultants commented that the level of coronary heart disease found at the post‑mortem examination was likely typical of a large proportion of the population of similar age to the pilot and was not known to produce symptoms.

The pilot had undergone and passed a Class 1 aviation medical within 3 months prior to accident which included an electrocardiogram.

Due to the pilot’s current effective management of their cardiovascular risk factors and a lack of any other evidence linking this condition to the outcome of the flight, it was considered unlikely to have influenced the accident.

Over the counter medication

During the examination of the wreckage, the ATSB found an over-the-counter antihistamine in the pilot’s possessions, and it was reported that the pilot regularly took this medication for the treatment of hay fever. The Civil Aviation Safety Authority (CASA) provides guidance on medications that are approved, hazardous and prohibited for flight. CASA notes that just because a medication is available over the counter does not mean it is automatically safe for aviation. CASA also recommends that a pilot should always consult their designated aviation medical examiner or CASA about the safe use of medication.

The active ingredient of this medication is listed in the CASA guidance as prohibited in aviation. While the label stated it was non-sedating, it is classed by CASA as a sedating antihistamine. ATSB medical consultant A commented that the sedating effects of this medication would be recognisable on taking the first dose. The pilot had been taking this antihistamine for some time and had not reported any side effects. Therefore, any adverse effect on the day of the accident was considered unlikely.

Upper torso restraint

The pilot was found to have not been wearing the upper torso restraint correctly at the time of the accident. The ATSB medical consultant commented that had this been an un-inverted impact, or an impact with significant longitudinal aircraft deceleration, the absence of the shoulder harness restraint would have increased the likelihood of head injuries, with possible fatal consequences in an otherwise survivable accident.

Findings

From the evidence available, the following findings are made with respect to the collision with terrain involving Kawasaki Heavy Industries BK117, VH-JWB, which occurred 9 km west of Ulladulla, New South Wales, on 17 August 2018.

Contributing factors

• While conducting fire-bombing operations, the pilot likely experienced an incapacitating event resulting in deviation off track, entanglement of the bucket in trees and subsequent collision with terrain.

Other factors that increased risk

• The pilot had acute lymphocytic myocarditis which is known to affect heart rhythm and/or blood pressure. This can cause dizziness, impaired consciousness, and incapacitation.
• The pilot had coronary heart disease which is known to reduce the supply of blood to the heart muscle. This can cause chest pain, dizziness, shortness of breath and possible incapacitation.
• The pilot used an over-the-counter medication for the treatment of hay fever that, although labelled as non‑sedating, was not approved for use while conducting flying operations.
• The pilot did not wear the upper torso restraint correctly. Although this accident was unsurvivable, the absence of such a shoulder harness restraint generally increases the likelihood of fatal head injuries.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Civil Aviation Safety Authority (CASA)
• operator
• pilot’s and crew of other helicopters airborne in the area
• New South Wales Police Service and Rural Fire Service
• aircraft and engine manufacturers
• maintenance organisation for VH-JWB
• Airservices Australia
• next of kin
• medical consultants
• accident witnesses
• recorded data from Spidertracks

References

Civil Aviation Safety Authority’s aviation medicine guidance, Medication, available from the CASA website.

De Vos, A. Reisen, F. Cook, A. Devine, B & Weinstein, P. (2008). Respiratory Irritants in Australian Bushfire Smoke: Air Toxics Sampling in a Smoke Chamber and During Prescribed Burns. Arch Environ Contam Toxicol (2009). 56:380-388.

Agency for Toxic Substances and Disease Registry. (2012). Toxicological profile for carbon monoxide. Retrieved from https://www.atsdr.cdc.gov/toxprofiles/tp201.pdf

Hampson, N.B. & Hauff, N.M. (2007). Carboxyhemoglobin levels in carbon monoxide poisoning: do they correlate with the clinical picture? The American Journal of Emergency Medicine, 2008(26), 665-669.

MacSween, K. Paton-Walsh,C. Roulston, C. Guerette, E. Edwards, G. Reisen, F. Desservettaz, M. Cameron, M. Young, E & Kubistin, D. (2019). Cumulative Firefighter Exposure to Multiple Toxins Emmitted During Prescribed Burns in Australia. Exposure and Health.

Rathore, O. & Rein, G. (2016). Carbon Monoxide Toxicology: Overview of Altitude Effects on the Uptake and Dissociation of COHb and Oxygen in Human Blood. Retrieved from RFImpactAltitudeCOToxicology.ashx (nfpa.org)

Reinhardt T.E, Ottmar RD (2004) Baseline measurements of smoke exposure among wildland firefighters. J Occup Environ Hyg 1(9):593–606. https://www.tandfonline.com/doi/full/10.1080/15459620490490101

Salazar, G.J. Federal Aviation Administration. (n.d.). Carbon Monoxide: A Deadly Menace. Retrieved from CObroforweb (faa.gov)

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 17 June 2018, at about 1309, passenger train NT32 collided with a track obstruction as it crossed the Wilson River Bridge, near Telegraph Point, New South Wales and sustained minor damage. The track obstruction was identified as an awning from a container being carried by freight train 7WB3, operated by Pacific National (PN), which had separated when it came open and struck the bridge structure as the train passed over.

What the ATSB found

The ATSB found that the container involved had been modified to include a large side opening awning. The awning was only held closed by spring-loaded bolts accessed from the inside of the container. This was not compliant with PN’s Freight Loading Manual (FLM), which required a system that could be locked and was externally visible to assure that openings remained secure and enable examination by inspection staff.

Inspections conducted by PN terminal operators at the departure location did not identify the modified container or the absence of locks. The customer did not notify PN that the container was modified as they were not aware of a requirement to do so. Consequently, PN were unaware of the need to assess the modifications against the FLM requirements.

While PN made the FLM available to customers, they did not actively advise them when they had a responsibility identified by the manual and did not have a process for ensuring customers complied with the manuals requirements.

Additionally, the training and checking processes for terminal operators who carried out inspections did not include the FLM requirements for modified containers. This removed an opportunity for the requirements to be reinforced and practiced during training and regular checking of inspection staff.

What's been done as a result

PN have advised that they have implemented a range of processes to ensure customers are aware of, and are compliant with their FLM requirements. These have included the development of an online course for the FLM, and an auditing program to monitor FLM compliance and performance. PN has further introduced a number of measures relating to the training and checking of inspection staff. These include trialling a change to their transport management system, which triggers mandatory checks by PN inspectors at any terminal where a non-standard or modified container enters, and updating training and checking packages to include the FLM requirements.

Safety message

Any item on a container that can open into the rail corridor represents a potential risk as, should they come open, they may strike infrastructure, opposing trains or bystanders. This highlights the significance of ensuring that such items are adequately secured prior to transit.

Further, this occurrence emphasised the importance of training and checking to reinforce operational procedures, in this case, for identifying and securing openings on modified containers. It also identified the need to have processes in place to advise customers of the requirements for the safe transport of modified containers and to ensure compliance.

The occurrence

Loading of container wagons

On 15 June 2018, a container (number 2200655) was delivered to the loading facility at Carrington, New South Wales (NSW), for loading onto a rail wagon. The container was loaded onto wagon RQSY 34371M, one of nine wagons loaded with container freight bound for Brisbane, Queensland (Qld). The container was a 20 ft (6 m) shipping container that had been modified for use as a canteen. The modifications included the addition of an awning on one side of the container, pictured below (Figure 1).

Figure 1: View of the container showing the awning on one side

Source: Pacific National

At about 1900 Eastern Standard Time,^[1] the nine loaded wagons were moved from the loading facility to Morandoo Yard where they were to be attached to the incoming service 7WB3 the next day.

On 16 June, at about 0840, a Pacific National (PN) terminal operator completed an inspection of the nine wagons, referred to by PN as an FX inspection (refer to section titled FX inspection). Upon completing that inspection, he issued a train inspection certificate for the nine wagons, indicating that no issues were identified.

Train 7WB3 was a service carrying mostly steel products, originating from Port Kembla, NSW, with a final destination of Brisbane, Qld. The train arrived at Morandoo early the next morning on 17 June. The nine wagons were attached to the rear of train 7WB3 by PN terminal operating staff and a brake pipe continuity test was performed.

Train 7WB3 journey to Taree

A train crew from Taree, consisting of two drivers, arrived at Morandoo at about 0500. The crew were to drive train 7WB3 from Morandoo to Taree, NSW. Train 7WB3 subsequently departed Morandoo yard at about 0510. On departure, the train consisted of 3 locomotives and 55 wagons with a mass of 4,090 t and length of 1,036 m. Two terminal staff performed roll-by inspections (refer to section titled Roll-by inspection), one from each side of the train as it departed and did not report any issues.

Train 7WB3 proceeded north and was confirmed to have arrived at Stroud Road (the location of a passing loop) and crossed^[2] a southbound train, 7BM4. The crew of 7BM4 performed a roll-by inspection of 7WB3 and did not report any issues. Train 7WB3 departed Stroud Road at about 0731.

At about 0754, the Australian Rail Track Corporation (ARTC) network control officer (NCO) controlling the NSW north coast train control section ‘Coast A’ received a telephone call from a member of public who reported an open wagon ‘door’ toward the rear of train 7WB3. The NCO advised the crew of the reported open ‘door’ and the crew of 7WB3 subsequently requested to stop their train at Craven North Loop to inspect. When the train came to a stand at Craven North at about 0756, one of the crew alighted and proceeded to inspect the train.

Upon returning to the lead locomotive, the crew contacted the NCO at about 0824 and reported finding and resecuring an ‘open window’ on an ‘office container’ on wagon RQSY 34371M. The NCO subsequently cleared 7WB3 to proceed. Photographs taken of the container by the crew member before and after resecuring show that the ‘door’ and ‘window’ referred to above were the awning on the side of the container (Figure 1 and Figure 2). The container number, 2200655, was visible in Figure 2.

Figure 2: View of the container with the open ‘door’ and ‘window’ (awning)

The image shows the awning open when inspected at Craven North. The container number 2200655 is also visible on the end door.

Source: Pacific National

7WB3 continued its journey and at about 1049, crossed train 6422 near Taree. The crew of train 6422 advised that they had seen a ‘door’ open on a container on 7WB3.

At about 1050, train 7WB3 arrived at Taree, which was a crew change location. The departing Taree crew informed the arriving Brisbane crew that a ‘door’ on a container at the rear of the train had been opening. They also informed the ARTC NCO that the ‘window’ had opened again. The Taree crew then proceeded to the back of the train to resecure the awning. They reported that, after they resecured the awning they tried to force it open again by pulling on it and were not able to do so. They informed the Brisbane crew that it was resecured, who relayed the message to the ARTC NCO at about 1105.

Occurrence

Train 7WB3 subsequently departed Taree at about 1107 and continued its journey north. At about 1257, it crossed the southbound passenger service NT32 at Telegraph Point. PN advised that 7WB3 was stationary in the passing loop for the cross, with NT32 proceeding past it on the main line. Although one of the drivers of train 7WB3 recalled hearing a ‘crackle’ on the radio after train NT32 had passed, the drivers did not receive a roll-by inspection report from NT32, nor any other message.

After crossing 7WB3 at Telegraph Point, train NT32 proceeded south and struck an object on the track while crossing the Wilson River Bridge, a steel through-truss bridge (Figure 3).

Figure 3: View of the Wilson River Bridge

The southern access to the Wilson River Bridge, facing north. This view shows the steel through truss structure that the awning struck.

Source: Pacific National

At about 1309, after bringing his train to a stop, the driver of NT32 reported this to the ARTC NCO. The driver described the object that had been struck as a metal object, ‘something about the size of a car bonnet’ and ‘looked like it might have come off a freighter’. The driver also reported that he would inspect his train and look for the metal object on the bridge.

Based on the description of the track obstruction, the ARTC NCO contacted the crew of 7WB3 at about 1319 and requested that they pull up to inspect their train. Ten minutes later the train pulled-up at Kundabung, NSW, and one of the crew members alighted. The other crew member drove the train forward slowly so that the person on the ground could inspect the train as it passed.

Meanwhile, the driver of NT32 had advised the NCO that he had completed the inspection of his train and had cut out the number 1 brake cylinder on the leading locomotive due to damage from hitting the track obstruction, and that NT32 was able to depart. The driver did not report seeing any issues on 7WB3, but indicated that one of the passenger service staff on NT32 reported hearing something hit the side of the train as they crossed by 7WB3. He further stated that he had not been able to inspect the bridge, as there was no safe access on foot. Train NT32 continued its journey without further incident.

At about 1332, the crew of 7WB3 reported to the NCO that a ‘window’ was missing from a container. They further advised that they had removed any loose items from the container, that nothing remained out of gauge,^[3] and that they were ready to depart. The NCO subsequently allowed 7WB3 to depart and the crew moved the train off from Kundabung at about 1347.

Post-occurrence

At about 1352, the NCO radioed the crew of 7WB3 and requested that they inspect the other side of the train at Kempsey. The NCO indicated that this request was in response to the report from NT32 of hearing something hit as they crossed 7WB3. The crew subsequently pulled up, inspected both sides of the train and reported that no further issues were found. Train 7WB3 departed Kempsey at about 1442 and completed its journey to Brisbane without further incident.

The damaged container was photographed by PN upon arrival at the Brisbane Freight Terminal (Figure 4). The damaged awning was subsequently recovered from the Wilson River (Figure 5).

Figure 4: View of the container showing the damage from the missing awning

Source: Pacific National

Figure 5: The damaged awning when recovered from the Wilson River

Source: Pacific National

__________

1. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
2. Cross: The passing of two trains travelling in opposite directions, often conducted at a crossing loop when on a single track line.
3. Out of gauge: when referring to items loaded on rollingstock - a vehicle load that does not conform to the relevant loading outline. Guidance on loading outlines can be found in Section 4 of the Rail Industry Safety and Standards Board Code of Practice – Loading of Rail Freight and Australian Standard AS7507.

Context

Container information

Container number 2200655 had been modified by Port Shipping Containers to include a large side opening that was about 1.2 m high by 3 m long, approximately one-quarter of one sidewall of the container (Figure 1). This opening was intended for use as an awning. During the sequence of events, notifications by the train crews and the Australian Rail Track Corporation (ARTC) network control officer (NCO) referred to the awning as a ‘door’ and ‘window’. It was understood that all such references were to the awning and not the container end doors.

The awning was constructed from a rectangular hollow section steel frame with the section of steel sheet that had been removed from the container side welded back into the frame. Another rectangular hollow section steel frame was welded to the opening in the container. The awning was attached to the container with three outward opening hinges along the top edge. A gas strut was mounted on each side to assist with opening and to support the weight of the awning when open.

The awning was held closed with two spring-loaded bolts accessed from the inside of the container (Figure 7). There was no locking mechanism provided that was accessible from the outside of the container. The bolts latched into holes in the outside frame, one of which is visible in Figure 8.

Figure 7: A view of one of the spring-loaded bolts used to hold the awning closed

Source: Pacific National

Figure 8: Detail view of one of the holes used for latching the spring-loaded bolts

Source: Pacific National

A Convention for Safe Containers (CSC) compliance plate^[4] was affixed to the container. However, the manufacturer’s number on the compliance plate, QXIC 3255502, did not match the number applied to the container end door, 2200655 (which was visible in Figure 2 above). The section of the compliance plate identifying the owner of the container was blank. The plate does not appear to have been amended, or compliance re-checked after the modifications were made. In addition, the container number, 2200655, did not comply with the applicable Australian Standard for container numbering (AS3711.9), as it did not include owner code or category identification letters and was not displayed on the side of the container. While the reason for these discrepancies were unknown, they did not contribute to the occurrence.

Pacific National Freight Loading Manual

Pacific National (PN) maintained a document suite called the Freight Loading Manual (FLM), which provided instructions on the loading and carriage of rail freight on their rolling stock. PN stated that the FLM:

Has been produced to provide guidance in the basic safety principles which must be followed and in particular the precautions which must be taken to ensure the safe carriage of customers loading.

Sections of the FLM related to the carriage and security of containers, including modified containers, including:

• FLM 01-12_04 Provisional load process
• FLM 03-06_11 Container door security
• FLM 03-14_07 Non-standard and modified containers.

Each section of the FLM listed above contained information and instruction relevant to the loading of the occurrence container. They included, on the first page of each section, identification of the parties that had a responsibility for that section. All the sections above listed, among others, either ‘terminal staff’, ‘terminal operators’ or ‘PN employees’ as responsible parties. Sections 03-06_11 and 03-14_07 also identify customers as responsible parties.

Loading and carriage of non-standard or modified containers

The FLM provided instruction on the loading and carriage of standard, non-standard or modified containers, which were defined in the FLM as:

Standard container:

In the context of this procedure the term standard containers refers to all solid containers fitted with end or side doors, locking rods and catches that are compliant to ISO [International Organization for Standardization] and AS/NZ [Australian/New Zealand] Standards.

Non-standard or modified container:

…any container that was either not manufactured to ISO/AS Standards or has been altered since manufacture.

The FLM further stated that ‘specific approval must be obtained from PN for the consignment of all non-standard or modified containers’. Without this approval, the load was not allowed to be transported. PN advised that this approval was to be obtained through the ‘provisional load process’.

PN reported that non-standard or modified containers made up a relatively small portion of the container traffic moved by rail. To quantify the relative rarity, PN indicated that the provisional load process had been used only three times to transfer modified containers in the 12 month period prior to the occurrence.

Provisional load process

The FLM contained a section specific to the provisional load process (01-12_04) which stated that the purpose of the process was:

…to ensure any freight that is transported which does not conform to a specific freight loading procedure can travel under a provisional approval on a Pacific National service.

The FLM stated that the customer was required to notify PN of the need for a provisional load approval. Further, it detailed the information that must be supplied by a customer when this approval was required, and that 5 working days was needed for PN to assess and process this request to grant approval. Where a provisional load approval had been granted, the process also required the load to be inspected for movement and restraint integrity at all terminals en route and during roll-by inspections.

However, in the case of this container, a provisional load process was not conducted as PN were not aware that the container was modified.

Information from customer

Port Shipping Containers reported that they did not consider the modifications they made to the container to be major or requiring re-certification. Further, prior to the occurrence, they did not know of a requirement to notify PN that the container had been modified prior to transport.

They estimated that the company was transporting approximately 50 modified containers per year by rail, although not all would have included side-opening awnings. They also indicated that an externally visible lock could be, and had been in the past, applied to awnings, but that this had only been done when requested by their end customer.

Container door security

Container security is a broad topic that includes theft prevention, load restraint and prevention of damage. In the context of this occurrence, container security was primarily of concern in terms of ensuring that container doors and other openings were prevented from opening during transit.

Securing doors on standard containers

The FLM contained a section specific to the requirements for securing standard container doors, which identified that:

Container doors when opened may swing out of gauge on a travelling wagon and strike track infrastructure including signals and bridges. They can also pose a serious and unacceptable risk to persons, by striking opposing trains, track workers or members of the public.

The FLM required that ‘all standard container doors travelling on Pacific National Intermodal services must be in good condition, be properly secured, and locked with an approved device/seal’. The FLM provided requirements and examples of how and where to apply approved devices (padlocks) and seals.

PN provided a photograph, taken when the container involved in the occurrence was later inspected at Brisbane Freight Terminal, showing an approved type of seal applied to the latch of the end door of the container (Figure 9).

Figure 9: Security seal on the end door of the container

Source: Pacific National

Applicability to non-standard or modified containers

The FLM section covering container door security identified that all non-standard or modified containers required specific approval (through the provisional load process) as they may ‘incorporate locking mechanisms other than those on standard containers’. The FLM further stated that ‘any item or structure that can protrude from the container and become out of gauge, regardless of placement on a wagon, must be adequately secured with a separate locking system’. It was also a requirement that the locking system be in operable condition, locked with a padlock or seal, and clearly visible to enable examination by PN train examiners.

Freight loading manual availability and familiarisation

PN indicated that the FLM was not a publically available document. Access to up-to-date versions of the FLM sections was provided to PN staff through their intranet, and to external parties, including customers, through an online portal.

PN indicated that staff received familiarisation with the FLM through their normal on-boarding processes and where appropriate, specific training activities. When a FLM part was updated or revised, change management procedures were in place to communicate the update to PN staff via a ‘safety advice’ notice.

At the time of the occurrence, PN did not have any processes in place to familiarise or notify customers or other external parties of the requirements of, and updates to the FLM.

Inspections at Morandoo

Two separate inspections were conducted prior to departure of train 7WB3 from Morandoo, NSW. These were an FX inspection of the nine loaded wagons, conducted prior to their attachment to the train, and a roll-by inspection of the complete train as it departed.

FX inspection

An FX inspection is a broad examination of many safety related items performed by a competent person. Of relevance to this occurrence was that it included a check of the security of all loads and equipment on the train. The inspection also included many other tasks such as checking the mechanical condition of all vehicles in a train, confirming the correct operation of the braking system, identifying any vehicles on the train with non-functioning brakes, and checking the make‑up of the train confirming that it was consistent with safe and efficient operations of the train.

Training

PN required FX inspections be conducted by terminal operators who had undertaken training in the loading and securing of freight. PN advised the ATSB that the terminal operator who undertook the inspection on the day had completed:

• The nationally accredited unit of competency TLIA1001A - Secure Cargo in August 2014
• Verification for competence for full train inspection (VOCFX) in January 2018

PN also provided course material for their training package PNE0001 Basic Freight – Load and secure freight that was specific to PN’s rail freight operations. However, PN did not indicate whether the terminal operator had completed this training.

The training course material did not cover the requirements for modified containers or refer specifically to the relevant FLM sections. While it did identify that checking locking devices and wagon doors was a requirement, it did not elaborate that these requirements extended to ‘any item or structure that can protrude from the container and become out of gauge’ as defined in the FLM for non-standard and modified containers.

Assessment checklist

PN inspectors were assessed on their ability to conduct the FX inspection through periodic verification of competency or VOCFX checks. The assessment checklist for the VOCFX, among other tasks, required inspectors be evaluated on inspecting loads, checking container locking devices, the security of wagon doors, and accessing the FLM through the intranet. However, there was no requirement for inspectors to be checked in identifying non-standard or modified containers and the follow-up actions required.

FX inspections also involved numerous other tasks such as checking of brake system condition and a mechanical check of rollingstock. While these items were not relevant to the occurrence, they did constitute a significant portion of the FX inspection and were required to be conducted on all rollingstock types regardless of what load was being carried. As such, they would be more routine FX inspection tasks than the inspection of locking devices on non-standard or modified containers, which were carried infrequently.

Roll-by inspection

A roll-by inspection is a visual inspection of moving rail traffic to identify equipment, loading security or other defects or failures. Roll-by inspections were routinely performed by terminal staff at departure terminals, disembarking crew at crew changes, and the crew of other trains when they passed each other on track.

Due to the nature of roll-by inspections, being a visual inspection of many moving wagons from a distance, they were generally considered to only be effective as a gross error check. Given that the awning was not open at the time of the departure roll-by inspection at Morandoo, there was no gross error present. Therefore, it was reasonable that no issue with the container was detected during this inspection.

Train crew actions in response to prior openings

It was reported that train crews could sometimes use wire as a temporary solution to resecure open locks and doors en route. However, this was not an option in the case of the awning as there were no suitable locations provided to apply wire onto. Therefore, short of removing the wagon with the effected container from the train, the crew had no options available to them with which to further secure the awning. While it was not known whether removal from the train was considered, given that they had been able to re‑close the awning, it appears reasonable that the crew did not remove the wagon from the train before continuing.

Crossing between trains NT32 and 7WB3

PN reported that train 7WB3 stopped in the passing loop at Telegraph Point to allow NT32 to pass on the mainline. PN also indicated that the container was loaded on the train with the awning on the down^[5] side of the train. As Figure 10 shows, this meant that the driver of train NT32 did not have visibility of the damaged side of the container as his train was passing on the up side of 7WB3.

Figure 10: Train NT32 passing Train 7WB3 at Telegraph Point

Note: Distance references were from the Australian Rail Track Corporation Network information Book Coast A.

Source: ATSB

Similar occurrences

The ATSB has conducted several investigations where the load was partially or completely unrestrained and subsequently moved during transit. None of these involved non-standard or modified containers. Relevant findings are documented below:

• RO-2018-003 Maitland, NSW, 16 January 2018: It was likely that the container was not effectively secured to the twist locks^[6] at one end, which was almost certainly not detected during the train examination. The affected container subsequently shifted out of gauge and collided with the Maitland Railway Station verandah.
• RO-2015-013 near Bowser, Victoria, 24 July 2015: The twist locks designed to secure two containers to a wagon were in an unserviceable condition, which was not identified during pre‑loading inspections. Subsequently, the two containers were not adequately restrained and fell from the moving train in strong winds.
• RO-2014-022 Great Western, Victoria, 9 December 2014: The load restraint and securement method used, in conjunction with a likely wagon hunting condition, allowed part of the load (a skeletal road trailer) to shift laterally and strike a bridge as the train passed.
• 2005/006 Eden Hills, South Australia, 30 September 2005: Inadequate load securement permitted movement of metal plates loaded on a container. Inspections by both the freight forwarder and the rollingstock operator did not detect the inadequate load securement. The metal plates subsequently moved out of gauge and struck a passenger train on an adjacent track.

In addition, the NSW Office of Transport Safety Investigation conducted an investigation into a 2010 incident (Investigation 04480). The findings included that the side gates of a container had come open during transport and swung out of gauge because their locking pins had dislodged from their retaining lugs. Inspections by several road and rail operators did not identify the inadequate restraint. Subsequently, one of the gates struck two platforms at Woy Woy Station, NSW, causing it to become dislodged from the train and strike a glass windbreak on the platform.
__________

4. Convention for Safe Containers (CSC) is an International Maritime Organization convention that provides uniform international safety regulations for the design of containers that are equally applicable to all modes of surface transport. The convention includes regulations for testing, inspection, approval and maintenance of containers. Approval is evidenced by the application of a safety approval plate containing the relevant technical data. The approval plate is commonly referred to as a CSC plate.
5. Up and down (within NSW): When referring to direction of travel, ‘up’ refers to the direction heading toward Sydney and ‘down’ away from Sydney. When used in reference to sides, the up and down sides are the left side in the corresponding direction of travel. For example, the down side is to the left when facing in the down direction.
6. Twist lock: a device used to restrain freight containers to a rail wagon. Twist locks are designed to couple with the standard corner castings found on most containers. They may manually or automatically engage and release from the corner castings depending on type.

Safety analysis

Introduction

While on the journey from Morandoo (Newcastle), New South Wales (NSW) to Brisbane, Queensland, the awning of a modified container being carried by train 7WB3 had come open on two occasions, but was subsequently closed by the crew. When the awning again opened, it struck the steel structure of the Wilson River Bridge, near Telegraph Point, NSW, and separated from the container. Train 7WB3 continued north and passed the south-bound passenger service NT32. Shortly after, NT32 struck the awning, sustaining minor damage.

When train 7WB3 passed, the driver of NT32 had the opportunity to perform a roll-by inspection. By that time, the awning had become separated. However, as the awning opening and damage to the container was on the other side of the train (down side), it would not have been visible to the driver.

While a staff member on NT32 heard something hitting the side of the train when passing 7WB3, the subsequent inspection of both sides of 7WB3 by the crew did not find any evidence to indicate that there was train-to-train contact.

There was no evidence to suggest that the handling of either train, the condition of the rollingstock or track geometry contributed to the occurrence.

This analysis will examine the locking system on the container and why the absence of an externally visible lock was not detected during the pre-departure train inspection. Further, it will discuss Pacific National’s (PN) requirements regarding non-standard/modified containers, how this information was communicated to customers and the training and assessment for loading and security of freight.

Awning locking system

PN’s loading requirements, as documented in the Freight Loading Manual (FLM), required that any side opening be secured with a locking system incorporating a padlock or other approved seal. This requirement existed regardless of whether the container was a standard or modified container. The FLM further stipulated that, for an addition that could protrude outside the normal gauge of a modified container such as an awning, the locking system was required to be externally visible. These requirements served the dual purpose of providing assurance that the openings remained securely closed and to enable examination by staff.

The side-opening awning on the modified container was held closed by spring-loaded bolts positioned on the inside of the awning. There was no mechanism provided for applying a lock directly to the bolts or separately to the inside or outside of the awning. As such, the container did not comply with PN’s requirements for an externally visible locking system. It also meant that there was no option available for the train crew to externally secure the awning during the journey.

Detection of modified container

The modified container was loaded onto one of nine wagons that were to be attached to train 7WB3 at Morandoo, NSW. An FX inspection was undertaken on the wagons by a qualified inspector and was to include checking container locking devices and ensuring that wagon doors were secured. Likewise, the FLM also required the locking system used on all external openings to be examined. As such, the inspector was required to check for a locking system on the container end doors (which were appropriately sealed) and the side-opening awning (which had no locking mechanism present).

However, a train inspection certificate was issued for the nine wagons despite the awning not having the required externally visible locks. Therefore, it was likely that the inspector did not identify that the container was modified and the awning was not secure when he conducted his inspection.

It is likely the chance of identifying the container was modified was influenced by the numerous other more routine FX inspection tasks required, such as checking of brake system condition and a mechanical check of rollingstock. In addition, there was no expectation of a modified container due to the lack of notification from the customer. It is also possible that a lack of internal training on the requirements of checking modified containers had the potential to influence the chance of detecting such containers.

Notification of modified container

The FLM defined non-standard or modified containers as ones that were not manufactured to the required standards or had been altered since manufacture. The presence of the Convention for Safe Containers (CSC) plate on the container indicated that it was initially manufactured as a 20 ft container in accordance with the standards. It was subsequently modified, including the addition of a side-opening awning, and therefore met PN’s definition of a modified container.

While the organisation (customer) who modified the container did not consider the awning to be a substantial modification, they were not aware of the requirement to notify PN of this addition. As a result, the provisional load process was not undertaken by PN, which removed an opportunity for them to assess the modification and ensure that it was adequately secured prior to transport.

Inform external parties of FLM requirements

The FLM detailed the requirements for the preparation and loading freight for transport, which was available to customers through an online portal. However, PN did not have any process in place to inform customers when they had a responsibility under the FLM or to ensure that they complied with the appropriate requirements. Consequently, in this case, the customer was not aware of the need to advise PN that the container had been modified. Further, as the FLM was applicable to all freight travelling on PN trains, the absence of a process potentially had broader implications.

Internal training

The FLM indicated that terminal operators, including inspection staff, were responsible for checking the security of locking systems on non-standard or modified containers. However, the operator’s training course for the loading and security of freight did not reinforce the FLM requirements as it did not include any reference to this obligation.

In addition, when inspection staff were being checked on their ability to conduct the FX inspection (verification of competency), there was no requirement to assess if the inspector was able to identify a non-standard or modified container and what follow-on actions were required.

The terminal operator had access to the requirements through the FLM and it was unknown if he had participated in the training course. Therefore, it could not be determined if the lack of reference to these types of containers in the training and during the periodic assessment contributed to the operator not identifying the modified container during the FX inspection in this instance.

Despite this, the FX inspections form the last line of defence to prevent unsafe non-standard or modified containers from being allowed onto the network where they may result in significant risk to other trains, infrastructure and passenger services. Consequently, this removed an opportunity for the requirements to be reinforced and practiced during training and regular checking of inspection staff. The opportunity for practice was of particular importance given that these containers were relatively uncommon and therefore, the required process was not applied on a regular basis.

Findings

From the evidence available, the following findings are made with respect to the track obstruction due to the loss of freight involving train 7WB3 and subsequent impact of passenger service NT32 with a track obstruction on the Wilson River Bridge, south of Telegraph Point, New South Wales, on 17 June 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The awning on a modified container that was being carried on a freight train separated after opening in transit and striking a bridge, obstructing the track on the bridge. A passenger train struck it, damaging brake equipment on the leading bogie.
• The awning on the modified container was only held closed by spring-loaded bolts accessed from the inside without a mechanism for applying a lock. This was not compliant with the Pacific National Freight Loading Manual, which required a locking system that was externally visible to assure openings remained secure and enable examination by inspection staff.
• Terminal staff did not identify that the awning on the container did not have externally visible locks during inspections prior to departure from the yard. This was likely due to them not identifying that the container was modified.
• The container was modified to include a large side opening awning on one side. The organisation requiring transport of the container were not aware of the requirement to notify Pacific National that it was modified. Consequently, this removed an opportunity for Pacific National to be aware of the need to assess the modifications against the Freight Loading Manual requirements.
• While the Freight Loading Manual was available to customers, Pacific National did not actively advise them when they had a responsibility identified by the manual. Further, they did not have a process for ensuring that customers complied with the manual’s requirements. [Safety issue]

Other factors that increased risk

• Pacific National's training course for the loading and securing of freight, and their verification of competency checks for inspection staff, did not include the Freight Loading Manual requirements for non-standard and modified containers. [Safety issue]

Safety issues and actions

Advise relevant external parties of container loading requirements and check for compliance

Safety issue number: RO-2018-010-SI-01

Safety issue description: While the Freight Loading Manual was available to customers, Pacific National did not actively advise them when they had a responsibility identified by the manual. Further, they did not have a process for ensuring that customers complied with the manual’s requirements.

Education on loading and inspection of modified containers

Safety issue number: RO-2018-010-SI-02

Safety issue description: Pacific National's training course for the loading and securing of freight, and their verification of competency checks for inspection staff, did not include the Freight Loading Manual requirements for non-standard and modified containers.

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence

Pacific National

Transportation of containers

As a result of this incident, Pacific National have made changes to how non-standard and modified containers are transported. Only their major freight terminals that are staffed by Pacific National employees will be accepting these containers for transport.

Load incident management procedure

Pacific National have reviewed and updated their load incident management procedure to ensure all load irregularity events are accurately identified, captured and investigated to ensure learnings are shared. Awareness packages have also been delivered to all Pacific National stakeholders as part of the change management program with the implementation of the revised procedure.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• Pacific National
• New South Wales Trains
• Port Shipping Containers.

References

Standards Australia. (2000). AS 3711.9-2000 Freight containers – Part 9: Coding, identification and marking. Standards Australia International Ltd: Strathfield, New South Wales.

International Maritime Organisation. (1972). International convention for safe containers (CSC). Retrieved from www.imo.org/en/About/Conventions/ListOfConventions/Pages/International-Convention-for-Safe-Containers-(CSC).aspx

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Pacific National, Port Shipping Containers, New South Wales TrainLink, Australian Rail Track Corporation and the Office of the National Rail Safety Regulator.

A submission was received from Pacific National. The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On the evening of 15 August 2018, a Boeing 737-376 Special Freighter, registered VH-XMO, operated by Express Freighters Australia, was transporting freight from Brisbane Airport, Queensland to Melbourne Airport, Victoria when the master caution and a right wing-body overheat annunciator illuminated.

The non-normal checklist was actioned followed by further troubleshooting in consultation with maintenance personnel. This resulted in a reduction of cabin pressure. The crew donned oxygen masks and the aircraft was entered into an emergency descent. During the initial part of the descent the captain was temporarily incapacitated by a reaction to the increased supply of breathing oxygen from the mask. A MAYDAY was declared by the first officer and the aircraft was diverted to Canberra Airport, Australian Capital Territory. During the diversion, the first officer also experienced incapacitating symptoms. The aircraft landed at Canberra Airport, under the control of the captain, with no further issues.

What the ATSB found

The ATSB found that faults in the right wing-body overheat detection system likely led to intermittent flickering of the master caution light and illumination of the right wing-body overheat annunciator. The operating flight crew conducted the appropriate non-normal checklist, however the overheat indication could not be rectified due to the fault in the wing-body overheat detection system.

An additional fault with an isolation valve in the aircraft pressurisation system prevented isolation of the right wing-body pressure duct. This led the crew to conduct further troubleshooting during which the cabin air supply was reduced. In conjunction with a higher than normal cabin leak rate, the reduced airflow also lessened the cabin pressure.

The flight crew responded to the cabin pressure reduction by donning their oxygen masks and descending the aircraft. During the descent, the captain selected emergency flow on the oxygen mask resulting in an ingestion of gaseous oxygen, causing a temporary incapacitation. After the flight was diverted to Canberra, the first officer experienced symptoms consistent with hyperventilation, leading the captain to declare the first officer incapacitated.

Post‑occurrence medical testing and assessments were carried out on the flight crew with no effects from the flight identified. During post flight inspections, Qantas engineers identified a range of serviceability issues with the aircraft fuselage cabin drain valves, fuselage door seal, and the auxiliary power unit duct bellow seal that affected the capacity for the aircraft to hold cabin pressure.

What has been done as a result

The operator advised the ATSB that, following the occurrence, amendments were incorporated into the approved scheduled maintenance program to:

• incorporate a functional check of the cabin drain valves
• specifically verify the integrity of the auxiliary power unit duct bellows seal
• introduce an enhanced aircraft cabin pressurisation system check.

The operator implemented an inspection regime to ensure timely detection and rectification of faults compromising the operation of the wing-body overheat detection system.

The operator also advised that in‑flight troubleshooting outside of the non-normal checklist procedures and Flight Crew Operations Manual is now prohibited.

Safety message

This occurrence is a reminder to flight crew of the hazards of dealing with system malfunctions that are not resolved using the approved non-normal checklist procedures. In such circumstances, associated system effects need to be taken into account when electing to conduct further troubleshooting outside of the non‑normal procedures, even with the assistance of external maintenance specialists. Configuration changes to an aircraft system may induce other effects due to underlying unserviceable components that may not be immediately apparent.

The ATSB also reminds flight crew to be cognisant that a non‑normal situation can lead to a misapplication of emergency equipment in the moment that it is actually needed. In this case the selection of the emergency flow setting on the fixed oxygen system resulted in temporary incapacitation of the captain.

Finally, a sequential series of non‑normal events, in conjunction with the use of emergency equipment, can add pressure and workload to the flight crew. Though it would seem unlikely to occur, these pressures may result in hyperventilation, increasing the potential for incapacitation during a critical phase of the flight.

The occurrence

On 15 August 2018, a Boeing 737-376 Special Freighter (SF), registered VH-XMO, and operated by Express Freighters Australia, was conducting a flight from Brisbane Airport, Queensland to Melbourne Airport, Victoria. The operating flight crew comprised of a captain and first officer. There were no passengers. The aircraft departed Brisbane at 1206 Coordinated Universal Time (UTC)^[1] and climbed to a cruising altitude of Flight Level (FL) 260.^[2]

At 1300 the flight crew observed a momentary illumination of the master caution^[3] light within the flight deck of the aircraft. The master caution then began to flicker with increasing frequency. After about 2 minutes of continuous flickering, the flight crew identified illumination of the right wing-body overheat annunciator, indicating a possible bleed air leak from the ducting of the right wing.

The flight crew consulted the quick reference handbook (QRH)^[4] and conducted the non-normal checklist^[5] procedure for a right wing-body overheat annunciator alert. This procedure removed bleed air pressure from the right wing bleed air duct by closing the isolation valve, switching off the right air conditioning pack, and turning off the bleed air source from the right engine.

Following completion of the non-normal procedure, the right wing-body overheat annunciator remained illuminated and the master caution light continued to flicker. Additionally, the right wing‑body duct pressure gauge in the cockpit displayed a residual pressure of 14 pounds per square inch (psi),^[6] indicating to the crew that the duct remained pressurised despite that system being isolated. The flight crew, concerned with the potential for leakage of high temperature bleed air into the right wing, contacted Sydney Line Maintenance Operations by VHF radio for technical assistance.

In consultation with a Sydney Line Maintenance Operations engineer, the flight crew began a process of troubleshooting with the intention of isolating the bleed air duct and extinguishing the right wing‑body overheat annunciator light. The flight crew advised of the already completed steps and discussed the non-normal checklist with the engineer. The engineer advised the flight crew to cycle components of the system and monitor the right bleed air duct pressure.

After noting that the residual pressure was lowest when the right pack was switched to AUTO the engineer assessed that the right wing-body overheat annunciator light was likely an erroneous warning. However, the engineer recommended that the right pack remain in AUTO for the remainder of the flight. Following receipt of that advice, contact with the engineer ceased due to the aircraft proceeding out of VHF radio range.

While continuing the flight toward Melbourne, the first officer conducted an instrument scan and identified the cabin pressure differential at 5 psi.^[7] The cabin altitude^[8] registered 6,000 ft and was increasing at 600 feet per minute. The flight crew discussed the rising cabin altitude, also commenting to each other that they both felt slightly unwell. The first officer recalled that the physical symptoms were not consistent with hypoxia^[9] and became concerned about the possibility of incapacitation due to fumes within the cockpit. As the cabin altitude continued to climb and anticipating that it would exceed 10,000 ft,^[10] the flight crew elected to don the emergency oxygen masks.

At 1325, the captain contacted air traffic control requesting a descent to FL 200. Air traffic control subsequently cleared the aircraft for a descent to FL 250. The captain immediately responded with a PAN PAN^[11] call and advised air traffic control that they were descending the aircraft to FL 200.

At the commencement of the descent, the first officer switched the right air conditioning pack from AUTO back to OFF as per the original non-normal checklist instruction. This commanded the left pack into high flow mode, increasing and restoring air flow into the cabin.

During the initial stages of the descent the captain reported that after manipulating the mask settings an ingestion of pressurised oxygen occurred. This resulted in a choking and gagging response from the captain. The first officer, cognisant that they had previously discussed feeling unwell, observed the captain slumped forward, gagging, and gasping for air. The first officer recalled checking on the captain during this episode but not receiving a response.

At 1326, approximately 19 km north of Narrandera Airport, New South Wales, the first officer broadcast a MAYDAY^[12] to air traffic control advising that they had issues with the aircraft and had commenced an emergency descent.^[13] Air traffic control acknowledged the MAYDAY and advised the first officer that there was no other reported Instrument Flight Rules^[14] aircraft traffic for their descent to 10,000 ft.

During the emergency descent, the captain recovered and subsequently removed their oxygen mask. Both the captain and first officer noted that oxygen could be heard continuously flowing from the captain’s mask. Due to their ongoing concern of fumes within the cabin, the first officer elected to remain on oxygen.

Air traffic control contacted the flight crew regarding their intentions to either continue to Melbourne or divert to an alternate airport. The first officer responded with a request for information on the lowest safe altitude for the area, and a heading for an immediate landing at Canberra Airport, Australian Capital Territory. After receiving direction from air traffic control, the captain elected to further descend the aircraft to 8,000 ft and tracked the aircraft toward Canberra.

During the diversion, the oxygen supply from the fixed onboard system depleted. In response, the first officer, who had elected to remain on breathing oxygen, retrieved and connected to the portable oxygen unit that was mounted on the bulkhead at the rear of the flight deck. While transferring to the portable oxygen system, the first officer also attempted to operate an iPad in preparation for the instrument approach to Canberra Airport. The captain recalled being unable to gain the first officer’s attention during that sequence. The first officer eventually responded to the captain, advising they were feeling unwell and had severe back pain.

The captain then instructed the first officer to transition to an observer-pilot role for the remainder of the flight. The captain subsequently declared a PAN PAN radio call to air traffic control informing of the first officer’s incapacitation and requested the attendance of emergency services on arrival at Canberra Airport.

At 1404, the flight landed at Canberra Airport and once the aircraft had been shut down, aviation rescue fire fighters entered the aircraft cabin and conducted an air sample test. No fumes were detected. Both the captain and first officer were transported to hospital via ambulance for medical assessment.

__________

1. Coordinated Universal Time (UTC): Eastern Standard Time (EST) - 10 hours.
2. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 260 equates to about 26,000 ft.
3. Master caution: a light used to provide indication to the crew that a malfunction is present within an electrical or electronic system component, it is associated with a relevant system annunciator light. The light remains illuminated as long as the caution condition exists, or until the crew resets the system.
4. Quick Reference Handbook (QRH): an approved document for the flight crew that contains procedures for non-normal and emergency conditions for use in flight.
5. Non-normal checklist: A specific procedure to be carried out in response to a system annunciator light.
6. In Normal flow mode the ducts are pressurised to about 30 psi and in High flow mode up to 60 psi.
7. Cabin differential pressure: the difference in pressure between inside the aircraft cabin and the local external atmosphere. Nominal B737 cabin differential is 7.45 psi at FL 260.
8. Cabin altitude: pressurisation of the cabin is displayed as cabin altitude and is the equivalent to outside pressure at that altitude. e.g. A cabin altitude of 6,000 ft corresponds to an atmospheric pressure of 6,000 ft.
9. Hypoxia: a deprivation of oxygen to the body at tissue level.
10. If the cabin altitude exceeds 10,000 ft, an altitude warning horn is activated and the flight crew must don their emergency oxygen masks.
11. PAN PAN: an internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.
12. MAYDAY: an internationally recognised radio call announcing a distress condition where an aircraft or its occupants are being threatened by serious and/or imminent danger and the flight crew require immediate assistance
13. Emergency descent: a manoeuvre for descending as rapidly as possible.
14. Instrument Flight Rules (IFR): a set of regulations that permit the pilot to operate an aircraft in instrument meteorological conditions (IMC), which have much lower weather minimums than visual flight rules (VFR). Procedures and training are significantly more complex as a pilot must demonstrate competency in IMC conditions while controlling the aircraft solely by reference to instruments. IFR-capable aircraft have greater equipment and maintenance requirements.

Context

Flight data recorder

Following the occurrence, the ATSB retrieved the aircraft’s flight data recorder (FDR). A range of parameters were automatically recorded by the FDR including those associated with the cabin warning and aircraft pressurisation systems. ATSB’s download of the FDR showed that the total duration of the occurrence flight had been recorded. A plot of the relevant parameters relating to the environmental system is displayed at Figure 1. The following primary events were identified:

At 1259 UTC the master caution proceeded to rapidly flicker on and off for a period of 10 minutes, which correlated with the flight crew’s account.

At 1301 UTC the right air conditioning pack (ECS)^[15] turned OFF, the left and right packs both signalled a switch to high flow, and the right engine bleed air turned OFF. These events were consistent with the crew actioning the non-normal checklist.

The FDR data showed that, at 1315 UTC, the right air conditioning (ECS) pack was switched ON and OFF multiple times in a short period. The left pack had switched between high- and low-flow modes. The right pack had also switched between high- and low-flow modes. These events correlated with the troubleshooting period conducted by the flight crew and the engineer at Sydney.

The FDR data recorded that, at 1325 UTC, the right air conditioning pack was turned OFF and the signals for the left and right packs had switched to high flow. The aircraft altitude then reduced rapidly signalling the commencement of the emergency descent.

Throughout the flight and reported period of cabin pressurisation problems, the FDR information showed that the cabin altitude did not exceed 10,000 ft.

Cockpit voice recorder

Following arrival to Canberra Airport, the aircraft was powered by engineers to facilitate maintenance action on the bleed air system and the wing-body overheat detection system. The cockpit voice recorder was not isolated during these activities and consequently the audio data was overwritten and not available for this investigation.

Figure 1: Recorded data from the occurrence flight.

Displayed is the master caution warning status, air conditioning system status and crew troubleshooting actions during the conduct of the flight through to the emergency descent and landing.

Source: ATSB

Pilot information

Captain

The captain held an Air Transport Pilot (Aeroplane) Licence issued on the 13 September 2012 and a multi-engine command instrument rating. The captain held an Australian Class 1 Aviation Medical Certificate that was valid until 12 November 2018.

The captain had been a company employee for about 8 years, initially as a first officer and then as a captain for the last 3 years. The captain was also a simulator instructor and a 737 ground training instructor with the company. At the time of the occurrence the captain had approximately 4,500 flying hours with 3,400 of those on the 737-aircraft type.

The captain last completed a flight review with the company on 18 February 2018.

First officer

The first officer held an Air Transport (Aeroplane) Pilot Licence issued on the 27 Jun 2014 and a multi-engine command instrument rating. The first officer held an Australian Class 1 Aviation Medical Certificate that was valid until 29 May 2019.

The first officer had been a company pilot since 26 September 2016. At the time of the occurrence, the first officer had approximately 5,000 hours total flying time with 700 of those operating the 737 aircraft-type.

Aircraft information

General

The Boeing 737-376 Special Freighter (SF) was originally manufactured as a passenger aircraft in the United States in 1987, before being converted for air freight operations. At the time of the occurrence the aircraft had accrued a total of 72,255 hours and 44,030 flight cycles. Express Freighters Australia operated four of this aircraft type within their national fleet service under the Express Freighters Australia air operator’s certificate.

Aircraft systems

Air conditioning and pressurisation system

The aircraft air conditioning and pressurisation system is designed to keep the flight crew comfortable within the cabin by maintaining adequate air flow, temperature, and pressure. Air temperature is controlled by processing bleed air from the engines in two air conditioning packs.^[16] Conditioned air from the left pack flows directly to the flight deck. Excess air from the left pack and air from the right pack is combined in a mix manifold and distributed to the cargo cabin (Figure 2).

During normal operation, the left pack uses bleed air from the left engine and the right pack uses bleed air from the right engine. An isolation valve allows the left and right bleed systems to connect. Engine bleed air is obtained from stage five and nine of the compressor section. When stage-five low pressure bleed air is insufficient for the bleed air system requirement, the stage-nine valve modulates to maintain adequate bleed air pressure.

Figure 2: Air conditioning schematic for the Boeing 737-300 series aircraft showing the configuration of the system during normal operation

The left air conditioning pack is supplied by stage-five bleed air from the left engine and the right air conditioning pack is supplied by stage-five bleed air from the right engine. The left and right engine stage-nine valves modulate open if stage-five bleed air is insufficient for system requirements.

Source: Express Freighters Australia, annotated by the ATSB.

With both air conditioning pack switches in AUTO and both packs operating, the packs provide ‘normal’ air flow. However, with one pack not operating (OFF position), the other pack automatically switches to ‘high’ air flow to maintain the necessary ventilation rate. To ensure adequate engine power for single-engine operation the automatic switching is inhibited when the aeroplane is on the ground, or in-flight with the flaps extended. With the air conditioning pack switch in HIGH, the pack provides ‘high’ air flow.

A single pack when selected to HIGH flow mode is capable of maintaining cabin pressurisation and acceptable temperatures throughout the aeroplane up to the maximum certified ceiling of 37,000 feet.

A cabin pressurisation controller modulates the cabin pressure via an outflow valve. The cabin pressurisation controller normally controls the cabin altitude rate of climb as well as the cabin altitude. The system has both an aural and visual warning for cabin altitudes above 10,000 ft, a level requiring flight crew to use supplementary oxygen.

Oxygen system

The B737-300SF is fitted with a fixed oxygen system designed to provide oxygen to the flight crew in the event of high cabin altitude (such as an aircraft depressurisation) or compromised air within the cockpit due to fumes and/or smoke. The B737-300SF is equipped with a 76 cubic foot oxygen cylinder (approximately 2,152 litres) for flight crew supply. Oxygen pressure is displayed on the indicator located on the rear overhead panel and the flow level is controlled through a pressure-reducing regulator, to reduce supply to a breathable pressure.

Each crew position is fitted with an oxygen mask that is stowed in a box immediately adjacent to each crew seat. The mask has selectable features that permit the crew to select either 100 per cent oxygen when contamination of the flight deck air exists or a NORMAL position which provides an air/oxygen mixture (Figure 3). The mask regulator also provides an EMERGENCY setting which is used when needed to supply positive pressure in the masks and goggles to remove contaminants.

The aircraft is also fitted with a flight crew portable oxygen bottle. This is a self-contained oxygen system, offering both demand and constant flow capabilities. The portable oxygen cylinder is installed behind, and adjacent to, the first officer’s seat.

Figure 3: Oxygen mask and regulator fitted to the Boeing 737-300 series aircraft

A push button switch activates the pilot oxygen system for normal use. A rotary dial is used to enable the emergency flow mode.

Source: Express Freighters Australia, annotated by the ATSB.

Post-flight aircraft maintenance

Following the occurrence the aircraft was examined and tested by Qantas engineers at Canberra Airport with the following defects identified:

Aircraft pressurisation

An engine ground run was conducted to simulate the conditions encountered during the flight. That test identified that the aircraft was unable to maintain cabin pressure. Minor leakage of bleed air was discovered on the right-wing leading-edge ducting. The leak was rectified on tightening of the duct clamp.

It was also identified that the isolation valve between the left and right systems was not completely closing, resulting in leakage and the right bleed air duct to remain partially pressurised (Figure 2).

Finally, during single-pack operation in NORMAL flow, the aircraft was unable to maintain differential cabin pressure. The Qantas engineers identified that this was due to:

• leakage of multiple cabin drain valves
• minor door seal leaks
• damage to the auxiliary power unit bleed air duct bellows and clamp.

Those defects created a cabin air escape route through the pressure bulkhead.

Overheat detector

A resistance check of the right wing-body overheat detector elements was completed in Canberra. The engineers identified that the centre wing-body overheat detector element was found out of tolerance and unserviceable. The overheat detector element along with an associated electrical connector was subsequently replaced. No additional faults were found with that system.

Oxygen system and fumes detection

Air sampling from the flight deck was conducted during extended engine operations. No evidence of fumes or odour was detected. The air quality testing showed no abnormal issues associated with carbon dioxide, carbon monoxide or particulate concentrations. The oxygen masks for the captain and first officer were inspected and tested. During replenishment of the aircraft oxygen system, the engineers reported that the captain’s mask had been set to emergency flow. No defects were identified with the oxygen masks.

Operational information

Flight crew operations manual

The Flight Crew Operations Manual (FCOM) was the primary flight crew reference for the operation of the aircraft along with the relevant checklists for normal, non-normal, and emergency conditions.

Non-normal checklists

Non-normal checklists were used by the flight crew to manage unexpected events that affect the normal operating procedures of the aircraft. Illumination of the master caution and system annunciator lights indicate a non-normal condition and are the cues to select and carry out the associated checklist.

Non-normal checklists begin with steps to correct the situation and, if needed, information for planning the rest of the flight. In all instances, the operator’s procedures require the captain to assess the situation to determine the safest course of action. The operator also noted that if further troubleshooting is determined to be the safest course of action, taking steps beyond published non-normal checklist steps may cause further loss of system function or a system failure. Consequently, the operator’s guidance to their pilot’s was that troubleshooting should only be considered when completion of the published non-normal checklist results in an unacceptable situation.

Non-normal checklists also have a list of assumptions. Assumptions relevant to this occurrence were listed within the FCOM:

- If the master caution and system annunciator lights illuminate, all related amber lights are reviewed to assist in recognising the cause(s) of the alert. Aural alerts are silenced, and the master caution system is reset by the flight crew as soon as the cause of the alert is recognised.

- The EMERGENCY position of the oxygen regulator is used when needed to supply positive pressure in the masks and goggles to remove contaminants. The 100% position of the oxygen regulator is used when positive pressure is not needed but contamination of the flight deck air exists. The Normal position of the oxygen regulator is used if prolonged use is needed, and the situation allows. Normal boom microphone operation is restored when oxygen is no longer in use.

Flight administration manual

The Express Freighters Australia Flight Administration Manual (FAM) was for the use of crew members and guidance for other personnel in dealing with matters associated with the operation of company aircraft. The FAM defined the policies, standards and procedures to be adhered to under all circumstances.

System failures and in-flight troubleshooting

The FAM stated that a component or system failure in flight should be dealt with according to established procedures, including completion of any associated checklist. Crew troubleshooting of system problems should not normally be attempted in flight unless there is an overriding operational requirement to do so, or where it may assist subsequent rectification. Before attempting any troubleshooting, flight crew were to attempt to contact Maintenance Watch for further guidance.

Medical information

Post occurrence, both flight crew were transported to hospital. Assessments and blood tests were carried out with no markers or indicators of a fumes event detected. The first officer recalled still feeling ‘dizzy’ and ‘foggy’ with a dry throat and lips during this time. The flight crew were subsequently released from hospital with no ongoing effects from the occurrence.

The flight crew were individually interviewed and medically assessed by their company doctor. It was reported to the ATSB that the first officer’s symptoms of tingling in the fingers and lips, along with the muscle tension were consistent with hyperventilation, although the symptoms can be confused with hypoxia or fume inhalation. An additional assessment of the symptoms was provided to the ATSB by an aviation medicine specialist, who similarly concluded that the first officer had developed hyperventilation as a response to the severity of the emergency.

Hyperventilation

Hyperventilation can be induced from rapid or deep breathing resulting from anxiety or panic. It occurs when the rate or tidal volume of breathing eliminates more carbon dioxide than the body can produce. The symptoms can be lingering and include dizziness, tingling in the lips, hands or feet, headache, weakness, fainting and seizures.

Nias (1998) explains that over-breathing can occur as part of the classic ‘fight-or-flight’ response as the body involuntarily prepares for action. Gradwell (2006) explains that even moderate hyperventilation has the potential to significantly impair motor skills, which, for a pilot, may lead to a reduced capacity to perform the necessary complex actions associated with the operation of an aircraft. Hyperventilation for aircrew can occur under certain conditions:

• exposure to low-frequency vibration
• during positive-pressure breathing
• the mental stress of a sudden in-flight emergency
• anxiety, apprehension, and fear.

Related occurrences

The ATSB research publication AR-2015-096 reviewed occurrences reported to the ATSB from 2010 to 2014. The publication identified 113 cases of pilot incapacitation with 86 of those in multi‑crew, high-capacity transport operations. Almost half of the incapacitation events for those pilots was due to gastrointestinal illnesses, such as food poisoning or gastroenteritis. There were no reported instances involving incapacitation due to hyperventilation.

The review indicated that most incapacitation occurrences do not involve a chronic or pre-existing medical condition and are largely unforeseeable events. Many are not in themselves life threatening but are capable of impairing pilot performance to the extent that safe operation of the aircraft may be adversely affected.

In most of the occurrences, the incapacitation was severe enough for the pilot to be removed from duty for the remainder of the flight. The ATSB found that approximately 10 per cent of the incapacitating events resulted in a return to the departure airport or a diversion to another airport.

ATSB investigation report AO-2013-120 describes the response to smoke in the cockpit by the flight crew of a Bombardier DHC‑8‑315. The crew found that communication became difficult once their oxygen masks had been donned. As a result, the crew removed their oxygen masks for the remainder of the flight to improve communication. However, that action increased the risk of crew impairment or incapacitation as there was still smoke in the cockpit.

The stress associated with the smoke resulted in a high workload for the crew and adversely affected their performance, leading to errors in aircraft management and checklist completion. This occurrence also highlighted the importance of flight crew familiarising themselves with the operation of the onboard emergency equipment.

__________

15. Environmental conditioning system pack also known as an ‘air conditioning pack’
16. The air conditioning system is often called the air conditioning package or ‘pack’.

Safety analysis

Introduction

The following analysis details the technical and operational issues encountered by the crew of a freight flight that led to pilot incapacitation during an emergency descent and diversion to Canberra Airport.

Aircraft depressurisation

While cruising at Flight Level 260, the flight crew observed the illumination and rapid flickering of the master caution light. Approximately 2 minutes later, the first officer identified the annunciator light for the right wing-body overheat was also illuminated. The concern from such an alert for the flight crew was the potential leakage of hot bleed air gases within the wing cavity damaging wiring and the internal structure of the wing. While various recommended actions were attempted to extinguish the warnings, the flight crew efforts were unsuccessful, and the flickering continued for approximately 10 minutes.

Though the flickering master caution and overheat annunciator light eventually extinguished, it is likely that these alerts were due to an electrical fault with the aircraft detection system rather than the result of elevated temperature within the wing body. After landing, maintenance engineers established that the centre conductor from a sensor within the overheat detection system was out of specification, leading to the observed erroneous system behaviour.

Actioning the non-normal checklist associated with the right wing-body overheat annunciator alert required isolating the bleed air systems from the right engine. Those actions were intended to remove high temperature bleed air, from the right wing-body duct and shut down that part of the air conditioning system.

However, following completion of the checklist the flight crew observed that the right duct remained partially pressurised, indicating that it was not isolated. Technical examination following the occurrence identified that a faulty isolation valve prevented complete closure of the duct.

The residual pressure after completion of the non-normal checklist operations led to the flight crew conducting further troubleshooting activities outside of that checklist in consultation with the Sydney Line Maintenance engineer. This resulted in the right air conditioning pack switch being selected to AUTO from OFF, which then transitioned the left (operating) pack from high flow to low flow, leading to a significant reduction of air available to pressurise the aircraft (Figure 4).

As the right air conditioning system remained partially pressurised, the captain’s decision to conduct further troubleshooting outside the non-normal checklist instructions was appropriate and completed in conjunction with assistance from Sydney Line Maintenance. Despite the attempts to extinguish the overheat alert by isolating the right bleed ducting, the effects of those actions unknowingly contributed toward a gradual depressurisation of the aircraft.

Figure 4: Air conditioning schematic for the Boeing 737-300 series aircraft showing the final configuration of the system post troubleshooting by the flight crew prior to the descent.

The right air conditioning system had been selected by the flight crew to AUTO mode which commanded the left air conditioning package from high flow to low flow. This reduced the conditioned air (highlighted blue) that was directed into the flight deck. The right engine bleed valve had been selected closed by the flight crew as part of their troubleshooting actions. The isolation valve had also been selected closed by the flight crew. A fault with the isolation valve allowed the right duct to become partially pressurised (highlighted yellow).

Source: Express Freighters Australia, modified by the ATSB.

Following the occurrence, the aircraft was found to have significant air leaks from the auxiliary power unit duct bellows, cabin drain valves that were found stuck open and minor leaks from the aircraft door seals. In combination, these leaks were significant however, when the aircraft was operating with both the left and right air conditioning packs operating, cabin pressure was still able to be maintained.

Single pack operation was configured as a result of the completion of the non-normal checklist. The additional troubleshooting actions by the flight crew reduced the air supply into the aircraft cabin. This, in combination with the excessive leakage pathways, resulted in a gradual depressurisation of the aircraft. That, in turn, resulted in the flight crew electing to don oxygen and conduct an emergency descent.

Pilot incapacitation

While wearing an oxygen mask during the descent, the captain selected the emergency purge setting on the oxygen mask resulting in the inhalation of pressurised 100 per cent oxygen. The flight crew operations manual stated that the emergency position of the oxygen regulator was to be used to supply positive pressure within the mask to remove contaminants such as fumes or particles from within the mask. Selection of the emergency position on this occasion produced a gagging reflex and led to the captain becoming temporarily incapacitated.

In response, the first officer declared a MAYDAY and continued the descent to 10,000 ft. While there was no enduring effect from the captain’s temporary incapacitation, had the system remained in normal operation mode administering an on-demand supply setting of regulated oxygen, it is unlikely to have occurred.

After landing at Canberra Airport, the flight crew were transported to hospital for medical assessment. Blood tests showed no markers or indicators that the crew were exposed to disabling or hazardous fumes generated from within the aircraft. This was supported by emergency services not detecting any hazardous gases during their post-landing check of the aircraft flight deck. Additionally, no medical problems were identified.

Despite that, the first officer recalled feeling ‘dizzy’ and ‘foggy’ with a dry throat and lips. They also reported feeling unwell and having severe pain during the descent. On balance, the ATSB concluded that the accumulation of stressors associated with the:

• troubleshooting activities
• use of the oxygen masks
• temporary incapacitation of the captain
• concern for hazardous fumes
• emergency decent and subsequent diversion

probably led the first officer to a heightened state of anxiety, hyperventilation, and the development of further incapacitating symptoms.

ATSB research into pilot incapacitation occurrences showed that the majority of cases were due to gastrointestinal illnesses, such as food poisoning or gastroenteritis. There were no reported instances involving incapacitation due to hyperventilation. The report noted that once declared incapacitated, the pilot was often removed from active flying duty and the flight was sometimes diverted, such as occurred in this instance.

Findings

From the evidence available, the following findings are made with respect to the depressurisation and crew incapacitation that occurred near Narrandera New South Wales, on 15 August 2018 involving a Boeing 737-376SF, VH-XMO.

Contributing factors

• Faults with the right wing-body overheat detection system likely led to intermittent illumination of the master caution and wing-body overheat annunciator.
• The crew were unable to isolate the right wing-body duct due to a faulty isolation valve.
• In consultation with Sydney Line Maintenance Operations, the flight crew conducted troubleshooting activities that resulted in the right air conditioning pack being selected to AUTO. This resulted in a reduction of cabin airflow.
• Due to the reduction in cabin airflow, along with a higher-than-normal cabin leak rate, the aircraft was unable to maintain required cabin altitude. This resulted in the flight crew electing to conduct an emergency descent.
• During the descent, the captain selected the emergency setting on the oxygen mask resulting in an inhalation of pressurised oxygen. This caused a gagging reflex leading to a temporary incapacitation.
• Throughout the diversion and landing the first officer experienced incapacitating symptoms consistent with hyperventilation from a heightened state of anxiety, leading the captain to declare the first officer incapacitated.

Other findings

• Post‑occurrence medical testing and assessments were carried out on the flight crew with no lasting effects from the flight identified.

Safety action

Safety action by Express Freighters Australia

Following this occurrence Express Freighters Australia advised that the three other B737-300SF aircraft within the Express Freighters fleet were inspected, and that:

• the auxiliary duct bellow seal from one other aircraft was similarly damaged
• non-functioning fuselage drain valves were also identified in those other aircraft.

The ATSB was also advised that safety action implemented by Express Freighters as a result of those aircraft inspections included:

• the implementation of an enhanced inspection regime to ensure timely detection and rectification of faults compromising the operation of the wing-body overheat detection system
• an amended maintenance program to incorporate an enhanced pressurisation system check and scheduled functional checks of the fuselage drain valves
• a specific task during scheduled maintenance of the aircraft to verify the integrity of the auxiliary power unit duct bellows seal.

Express Freighters Australia have also amended their policy for system failures and in‑flight troubleshooting, advising the ATSB that the following amendment has been incorporated into their Flight Administration Manual:

• A component or system failure inflight should be dealt with according to established procedures, including completion of any associated checklist. Systems troubleshooting by crew is prohibited, except in accordance with the FCOM/QRH. Actions contrary to the FCOM/QRH cannot be authorised by Maintenance Watch.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Flight crew of VH-XMO
• Express Freighters Australia
• Qantas medical services

References

David J. Rainford & David P. Gradwell 2006, Ernsting’s Aviation Medicine, Hodder Arnold, fourth edition, London UK

David K B Nias 1998, ‘Addressing the causes of hyperventilation’ Practitioner, London

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Flight crew
• Express Freighters Australia
• Civil Aviation Safety Authority.

Submissions were received from:

• Flight crew (Captain)
• Express Freighters Australia

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

The Australian Transport Safety Bureau was an accredited representative to assist the South African Civil Aviation Authority (SACAA) for their investigation of a General Dynamics Convair 340, registered ZS-BRV, which collided with a building near Wonderboom Airport, South Africa, on 10 July 2018.

During the initial climb, smoke was observed emanating from the left engine. The aircraft subsequently collided with a building. One person on board the aircraft was fatally injured and 18 people were injured. One person on the ground was fatally injured and two people sustained serious injuries.

The SACAA’s Accident and Incident Investigations Division has completed the investigation and the final report is now available. Any enquires relating to the investigation should be directed to the SACAA at: www.caa.co.za