A coal train MR336 departed for Newcastle after being loaded with coal from Moolarben loading terminal. On route the 25th wagon in the train consist derailed at Antiene and then subsequently collided with another coal train WC915 as it passed in the opposing direction at Ravenan. The collision resulted in the locomotives on WC915 being damaged and derailed and several wagons from both trains were also damaged and derailed.
What the ATSB found
A loading sensor malfunctioned during the loading sequence which stopped coal from being loaded into the 25th wagon. The train loading operator (TLO) was pre-occupied when control alarms sounded and missed viewing the wagon pass under the loading bin. The TLO could not confirm if the wagon was loaded or not in the low light conditions, so instigated a verification check. The TLO unknowingly provided misleading information to check the 28th wagon, rather than the 28th vehicle in the sequence. The empty 25th wagon was not detected by the loading terminal before MR336 departed onto the rail network.
An empty wagon positioned between two loaded wagons was allowed onto the rail network and this known risk materialised in a derailment of the empty wagon. The derailed state of the wagon on MR336 caused the collision with WC915.
The controls for managing loading irregularities, were operational in the Moolarben loading system however, it is likely, the reliability of the alarms to indicate a loading irregularity in the loading system contributed to the TLO questioning their accuracy.
What has been done as a result
Moolarben loading terminal corrected the malfunctioning sensor and implemented more detailed verification processes of the train load out summary. They reviewed their risk assessment for train loading and implemented a number of actions resulting from this review process. The details of these actions is presented in this report.
Safety message
Empty or light loaded wagons positioned between loaded wagons running on the rail network is a known risk that can have severe consequences. Coal loading terminals and rolling stock operators should review their processes to prevent this known risk from materialising.
The occurrence
Train loading
At 0356 on 26 September 2018, coal train MR336 arrived at Moolarben coal loading terminal to load coal and return to Newcastle, New South Wales.
Shortly after, the train driver of MR336 moved the train up to the loading bin in readiness to commence loading. At 0417, loading coal into the wagons of MR336 commenced.
At 0445, the TLO was alerted to a ‘wagon empty detected’ alarm from the loading system.
When this alarm sounded, the TLO was pre-occupied and could not confirm if the wagon was loaded by viewing it as it passed under the loading bin. The TLO then waited for the weighbridge readings for wagons 28 and 29. The TLO received a ‘wagon empty alert’ from the weighbridge but was unable to visually verify if these wagons were empty as the wagons had moved beyond the lit loading area.
Shortly after, the TLO called the Coal Handling Preparation Plant (CHPP) Supervisor to check wagon 28. The CHPP Supervisor confirmed he would check the wagon. The TLO then continued to load the train with the train driver communicating through a combination of telemetry[1] and radio calls.
The CHPP Supervisor and a technician drove up to the front of the loading train then proceeded to count back from the 1st wagon. When they reached the 28th wagon, they checked wagons 27, 28 and 29 and confirmed that all three wagons were loaded.
The TLO continued to load the train, with another three loading interruptions occurring before it was completed at 0645.
Shortly after, the TLO contacted the train driver by radio to advise loading was complete. MR336 then departed the loading terminal on its path to Newcastle where it would unload.
Derailment
MR336 travelled approximately 160 km after departing Moolarben loading terminal before the train derailed on the up main line[2] at Antiene. The leading wheelset of the trailing bogie of the 25th wagon mounted the rail at kilometre mark 274.396 km.[3] The wheelset dropped off the rail in a derailed state at kilometre mark 274.394 km.
Shortly after derailing, a wheelset ejected from its bogie and came to rest at 271.684 kms. The train continued to travel in a derailed state for approximately nine kilometres.
Figure 1: Location of ejected wheelset
Source: ARTC
Collision
As MR336 reached Ravenan, another coal train, WC915 travelling in the opposite direction approached on the down main line.
The second person in WC915 was alerted to something dragging along-side MR336. As WC915 got closer, the second person shouted to the train driver of WC915 to apply full emergency brakes. The train driver applied the emergency brakes as the second person got on the radio to tell the train driver of MR336 to stop immediately.
The trailing bogie on the 25th wagon on MR336 was dragging across the down track fouling the down main line. The lead locomotive of WC915 collided with the dragging bogie that had been partly dislodged from the wagon earlier. The collision between the lead locomotive of WC915 and the dragging bogie caused the wagon it was attached to (25th) and the seven following wagons on MR336 to derail and incur damage to varying degrees.
The 25th, 26th and 27th wagons tipped on their side away from the down main line. The 25th wagon was found without coal.
The locomotives and two wagons on WC915 were derailed and damaged as a result of the collision.
Track infrastructure underneath the derailed rollingstock was damaged and approximately nine kilometres of track and infrastructure between Antiene and Ravenan was damaged to varying degree by the dragging bogie on MR336.
There were no injuries to the train drivers from either train.
Figure 2: Curve and gradient diagram indicating point of derailment and point of collision
Source: ARTC annotated by OTSI
Incident response
The train crew on WC915 contacted Network Control and their organisation’s operations control to inform them of the incident. They checked their locomotives for any fluid loss and confirmed with their operations control that the locomotives were intact.
The rail infrastructure manager sent crews to isolate the site and make it safe. Information was communicated to relevant organisations as required and post incident investigations commenced that afternoon.
Spanning over 450 km the Hunter Valley Coal Chain is made up of coal producers (or mines), rail haulage providers, the Australian Rail Track Corporation (ARTC), three export terminals, port managers and the Hunter Valley Coal Chain Coordinator. Collectively the Hunter Valley Coal Chain facilitates more than 20,000 train trips and the loading of 1,600 vessels annually in order to export more than 80 different types of thermal and coking coal to destinations around the world.
The trains involved in this incident were coal trains.
Australian Rail Track Corporation
The ARTC is the rail infrastructure manager for mainline rail in the Hunter Valley. ARTC was accredited by the Office of the National Rail Safety Regulator (ONRSR) to manage the Hunter Valley rail network.
As the accredited organisation, ARTC is responsible for maintaining the condition of the rail infrastructure to relevant standards and for providing network control for the movements of rollingstock over the network.
The rail track where the derailment and subsequent collision occurred was under the management of the ARTC. The system of safeworking was rail vehicle detection using axle counters to detect the presence of rail traffic in a block section.
Moolarben Coal Complex
The Moolarben Coal Complex is located approximately 40 kilometres north of Mudgee in the Western Coalfields of New South Wales.
Moolarben Coal Operations Pty Ltd (MCO) is the operator of the Moolarben Coal Complex on behalf of the Moolarben Joint Venture (Moolarben Coal Mines Pty Ltd, Yancoal Moolarben Pty Ltd and a consortium of Korean power companies). MCO, Moolarben Coal Mines Pty Ltd and Yancoal Moolarben are wholly owned subsidiaries of Yancoal Australia Limited.
Operating 24 hours a day, the Moolarben Coal Complex comprises four approved open cut mining areas, three approved underground mining areas and other mining related infrastructure (including coal processing and transport facilities).
Moolarben loading terminal
The Moolarben loading terminal is a loading facility built for loading coal trains and forms a significant part of the transport facilities of the Moolarben Coal Complex.
Coal loading process
Train information sent to TLO
Prior to the arrival of the coal train at the loading terminal, the rolling stock operator was responsible for sending Moolarben information relating to train loading. The information which was sent includes but is not limited to wagon and locomotive; type, number, position in consist and loading restrictions (i.e. if some wagons are to remain empty or partially filled).
Information uploading
As the train approaches the loading terminal, the TLO uploads the information provided in preparation to load the train. The data is uploaded into the train load point supervisory control and data acquisition system (SCADA). This system monitors the progress of a train and through the use of algorithms loads the train at a speed and rate so as to optimise the volume of coal loaded on each train against certain customer requirements.
Train movement into loading terminal
Once the information is uploaded by the TLO, the TLO provides the train driver a verbal authority to proceed through the loading terminal via 2-way radio. The TLO also advises the train driver to maintain a speed which was advised to be around 0.7-0.8 km/h. Beyond the initial verbal communication, the train speed is communicated from the TLO to the train via the train speed indicator (TSI) panel in the locomotive cabin. The speed of the train is monitored by sensors at the loading terminal and warns the TLO of any over speed or under speed.
Train loading display screen
Prior to the occurrence (wagon not being loaded), the train loading display screen did not display the wagon number column.
Figure 3: Train loading display screen
Source: OTSI
There was no clear delineation between the ‘wagon’ position in the train consist and the ‘vehicle’ position in the train consist. That is, vehicle position was the physical count of all vehicles (wagons and/or locos) starting from the first vehicle (in the direction of travel) of the train consist. Whereas wagon position was the physical count from the first wagon in the train consist, not including any locomotives. To be clear, if there were 3 locomotives on the front of a head end powered train, wagon number 25 was the same as vehicle 28. The requirement to distinguish between locomotives and wagons was a recent change as a result of Moolarben’s investigation into this occurrence.
Train loading
Moolarben’s coal loading terminal has a semi-automated coal loading system that uses a number of sensors for wagon detection to start and stop coal loading. The coal loading system is overseen by the TLO. The TLO would normally be seated in the loading cabin which was situated above the wagons so coal loading into the wagons could be easily observed.
How the sensors work
The sensors are known as photo electric (PE) sensors. The sensors work by emitting and receiving electromagnetic radiation. If there is an obstruction, the receiver cannot detect the emitted radiation and hence knows there is an obstruction. If the receiver can receive the emitted radiation, the system knows that there is no obstruction.
Figure 4: PE Sensor operation
Source: OTSI
The sensors involved in coal loading were P1, P2, N1, N2, N3 and N3A.
Sensors P1 and P2
Sensors P1 and P2 initiate the loading of coal from the coal bin above the wagons. The coal bin has a capacity of 1000 t and it is continuously monitored and filled by conveyor belts during a typical train loading operation. A typical 93 x 120 t train will carry approximately 9021 t of coal.
The sensors detect a gap between the front of the wagon to be loaded and the rear of the wagon which had just been loaded. Once the front of the wagon to be loaded obstructs P1 and P2, there is a delay and the system instructs the bin gates to open to commence loading.
Figure 5: Sensor P1 and P2 instructing system to drop coal
Source: OTSI
Coal loading then continues as the train progresses at 0.7 to 0.8 km/h.
Sensors N1, N2, N3 and N3A
Sensors N1, N2, N3 and N3A work to instruct the system to stop loading coal. As a gap emerges at N1, it warns the system that it is approaching the end of the wagon and begins to slow the loading of coal. Once a gap emerges at N2, the system instructs the loading to stop completely and by the time there is a gap at N3, the system should have stopped loading coal.
It was advised by Moolarben representatives that a redundant sensor N3A also existed at the time of the occurrence which was used to confirm what the N3 sensor was detecting. This redundant sensor has since been removed.
Figure 6: N1, N2 and N3 sensors
Source: OTSI
Post wagon loading
After the wagons are loaded, they enter a weigh bridge approximately three wagon lengths from the loading terminal in the direction of travel. The weigh bridge measures the weight of the wagons to confirm the wagon has been loaded within tolerances. This weigh data is used as feedback to the SCADA system so as to load more or less coal in the remaining wagons based upon a number of parameters including the speed of the train, the time the load bin chute is open for, etc).
It was advised that if the wagons fall below or above a threshold weight, an alarm is activated to alert the TLO. In this scenario, the wagon may be reversed to load more coal or adjusted to reduce the amount of coal within it.
Safety Interface Agreements
A safety interface agreement is a written agreement for managing the risks to safety at interfaces.
The Rail Safety National Law (RSNL) requires that rail transport operators (i.e. rail infrastructure managers and rolling stock operators) and road managers must enter into interface agreements to manage the risks to safety at interfaces.
Pacific National Pty Ltd and Moolarben Coal Operations Pty Ltd entered into a safety interface agreement between the two parties from the 14 March 2016.
In part 31.2 of the safety interface agreement;
Moolarben Coal Operations Pty limited is responsible for train (wagon) loading operations to ensure wagons are loaded safely and evenly without causing damage to Pacific national property and notification to Pacific National of any wagon loading irregularity, including overloading, underloading (wagons to be loaded within maximum and minimum gross load limit) empty or part loaded wagons, coal spillages, and will ensure wagon loading is carried out, so far as reasonably practicable, as detailed in Pacific National Procedure NSWC005 – Coal Train Loading Process.
Safety analysis
Introduction
A number of potential contributing factors were considered in this investigation, including the condition and maintenance history of the rolling stock and the rail infrastructure.
Rolling stock maintenance history was provided by the rollingstock operators and the investigation concluded maintenance did not contribute to the incident. Post incident inspections of the damaged wagons, draw gear, bogies and wheelsets found the damage to be consistent with the derailment and collision and therefore unlikely any pre-existing condition in the rollingstock contributed to the incident.
Track measurements (top, gauge and twist)[4] were taken of the Up Main line from the point of mount (274.396 km)[5] to 100 m in the down direction. Track measurements were also taken up to 25 m after the point of mount in the up direction The track measurements were all within the ARTC’s track geometry standards. Maintenance data for the section of track was provided by the ARTC and the investigation concluded track maintenance and the condition of the track did not contribute to the incident.
The focus of the analysis is on the conditions that led to the derailment of the 25th wagon in the train consist and the awareness of this risk in the industry.
Wagon empty and undetected
There were a number of controls in place at the Moolarben loading terminal to detect when a wagon had not been loaded as required. At the time, Moolarben loading terminal was in process of commissioning various parts of the loading system so that it could be a fully automated loading process without the need for intervention by a TLO.
The loading system was set up with sensors to detect wagons and automatically load each wagon as it passed underneath the coal loading chute. As loading progressed on the morning of the incident, there was a fault in the system which stopped coal from being loaded into the 25th wagon. Moolarben’s post incident analysis of the loading system found the stop loading sensor N3A had malfunctioned. Moolarben loading terminal decommissioned the N3A sensor shortly after.
When loading faults such as this occurred there was the ‘wagon empty detected’ alarm which formed part of the check system that was being commissioned and would form part of the system for automatic loading. In the commissioning phase, this alarm had false triggered on a number of occasions and the confidence level of the TLO in the alarm was not high.
The wagon empty detected alarm sounded as required but was reliant on an action from the TLO to intervene and check that the alarm was indicating an actual event and then set the train back so the wagon could be loaded if required.
At the time the alarm sounded, the TLO was pre-occupied with other non-work related activity which kept his attention long enough to miss being able to confirm if the wagon had been loaded by viewing it as it passed under the loading bin.
When the TLO eventually returned his attention to the train loading, he attempted to confirm whether there was coal in the wagon, however the wagon had moved beyond the lit loading area and in the low light of pre sunrise the TLO could not visually confirm whether there was coal in the wagon or not. The TLO was aware the wagon would be passing over the weighbridge which was also fitted with an alarm for detecting empty wagons.
When the weighbridge alarm sounded indicating there was an empty wagon, the TLO waited for the next wagon to go over the weighbridge to confirm whether the weighbridge was reading correctly. When the following wagon passed over without sounding the weighbridge alarm, the TLO contacted the CHPP Supervisor to check the wagon.
Prior to the incident the train loading display screen for the TLO only had the Seq. No. column. When the TLO contacted the CHPP Supervisor to check the wagon, the TLO called the wagon – wagon 28, when it was in fact the 25th wagon, as there were 3 locomotives at the front of the train.
The CHPP Supervisor and a technician drove up to the position of the 28th wagon by counting back from the first wagon after the locomotives. They checked the 27th, 28th and 29th wagons to confirm all were loaded. As the 25th wagon (28th vehicle in the sequence) was the unloaded wagon, it was missed by this check.
The CHPP Supervisor confirmed the 28th wagon was loaded and the TLO continued to load the train.
‘Less than safely loaded’ wagons
In June 2010, the Independent Transport Safety and Reliability Regulator (ITSRR), the then rail safety regulator in New South Wales, released a rail industry safety notice (RISN No.32) on the ‘Operation of less than safely loaded wagons’.
The safety notice was published following instances of one or more wagons in a coal train consist being left unloaded or lightly loaded and positioned between loaded wagons at a coal loading point on a railway balloon loop off the main line.
The safety notice was directed to coal loading operators and rolling stock operators who were responsible for loading coal into wagons of a coal train to a safe level.
In the 20 months leading to the release of the safety notice, a freight operator in NSW had experienced three incidents most likely attributed to an empty or lightly loaded vehicle entering service undetected post loading, within the train consist. In each case, the empty or lightly loaded wagon had been positioned between two fully loaded wagons resulting in the trailing in-train longitudinal forces either lifting the wagon off its bogie(s), lifting the wagon and bogie(s) off the rail or, the precursor, the forces creating a diminished wheel loading on wheelsets of the affected wagon, which heightens the risk of derailment.
On each of the above occasions, the wagon was retained in the train consist by the solid drawbar connection which prevented the train consist from uncoupling, however, two of the incidents resulted in derailments.
As a result ITSRR provided some key points to consider which included:
Rolling stock operators to check that suitable and sufficient information has been provided to the loading points regarding appropriate wagon loading configurations (ie. less than safely loaded thresholds) for safe operations.
Existing controls for the majority of coal loading facilities are predominantly procedural based ie. reliance on the competency and fitness for duty (ie. drug and alcohol, fatigue management, etc) of their coal load personnel and their vulnerability to human error (or performance variability).
Attention of coal load personnel can also be subject to distraction from other train management, mining and stockpile duties.
A number of incidents of less than safely loaded wagons have either gone undetected and/or the train crew involved have not been informed prior to completion of the loading activity.
Refer to Appendix A for the full rail industry safety notice.
In July 2019, the ONRSR released a safety message titled; ‘Unsafe Loading of Coal Wagons’. It was an updated safety message with the same safety related content released in response to this occurrence.
Refer to Appendix B for the full safety message.
Derailment
The train travelled approximately 160 km without incident. As the train approached Antiene, it is likely a combination of train handling (train braking was being applied), track geometry (a falling grade of 1:59 and a left hand 690m curve radius[6] into a turnout on tangent track), and the trailing in-train longitudinal forces lifting the 25th wagon and its trailing bogie resulting in the leading wheelset of the trailing bogie mounting the rail at kilometre mark 274.396 km. The wheelset then dismounted the rail in a derailed state at kilometre mark 274.394 km.
The 25th wagon was positioned between two loaded wagons, the front of the wagon was coupled to the 24th wagon and was attached to the 26th wagon by the solid drawbar connection.
Figure 7: Point of Mount (POM) and Point of Dismount (POD) – Antiene Up direction
Source: OTSI
Following the derailment the leading wheelset of the trailing bogie was ejected from the bogie and left on the track at kilometre mark 271.684 km. As the driver remained unaware of the derailment, the train continued with the bogie dragging on the down rail of the up main line within the six foot and foul of the down main line.
Figure 8: WC915 front locomotive footage just prior to collision
Source: Aurizon annotated by OTSI
The derailed wagon and dragging bogie caused damage to multiple parts of the rail infrastructure network. As the train travelled in a derailed state, the NCO received information that may have alerted the NCO to a possible problem however it was received and interpreted in the following manner (see Table 1).
Table 1: NCO log of incident events
Source: ARTC annotated by OTSI to de-identify parties
The responses by the NCO to the track failures as they occurred are likely standard responses taken by any NCO when faced with track irregularities.
At 1202 when the NCO was alerted to an irregularity on the down main line, the NCO’s response was to make contact with the signals team and request they investigate a possible track failure.
This is an immediate action taken by the NCO that attends to a potential problem and would allow the NCO to continue working on other issues while waiting for further information.
When the second track failure occurred at 1209, the NCO’s response was to reset the axle counters which appeared to rectify the situation, although the original track failure remained. The NCO had already taken action on the original track failure and it is reasonable to see he would continue to wait to hear back from the signal team.
At 1216 when there were multiple track failures, the NCO assumed a possible power issue caused by lightning strike or storm which was occurring further north on the rail network and therefore took action by advising the signals team of these other failures.
Between this time and the emergency call made by the crew on WC915, the NCO had an opportunity to make contact with the train crew on MR336 if he suspected there was a problem. Had the NCO made the enquiry, it is likely the crew of MR336 would not have been able to provide any other information that would help the NCO identify the source of the problem.
As at 1225 when the NCO heard the emergency call from WC915, the NCO made contact with the driver of MR336 and made enquiries. MR336 had come to a stand and the crew reported they were not injured. They were also not aware of any issue other than a minor air issue which they deemed not a problem.
It is possible the air issue was a leak in the trains pneumatic braking system[7] as a result of the derailed 25th wagon however such a situation where air is being lost but not significantly so as to automatically apply the brakes, the train crew would remain unaware of there being a problem with the train.
Management of known risk
The risk associated with releasing an empty or lightly loaded wagon positioned between a loaded wagon onto the rail network was known by the rollingstock operator and the loading terminal. The requirement to load wagons safely and evenly was detailed in the safety interface agreement between the two parties.
Moolarben loading terminal had a number of controls in place to ensure wagons were loaded in accordance with the rollingstock operator’s procedure for loading coal trains. This indicated both parties understood the risk and reasonable mitigating controls had been implemented to prevent the risk from arising.
A summary of the risk controls that were ineffective which lead to the unwanted event of an empty wagon positioned between loaded wagons is depicted below (see Figure 9).
Figure 9: Bow tie risk diagram depicting ineffective risk controls in this incident
Source: OTSI
The layers of control (defences) in place failed to prevent and detect the loading irregularity. As a result, the loading terminal reviewed its risk assessment and controls to confirm the systems level of effectiveness. The outcomes from the review included implementation of additional controls, such as extra lighting on the outbound side of the loading chute, two independent mechanisms for detection of empty wagons and a process of verification of the train load out summary between the TLO and the Control Room Operators to ensure each train is loaded within required specification prior to advising the train operator that loading is complete.
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the derailment of MR336 at Antiene and subsequent collision between MR336 and WC915 at Ravenan New South Wales on 26 September 2018.
Contributing factors
An empty wagon positioned between two loaded wagons on MR336 was allowed onto the network and this known risk materialised in a derailment of the empty wagon.
The derailed state of MR336 caused the collision with WC915.
Sensor N3A malfunctioned during the loading sequence which stopped coal from being loaded into the 25th wagon.
The TLO was pre-occupied when control alarms sounded and missed viewing the wagon passing under the loading bin.
The TLO instigated a verification check however the TLO unknowingly provided misleading information to check the 28th wagon, rather than the 28th vehicle in the sequence.
The 25th wagon in the train consist was not loaded and was not detected by the loading terminal.
Other factors that increased risk
It is likely, the reliability of the alarms to indicate a loading irregularity in the loading system contributed to the TLO questioning their accuracy.
The TLO could not see if the wagon was loaded or not in the low light of pre sunrise when the wagon had already passed through the loading area.
Safety action
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are provided separately on the ATSB website, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website as further information about safety action comes to hand.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Moolarben loading terminal
Following the occurrence Moolarben conducted an internal investigation and developed a number of safety actions in their corrective action plan. During the DIP process Moolarben provided an update on the status of the actions listed below.
Malfunctioning Sensors
Sensor N3A was determined to be faulty and for this reason has been removed from service.
Empty wagon detection sensors have been re-commissioned and are functional.
Verification of train load out summary
Communicate requirement for verification of train load out summary at end of loading by both the TLO and Control Room Operators to ensure train is loaded within required specification prior to advising train operator that loading is complete. Completed.
Review risk assessment for additional train loading requirements
Review of the train load out risk assessment has been completed. Outcomes of this review included the following items;
Train loading sequence stop and alarms raised if wagon overloaded, underloaded or empty.
Empty wagon detection via two independent methods, being radar profiling and weighbridge.
Sequence number, wagon number and unique wagon identifier to appear on train summary page.
Improve lighting on outbound side of train load out.
Use of radar for train speed detection.
Increased monitoring of weighbridge performance.
Enable recording of train load out CCTV cameras.
Install scraper blade for removal of coal from the top of a wagon if an overload occurs.
Upgrade and reprogram the train loading control system to incorporate all of the above requirements.
Complete change management for additional train loading requirements
Complete Change Management for additional train loading functionality requirements as identified by the risk assessment review. The additional requirements listed above have been implemented since the incident occurred.
Review and update train loading manual and training package
Review and update train loading manual and training package including additional train loading functionality requirements and actions to be taken if a wagon is outside of acceptable loading specifications. Completed.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Moolarben
Australian Rail Track Corporation
Aurizon
Pacific National
Office of the National Rail Safety Regulator (ONRSR)
Interviews with directly involved parties
Video footage of the incident and other photographs and videos taken on the day of the incident and in the days after
References
ARTC curve and gradient
ITSRR
Safety interface agreement
Rail Safety National Law (RSNL)
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
Moolarben
Australian Rail Track Corporation
Aurizon
Pacific National
ONRSR
Transport for NSW
Submissions were received from:
Moolarben
Australian Rail Track Corporation
Pacific National
Transport for NSW
ONRSR
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
General details
Train 1 details
Track operator:
Australian Rail Track Corporation
Train operator:
Pacific National
Train number:
MR336
Type of operation:
Freight
Consist:
Coal
Departure:
Moolarben loading terminal
Destination:
Newcastle
Persons on board:
Crew – 2
Passengers – N/A
Injuries:
Crew – 0
Passengers – N/A
Damage:
Substantial [7 wagons damaged] and nine kilometres of track
Train 2 details
Train operator:
Aurizon
Train number:
WC915
Type of operation:
Freight
Consist:
Coal (empty)
Departure:
Newcastle
Destination:
Werris Creek
Persons on board:
Crew – 2
Passengers – N/A
Injuries:
Crew – 2 (minor)
Passengers – N/A
Damage:
Substantial [2 locomotives and 2 wagons damaged]
Appendices
Appendix A – Rail Industry Safety Notice (RISN No. 32)
Appendix B – Safety Message: Unsafe Loading of Coal Wagons
This safety message is directed to coal loading operators and any other rolling stock operators responsible for loading coal into wagons.
Recently a coal train consist at a coal loading point on a railway balloon loop off the main line in New South Wales was allowed to depart with an unloaded wagon. The unloaded wagon subsequently derailed on the main line whilst the train was braking to negotiate a curve.
The empty wagon had been sandwiched between two fully loaded wagons resulting in the trailing in-train longitudinal forces either; lifting the wagon off one of its bogies, lifting the wagon and one of its bogies off the rail or, as a precursor, the forces created a diminished wheel loading on wheelsets of the affected wagon - subsequently heightening the risk of derailment.
Further the wagon was retained in the train consist by a solid drawbar connection which prevented uncoupling and resulted in a derailment. One bogie dislodged from the centre casting and rotated under the vehicle before fouling the adjacent track. The derailed bogie was subsequently struck by another coal train traveling on the adjacent track causing that train to derail.
In view of the above, it is imperative that the actual load in each wagon is ascertained at the loading points prior to the consist entering a rail transport operator’s network.
Points to consider
Rolling stock operators should check that suitable and sufficient information has been provided to the loading points regarding appropriate wagon loading configurations (i.e. less than safely loaded thresholds) for safe operations.
Existing controls for the majority of coal loading facilities are predominantly procedural based i.e. reliance on the competency and fitness for duty (i.e. drug and alcohol, fatigue management, etc.) of their coal load personnel and their vulnerability to human error (or performance variability).
Attention of coal loading personnel can also be subject to distraction from other train management, mining and stockpile duties.
The following actions should be taken by rail transport operators
ONRSR requires coal loading operators and rolling stock operators to carry out their respective railway operations in relation to loading coal into wagons of a coal train in a safe manner, to do so in a way that does not threaten safety. Coal loading operators and rolling stock operators should:
Review the risks associated with operations and loading of coal trains, in particular ensuring correct and known loading configurations are met for the subsequent movement of the train away from the coal loading facility.
In the context of this safety message review the current standards, procedures, rules and control measures including safety interface agreements to ensure:
clear delineation of roles and responsibilities;
Ongoing effectiveness of existing controls; and
Opportunities to implement additional controls including engineering controls such as ultrasonic load profile detectors, track based load cells, etc.)
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 21 September 2018, overnight track maintenance works being conducted in the Colac area had necessitated the isolation of the protection equipment at eight level crossings. On completion of the track work, equipment was to be reinstated and the operation of crossing protection equipment tested.
With the completion of the maintenance work, the track was returned to service and train services resumed on the morning of 22 September. However, the driver of a train transiting the area noticed that the level crossing protection equipment at the Hart Street level crossing was not operating. He stopped his train but was unable to prevent it from occupying the crossing. There was no road traffic at the time.
What the ATSB found
The ATSB found that V/Line did not have a documented detailed process for inhibiting and then reinstating level crossing protection equipment. The Signal Maintenance Technician (SMT) undertaking these activities partially restored the Hart Street level crossing equipment before attending to other tasks. He subsequently forgot to return to that crossing to complete its reinstatement and testing, and the track was returned to service with the protection at the Hart Street crossing not operational.
It was also concluded that, for the scope of works on this night, the allocation of a non-rail electrician to support the SMT was very likely of less assistance to the SMT than had a rail-qualified technician been provided.
What has been done as a result
V/Line has developed new procedures related to the task of inhibiting and reinstating level crossing equipment and conducted training for relevant employees in these procedures.
In addition, V/Line has reviewed its resourcing of complex and time critical tasks involving inhibiting and reinstating level crossing equipment.
Safety message
When isolating safety equipment, it is important to have formal procedures that require the recording of the equipment’s isolation, reinstatement and testing, in order to validate that restoration work is completed before rail services resume.
The occurrence
On the night of 21 September 2018, overnight track maintenance works were being conducted in the Colac area. To enable these works, an ‘absolute occupation’[1] applied overnight between Warncoort Loop and Camperdown (Figure 1).
Figure 1: Location diagram
Source: Melways (used with permission). Annotated by Chief Investigator, Transport Safety (Vic).
Due to the likelihood of these works causing damage to track assets, the active protection equipment at eight railway level crossings (RLXs) were required to be placed out-of-service[2] and the associated electrical connections disconnected and cables removed clear of the track.
Level crossing inhibition
A Signal Maintenance Technician (SMT) was engaged to inhibit and later reinstate the crossing protection equipment. To complete the inhibiting task for each crossing, it was necessary to isolate control equipment at the crossing, and to travel to the extremities of the level crossing approach circuits to disconnect cabling.
For the five crossings closest to Colac Railway Station, the SMT initially requested the issue of five Permits To Foul the Line (PTFL)[3] together (№’s 1-5) issued between 2216 and 2226 (Figure 2). This was so he could quickly isolate the protection equipment at these proximal crossings and remove their track connections to allow the track works to proceed.
The SMT then received a call to attend the Colac-Ballarat Road RLX (about 6 km by road from Colac Railway Station). He drove to the location, obtained PTFLs 8 and 9 (issued between 2239 and 2241) for the Colac-Ballarat Road and the nearby Flaxmill Road crossings, and completed the inhibition of these two crossings.
Returning to Colac, the technician completed the inhibition activity on the five RLXs nearby to Colac Station.
Figure 2: Diagram showing the area of works on 21 September, including RLXs
Source: Chief Investigator, Transport Safety (Vic)
Receiving advice of rapid progress, the SMT requested PTFL10 (issued at 0126), then drove to and inhibited the Deans Creek Road RLX (approximately 3.5 km by road from Colac Railway Station).
All eight level crossings were now inhibited.
Level crossing reinstatement
Knowing the Tamper & Regulator Gang had completed work at the Colac-Ballarat Road and Flaxmill Road RLX locations, the SMT returned there (a total distance of about 11 km by road to attend both RLXs), reinstated the in-track equipment, and surveyed[4] the two crossings. PTFLs 8 and 9 (for these crossings) were not returned at that point but were returned later, during the call to the Track Force Protection Coordinator (TFPC) in which PTFL 2 was also returned.
Moving to the Church Street RLX (a further 2.5 km of travel) the SMT reinstated its on-track equipment, surveyed it, and returned PTFL 2 (together with PTFL 8 and 9) between 0518 and 0519. Following this, he reinstated the equipment for the Queen Street RLX (1 km distant by road) and surveyed it as well. However, he could not return the PTFL at this time as the track machines were returning to the Colac yard and were occupying the crossing for a period.
The SMT then reinstated the in-track equipment for Hart Street (1.5 km distant) and went to the location case (the level crossing equipment control box) intending to return the control equipment to operation. However, due to overlapping track circuits[5] not yet being reconnected, the full restoration of the Hart Street crossing protection was not completed at that point in time. The technician then went to undertake other tasks, and subsequently did not return to Hart Street to complete its reinstatement.
By this time, the Tie Renewal Gang had completed their work and returned to the Colac yard, and the SMT commenced to reinstate in-track equipment and survey the remaining RLXs at Deans Creek Road, Cants Road and Armstrong Street.
The SMT then called the TFPC and returned the remaining five PTFLs between 0625 and 0626, including that for Hart Street. He believed he had been to each RLX, reinstated and tested each, and confirmed this belief with the assisting electrician. With this, the SMT considered his work for the shift completed.
At the completion of the night’s work, the track occupation was cancelled by the TFPC. This enabled the recommencement of train services between Melbourne and Warrnambool.
The first train to transit the area was a Warrnambool-to-Melbourne service. Its driver did not report any fault with the RLX. The second service was running from Melbourne to Warrnambool and had departed Colac Railway Station at about 0930. Its locomotive driver noticed that the flashing lights for the Hart Street level crossing were not operating. He made an Emergency brake application but was unable to prevent the locomotive from occupying the crossing. There was no road traffic at the time. The locomotive driver inspected the rail head and train consist wheels for contamination, identifying no issues, and the service was permitted to continue.
Subsequent inspection of the Hart Street RLX active protection revealed that the level crossing protection had not operated because it was still inhibited. __________
The track and associated infrastructure, including the level crossing protection systems, is owned by the Victorian Rail Track Corporation (VicTrack) and managed by V/Line Corporation (V/Line). V/Line is responsible for track and signalling maintenance.
The maintenance work on 21-22 September was part of a tie[6] renewal project, being carried out by V/Line between September and December 2018, to replace sleepers on the Melbourne-to-Warrnambool line.
Resourcing
This project was the first to be undertaken since the inception of a new method for allocating staff to track maintenance projects. The resourcing and support function of projects such as this became the direct responsibility of the corporate Project Delivery team. Previously, local[7] signal maintenance technicians supported projects within their area. From the time of this project, there was greater scope to draw technicians from other regions.
At the commencement of these works, maintenance technicians were not readily available (due to the effects of insufficient staff numbers and annual leave requirements). Thus, for signal maintenance technical support, the Warrnambool tie renewal project required that a technician be drawn from other assignments. The Signal Maintenance Technician (SMT) allocated to support this project was based in Ballarat.
The track maintenance work groups
There were four separate work groups operating within the track occupation:
The Electrical Assets group; a Signal Maintenance Technician and assistant, responsible for removing on-track equipment and for functionally inhibiting any active Railway Level Crossing (RLX) protection prior to the works, and for reinstating it following completion.
The Tie Discharge Gang; engaged in unloading and laying out the new sleepers. They worked ahead of the Tie Renewal Gang.
The Tie Renewal Gang; consisting of more than 40 personnel and about 12 on-track machines to insert the replacement sleepers
The Tamper & Regulator Gang; followed the Tie Renewal Gang with personnel and on-track machinery to restore the track and ballast state in preparation for the resumption of rail traffic.
Supervisor of the four workgroups
The overall on-site workgroup supervisor for the area under the Absolute Occupation was a V/Line Assistant Track Maintenance Supervisor. He had about 30 years’ rail experience.
Signal Maintenance Technician
Qualification and experience
The maintenance technician on this shift was a qualified electrician and Signal Maintenance Technician with around 4.5 years’ experience in the rail industry. He had been involved in V/Line projects since May 2018.
Technician’s roster and sleep
On the Monday prior to the incident, the SMT worked a 10-hour dayshift, then had 26.5 hours off duty. Commencing 1900 on the Tuesday evening, he was then rostered on for 12-hour night-shifts. He worked these night-shifts on the Tuesday, Wednesday and Thursday nights with 12 hours off duty, and reportedly about 6 hours’ sleep, between each shift. He was rostered to work another 12-hour shift on the night of the incident.
The incident occurred overnight between Friday and Saturday. The SMT reported going to bed at around 0630 on the Friday morning following his previous shift, and achieving about 6 hours’ sleep. He commenced work at Wendouree (Ballarat) at about 1930 that evening and drove to Colac to commence his support work. He completed activities on site at about 0630 the following morning, before driving back home.
The work
In the week prior to the incident, the SMT had become aware that signals technical support was required for this tie renewal project and had agreed to be tasked for the project. Work for the project commenced on 4 September and was progressing west.
The level crossing inhibition task required:
the isolation of the RLX active protection by using temporary jumper wires to connect certain system component terminals within the equipment location cases adjacent to each RLX (Figure 3)
the disconnection of signal and track circuit bonding wires from the rails at each RLX
the detachment and removal of any between-rails equipment.
Figure 3: Position of a typical RLX location case (Hart St, Colac)
Source: Chief Investigator, Transport Safety (Vic)
Following completion of work, these actions were reversed, with the addition of a test (survey) at each crossing to confirm its functionality.
V/Line did not have a formal, written procedure describing or defining this sequence of actions. SMTs learnt the processes associated with inhibition and reinstatement through on-the-job training.
Support resources
The SMT had commenced his role on the project working solo but, having become aware of the scope-of-works for the Friday-night shift, requested assistance for that shift.
The SMT was informed that no qualified rail technical assistance was available, but that an assisting electrician from a contract electrical company would be supplied. The contract electrician had no previous rail-based experience but held a Track Safety Awareness qualification and was to work under the technician’s direct supervision.
Supporting documentation
The overlap of adjacent track circuits and unfamiliarity with the location presented a challenge to the SMT. The As-In-Service plans[8] for the RLXs in this region had not been updated since their track-circuited approaches had been extended from 1,000 to 1,300 m about a year earlier. Lacking an up-to-date diagram of arrangement, the SMT was required to inspect the length of each track-circuited section to identify the location of connected equipment.
Worksite Protection
Overall protection
The worksite protection for the four groups was managed by a Track Force Protection Coordinator (TFPC). Their role included establishing the Absolute Occupation Order, and arranging its cancellation at the completion of works. The TFPC held such an Order for the Warncoort Loop-to-Camperdown section (issued at 2209 on 21 September 2018) with Worksite Protection recorded as being in place at 2214. This TFPC was also authorised to issue Permits To Foul the Line (PTFLs).
Signalling workgroup supervisor
The SMT functioned as the ‘Workgroup Supervisor’[9] for his workgroup. He was authorised to have on-site management of an individual or group of people working under the cover of an Absolute Occupation. He was also authorised to seek and hold PTFLs.
Permit To Foul the Line (PTFL)
A PTFL is a paper instrument designed to convey and record the granting of permission to occupy the track between defined geographical limits during the existence of an Absolute Occupation. Relevant portions of the process are described here.
Where the active protection equipment at a railway level crossing (RLX) is to be disconnected (or ‘inhibited’) or its functionality restricted, the workgroup supervisor, who, for this particular task must also be qualified as a signal maintenance technician, must first obtain a PTFL. Work at the location of the RLX cannot commence until the PTFL has been issued.
An SMT may hold multiple PTFLs for the disconnection of active level crossing protection equipment and must be in possession of a separate PTFL for each RLX during the time the active protection equipment is out-of-use at that crossing. The PTFL remains in place until normal operation of the active protection equipment has been restored.
The PTFL must only be issued or cancelled by the TFPC who (at the time) is holding the Absolute Occupation. When a workgroup, including that of an SMT, has completed their work, and all staff, machinery and equipment is clear of the line, the workgroup supervisor must ‘return’ the PTFL to the TFPC by completing the relevant section of the form. The TFPC then cancels the PTFL. This process can be by radio communication.
Toward the end of a busy night shift, the Signal Maintenance Technician (SMT) and his assistant had proceeded to Hart Street to complete reinstating its crossing protection. Track equipment was reconnected, but the reinstatement process for Hart Street was not finalised at that point in time because of a requirement to reinstate track circuit cabling. The SMT and his assistant then attended to other tasks, and forgot to return to the Hart Street level crossing to complete its reinstatement, and test its functionality.
Workload
The rate-of-progress achieved by other workgroups during the evening meant there was competition for the SMT’s attention to have level crossings isolated or reinstated as the works progressed. To satisfy the requirements of the other work groups, the SMT was engaged in considerable to-and-fro travel throughout the work area.
Fatigue
Regularly sleeping for reduced hours can affect human performance. In one study, people reporting more than 7.5 hours of sleep had significantly less probability of falling asleep than those reporting sleep durations of less than 6 hours 45 minutes.[10] Other studies have confirmed that chronic sleep restriction to fewer than 6 hours per night has been shown to impair performance and to increase the tendency to involuntarily fall asleep.[11]
In this instance, the SMT reported that he had had around 6 hours sleep the day before this shift. The technician had switched to a night-shift roster on the Tuesday, and this was his fourth 12-hour night shift. Following the shift change, and as a result of the low sleep hours in the preceding days, it is likely that the technician’s cognitive performance was less than if he’d been well rested.
Process control
SMTs learnt the process for inhibiting and reinstating active railway level crossing (RLX) installations through on-the-job observation. They did not have the benefit of any prescribed procedure for this activity. Thus, there was no formal process available to the SMT by which the individual tasks associated with the isolation or removal of active level crossing equipment could be recorded and then be available to ensure correct and complete reinstatement.
The SMT was handling multiple Permit to Foul the Line (PTFLs) (that was permitted). However, rather than returning each permit individually at the completion of reinstatement of each RLX, the SMT in some cases delayed and then grouped their return. This included the PTFL for the Hart Street crossing, that was returned, away from the Hart Street site, at the end of the SMT’s work. This method of handling the PTFLs removed another potential defence against error.
Project resourcing
The SMT assigned to the project assessed that he would require (and he requested) assistance for Friday’s overnight shift. However, V/Line could not provide a rail technician due to a lack of staffing availability, and provided instead, an electrician who was only able to carry out tasks under direct supervision. As a result, the SMT did not have the benefit of a rail-qualified associate with whom he could divide the task of inhibiting the eight level crossings. Nor was the SMT able to potentially benefit from cross-checking by a rail-experienced colleague.
Given the scope of works to be undertaken by the SMT on this night, he would have benefited from the support of an appropriately qualified rail technician.
Out-of-date ‘As-In-Service’ plans for rail level crossings
System diagrams depicting the arrangement of equipment unique to each level crossing and its associated track circuitry were held within the Public Transport Victoria (PTV)[12] Drawing Management System. Maintaining their currency was the responsibility of V/Line. However, the on-site documentation was not up-to-date. Track circuit distances had changed over the prior year, and this information had not been transferred to the As-In-Service diagrams of the RLXs.
As a result, the SMT expended valuable time in having to identify each RLX circuit without the assistance of accurate documentation.
Previous investigation
In a previous investigation[13] into a ‘short ring incident’ incident at a Colac RLX, the Chief Investigator, Transport Safety (Vic), found that: ‘As-In-Service drawings were found to be inconsistent with the actual site configuration’ and that ‘site working documents for field maintenance staff did not fully reflect the actual system configuration.’
From the evidence available, the following findings are made with respect to the non-operation of railway level crossing protection that occurred in Colac, Victoria on 22 September 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The Signal Maintenance Technician (SMT) forgot to complete the restoration of the Hart St level crossing.
V/Line did not have a documented detailed process for inhibiting and reinstating level crossing protection equipment. [Safety Issue]
Other factor that increased risk
For the scope of works on this night, the allocation of a non-rail electrician to support the SMT was very likely of less assistance to the SMT than had a rail-qualified technician been provided.
Other finding
V/Line had not maintained up-to-date the system diagrams depicting the arrangement of equipment at each level crossing.
Safety issues and actions
Depending on the risk level of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to rail industry, the Australian Transport Safety Bureau (ATSB) may issue safety recommendations or safety advisory notices as part of the final report.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Safety issue description: V/Line did not have a documented detailed process for inhibiting and reinstating level crossing protection equipment.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
V/Line has reviewed its resourcing levels for complex and time critical tasks involving inhibiting and reinstating level crossing equipment.
Sources and submissions
Sources of information
The sources of information during the investigation included:
V/Line
References
Level Crossing Short Warning Time, Freight Train 9251, Queen Street Colac, 9 July 2008, Chief Investigator, Transport Safety (Vic), Rail Safety Investigation Report No 2008/06, pp 35-36.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to V/Line, the employees concerned and relevant agencies. Submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 20 September 2018, at about 1620 Eastern Standard Time[1], an Airbus A320, VH‑VGZ, operated by Jetstar departed Brisbane Airport, Queensland, on a scheduled passenger flight to Sydney, New South Wales, with six crewmembers and 178 passengers on board.
During the landing roll, the flight crew selected both engines to ‘reverse thrust’ and received an Electronic Centralised Aircraft Monitor (ECAM) ‘reverse fault’. The captain called, ‘no reverse’ and the first officer completed the landing utilising normal braking. The flight crew taxied the aircraft off the runway at the planned exit. The captain later recalled that, during the pre-flight checks, he had not observed any indications on the engine cowls, in the cockpit or on the technical log to show that the thrust reversers were de-activated.
There was no damage to the aircraft, or injuries sustained during the incident.
Engineering inspection
Following the incident, an engineering inspection revealed that the thrust reversers were in the de‑activated position; with the minimum equipment list (MEL) lockout pin installed (Figure 1). The lockout pins were removed from each of the engines, thrust reversers were tested and found to be serviceable, and the aircraft was returned to service.
Figure 1: MEL lockout pin installed in thrust reverser hydraulic control unit (HCU)
Source: Operator, annotated by the ATSB
Maintenance prior to the incident flight;
On 17 September 2018, VH-VGZ arrived at the Qantas maintenance facility in Brisbane, Queensland. The aircraft was scheduled for a three-day maintenance check and was due to return to service at 2040 on 20 September 2018.
Two days into the maintenance, the engineers identified that the horizontal stabiliser actuator required replacing, which added half a day of work to the schedule. To recover the lost time, a team was organised to begin work at 0400 the following day. At about 0600 on 20 September 2018, the actuator replacement was completed and the team proceeded to finalise the remaining scheduled maintenance tasks.
At about 0840, a licenced aircraft maintenance engineer (LAME) completed and certified the task card for a required thrust reverser functional check. Based on the system test of the thrust reversers, but contrary to the required procedure, he also completed the certification for the same check on the ‘hangar release’ task card.
The check coordinator (CC) instructed the engineering team to return all equipment to the tool crib, so that he could complete signoffs on the work packages. Two hours later, the CC received a call from Jetstar to inform him that the aircraft departure time had been brought forward to 1620. The CC assessed the request based on outstanding workload, certification and resource requirements and accepted the reschedule. The CC communicated the new schedule to the engineering team. To avoid a shift handover during the final maintenance signoffs, the CC instructed the engineers to complete the maintenance by the end of first shift at 1500. Due to the compressed schedule, many of the engineers worked through their lunch breaks to ensure they could complete the maintenance on time.
After completion of the engine ground run checks, the engineers discussed the remaining maintenance items on the ‘hangar release’ task card (Figure 3), giving consideration to the limited time remaining. The engineers noted that:
the thrust reverser functional check was not a requirement in the aircraft maintenance manual (AMM) following the engine leak check
the functional check on the hangar release card had already been signed concurrently with the thrust reverser functional check completed earlier that morning.
On that basis, and with consideration to the remaining time, the engineers decided that they did not need to repeat the functional check on the thrust reversers after completing the engine leak checks. That was contrary to the requirements associated with releasing the aircraft back to service (see the section titled Maintenance procedures).
Shortly after, the engineers pushed the aircraft out of the hangar to complete the final checks, which included the engine leak checks. The AMM engine leak check procedure required the left and right engine thrust reversers to be de‑activated. The de-activation procedure specified the use of warning notices in the cockpit and a lockout pin with a red warning flag attached (Figure 2). The AMM lockout pin was located in the tool crib. Checking out the AMM lockout pin from the tool crib would have resulted in delays to the closure of the work package as that could only be done when all tools were checked back in. The MEL lockout pin, which was functionally the same but did not have a warning flag attached, was located inside the engine cowling. In an effort to keep to schedule, the engineers decided to use the MEL lockout pin as a substitute. The engineers did not put additional warning notices in the cockpit for thrust reverser de-activation as they considered the ‘maintenance in progress’ notice to satisfy the AMM requirement.
The installed MEL lockout pins were not identified following completion of the engine leak check procedure. Consequently, both engine cowlings were closed with the lockout pins in place and the thrust reversers inoperative.
Figure 2: Lockout pin with warning flag
Source: Operator
At about 1240, 3 hours and 40 minutes prior to the incident flight, the final paperwork was completed and the engineers released VH-VGZ to service.
Maintenance procedures
A typical work order for any maintenance check contained a number of ad hoc task cards that were required to be completed and certified to record the work done. During aircraft maintenance checks, ‘non-routine’ task cards could be raised by the engineers to complete defect rectification or other work resulting after carrying out inspection tasks of the check’s work pack and/or technical log defects.
The ad hoc task card for the hangar release check, contained a note regarding the importance of completing all post-maintenance checks as standalone tasks; and provided an order of jobs to be completed sequentially (Figure 3).
Figure 3: Operator’s task card for A320 hangar release check
Source: Operator, annotated by the ATSB
Engineers’ comments
The maintenance engineers provided the following comments after the incident:
During the final maintenance tasks, some of the engineers reported feeling tired as a result of a combination of factors including:
early start times
skipped meal breaks
circumstances outside work, which had limited their ability to get quality sleep the previous evening.
Each of the engineers felt a sense of responsibility and pressure to provide on-time performance to the customer.
The schedule compression and increased pressure for on-time performance influenced their decision to use the MEL lockout pin, as it would not delay the completion of the maintenance paperwork.
At the start of the maintenance check, the engineers placed a generic ‘maintenance in progress’ warning notice over the controls in the cockpit. The generic warning notice was considered by some of the engineers to concurrently satisfy the requirement in the individual AMM tasks to place specific warning notices over the controls.
Qantas’ comments
Following an internal review of the incident, Qantas provided the following comments:
The individuals involved in this occurrence were all working in compliance with the maintenance organisations’ approved fatigue management framework.
The awareness of following the AMM safety precautions steps, such as placing specific warning notices over the controls, at the Brisbane base was not as robust as it should be.
Safety analysis
Following non‑operation of the thrust reversers during the landing roll, an engineering check revealed that the MEL lockout pins were installed in the hydraulic control units (HCU) resulting in deactivation of the thrust reverser system. The pins were installed as part of required maintenance action and unintentionally not removed prior to flight.
Although the AMM procedure did not require a functional check of the thrust reversers following reactivation, the operator’s task card did. The task card was a supplemental procedure to the AMM and it was a requirement that a licenced engineer sign and certify that each step was completed. The task card specifically noted the importance of conducting the post‑maintenance checks as stand-alone tasks. Contrary to the written procedure, the engineers did not follow the task card sequentially and signed off the operational check based on testing that they had completed earlier in the day. While that action was probably motivated by the desire to expedite the aircraft’s return to service, if the engineers had completed the functional check in sequence, they would have discovered that the thrust reverser was still de-activated.
Although the required operational check of the thrust reverser would have prevented this incident, other maintenance actions hampered detection of the HCU lockout. Thrust reverser de-activation required the use of a lockout pin with a red flag attached to provide a visual indication that the HCU was de-activated. The MEL lockout pin that was actually fitted was designed for in service use and was much less visually obvious than the pin used during maintenance.
The replacement of the horizontal stabiliser actuator and change to the revenue flight departure time had a compounding effect on the maintenance schedule. The engineering team probably felt pressure to expedite the maintenance, working through meal breaks in an effort to achieve this. The engineers stated that they felt pressured to return all tools to the tooling crib so that the CC could complete the paperwork, and that this was an influential factor in their decision to use the MEL lockout pin.
The AMM thrust reverser de-activation procedure also required the use of specific warning labels in the cockpit, stating that ‘thrust reverser HCU is de-activated’. However, it was reportedly common practice to only use a generic maintenance warning notice. That action, in combination with use of the MEL lockout pins, removed opportunities to identify the status of the thrust reverser system during the final inspection, and before the aircraft was returned to service.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Deviation from the required maintenance procedures resulted in the aircraft being returned to service with the thrust reverser system inadvertently deactivated.
Operational pressure to expedite the maintenance probably influenced the engineers’ decision to deviate from the written procedures.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Qantas Engineering
As a result of this occurrence, the maintainer has advised the ATSB that the following safety actions were taken:
A Quality Alert was issued, with a requirement for all Brisbane‑based maintenance staff to read and sign. The Quality Alert reminded engineers to ‘always use the lockout pins issued from the tool crib unless a MEL is required to be applied to the aircraft.’
The occurrence was discussed with all Jetstar’s aircraft-certifying staff, including the effect of perceived time pressures and the importance of documentation and compliance.
A review of the process of previous lockout pin management in Brisbane was conducted to rule out a systemic problem with lockout pin management.
All A320 thrust reverser lockout pins were inspected to confirm they were correctly identified and flagged.
An A320 de-activation board, containing the correct A320 lockout tooling, has been constructed. The trolley will sit next to the aircraft during maintenance visits for ease of access.
Safety message
Operational pressures are a reality of the aircraft industry, with aircraft delays having a substantial cost impact to operators. Such time and production pressures have the potential to influence safe work practices. It is imperative in the aircraft maintenance industry that, at all levels of an organisation, employees feel empowered to stop a process when they observe procedural violations or foresee that an error is likely to occur.
This incident serves as a reminder that a failure to follow procedures, such as functional checks, can result in unintended consequences. Functional checks are the last line of defence in maintenance work and can identify a range or errors that may have occurred during the job completion process. The extra few minutes taken to complete a functional check could detect an unsafe situation.
The United States Federal Aviation Authority has conducted research into the topic of ‘failure to follow procedures’. A number of useful articles and training tools can be found on their website, including:
Recognising that there was no identified fatigue-related contribution to this occurrence, some of the engineers noted that they were feeling tired while completing the final maintenance checks.
The ATSB SafetyWatch report, Fatigue, provides information on how to recognise if fatigue may be affecting your performance.
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
On 4 September 2018, the ATSB commenced an investigation into high engine vibrations involving Avro RJ100, VH-NJY, on a flight from Prominent Hill, South Australia, to Port Augusta, South Australia on 30 August 2018. The Bureau of Meteorology had issued a significant meteorological information (SIGMET) for severe turbulence and icing along the aircraft’s planned flight path. The flight crew were aware of this SIGMET and later recalled it to be consistent with the actual conditions encountered in flight.
When cruising at FL 250[1] in instrument meteorological conditions, an engine vibration caution was annunciated on the master warning panel (MWP). The flight crew identified the number 4 engine was indicating 1.8 units of vibration (more than the specified maximum of 1.2 units). About this time the flight crew observed ice build-up on the windscreen. They commenced the applicable checklist actions, and the fault message cleared before the checklist was completed.
The MWP then indicated a second engine vibration caution, and the crew identified that the number 2 engine was indicating 2.1 units of vibration. They performed the applicable checklist actions for the number 2 engine, and the fault annunciation cleared. The flight crew then descended the aircraft to FL 190, where the outside air temperature was higher, to prevent further icing. In consultation with the operator, the flight crew elected to divert to Adelaide rather than continue the flight to Port Augusta. No further excessive engine vibrations were encountered.
The ATSB obtained additional information from the flight crew that identified that the crew had selected the engine anti-ice system on prior to the occurrence. This and other airframe anti-ice systems were reported to be functioning normally. The ATSB also obtained data from the aircraft’s flight data recorder for the flight.
The ATSB reviewed the available information relating to this occurrence as well as information from its database associated with any similar previous occurrences involving the same aircraft type. Based on this review, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.
___________
[1] Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 250 equates to 25,000 ft.
On 14 August 2018, a Virgin Australia Regional Airlines (VARA) A320, registered VH-FNP, was prepared for a scheduled passenger flight from Perth Airport, Western Australia, to Christmas Island. Landing gear ground locks (LGGL) were fitted to the landing gear of FNP during the preparation, and were not removed prior to pushback. A ground handler removed the locking pins from the LGGL, but did not remove the associated sleeves.
As the aircraft was pushed back, taxied and took off from Perth Airport, the LGGL sleeves fell from the landing gear, onto a taxiway and Runway 21. The remainder of the flight was uneventful and FNP landed safely at Christmas Island.
What the ATSB found
The ATSB found that a lack of documentation relating to installing and removing LGGL from VARA A320s, and an ineffective handover of responsibilities between two engineers, contributed to the engineers not detecting that the LGGL remained installed during the preparation for flight.
Although the flight crew aircraft exterior walk-around check identified the LGGL, this was at a time when the flight crew did not have access to the flight deck due to maintenance work on the flight deck. The disrupted pre-flight sequence for the flight crew contributed to the flight crew later not identifying that the LGGL were missing from the stowage compartment on-board.
There was no procedure for making maintenance log entries when LGGL were installed and removed. A maintenance log entry relating to LGGL would have provided another opportunity for both the flight crew and the on-board engineer to become aware that the LGGL had not been removed and stored on-board before flight.
Rather than inform an engineer or pilot as per procedures, the pushback driver removed the LGGL pins from the landing gear sleeves before pushback. This decision was affected by time pressure and prior experience removing pins from another aircraft type. However, as the lanyards attaching the pins to the sleeves was missing and the pushback driver did not understand the LGGL locking mechanism, he removed the pins and not the sleeves.
What's been done as a result
VARA introduced procedures requiring an authorised person to sign an Aircraft Readiness Log to certify that LGGL had been removed prior to flight. If the aircraft has been towed after the initial check, the check must be performed again. Towing procedures also now require the approved brake rider to ensure that LGGL have been removed after a positional tow.
VARA have also issued a notice to flight crews instructing them to use a standardised method for stowing LGGL pins and sleeves. A separate notice reminds ground handlers they should not remove pins themselves.
Safety message
This investigation highlights how a number of relatively small errors and/or omissions, associated with separate functional areas, can combine to potentially affect flight safety. In this case, the identification and rectification of any one factor would probably have significantly reduced the likelihood of the occurrence developing.
While all persons working in and around aircraft have specific roles, they also have a responsibility to notify the operating crew about any concerns they may have with the aircraft. It is imperative that any concerns are assessed and rectified by appropriately qualified personnel before flight.
The occurrence
What happened
On 14 August 2018, Virgin Australia Regional Airlines (VARA) was operating an Airbus A320-231 (A320), registered VH-FNP (FNP), on a scheduled passenger flight from Perth, Western Australia to Christmas Island. The scheduled departure time was 1305 local time.
Aircraft tow to departure bay
To prepare for departure, ground handling personnel towed FNP from the domestic apron to its departure bay at the international terminal. In preparation for this tow, a VARA Aircraft Maintenance Organisation (AMO) engineer (the apron engineer) fitted landing gear ground locks (LGGL)[1] to the landing gear of FNP. The apron engineer then performed the aircraft brake operator (ABO)[2] duty, as FNP was towed onto its departure bay at 1117.
At 1121, the apron engineer left FNP, as he had been instructed to supervise the refuelling of another aircraft. The apron engineer anticipated that he would return after the other aircraft had been refuelled, at which time he planned to supervise the refuel of FNP and remove the LGGL.
During this time, VARA engineers were working in the cockpit of FNP to rectify a defect with a navigational display. Another engineer who was travelling with FNP to Christmas Island (on-board engineer), was assisting with the rectification work. When the apron engineer left FNP, he anticipated that it might sit for some time due to the rectification work, possibly resulting in the aircraft being unserviceable for the planned flight.
Pre-flight walk-around
The flight crew for FNP comprised the captain, first officer (FO), and an augmenting crewmember.[3] For the first sector (to Christmas Island), the captain would be pilot flying (PF) and the FO would be pilot monitoring (PM).
The flight crew arrived at the aircraft about one hour before the scheduled departure time. The crew were unable to access the cockpit to conduct their pre-flight procedures because of the rectification work. An engineer advised the captain it would take about 30 minutes to complete the works, so the crew waited in the passenger cabin.
The captain tasked the augmenting crewmember with conducting the exterior walk-around, which he commenced at about 1202. During the walk-around, the augmenting crewmember observed that the LGGL were still fitted. He considered removing the LGGL but determined he could not do so safely.
After completing the walk-around, the augmenting crewmember returned to the cabin, and reported to the captain that the LGGL remained installed. The captain acknowledged this, and anticipated that the normal departure procedures would lead to the removal of the LGGL prior to flight.
Refuelling
As the departure time approached, the apron engineer identified that he would be unable to return to FNP in time to supervise the refuel. Consequently, he phoned the on-board engineer and asked that he take over the remaining engineering duties for FNP, including supervising the refuelling.
At 1217, 48 minutes before the scheduled departure time, the on-board engineer left the flight deck of FNP. When the on-board engineer arrived at the refuelling console (on the fuselage under the wing), the refueller was already at FNP and had been waiting for some time. The on-board engineer recalled that the task of supervising the refuelling had been given relatively late in the pre-departure schedule for FNP.
From 1217 to 1245, the on-board engineer supervised the refuel, then returned to the flight deck.
Pre-flight cockpit preparation
The flight crew gained access to the cockpit about 30 minutes prior to the scheduled departure time. This was about 30 minutes after the augmenting crewmember had advised the captain that the LGGL were still installed.
The captain and the FO commenced their pre-flight procedures and checklists, performing allocated tasks as PF and PM respectively. These procedures started about 30 minutes later than normal, relative to the scheduled departure time.
Pushback and dispatch
At about 1247, the pushback driver and the dispatcher, employed by the ground handling agent Swissport, were in a pushback tug vehicle in front of FNP. The ground handlers had finished loading baggage onto the aircraft and were waiting for passengers to board before commencing pushback (using the tug vehicle) and dispatch duties.
While waiting in the pushback vehicle, the pushback driver saw pins and associated flags attached to the landing gear of FNP, which he considered unusual. The pushback driver made multiple attempts to radio the aircraft movements co-ordinator (AMCO) over a period of about 10 minutes, in order to request an engineer to inspect the pins. The pushback driver was unable to contact the AMCO.
At about 1258, seven minutes prior to the scheduled departure time, the pushback driver removed the LGGL pins from the landing gears, but unknowingly left the associated locking sleeves in place. The pushback driver placed the pins in the pushback vehicle.
Shortly after, the pushback driver went into the cockpit to have the load sheet signed by the flight crew. The dispatcher communicated with the crew via a headset plugged into the aircraft, to confirm all doors and panels were secured and that the aircraft was clear to push back. Neither ground handler mentioned the LGGL to the crew.
As FNP was pushed back, at about 1328, one of the LGGL sleeves fell unnoticed from the aircraft onto the taxiway. As FNP took off at 1339, a second sleeve fell from the aircraft onto Runway 21.
Identification of foreign object debris
In the two hours following the departure of FNP, there were a number of reported observations of foreign object debris (FOD) on Perth Airport runways and taxiways.
At 1414, the crew of an arriving aircraft contacted air traffic control to report sighting FOD on Runway 21. A Perth Airport operations officer inspected the runway, but was unable to detect the FOD.
At 1420, another arriving aircraft reported observing FOD at the northern end of Runway 21. A second operations officer located one of the LGGL sleeves adjacent to the Runway 21 precision approach path indicator.
At 1510, the second LGGL sleeve was located in the taxi line behind bay 153/154.
Approach to Christmas Island
On descent into Christmas Island, the flight crew of FNP received a satellite phone call from VARA flight management, who advised of the discovery of LGGL parts at Perth Airport and asked that the flight crew check the flight deck stowage compartment for LGGL pins and sleeves. The flight crew identified that the LGGL parts were missing from the stowage compartment.
Considering the LGGL were unaccounted for, the flight crew identified there was a risk the landing gear was potentially damaged. The flight crew modified their approach plan so that the landing gear was lowered earlier, which gave the flight crew additional time to respond to any abnormal indications.
The approach and landing into Christmas Island was uneventful. The landing gear operated normally and there were no other indications of abnormalities.
Upon landing at Christmas Island, the flight crew notified the on-board engineer that the LGGL had not been stowed on-board FNP. The on-board engineer conducted a visual inspection of the landing gear and underside, and observing no damage, certified that FNP was serviceable.
The planned flight to Christmas Island was part of an Indian Ocean Territory (IOT) service, which VARA operated twice a week. On the day of the occurrence, the service departed from Perth to Christmas Island, before continuing to Cocos Islands then returning to Perth.
Augmented crew
Due to the duty time length for the IOT service, VARA operated the occurrence flight with an augmented crew. The augmenting crewmember on-board FNP was a training Captain who was qualified to perform the roles of both the first officer (FO) and captain.
The augmenting crewmember did not have any specified duties in the pre-flight sequence. However, it was common practice for augmenting crewmembers to conduct the exterior walk-around. The IOT service contained several additional requirements in terms of the pre-departure workload for the flight crew, so delegating the walk-around to the augmenting crew reduced the load on the pilot monitoring.
A320 Landing Gear Ground Locks (LGGL)
Landing gear ground locks are used to ensure physical down-locking of landing gear during towing operations when hydraulic power supply is not available. The LGGL for Airbus A320 aircraft comprise locking sleeves that fit around the landing gear, preventing the collapse or retraction of that gear, and pins that hold the sleeves in place. There are two types of LGGL used on A320s, those which secure the landing gear strut and those which secure the landing gear door actuating cylinder. The LGGLs installed on FNP were landing gear strut lock sleeves.
Figure 1 illustrates the design of the LGGL, whereas Figure 2 shows the LGGL used on FNP.
In normal operations, the LGGL would be removed from the aircraft prior to flight and stored in the flight deck stowage compartment.
Figure 1: Schematics showing design of LGGL strut locks
Source: Airbus, amended by ATSB
Figure 2: LGGL pins, flags and sleeves installed on VH-FNP
Source: VARA
As shown in Figure 1 and Figure 2, the LGGL have several design features to make them conspicuous. The LGGL sleeves are painted red and the pins have high-visibility flags attached.
Under normal conditions, a wire lanyard secures the LGGL sleeves to the pins, preventing separation of the two components. The lanyards were missing for both sets of LGGL on VH-FNP (FNP), a condition that had not been reported prior to the occurrence. The operator conducted a check across their fleet and missing lanyards were also found on two other aircraft.
VARA AMO procedures for using LGGL
The ATSB reviewed the systems and procedures in place to manage the installation and removal of LGGL from VARA A320 aircraft during and after a positional tow.[4]
VARA Approved Maintenance Program A320 (AMP)
This manual provided a detailed description of maintenance procedures for VARA A320 aircraft, and was applicable to VARA Aircraft Maintenance Organisation (AMO) personnel. The AMP did not provide procedures for towing. There were no procedures relating to installing or removing LGGL following a procedural tow.
A320 Aircraft Maintenance Manual (AMM)
This manual described the maintenance procedures for the A320 as specified by Airbus. The AMM stated that safety devices (LGGL) were to be installed on landing gear prior to towing. The AMM did not describe steps for removing LGGL after completing a tow.
Virgin Group Operations Manual: Airport Airside Operations Manual (AAOM)
The AAOM provided instructions for towing Airbus A330 and Boeing 737 type aircraft. The instructions specified the requirement to install and remove LGGL, and that the Aircraft Brake Operator (ABO) riding on the aircraft during the tow was responsible for doing this task for these aircraft types.
The AAOM did not describe towing procedures for A320s, nor the responsibilities of the ABO for this aircraft type. The only mention of landing gear pins on A320s in the AAOM was in the section on aircraft dispatch procedures for A320s and Fokker 100 aircraft. These procedures stated that removal of landing gear pins was the responsibility of the flight crew and engineering.
VARA line maintenance procedures (LMP)
The LMP in effect at the time of the occurrence (dated 11 September 2017), noted that towing should be conducted in accordance with the AMM. Limited other guidance was provided in these procedures and there was no documentation for installing or removing pins as part of towing procedures. The section titled ‘Removal of locking and safety devices’ was empty, denoted as ‘Reserved’.
The previous version of the LMP (dated 9 September 2016) provided a summary description of the tasks involved in towing aircraft, but did not document a step for removing LGGL after a tow was completed. The section titled ‘Removal of Locking Devices’ stated:
The captain was responsible for ensuring all locks prior to flight, and must confirm with the first officer that lock pins had been removed and stowed on board the aircraft.
Authorised aircraft maintenance engineers must remove locks and stow them on the aircraft.
The dispatcher would provide an additional check during the pre-dispatch walk-around to ensure all locks had been removed.
Procedures as understood by engineers
The ATSB found that there were no specific procedures for removing LGGL from A320s after a positional tow. Consequently, the ATSB examined the engineers’ understanding of the process for installing and removing LGGL.
At interview, the on-board engineer said that the normal sequence after towing an aircraft onto the departure bay was for the engineer to remove the LGGL and stow them on board the aircraft. The on-board engineer indicated it was not normal practice to leave the LGGL on aircraft.
The apron engineer said it was approved practice for engineers to leave pins in place after towing an aircraft, particularly if the aircraft was likely to sit for a while or may be unserviceable and towed off the bay. In such circumstances, engineers would leave the LGGL installed after performing the tow and only remove the LGGL when they returned to supervise the refuel.
Recent changes to pre-flight engineering duties
In the months preceding the occurrence, changes to the responsibility for performing pre-flight dispatch duties for VARA aircraft affected the procedures used by engineers.
Prior to the change, VARA AMO engineers were responsible for dispatch. The process included a walk-around safety check, including a check of the landing gear prior to the departure of each aircraft. Engineers involved in this occurrence said that any LGGL left installed through the preparation of the aircraft would be removed at this point.
On 21 May 2018, Swissport (then Aerocare) took responsibility for dispatch duties. AMO engineers advised that they continued to conduct informal walk-arounds after dispatch duties transferred to Swissport, although there was no requirement to do so. The on-board engineer advised that he did not perform a walk-around after supervising the refuel of FNP because he perceived that he was running late and there was no requirement to perform a walk-around.
Handover of VARA AMO Engineering Duties
For this incident, the handover of engineering duties for FNP was conducted orally (via mobile phone). The two VARA AMO engineers recalled that they could clearly hear the other. However, their recollections of the handover content differed:
The apron engineer recalled that he advised the on-board engineer that FNP was on the bay and needed to be refuelled. The apron engineer also recalled that he advised that the pins (meaning LGGL) were still installed on FNP.
The on-board engineer recalled that the request was to perform the refuel only and that he was not told that the pins remained on FNP.
The apron engineer recalled he perceived the handover had been effective at the time. Neither engineer recalled confirming their understanding of the remaining tasks following the handover.
The VARA AMO did not have documented procedures or training relating to the handover process between engineers.
Flight crew pre-flight procedures and checklists
Formal procedures and checklists are essential for overcoming the limits of pilot memory, and ensuring that actions are completed in sequence and without omission. According to Degani and Wiener (1990):
The major function of the flight deck checklist is to ensure that the crew will properly configure the airplane for any given segment of flight. It forms the basis of procedural standardisation in the cockpit
The pre-flight procedures and responsibilities for VARA A320 flight crews were described in the Flight Crew Operating Manual A320 (FCOM) and the A320 Quick Reference Handbook (QRH)
Preliminary cockpit preparation
The flight crew perform the preliminary cockpit preparation procedure prior to all flights. The procedure included checking that the three landing gear pins and pitot tube covers were on board and stowed. The QRH assigns this duty to the pilot monitoring (PM).
The FO and the captain indicated that the normal sequence was to check the stowage compartment during the process of exiting the cockpit to conduct the exterior walk-around checks. The stowage compartment on-board FNP was located in such a way that it was difficult to check the LGGL while seated in the flight seat.
The ATSB noted that the check of the stowage compartment was not necessarily dependent on the walk-around, although the crew perceived the tasks were normally performed together.
Exterior walk-around
The exterior walk-around was part of the normal duties for the PM and occurred immediately after the preliminary cockpit preparation procedures. The exterior walk-around comprises a sequential check of the exterior of the aircraft, including checking that the nose, left main, and right main landing gear safety pins have been removed.
The VARA Flight Operations Policies and Procedures Manual (FOPPM) was applicable to all aircraft operated by VARA. The FOPPM described additional procedures applicable where LGGL remain fitted during the exterior walk-around. In these circumstances, the FOPPM stated that the captain must:
Direct that the LGGL are removed prior to taxiing.
Confirm the LGGL have been removed by the display of the locks/pins by an authorised person from an appropriate position on the ground.
Acknowledge (in the form of a ‘thumb up’ sign) indicating he/she is satisfied that all locking devices have been removed. (The first officer can also perform this acknowledgement).
The augmenting crewmember performed the exterior walk-around for FNP according to procedure, before returning to the aircraft and telling the captain that he had observed the LGGL were still installed. The augmenting crewmember conducted this walkaround while the remaining flight crew were waiting in the passenger cabin. However, there is no evidence that the captain subsequently directed or confirmed the removal of the LGGL as documented in the FOPPM.
Before start checklist
The Before start checklist is part of the Normal checklist and is called after cockpit preparation is completed. The VARA A320 Normal checklist was designed such that all actions should be completed from memory prior to the flight crew calling for and performing the Normal checklist, reading from a laminated card. The VARA FOPPM stated:
The normal checklist is the most effective method of identifying procedural omissions and is the last line of defence in preventing an undesired aircraft state.
The Normal checklist is a challenge-response type checklist. The pilot flying (PF) was responsible for calling for the checklist, while the PM was responsible for reading checklist items. The PF was then responsible for checking the relevant system, before responding to the PM. For the ‘Cockpit Prep is completed’ checklist item, both the PM and PF are responsible for confirming the status of the aircraft.
The Before start checklist was designed to be performed in two parts, with the parts separated by a line. The crew had to perform checks of seven aircraft systems before pushback, then four further system checks after pushback. The first two items on the checklist were:
Cockpit Prep is completed
Gear Pins and Covers are removed
The captain reported that although he was aware the flight crew did perform the Before start checklist, he did not have a specific memory of this checklist from the occurrence flight. The FO did not report any details about the Before start checklist either. Consequently, the ATSB could not verify the specific actions of the flight crew in conducting this checklist. It is not unusual for individuals to have difficulties recalling a particular iteration of a highly-practiced task, and no inference is made regarding the captain’s difficulty remembering the Before start checklist for this flight.
Procedural tasks and errors
Procedures and checklists are important defences against equipment failures and other adverse events, and the failure to perform them properly can have severe consequences for flight safety.[5] Nonetheless, research has found that checklist deviations occur relatively frequently, relative to other forms of deviation from operating procedures. Such deviations include missed checklist items, procedures performed at inappropriate stages of flight, verbal response to checklist items without actually sighting the item, and performing flow-check procedures as read-do (Dismukes and Berman, 2010).
A substantial body of research has investigated conditions associated with checklist and procedural deviations in the context of aviation. In particular, research on prospective memory errors in aviation has identified a number of task situations that increase prospective memory demands and may increase the likelihood of error.
Episodic tasks
In situations where pilots are required to remember to perform an action at a later time, prospective memory is negatively affected when that action is not usually performed. In the context of flight operations, the time between forming an intention and the window of opportunity to act, is often filled with other tasks and demands that will divert a pilot’s attention away from what they need to remember to do. In such circumstances, pilots often forget to perform the delayed task.
The flight crew of FNP were required to delay their usual checks, including checking the on-board stowage compartment and acting on the report from the augmenting crewmember, until they were able to access the flight deck. The captain reported that by the time he was able to access the cockpit, other information had ‘got in front’ of the augmenting crewmember’s report.
Interruptions
Interruptions during the pre-flight sequence can significantly affect flows and checks. Line observation research showed that flight crews experience frequent and unpredictable interruptions during pre-flights, which takes their attention from allocated tasks (Loukopoulos, Dismukes and Barshi, 2001). This research also showed that because interruptions mean pilots were required to form and defer intentions, this increased the likelihood of error.
During the pre-flight preparations for this flight, the crew experienced several interruptions. The captain recalled there were inaccuracies in the maintenance log and loading documentation, and that he needed to attend to this and re-check the documentation prior to certifying the airworthiness of FNP. Moreover, the pre-flight sequence involves a high level of workload for the flight crew, with many competing requirements. In the context of the preparation of FNP, there were other tasks and demands the flight crew attended to after gaining access to the flight deck.
Loss of normal cues and routines
As normal procedures are highly structured, and flight crews conduct these procedures over many hundreds of flights, the procedures become highly habitual over time. Along these lines, Dismukes (2008) reports that pilots often develop significant cue-behaviour associations for routine tasks. Importantly, Dismukes notes that when the prompting cue for those tasks is removed, pilots are more likely to forget to perform the task.
In this occurrence, the normal sequence for the PM pre-flight tasks was in a sequence involving standing up for the intention to leave the cockpit for the walk-around. With practice, the actions associated with standing and doing the walk-around probably developed cue-behaviour associations with other tasks in particular checking the cockpit stowage compartment.
Methods for ensuring procedures and checklists are completed
Formal safety systems and individual strategies can be used to prevent checklist deviations, to help ensure procedures and checklists are performed appropriately.
In terms of formal systems, the operator provided training to support the ability of flight crews to manage distraction and disruption, and assessed flight crew competence on those skills. In particular, pilots received threat and error management classroom training, and were assessed on these skills as part of cyclical simulator training. The classroom training included education for pilots on the effects of distractions and interruptions, and advised crews to manage distraction using a range of techniques, including re-starting interrupted checklists, and using memory aids. The flight crew for FNP had all received passing assessments for threat and error management skills in their most recent simulator assessments, prior to the incident.
The flight crew of FNP recalled a number of strategies, which they normally used while conducting procedural tasks and checklists. The main strategy was to use materials available within the cockpit to create a visual reminder of an outstanding or otherwise required action. For example, the captain described using the pull-down cockpit compass to remind him that further action was required. The FO reported turning the Quick Reference Handbook manual from portrait to landscape orientation to provide a similar reminder. The flight crew also reported using the take-off data cards to create written reminders.
However, these strategies rely on access to the cockpit. In this case, the flight crew’s normal process was disrupted due to delayed access to the cockpit, so their normal strategies were unavailable.
Maintenance log requirements for LGGL
The maintenance log records the details of maintenance activities performed on an aircraft, in order to meet regulatory requirements relating to issuing certificates of release to service. When a maintenance activity is performed, engineers make a maintenance log entry to record the details of that activity, as well as a second entry to certify that the activity is completed.
VARA Continuing Airworthiness Management Organisation (CAMO) procedures did not define installing and removing LGGL as a maintenance activity, so there was no requirement to record these activities in the maintenance log.
Use of maintenance log by flight crews
As part of the preliminary cockpit procedure, the captain reviews documentation, including the maintenance log, to determine the airworthiness of the aircraft. In this way, the maintenance log provides a means of ensuring safety-critical maintenance information is communicated effectively between the flight crew and the engineers.
The captain reported that during the preparation of FNP, he checked the documentation associated with the serviceability of the aircraft, including the maintenance log. However, the log did not contain an entry regarding the LGGL as an entry was not required by the procedures.
Use of maintenance log by engineers
The maintenance log also functions as a means for engineers to determine the maintenance status of an aircraft. The log is relatively unambiguous regarding maintenance activities that are yet to be certified as completed.
In the pre-flight sequence for the occurrence flight, the on-board engineer used the maintenance log to record the stowage of the engineer’s flyaway kit on-board FNP. The maintenance log did not record any activities related to fitting and removing the LGGL, nor was there any requirement to record these activities.
Previous occurrence
On 12 April 2016, a VARA Fokker 100 aircraft departed from Perth Airport with landing gear pins (equivalent to LGGL) attached. The pins had been fitted so that the aircraft could be towed prior to the flight, but had not been removed. The aircraft was required to conduct an air turn-back, and safely landed at Perth Airport.
An internal investigation by the operator found that the captain had conducted an external inspection and identified the pins. However, the captain had regarded removing pins as an engineering function and assumed that they would be removed prior to departure. An engineer had conducted a pre-dispatch walk-around inspection, but had not detected or removed the pins.
The operator subsequently recommended that the VARA CAMO consider making the installation and removal of gear pins an action that requires a maintenance log entry. This would require engineers to sign when pins were installed, and sign-off when they were removed. After a review, the operator introduced an Aircraft Readiness Log, which would perform the same function as described above. The log was introduced on 8 October 2018. The recommended actions had not yet been implemented at the time of the A320 incident on 14 August 2018.
Ground handling context
Ground handler background information
The pushback driver was trained for both the pushback and dispatcher roles for A320 aircraft. On the day of the occurrence, the pushback driver was performing the role of leading hand on an IOT flight for the first time without supervision. Being new to this role, he felt additional pressure to ensure he did everything correctly. The pushback driver also felt pressure to get the aircraft out on time, because he did not want delays to affect his subsequent flights that day.
Prior to this occurrence, the pushback driver had removed pins from Boeing 737 aircraft. The pushback driver described this as being done to assist the engineers, and as having occurred under the supervision of the engineers. The pushback driver recalled that the 737 has pins in a similar position to the LGGL on the A320. He also thought the A320 LGGL were equivalent to pins on a 737 and was not aware that the A320 LGGL had a sleeve. The on-board engineer also recalled instances of ground handlers assisting engineers by removing pins from aircraft.
The dispatcher was trained for the dispatcher duties on A320 aircraft, although was new to the role. When the ground handlers considered removing the LGGL from FNP, the dispatcher deferred to the judgement of the pushback driver.
Ground handler procedures and training
A320 procedures for ground handlers require the dispatcher to perform a walk-around check prior to departure. The procedures also instructed ground handlers to ‘be aware’ of landing gear pins, and indicated that the dispatcher should check that landing gear pins have been removed during the walk-around. The procedures stated that any abnormalities (such as unexpected pins) must be reported to the pilot in command immediately after the walk-around.
The training material for the dispatcher role described a similar procedure to the above. The training materials stated the dispatcher should report anomalies to the captain and/or an engineer.
The ground handler training did not show or describe the LGGL specifically. There was no indication in any training material relating to what the LGGL were, or how they function.
Pushback driver understanding and usual practices
At interview, the pushback driver noted he had been taught that if he saw anything unusual or unexpected on an aircraft, he should ‘tell somebody, either a supervisor or the AMCO, try to get an engineer’. The pushback driver reported he had been taught this during initial training, and could not recall any further reinforcement of this procedure.
The pushback driver reported that, in the context of responding to unusual observations during aircraft preparation, he would normally try to contact the AMCO, to get an engineer. The pushback driver reported this occurred very infrequently, noting that the last time he had cause to contact an engineer about an unusual observation was six months prior to this occurrence.
Factors affecting non-communication with flight crew
The decision to remove the LGGL pins and not contact the flight crew was contrary to procedures and training. The pushback driver reported that he did not consider contacting the flight crew. There were several opportunities for both the pushback driver and the dispatcher to communicate with the crew throughout the pre-flight sequence, and there was no technical barrier to this communication.
The ATSB considered whether a high power gradient between the ground handlers and the flight crew contributed to the non-communication. Pilots have substantially more aviation knowledge and more status in the context of the operation, and this is can lead to a high power gradient between them and the ground handlers. Research has shown that individuals are less likely to raise concerns with individuals they perceive to have significantly more power than they do.
Communication between the ground and the plots is a regular requirement of the ground handler roles, as part of dispatch and receipt duties. The pushback driver reported that he felt ‘fine’ talking to the crew, although he indicated his preference was to communicate with engineers. The pushback driver stated that when he entered the cockpit to deliver the loading information, the LGGL did not seem important and that his main concern was getting the aircraft out. This implies the pushback driver did not mention the LGGL due to a perception of importance, rather than reluctance due to power gradient.
In terms of safety systems which may reduce the problematic effects of power gradients, non-technical skills training completed by the flight crew included content which described the impacts of very high power gradients, specifically the importance of creating an atmosphere where others feel safe to communicate concerns. The flight crew had all received passing assessments for communication skills for the non-technical skills components of their most recent simulator assessments, prior to the incident.
Although a high-power gradient may have existed, there was insufficient evidence to determine that this influenced the non-communication between the crew and the ground handlers.
The handover of pre-flight engineering duties between the VARA Aircraft Maintenance Organisation (AMO) engineers did not effectively transfer the responsibility to remove landing gear ground locks (LGGL) from VH-FNP (FNP).
Handing over duties from one person to another has been found to be associated with increased risk of error and accidents (Parke and Kanki, 2008). The main risk associated with handover is that critical task information is lost. There are two primary mechanisms of possible information loss during a handover: critical information may be omitted, or it may not be correctly received.
The ATSB was not able to establish exactly what was said during the handover, or how it was said. The on-board engineer reported that following the handover, he did not know the LGGL remained on FNP. The two engineers reported different accounts of the handover, further supporting the absence of effective communication. It is likely that one or both form(s) of information loss occurred.
The risk of information loss during handover is influenced by the mode and methods used to conduct handover. Research has shown that oral-only handovers are associated with much higher levels of error, when compared to handovers that supplement oral methods, such as using note-taking or printed information .
Although oral-only handover is associated with greater information loss, effective communication and listening methods can moderate this. These include closed loop communication, where both the sender and receiver actively confirm that the message was transmitted as intended. Research suggests that this is effective at ensuring team members maintain shared awareness, even in complex environments (Bearman, Paletz, Orasanu and Thomas, 2010).
The ATSB did not identify any training or other materials which supported the use of effective communication skills in this context. It is possible that the use of oral-only handovers, and the absence of training or other supports for these handovers, increased the risk of information loss.
Because the handover was not effective, the on-board engineer had no expectation that the LGGL pins may have been in place on FNP when he supervised the refuel. It is likely that this contributed to the on-board engineer actions which resulted in him not detecting the LGGL pins.
Towing procedures not documented
There were no procedures specifying when or how LGGL were to be removed from VARA A320s after positional tows. Procedures which did specify these requirements did not apply to A320s.
Reason (1997) describes how the absence of appropriate formal procedures produces the conditions for the development of work-arounds and other informal practices. Where no formal procedures exist, individuals will tend to improvise and develop procedures based on their own understanding. Such improvisation is associated with high levels of error.
Procedures also facilitate a shared understanding of how and when tasks are done. Research has shown that successful team performance requires that team members develop shared mental models for the job and the task, which relate to how the task is performed, in terms of what procedures are involved. Appropriate, accessible written procedures facilitate the development of this shared understanding between team members.
Although the importance of procedures may seem abstract, these concepts were illustrated in the occurrence. The absence of appropriate procedures for removing LGGL meant that the engineers did not have an appropriate reference for how that task should be performed, and instead used their own informal procedures.
The engineers had different understandings of the task of removing LGGL from A320s. The apron engineer stated that it was accepted practice for LGGL to be left installed on aircraft after positional towing. In contrast, the on-board engineer reported that normal practice was to remove LGGL from the aircraft after a tow.
The absence of a procedure for removing LGGL contributed to the absence of shared understanding between the engineers regarding the removal of LGGL from FNP. This contributed to the LGGL remaining in place throughout the preparation of FNP.
Expectancy affected detection of LGGL
The on-board engineer had opportunity to sight the LGGL after leaving the cockpit and walking to the refuelling panel. It is likely that if the on-board engineer observed the LGGL, he would have removed them appropriately and placed them in on-board stowage compartment. The ATSB determined that the LGGL were likely to have been highly conspicuous, and there were no indications that fatigue or visual obstruction were contributory. However, the on-board engineer reported that he did not expect to see the pins when he supervised the refuel.
Research shows that expectation affects attention and perception, influencing what people detect and whether they attend to information (Wickens and McCarley, 2008). As identified in the phenomena of inattentional blindness, people can fail to detect even highly salient targets when they are not expecting to see them (Simons, 2000).
It is likely that the on-board engineer’s low level of expectancy that the LGGL would be installed on FNP reduced the likelihood he would to detect the LGGL.
Flight crew disrupted in pre-flight procedures
The flight crew of FNP omitted several checks and actions that would normally have detected that the LGGL had not been stowed on-board the aircraft as required. These were:
The captain did not perform the required actions after the augmenting crewmember advised the LGGL remained on FNP during the exterior walk-around.
The first officer (FO) did not check the landing gear stowage compartment.
Neither the captain nor the FO identified that the LGGL were not stowed on-board during the Before start checklist. It is likely that these items were not performed, or that the crew responded to the checklist items without visually inspecting the associated systems.
It is unlikely that role confusion associated with the delegation of the walk-around contributed to the omission of the cockpit stowage check by the FO.
The flight crew were delayed in accessing the flight deck. Consequently, the captain needed to remember that the LGGL had been observed during the walk-around, but could not act on this information for around 30 minutes. The captain did not implement any alternative reminder and relied on his memory to remember to perform a future action. After the crew gained access to the flight deck, they had other demands associated with the pre-flight. It is likely that the delay adversely affected the captain’s ability to remember to act on the LGGL information.
The delay also meant that the crew did not have access to the usual reminders they would employ as a method to ensure checks were performed, as these methods relied on access to the cockpit.
Because the walk-around task was delegated to the augmenting crewmember, the FO varied his normal sequence of pre-flight checks. When the FO entered the cockpit, and sat in the flight seat to conduct his pre-flight checks, there was no requirement to leave his seat because the augmenting crewmember had already performed the walk-around. The sequence of events he normally relied upon to check the stowage compartment was not necessary, so there was no cue for him to check the stowage compartment and this step was missed. In general, it is preferable to manage delays and interruptions by ensuring that procedures are performed in their usual sequence. Where there are known barriers to completing procedures, it may be preferable to delay commencing those procedures until the barriers are removed.
As summarised, the normal pre-flight sequence for the flight crew was disrupted due to maintenance work on the flight deck and delegation of the exterior walk-around check. This contributed to the flight crew not identifying that the LGGL were missing from the stowage compartment on-board FNP.
No maintenance log requirement for LGGL
Installing and removing LGGL was not defined as a maintenance activity. Consequently, there was no requirement for VARA AMO engineers to make maintenance log entries for these tasks. This meant that when the captain reviewed the log during the preliminary cockpit preparation procedure, there was no indication that the LGGL remained fitted to the aircraft and not stowed on-board the aircraft.
In the absence of maintenance log entries, the flight crew relied on visual checks during the pre-flight procedures to check. The context in which these checks occur, being the pre-flight sequence, can be characterised as typically involving a high level of workload, with frequent interruptions and distractions. As illustrated in this occurrence (and in the research literature), such conditions increase the likelihood of flight crews omitting pre-flight checks (Loukopoulos, Dismukes and Barshi, 2001).
This absence of LGGL maintenance log requirements also affected the ability of the on-board engineer to identify that the LGGL remained on FNP. This meant that engineers relied on oral-only methods to communicate the status of this task. As there was no requirement for VARA engineers to conduct a walk-around, there were limited other opportunities for the on-board engineer to notice that the LGGL had not been removed prior to flight.
It is likely that a maintenance log entry relating to LGGL would have provided another opportunity for the flight crew and the engineer to become aware that the LGGL had not been removed and stored on-board FNP before flight.
Pushback driver decision to remove LGGL pins
The pushback driver recognised that the LGGL pins and associated flags needed to be removed before flight. Although it was outside of his procedures, the pushback driver decided to remove the LGGL pins from the landing gear of FNP, but inadvertently did not remove the LGGL sleeves from the landing gear. Because the pins were removed prior to the dispatcher walk-around check, there was no opportunity for the dispatcher to identify the LGGL during that check. Neither the pushback driver nor the dispatcher advised the flight crew that the LGGL had been detected and/or removed. These decisions and the result was influenced by the following.
Time pressure
Research has shown that when individuals make decisions under pressure, they tend to sample less information overall (Wright, 1974), and perceptions of time pressure can reduce decision-making and judgement performance (DeDonno and Demaree, 2008). Time pressure is also associated with the use of less-analytical decision-making.
After attempting to contact the AMCO for around 10 minutes the pushback driver perceived pressure to ‘get the aircraft out’. This perceived pressure was partly due to the pushback driver wanting to perform well as a new leading hand on IOT flights. The ATSB established that there was no pressure explicitly placed on the pushback driver to expedite tasks during the preparation of FNP. It is likely that perceived time pressure influenced his decision to remove the pins from FNP.
Pushback driver’s experience removing pins from Boeing 737s
When the pushback driver perceived the pins on FNP, he recognised this as being similar to prior experiences of removing pins from 737 aircraft. The pushback driver perceived that he would be able to remove the pins FNP, and that this action was required to prepare FNP for flight.
Pushback driver’s lack of understanding of LGGL mechanism
Although the pushback driver correctly recognised the pins needed to be removed before flight (as indicated by the flags), he did not realise the sleeves also needed to be removed. The ATSB noted that the role of a ground handler is limited in scope and responsibility. There was no requirement for a global understanding for aircraft systems or equipment, including the LGGL. Conducting a procedure outside of his responsibility therefore greatly increased risk as his actions were then reliant on an understanding of a system he had not been trained in (Rasmussen, 1983).
Missing lanyards
As the wire lanyard was missing for both sets of LGGL, there was no physical defence to ensure the sleeves could not be left on the aircraft without the locking pins in place. While a last line of defence, such a simple mechanism would have been an effective protection against an occurrence such as this.
Findings
From the evidence available, the following findings are made with respect to the aircraft preparation event involving A320, VH-FNP (FNP) at Perth Airport, Western Australia on 14 August 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
The handover of pre-flight engineering duties between engineers did not effectively communicate the requirement to remove landing gear ground locks (LGGL), contributing to the on-board engineer having no expectation of any further requirement to perform additional checks or tasks relating to the exterior of the aircraft.
There was no formal documentation regarding when LGGL pins should be removed following a positional tow. The absence of a formal process contributed to the LGGL remaining in place throughout the preparation of FNP, and the on-board engineer having no expectation that the LGGL were still installed when he supervised the refuel.
The normal pre-flight sequence for the flight crew was disrupted due to maintenance work on the flight deck and delegation of the exterior walk-around check. This contributed to the flight crew not identifying that the LGGL were missing from the stowage compartment on-board FNP.
The operator did not have a procedure for making maintenance log entries when LGGL were installed and removed. The maintenance log entry relating to LGGL would have provided another opportunity for the flight crew and the engineer to become aware that the LGGL had not been removed and stored on-board FNP before flight.
Rather than inform an engineer or pilot as per procedures, the pushback driver removed the LGGL pins from the landing gear sleeves before pushback. However, as the lanyards attaching the pins to the sleeves was missing and the pushback driver did not understand the LGGL locking mechanism, he removed the pins and not the sleeves.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions in response to this occurrence.
Responding to a previous occurrence involving gear pins (LGGL) not being removed prior to flight, VARA reviewed existing procedures and industry practice. VARA introduced an Aircraft Readiness Log and associated procedures, which meant that an authorised person must sign a log entry whenever LGGL pins were installed and removed, to certify that LGGL have been removed prior to flight. If the aircraft has been towed after the initial check, the check must be performed again. This procedure was communicated to involved parties within VARA, the VARA Approved Maintenance Organisation and VARA Continuous Airworthiness Maintenance Organisation, as well as other affected parties, on 5 December 2018.
The memo issued on 5 December 2018 also updated towing duties for procedural towing. The memo specified that it is the responsibility of the approved brake rider (Aircraft Brake Operator) to ensure that the LGGL are installed before towing, and removed after towing is completed. The memo also specified that the Aircraft Brake Operator document the actions in the Aircraft Readiness Log.
VARA issued a notice to flight crews in April 2019 which instructed them to use a standardised method of stowing LGGL pins and sleeves in the stowage compartment. Flight crews were instructed to stow the LGGL such that the flag ends were partially exposed, to assist with easier identification during the pre-flight inspection.
VARA also issued a ‘Safety Alert’ message to all ground handlers after the incident. This message emphasised that ground handlers should not remove LGGL pins, and instructed them to notify either the pilot-in-command or maintenance personnel if they were to observe gear pins installed during their walkaround or prior to an imminent pushback. The message also showed photographs of A320 and Fokker F100 landing gear with pins installed and removed.
Sources and submissions
Sources of information
The sources of information during the investigation included the:
flight crew
engineers
ground handling personnel
aircraft operator.
References
Bearman, C., Paletz, S. B., Orasanu, J., & Thomas, M. J. (2010). The breakdown of coordinated decision making in distributed systems. Human factors, 52(2), 173-188.
Bhabra, G., Mackeith, S., Monteiro, P., & Pothier, D. D. (2007). An experimental comparison of handover methods. The Annals of The Royal Surgical College England, 298-300.
DeDonno, M. A., & Demaree, H. A. (2008). Perceived time pressure and the Iowa Gambling Task. Judgment and Decision making, 3(8), 636.
Degani, A., & Wiener, E. L. (1990). The human factors of flight deck checklists: The normal checklist (NASA Contractor Report 177549). Moffett Field, CA: NASA Ames Research Centre.
Dismukes, R. K. (2008). Prospective memory in aviation and everyday settings. Prospective memory: Cognitive, neuroscience, developmental, and applied perspectives. NASA Ames Research Centre.
Dismukes, R. K., & Berman, B. (2010). Checklists and Monitoring in the Cockpit: Why Crucial Defenses Sometimes Fail. Moffett Field, CA: NASA Ames Research Centre.
Loukopoulos, L. D., Dismukes, R. K., & Barshi, I. (2001). Cockpit interruptions and distractions: A line observation study. In Proceedings of the 11th international symposium on aviation psychology (pp. 1-6). Ohio State University Press Columbus, OH.
Mathieu, J. E., Goodwin, G. F., Heffner, T. S., Salas, E., & Cannon-Bowers, J. A. (2000). The influence of shared mental models on team process and performance. Journal of Applied Psychology, 85(2), 273-283.
Parke, B., & Kanki, B. G. (2008). Best practices in shift turnovers: Implications for reducing aviation maintenance turnover errors as revealed in ASRS reports. The International Journal of Aviation Psychology, 18(1), 72-85.
Reason, J. (1997). Managing the Risks of Organisational Accidents. Routledge.
Simons, D. J. (2000). Attentional capture and inattentional blindness. Trends in cognitive sciences, 4(4), 147-155.
Wickens, C. D., & McCarley, J. S. (2008). Applied Attention Theory. Boca Raton: Taylor & Francis Group.
Wright, P. (1974). The harassed decision maker: Time pressures, distractions, and the use of evidence. Journal of applied psychology, 59(5), 555.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Virgin Australia Regional Airlines, Swissport, CASA, the captain, first officer, augmenting crewmember and onboard engineer on board VH-FNP, the apron engineer and the pushback driver.
Submissions were received from Virgin Australia Regional Airlines and Swissport. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 0845 Western Standard Time[1] on the 16 September 2018, a Cessna 207, registered VH-MIA (MIA), operated by Kalbarri Scenic Flights, took off to conduct a scenic flight from Kalbarri, West Australia (WA), to East Wallabi Island, WA. A pilot and three passengers were on board the aircraft.
The pilot had conducted a short scenic flight lasting about 45 minutes earlier that morning. She had around 30 minutes between flights to prepare the aircraft for the second flight.
The pilot advised that she briefed the passengers on the safety aspects of the aircraft before taking off. The flight proceeded past the township of Kalbarri and then along the shoreline before heading to East Wallabi Island, part of the Abrolhos Islands, at about 2,500 ft above mean sea level.
The aircraft overflew the island and the pilot reported that she observed the windsock was indicating an easterly wind, which was a crosswind for both runways. She decided to join runway 36 on the mid-crosswind leg of the circuit. The pilot reported that she touched down on the runway abeam the taxiway (see Figure 2), which normally gives her enough runway length to stop the aircraft. However, on this occasion, she could not stop the aircraft and overran the runway end by approximately 1 metre (Figure 1). The aircraft was not damaged and there were no injuries to the pilot or passengers.
Figure 1: VH-MIA after runway excursion
Source: Sue McAuliffe
Runway strip
The runway strip on East Wallabi Island is a privately owned unsealed strip. It is 637 m long and 30 m wide. The pilot reported that it slopes down slightly in the middle and has soft sand at one end. The windsock is on the western side of the runway on a slight hill.
Figure 2: East Wallabi Island runway and Kalbarri, North Island and East Wallabi Island
Source: Google Earth, annotated by ATSB
Weather at East Wallabi Island
East Wallabi Island does not have a dedicated weather forecasting service, but weather observations from North Island, which is 20 km north-west of East Wallabi Island, indicated that the wind was from the south at approximately 8 knots. This would indicate that the wind was almost all tailwind at the time the aircraft landed.
Pilot comments
The pilot reported she had checked the weather before they had departed on the first flight that morning.
The pilot reported that the approach and landing appeared normal until the aircraft did not slow after the aircraft touched down on the runway. She had slowed the aircraft to 80 kts on the final leg of the approach and touched down at the normal speed. She applied brakes as normal, released and then reapplied the brakes, to ensure the wheels did not lock, as this was a gravel strip.
The pilot reported that she used the position of the taxiway along the runway as her decision point as to whether she was going to conduct a go-around. As everything felt normal at that stage, she did not conduct a go-around.
The pilot reported that she was not fatigued. She had a day off the day before the incident. She had slept normally and had risen at her normal time of around 0530. She had arrived at the airport at around 0700, which gave her plenty of time to prepare for the flights. She was not feeling time pressure and the workload for the flight was normal.
She also advised that she had flown to the island a number of times and knew the strip well.
Operator comments
The operator reported that the aircraft was loaded within the aircraft limits.
The operator has discussed the incident with the pilot. They have stressed the importance of checking the windsock on the final leg of the circuit to ensure there is no downwind component, especially on a short runway. The operator and the pilot have also discussed the importance of using all available weather data, in particular the observations page on the Bureau of Meteorology website before going flying.
Previous occurrences
A review of the ATSB occurrence database for similar occurrences identified that in the last 10 years there were 14 incidents where a tailwind contributed to a runway excursion on landing. Of these, 11 were excursions where the aircraft ran off the end of the runway. Seven of these aircraft sustained substantial damaged.
Safety analysis
While the pilot advised she had checked the wind as they overflew the runway to join the circuit for runway 36, weather information received from the Bureau of Meteorology indicated that there was a southerly wind at the time the aircraft landed. The ATSB could not clarify if the pilot misread the windsock or the wind direction had momentarily changed when they joined the circuit and returned back to the southerly direction before the aircraft landed. The aircraft most likely landed with a tail wind component resulting in a faster ground speed at touchdown and the aircraft overrunning the end of the runway.
The pilot’s decision to land the aircraft adjacent to the taxiway reduced the available stopping distance available. Using the full runway strip, would probably have allowed the pilot to stop the aircraft on the runway.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
It is likely that the aircraft landed with a tailwind component resulting in the aircraft overrunning the runway.
The pilot’s chosen landing position did not use the full runway strip length, reducing the stopping distance available.
Safety message
This incident highlights the importance of, where possible, landing with a headwind. Landing with a tailwind could result in an increase in the required landing distance by 21 per cent for the first 10 kts of tailwind, according to the United States’ Federal Aviation Administration advisory circular no. 91-79AMitigating the risks of a runway overrun upon landing. They also advise that for some smaller general aviation aircraft (for example a Cessna 152), the landing distance required will increase by 10 per cent for every 2 kts of tailwind. If a pilot is not expecting a tailwind component, there is a significant risk that the aircraft will overrun the runway when operating on a short runway. One way of reducing the chances of landing with a tailwind is to include a check of the windsock during pre-landing checks and to conduct a go-around if a tailwind is detected.
Runway excursions continue to be a safety concern around the world with the Transport Safety Board of Canada recently releasing its Watchlist 2018, which lists runway overruns as one of its two aviation safety concerns for 2018.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 7 September 2018, the pilot of a Yakovlev 9-UM (YAK 9) aeroplane, registered VH-YIX, departed Latrobe Regional Airport, Victoria for a local private flight. The aircraft was observed by witnesses to the north of Moe, Victoria performing aerobatic manoeuvers. A short time later the aircraft impacted the ground in a steep nose‑down attitude, fatally injuring the pilot and destroying the aircraft.
What the ATSB found
The ATSB found that the aircraft entered a spin at low altitude from which it was not possible to recover. There was no evidence of pilot incapacitation, or a mechanical fault with the aircraft that contributed to the accident.
The pilot had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. He was therefore likely unaware of its unique handling characteristics and not adequately prepared to conduct the solo aerobatic flight.
The ATSB also identified a number of other factors that, while not contributory, increased safety risk. These included inadequate aircraft maintenance and operation without important flight and maintenance documentation.
Safety message
This accident highlights the inherent risks associated with performing low-level aerobatics in high performance aircraft. Pilots engaged in such flights are encouraged to observe minimum approved operating heights above the ground, commensurate with their ability and qualifications, and to engage in regular flight reviews and/or flight instruction.
Pilots should also ensure that careful preparation and planning is undertaken prior to each flight and that all documentation, checklists and required manuals are appropriately stored and accessible within the aircraft.
The occurrence
What happened
On 7 September 2018, a Yakovlev 9-UM (YAK 9), VH-YIX was flown from Boonah Queensland, to Latrobe Regional Airport, Victoria. The relocation of the aircraft was undertaken by two separate pilots, with a handover conducted at Dubbo Airport, New South Wales. One of the pilots, an instructor, flew another aircraft from Latrobe Regional Airport to Dubbo. On arrival at Dubbo the pilots swapped aircraft for their respective return flights.
Prior to landing at Dubbo in the YAK 9, the pilot from Boonah opened the forward cockpit canopy in-flight to provide greater visibility for the landing. It was reported that the resultant turbulent airflow from the open canopy ejected a number of aircraft documents from inside the cockpit. After landing at Dubbo, the instructor was advised of the loss of the aircraft checklist, maintenance release, Certificate of Registration, and Special Certificate of Airworthiness from the aircraft.
The instructor conducted an uneventful flight back to Latrobe Regional Airport in the YAK 9, and landed at about 1155 Eastern Daylight-saving Time.[1] He refuelled the aircraft with 341 litres of aviation gasoline and parked the aircraft on the Latrobe Valley Aero Club hardstand at 1244.
One of the aircraft’s owners (the pilot) met the instructor on arrival. The pilot told the instructor that his intention was to conduct some taxi practice prior to a pre-arranged instructional flight scheduled for 1630 that afternoon.
The instructor and the pilot discussed the absence of the checklist and other required documents. The instructor reported that they agreed that the aircraft should not be flown, but taxiing would be acceptable, provided the aircraft’s operating temperatures were monitored. The instructor then proceeded inside the aero club to prepare another student for a training flight.
Sometime later, the instructor heard the pilot attempting to start the YAK 9. After numerous starting attempts, the instructor went outside to assist the pilot to apply the correct starting sequence.
At about 1420, the pilot began to taxi the aircraft, which was witnessed by two aircraft engineers standing outside a hangar at the northern end of runway 21. The aircraft was taxied along to the run-up bay. The witnesses observed that the rear canopy of the aircraft was open and that the pilot appeared to conduct routine engine checks. A short time later, the aircraft entered runway 21, the pilot applied power and commenced to take-off.
The instructor, who was walking across the tarmac from the aero club, recalled observing the take-off roll of the YAK 9 and noted that the aircraft used more than double the normal length of runway before it lifted off. The instructor then noticed that the rear canopy was not secure.
He attempted to contact the pilot from within the aero club by radio to advise him that the rear canopy was not secure. The instructor made several broadcasts but did not receive a response from the pilot. However, another pilot in the area responded to the instructor’s radio call, which confirmed that the radio call had been broadcast.
The YAK 9 initially maintained runway heading as it continued to climb. At 1428, it was identified by military radar turning off runway heading to the west at about 130 kt (Figure 1). The aircraft climbed to about 2,600 ft above mean sea level (AMSL). About 4.6 km to the south‑west of Latrobe Regional Airport, it was observed on radar to level out.
Figure 1: Flight track of VH-YIX
Source: Google Earth with annotations by ATSB
At 1431:09, the aircraft was about 18 km to the north-west Latrobe Regional Airport at about 2,800 ft, and travelling at 206 kt groundspeed when the pilot began to conduct what ground witnesses assessed as aerobatic manoeuvers. Radar contact with the aircraft was lost during those manoeuvres. The aircraft briefly reappeared on radar at 1431:34, at about 3,100 ft, (2,900 ft above ground level) with a groundspeed of 157 kt. This was the last contact received by radar, and showed a 49 kt reduction in groundspeed during the 25-second period when the aircraft was not visible on radar.
Figure 2: Video captured by a witness with overlayed ATSB analysis
Source: Witness footage with ATSB analysis and annotations
Witnesses in the Moe region, who were actively watching the aircraft from the ground, observed the YAK 9 conduct a series of what appeared to be aerobatic manoeuvers. One witness described what appeared to be a roll followed by a loop. They stated that as the aircraft came out of the bottom of the loop, the aircraft appeared to conduct an abrupt left turn before it began spiralling towards the ground. Video taken by another witness showed the aircraft in a spinning, steep nose‑down attitude prior to disappearing from view (Figure 2). These four frames were captured over 0.48 seconds.
At about 1432, the aircraft impacted terrain in a paddock about 3 km north of Moe, in a flat, slightly right‑wing and nose-low attitude, with little to no forward movement (Figure 4). The aircraft was destroyed, and the pilot was fatally injured.
The pilot held a Commercial Pilot Licence (Aeroplane), issued in March 1983. At the time of the accident, the pilot held the appropriate aircraft ratings and endorsements to operate the YAK 9. The pilot had undertaken an aeroplane flight review with an instructor in a twin-engine Cessna 310, about two weeks prior to the accident.
In August 1997, the pilot conducted spin training in a basic aerobatic training aircraft. At that time, the pilot also received an aerobatic endorsement. This qualification permitted the pilot to perform basic aerobatic manoeuvres such as loops, aileron rolls, slow rolls, barrel rolls and stall turns. The endorsement contained an altitude restriction which required the pilot to have completed any aerobatic manoeuvre by 3,000 ft above ground level.
Experience
The pilot was a relatively experienced private aircraft operator, and had operated a number of ex‑military, high-performance warbird aircraft. The pilot had logged over 2,000 flight hours in multiple aircraft types, and had flown about 100 hours in warbird aircraft. The pilot had recorded a total of 1.9 hours in VH-YIX as at 29 March 2018, however it was reported that a number of additional flights were undertaken in the aircraft but not recorded in the pilot’s logbook. The instructor who had overseen all of the pilot’s operation of the aircraft estimated that the pilot’s experience in the YAK 9 was about 5‑6 hours.
As part of transitioning to operate high-performance warbird aircraft, the pilot had voluntarily undertaken a significant number of instructional flights in warbird aircraft since 2011. Flight training records and instructor interviews indicated that the pilot normally required debriefing in a number of areas after these flights. Basic warbird aircraft handling issues were identified as the most prevalent debriefing points. However, the use of checklists and correct procedures were also identified a number of times. Several different instructors noted in the pilot’s training records that he needed to fly often to retain currency and consistency in operating warbird aircraft.
The pilot had conducted aerobatics in a number of high-performance warbird aircraft in the two years prior to the accident, however he had not flown the YAK 9 in over 3 months, and had not previously conducted aerobatics in the aircraft.
Medical
The pilot conducted an aviation medical examination on 10 July 2018 and was issued a Class 2 aviation medical certificate on 31 July 2018. Limitations placed on the pilot’s medical certificate required distance vision correction to be worn whilst flying and reading correction to be available whilst exercising the privileges of the licence. A review of the previous five years of medical files did not identify any medical concerns. The post-mortem examination found no evidence of any medical conditions that may have affected the pilot’s performance.
The pilot was reported to be excited about the return of the YAK 9 to Latrobe Regional Airport, and took a flight bag when departing for the airport that morning. However, family members reported that the pilot was uncertain if he would fly the aircraft that day.
Aircraft information
General
The YAK 9 is a two-seat, low-wing, aerobatic[2] aircraft with retractable landing gear. At the time of design, it was intended to perform the role of an advanced wartime aerial combat platform. Manufactured with front and rear flight controls, the primary flight controls are located in the front cockpit section with independent, secondary flight controls located in the rear passenger cockpit.
VH-YIX was manufactured in Russia in 1996 and exported to the United States shortly after construction without an engine. A Special Airworthiness Certificate issued for the purpose of experimental exhibition was granted on 20 February 2004 to allow the aircraft to operate in the United States. Logbook entries indicate that an Allison V-12 liquid‑cooled engine was installed and on 12 April 2004, the aircraft had flown 1.5 hours. The aircraft was imported to Australia and was placed on the Australian civil aircraft register on 19 July 2004, as VH-YIX.
Handling characteristics
As part of dive recovery, most aircraft require the application of rearward pitch control input to raise the nose and ease out of a dive. Experienced YAK 9 pilots reported that the aircraft exhibited a divergent pitch control that was more pronounced when it had a rearward centre of gravity. This characteristic, which is different to most other warbird aircraft, meant that the effort required to pull back on the control stick reduced as the airspeed increased during a high-speed dive. That behaviour increases the possibility of the pilot over-controlling the aircraft with excessive pitch-up input. This, in turn, increases the risk of unintentionally entering a high‑speed stall by exceeding the wing’s maximum angle of attack[3] and entering a spin.[4]
The YAK 9 flight manual emphasises the need for smooth and deliberate control inputs for aerobatics. A high-speed stall occurs when the airflow over one or both wings of an aircraft detaches and becomes turbulent due to a high angle to the relative airflow.[5] At this point the addition of a yawing force, most typically due to an out of balance condition, begins to rotate the aircraft into a spin. These forces will continue until control input from the pilot stops them. High‑performance aircraft like the YAK 9 transition into a fully developed spin quicker and more forcefully than a typical light training aircraft. It is essential during recovery from a spin to have sufficient altitude to effect the recovery. Experienced YAK 9 pilots stated that, depending on pilot experience, 5-7,000 ft is required to safely recover the aircraft from a developed spin.
The YAK 9 flight manual states that recovery from a spin (Figure 3) also requires considerable forward control stick movement to hold the aircraft in a dive until the speed builds up. It also warns pilots not to energetically over-control the elevator during dive recovery as the aircraft may ‘wing rock’, which is a symptom of impending stall. Should too much rearward control stick application continue, then the aircraft may re-enter a stalled state that may lead to a further spin.
It is an Australian regulatory requirement that the aircraft maintenance history is documented in the aircraft and engine logbooks. A review of the aircraft’s logbooks indicated that the YAK 9 was operated in Australia for about 106 hours before the aircraft was damaged in a landing incident at Tyabb, Victoria, in September 2015. The aircraft underwent a significant repair process, which was completed on 21 October 2016. The aircraft logbook indicated that, as part of the repair the:
rudder and port aileron had been removed, repaired, recovered and refitted
fin and port wingtip had been repaired
engine was removed, bulk stripped and refitted
propeller was overhauled and propeller blades replaced
centre and rear cockpit canopy transparencies were removed and replaced.
An independent inspection of the flight control system was undertaken relating to the rudder and port aileron refit.
Following the purchase of the aircraft from the original owner, a maintenance provider conducted a periodic inspection, and a maintenance release was issued on 20 December 2017. The aircraft’s total time in service was 107.9 hours when it became registered to the pilot on 22 January 2018.
Entries in the maintenance release[6] indicated that it flew a further 15.9 hours before the day of the accident. The last recorded entry on the aircraft maintenance release was dated 29 May 2018 and listed a total time in service of 122.8 hours with no recorded outstanding maintenance or defects. It was reported by the ferry pilot that prior to departing Boonah, there were no outstanding recorded maintenance or defects.
It was originally reported that the Yak 9 was relocated to Queensland for maintenance, however the only maintenance performed on the aircraft during its time at Boonah related to checking the security of coolant hoses. It was subsequently reported that the aircraft was primarily flown to Queensland to attend, and conduct a display at, an air show.
Requirements for the carriage of a documents in flight
The Civil Aviation Regulations 1988 (CAR) require that the pilot-in-command of an aircraft carries, as a minimum on the aircraft during flight, the maintenance release and the flight manual (if any).
Paragraph 139 (1) (c) of the (CAR) also directs that an aircraft shall not commence a flight unless there is a valid maintenance release or other approved document in force, covering the period of the proposed flight. This is to ensure that the pilot-in-command:
is informed of any defects in the aircraft
is able to determine that all required maintenance on the aircraft has been completed and certified
can determine that no maintenance requirement will become due during the time of the proposed flight.
Pilots familiar with operation of the YAK 9 reported that there was little provision to store flight documents in the cockpit. When preparing to land the aircraft, it was common for a pilot to open/slide the forward canopy rearward to allow for a better view of the landing area during the final turn for landing. On a previous occasion, opening the forward canopy in flight resulted in the loss of the aircraft maintenance release and the aircraft checklist. At that time, the maintenance release was re-issued by an approved maintenance organisation.
A similar situation occurred when the aircraft arrived at Dubbo, on its return flight to Latrobe Regional Airport on the day of the accident. As a consequence, the aircraft departed Dubbo without the maintenance release or checklist. The instructor reported that on arrival at Latrobe Regional Airport, he asked the maintenance provider to arrange a replacement maintenance release for VH-YIX. However, before a maintenance release could be reissued, the aircraft departed the airport without an aircraft checklist or current maintenance release.
In the case of VH-YIX, the aircraft checklist was incorporated into, and formed part of the flight manual. Neither the flight manual nor the maintenance release were located at the accident site.
Rear canopy
The rear canopy of the YAK 9 can be secured from the rear seat inside the cockpit, or prior to flight from the front seat. Securing the rear canopy from the front seat requires the front seat pilot to face backwards in order to lock the rear canopy in place, prior to resuming the control seat.
The YAK 9 pre-flight checklist specifically requires that in single seat operations, prior to starting the engine, the rear seat must be properly prepared by securing the seatbelt assembly to prevent interference with the aircraft’s controls, and the rear canopy is also to be locked in place prior to taxi. It is not possible to secure the rear canopy once seated from the front seat.
Wreckage and impact information
On-site examination
The accident site was in a flat grazing paddock, 19 km west-north-west of Latrobe Regional Airport. The aircraft collided with terrain close to the fence line of two properties.
Figure 4: Major features of the wreckage at the accident site
Source: ATSB
The site inspection confirmed the presence of all the major flight control surfaces including trim tabs, the tailplane, fuselage and wings.
Fuel burns to grass were identified forward of the aircraft’s orientation. This was the result of the highly compressed wing structure rupturing the main leading edge fuel tanks, allowing fuel to escape on impact, chemically burning vegetation adjacent to the accident site.
The lack of wreckage trail, high compression of the aircraft structure and close proximity of the majority of the aircraft pieces indicated an impact at a high vertical speed with little forward movement.
Figure 5: Right wing structure impact damage
Source: ATSB
Ground impact marks and aircraft damage indicated that the YAK 9 collided with terrain in about a 30° right wing low, and 30° nose‑low attitude (Figure 5). This attitude and wreckage distribution was consistent with the wreckage pattern of an aircraft established in, or partially recovering from, a spin.
One propeller blade separated from the aircraft at impact and the other two sustained damage consistent with the engine operating under low power at the time of the accident. Witness reports of engine popping and backfiring prior to impact were consistent with the engine operating in a dive with a reduced power setting. The inspection of the engine and its controls did not reveal any defect that may have prevented its operation. The availability of fuel, serviceability of the ignition and engine control systems and a lack of structural defects, indicated that all systems appeared serviceable during the flight.
In combination with the propeller blade damage, it is likely that at the time of impact with terrain, the engine was operating, however at a low power setting.
The flight controls were present and accounted for at the site. Examination of the systems did not reveal any pre-existing defects that may have inhibited normal operation.
Some anomalies were noted within the wreckage during the ATSB’s on-site phase of the investigation, these included:
the rear canopy was not accounted for within the wreckage at the accident site - it was subsequently located by a land owner in a nearby paddock
one of the rear seat rudder control balance cables and pulley had detached from the airframe
internal corrosion was identified within the compromised structure of the welded steel fuselage
unsecured fasteners in the forward and rear seats
rear-seat seatbelt assembly unbuckled and unsecured.
Rear canopy
The rear passenger canopy was located approximately 500 m to the south-east of the impact site. The proximity of the canopy in relation to the accident site, in combination with the recorded radar track of the aircraft during the final moments of the flight, indicated that the canopy most likely separated from the aircraft during the vertical descent.
Assessment of canopy photographs identified that the canopy was relatively intact, sustaining only minor damage upon separation from the aircraft and some further damage on impact with the ground. The canopy’s transparency contained two large cracks on the left and right side; originating at the forward corners of the canopy frame and extending rearward. The transparency was contained within its alloy frame. The forward part of that frame, identified as the canopy bow, had buckled in a rearward manner, likely due to impact with the ground (Figure 6). There was no evidence that the rear canopy contacted the aircraft structure, including the flight controls, following detachment.
Figure 6: Forward looking view of the rear canopy
Source: Insurance assessor image with ATSB annotations
Rear rudder control assembly
The YAK 9-UM is a tandem two-seat aircraft. Each seating position has independent rudder cables running from the rudder, through a series of pulleys, to the rudder pedals. To balance the movement of each rudder pedal position in each seat, a balance cable ran between the left and right rudder pedals. This ran through a series of pulleys to ensure that if one rudder pedal was depressed then the other would raise. Each rudder control, for both the forward and rear seating positions, was independent of each other. This means that in the event of a failure in one, the other would function appropriately.
On-site wreckage examination identified that the passenger right-side rudder balance cable pulley had separated from its mount within the airframe structure. The castellated nut, washer and accompanying split pin that would normally secure the pulley bolt to the airframe tube were not able to be located and there was no evidence that the fastener had failed due to force associated with the impact sequence (Figure 7).
Figure 7: Rear right rudder pulley, found away from the airframe.
Source: ATSB
An additional anomaly was noted with the left-side rudder pulley. Although the castellated nut was present on the bolt threads to that pulley, no split pin had been fitted. Furthermore, even if one had been fitted, the fastener arrangement would not have prevented loosening of the castellated nut (Figure 8).
Figure 8: Left side rear rudder balance cable bolt and castellated nut
Source: ATSB
Internal corrosion within tubular structure
During the on-site examination of the wreckage, corrosion was noted inside a number of airframe tubes. The rear cockpit‘s rudder balance cable pulley structure also had evidence of internal corrosion. The pilot’s seat rear mount cross-member had separated from the tubular side frames of the forward cockpit, revealing further evidence of internal corrosion. Internal corrosion was also found in the tubular steel structure of the fuselage. It was noted that there was little provision for applying and draining corrosion-inhibiting products to the internal surfaces of the tubes.
Further examination
ATSB identified other anomalies during the on-site examination of the wreckage. There was evidence of incomplete maintenance activity, with further examples of missing split-pins, in the rear-seat mounting bolts and nuts. A split-pin was also missing from the pilot’s seat lower mounting bolt securing nut, which was engaged by several threads, with the locking portion of the nut disengaged.
The rear seat was found outside the aircraft near the tailplane with the individual straps of the seatbelt assembly loose. The position of the seat indicated that significant force/s had been applied to it, raising the possibility that the rear seatbelt assembly became unclipped during the impact sequence.
However, the instructor who flew the aircraft to Latrobe Valley earlier that day reported that, on arrival, he removed a bag that had been secured via the harness to the rear seat and left the seatbelt undone in preparation for a planned 1630 flight with the pilot. If that harness was not secured by the pilot prior to the accident flight, the straps may have fouled the control stick and inhibited full and free movement in flight. From the available evidence, it was not possible to determine if that occurred.
VH-YIX departed Latrobe Regional Airport, Victoria at about 1428 and climbed to 2,600 ft before turning to the north and accelerating to over 200 kt north of Moe. The pilot then began to conduct manoeuvres identified by witnesses as being consistent with aerobatics. A short time later the aircraft impacted the ground in a steep nose‑down attitude, fatally injuring the pilot.
This analysis will discuss the development of the accident, including the pilot’s qualifications and readiness for the flight. Aspects of the aircraft maintenance and associated documentation will also be detailed.
Development of the accident
Aerobatic manoeuvres
Witness reports indicated that the pilot was performing manoeuvres consistent with aerobatics, including loops and rolls, immediately prior to an abrupt loss of control.
Analysis of video footage provided by a witness indicated that VH-YIX was established in a spin when the aircraft disappeared from view below 1,000 ft above ground level (AGL). The aircraft damage and localised nature of the accident site confirmed that the aircraft collided with terrain in a right wing‑low and nose‑down attitude at high vertical speed and with little forward movement. That impact signature was consistent with the aircraft established in a spin.
Analysis of radar coverage in that area identified that an aircraft operating below about 1,800 ft above mean sea level would be below radar coverage, and therefore not identifiable on radar. The absence of radar identification of the aircraft during the latter part of the flight therefore indicated that the pilot was operating significantly below his approved 3,000 ft AGL aerobatic limit. More importantly, the aircraft was also well below the altitude that experienced YAK 9 pilots advised was required to safely recover from a spin. As such, and consistent with the observed impact signature, the spin was probably unrecoverable in the height available.
The pilot was qualified to perform basic aerobatics above 3,000 ft AGL, and the aircraft type was appropriate for the aerobatics conducted. However, while the pilot had experience conducting aerobatics, he had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. He was therefore likely unaware of its handling characteristics during such manoeuvres. Specifically, the possible pitch control sensitivities required during aerobatic manoeuvres or spin recovery in the YAK 9.
Additionally, as there was no flight manual/checklist available to the pilot, he was unable to refer to important operational information such as operating airspeeds/limitations during the flight.
In summary, the ATSB concluded that the pilot was probably not adequately prepared to conduct a solo aerobatic flight in the YAK 9.
Canopy
Numerous witnesses recalled that the rear canopy of the YAK 9 was not secure prior to take-off. Consequently, this allowed in flight air loads to slide it fully rearward along its guide rails and ultimately detach it from the aircraft. There was no evidence that the canopy struck any other part of the aircraft as it departed the airframe.
While it remains unknown if an open rear canopy may have a detrimental effect on airflow over the rear control surfaces of the YAK 9, it is unlikely to have been sufficient to cause a loss of control as it was open from the commencement of the take-off. However, the canopy’s departure from the airframe was probably sudden and could well have distracted the pilot. Given the proximity between the canopy and the wreckage location and the flightpath of the aircraft however, it was considered likely that the canopy detached during the spinning vertical descent.
Aircraft maintenance
Defects
Examination of the rear rudder balance cable pulleys identified that the associated fasteners were not correctly secured. Specifically, the required split pins were not fitted and this led to detachment of one of the castellated nuts. Despite that, the design of the pulleys is such that the bolt shank is unlikely to migrate from its installation during operation as cable tension from the rudder control is likely to keep the rudder pulley bolt in place during service.
In addition, wreckage examination also identified unsecured rear seat mounting bolts and an unsecured pilot’s seat mounting nut.
Finally, significant corrosion was identified within the steel fuselage frame. The nature and progression of the corrosion was not at a magnitude to be visually identifiable on the external airframe, however it may have presented a significant future risk to aircraft operation. Russian accredited representatives advised that internal tube anti‑corrosion measures are not applied to the YAK 9, and that no internal surfaces are coated during manufacture.
These observations, while not considered to have contributed to the accident, indicated that maintenance had not been performed on the aircraft to an acceptable standard. That had the potential to affect the future airworthiness of the aircraft.
Documentation
The loss of the maintenance release approaching Dubbo Airport meant that the written means to convey relevant maintenance information or defects was unavailable to both the instructor and the accident pilot. While this did not influence the development of the accident, operation without this document increases the risk that maintenance may be overdue, or that a defect may compromise the safety of the aircraft.
Findings
From the evidence available, the following findings are made with respect to the collision with terrain involving the Yakovlev 9-UM (YAK 9), registered VH‑YIX, which occurred 19 km west‑north‑west of Latrobe Regional Airport, Victoria on 7 September 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
While conducting aerobatic manoeuvers, the aircraft entered a spin and impacted terrain.
The pilot initiated aerobatics lower than his flight activity endorsement permitted and well below the height required to safely recover the YAK 9 from a spin.
The pilot had limited experience and recency in the YAK 9 and had not previously conducted aerobatics in the aircraft. He was therefore likely unaware of its unique handling characteristics and not adequately prepared to conduct the solo aerobatic flight.
Other factors that increased risk
The rear canopy was unsecured before take-off and consequently separated from the aircraft during flight. This increased the risk of damage to aircraft structure, distraction of the pilot and possibly adverse handling qualities.
Post-accident examination of the aircraft identified incomplete maintenance practices, including inadequate airframe anti‑corrosion measures and insecure primary flight controls and seat fasteners.
The aircraft was operated without the maintenance release or the flight manual, which deprived the pilot of important operational and maintenance‑related information.
General details
Pilot details
Licence details:
Commercial Pilot Licence (Aeroplane) issued April 2010
The sources of information during the investigation included:
witness interviews
the pilot’s previous flight instructors
interviews with YAK 9 pilots
the aircraft logbooks and maintenance documentation
the aircraft flight manual and documentation
Airservices Australia and Department of Defence radar data
the Civil Aviation Safety Authority pilot licence and aircraft documentation
the pilot logbook
video and audio information related to the flight.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority, Airservices Australia, Department of Defence, National Transport Safety Bureau, Interstate Aviation Committee, the maintenance provider and the pilot’s recent flying instructor and a subject matter expert in the YAK 9.
A submission was received from the pilot’s recent flying instructor. The submission was reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 15/11/2018
What happened
On 7 September 2018, a Yakovlev Aircraft Factories YAK-9UM aircraft, registered VH-YIX (Figure 1), was being operated on a private flight from Latrobe Regional Airport, Victoria. The pilot/owner of the aircraft was the sole occupant.
The aircraft departed the airport at about 1425 Eastern Standard Time.[1] Recorded air traffic control data showed that the aircraft initially tracked from the airport to the west toward Morwell, climbing to about 2,600 ft and heading north-west near Moe.
Several witnesses described seeing the aircraft conducting aerial manoeuvres to the north of Moe and video footage from a witness showed the aircraft in a steep spiralling dive shortly before it collided with terrain (Figure 2). Other witnesses described seeing the aircraft moments prior to the accident with the engine ‘not revving very loudly’, and ‘making popping noises’. The aircraft was destroyed, and the pilot was fatally injured.
On-site examination of the wreckage and surrounding ground markings indicated that the aircraft impacted terrain in a right-wing low, nose‑down attitude. The tail of the aircraft separated from the fuselage during the accident sequence. Both wings, the forward fuselage and the cockpit were substantially disrupted and compressed from vertical impact forces. An extensive area surrounding the accident site was contaminated with fuel that was released when the wing tanks ruptured. The degree of propeller damage observed on-site was consistent with the engine producing a level of power at the time of impact.
The ATSB recovered a number of components from the accident site for further examination. The aircraft was not equipped with a flight data recorder or cockpit voice recorder, nor was it required to be.
Figure 2: VH-YIX aerial picture of accident site
Source: ATSB
Ongoing investigation
The investigation is continuing and will include consideration of the:
pilot’s qualifications, experience and medical history
recovered aircraft components
maintenance documentation
operational documentation
witness interviews
electronic devices recovered from the aircraft.
The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 19 July 2018, a Quest Kodiak 100 aircraft registered P2-NTZ experienced a nose wheel collapse during landing at Mibu Airstrip, Raicoast District, Padang Province, Papua New Guinea. The Papua New Guinea Accident Investigation Commission (AIC) is conducting an investigation into this occurrence.
As part of its investigation, the AIC requested technical assistance from the ATSB. The ATSB was asked to examine the fractured nose wheel fork to determine the failure mode and if there were any pre-existing defects. To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003.
The ATSB completed the component examination and found that the assembly fractured as a result of overstress with no evidence of pre-existing defect.
The PNG Accident Investigation Commission is responsible for and will administer the release of the final investigation report into this accident. Further information regarding the occurrence can be found at www.aic.gov.pg or specific enquiries should directed to infor@aic.gov.pg.
__________ The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.
Occurrence summary
Investigation number
AE-2018-060
Occurrence date
19/07/2018
Location
Mibu Airstrip, Raicoast District, Padang Province, Papua New Guinea
Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.
On 6 September 2018, the ATSB commenced an investigation into a safeworking irregularity between a suburban passenger train (45-E) and three rail track workers on the Up Suburban Line on 3 September 2018, about 100–200 m from Flemington Station in Sydney, New South Wales.
A protection officer and work group of three arrived at Flemington to place temporary speed restriction warning boards beside the Up Suburban Line on 3 September 2018, in conjunction with a track possession between Homebush and Redfern. Heavy rain prevented the group from immediately accessing the track.
After 25 minutes, the protection officer was contacted by the possession protection officer and advised that the track possession between Homebush and Redfern had been granted. Without conducting a safety assessment or seeking permission from the Flemington area controller, the protection officer and work group entered the rail corridor and moved along the track, towards the location where they intended to place the warning boards.
As Sydney Trains’ Leppington to Circular Quay suburban passenger service 45-E approached Flemington station on the Up Suburban Line at 70 km/h, the train driver saw the three workers on the track. The train driver sounded the horn and applied brake, and the workers moved across to the adjacent Down Suburban Line. The incident was subsequently reported by the train driver as a ’near miss‘.
On questioning the possession protection officer about the presence of a train within the track possession area, the protection officer was reminded that the section where the work group intended to place warning boards was not within the track possession between Homebush and Redfern.
The ATSB obtained the Sydney Trains workplace investigation report and initial incident reports, audio communication between the protection officer and the area controller Flemington, CCTV camera footage from Flemington station, and interviewed the protection officer.
Based on its review of this information, the ATSB concluded that it was unlikely that further investigation of this specific occurrence would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.
Safe work on track is one of the ATSB’s SafetyWatch items. The ATSB is aware that this occurrence has similarities with a number of other occurrences in recent years in the Sydney region, and the ATSB is currently conducting other investigations of safe work occurrences. The ATSB is actively monitoring these types of occurrences.
At about 1040 on 19 August 2018, the train crew of Pacific National train 7MP7, travelling from Cook, South Australia to Parkeston near Kalgoorlie in Western Australia approached the points located at the eastern end of the Coonana train order location. Around 4 hours earlier, the trackside interlocking at Coonana detected that the point machine at the eastern end had not set correctly for the main line following the passage of a previous train. The colour light indicator (enhancer) situated adjacent to the point machine displayed a red light (stop indication) to approaching train crew of 7MP7.
During the approach to Coonana, the train crew of 7MP7 maintained track speed while looking for the light displayed by the enhancer ahead. When they realised that they could not see the enhancer, they braked but were unable to stop train 7MP7 before it traversed the eastern point machine travelling at 44 km/h and derailed. The two lead locomotives, unoccupied crew car and first two platforms of the lead wagon derailed, destroying around 200 m of the main and crossing loop tracks. The train crew were uninjured.
What the ATSB found
Point machines at each end of Coonana crossing loop would normally be set to allow travel along the main line. An incorrectly stored locking pin from a point clamp dislodged and caught in a mechanical pivot mechanism attached to the eastern point machine, preventing the correct movement of the points to reset for the main line after the departure of the previous train.
The ATSB found that during the approach to Coonana the train crew sought to identify and confirm the light displayed on the enhancer. While doing so, the speed of 7MP7 was not sufficiently reduced at the Location Ahead sign to ensure the train could be stopped before the facing points should the light indicator not display a green aspect. Additionally, a breakdown in verbal communication between the supervising and trainee driver resulted in a misunderstanding of the significance of not sighting the enhancer indication when predicted, and the urgency of the intended action to brake the train. Consequently, train 7MP7 approached the eastern end of Coonana at a speed where it was unable to stop before the open points.
The subsequent manipulation of locomotive control inputs in response to the situation highlighted how the on-the-job component of the Pacific National driver competency program did not adequately prepare the trainee driver to control the train in response to an emergency.
What's been done as a result
Post the derailment of 7MP7, the Australian Rail Track Corporation (ATRC) removed all point clamps from the point indicator stands and relocated them to the adjacent equipment huts at each location between Malbooma (South Australia) and Parkeston (Western Australia). Additionally ARTC have replaced all K3 searchlight units with long-range LED luminaire type units between Malbooma and Parkeston.
Pacific National (PN) introduced a SPAD reduction program and reinforced that train crews reduce speed in preparation for stopping short of facing points, until both drivers confirm recognition and understanding of indicator aspects. Additionally PN discussed with ARTC the implementation of improvements to point indicators between Kalgoorlie (Western Australia) and Cook (South Australia).
Safety message
The practice of maintaining momentum approaching a train order location, before confirming the enhancer indication, is an issue that probably affects multiple operators. The variability in the distance for the effective sighting of enhancers and targets at these safety critical locations means the available distance when an indication is sighted may be less than the effective braking distance of the train, which represents a physical gap or limitation in the system. This gap/limitation places the onus on train crews to implement a rule-based procedure to reduce speed at defined locations repeatedly, in preparation for an anomalous event where the enhancer might display a red light (stop indication).
The occurrence
At about 0320[1] on 19 August 2018, a train crew comprising a supervising and trainee driver signed on to duty at Cook in South Australia. They were rostered to work a westbound Pacific National freight train (7MP7) to Parkeston, located near Kalgoorlie in Western Australia (Figure 1). The journey to Parkeston was the return leg of their first round trip[2] together as a crew.
Figure 1: Referenced locations between Cook and Parkeston (Kalgoorlie)
Source: Geoscience Australia, annotated by ATSB
The crew took control of 7MP7 following its late arrival into Cook. After refuelling train 7MP7, the crew received a Train Authority[3] (TA) from the Australian Rail Track Corporation Network Control Officer (NCO). With the trainee driver driving, train 7MP7 departed Cook at about 0347, approximately one hour later than the scheduled departure time. Shortly after, as 7MP7 approached the Koonalda Block Point,[4] the driver performed a routine running brake test,[5] which indicated no abnormality in the train’s braking performance. The lead locomotive intermittently lost traction en-route, activating the wheel slip alarm, causing the train crew to apply various driving techniques in an attempt to rectify the issue and restore tractive effort.
At about 0545, the crew travelled through the main line at Reid, crossing the first in a series of eastbound trains that would be stopped on the adjacent loop track at the respective crossing locations. Around the same time, the crew of an eastbound train (7PM5) were preparing to depart the Coonana loop track, about 500 km ahead. The crew of 7PM5 had completed a similar cross with the preceding westbound train to 7MP7.
To depart the loop track, a crewmember from 7PM5 operated a trackside pushbutton to motor the point machine at the eastern end of the yard to the reverse position. Once reversed, the point indicator displayed a yellow dumb-bell,[6] signalling the points had set correctly for the crew’s departure. Shortly after, the rear of train 7PM5 cleared the points at the eastern end of Coonana and the trackside interlocking automatically controlled the point machine to return to the normal position, set for the main line.
At about 0550, the trackside interlocking detected that the point machine had not motored to the normal position within the required time. As the points were not correctly set, the light indicator (enhancer) at the eastern end of Coonana displayed a red light (stop indication) to westbound train crews.
At about 0640, the crew of 7MP7, the next westbound train, passed through the main line at Mundrabilla after crossing another eastbound train stopped on the adjacent loop track. At Mundrabilla, the trainee and supervising driver changed over, with the supervising driver moving into the driver’s position. The supervising driver continued driving through to Wilban, where the trainee driver again changed over into the driver’s position at about 0820. Shortly after, the NCO issued the next TA to the crew, authorising travel from Rawlinna through Coonana to Golden Ridge. The NCO had no information to indicate that the eastern end-point machine at Coonana had not returned to normal for the passage of 7MP7 or that the point indicator was displaying a stop light.
The trainee continued driving, crossing train 7PM5 which stopped in the loop track at Rawlinna. The trainee and supervising driver planned another driver change at Zanthus (about 39 km before Coonana), but the trainee wanted to continue toward Parkeston to gain additional driving experience and route knowledge for the track section in that direction. At about 1020, the crew passed through Zanthus, and the supervising and trainee driver continued to discuss train-handling practices for maintaining momentum on the undulating grades through the sand hills ahead.
Approaching Coonana, the In-Cab Activated Points System (ICAPS) sounded an alert that the crew were approaching a crossing location ahead. The train crew did not need to take any action to the ICAPS alert, as their TA allowed travel on the main line through that location. The train crew cross-called[7] the TA and again discussed the typical train-handling practices for the approach. The trainee driver was also aware of an unposted temporary 80 km/h speed restriction at the eastern end of Coonana, and the need to manage train speed for that restriction. About 2,500 m from Coonana and travelling at about 115 km/h, the train passed the Location Ahead sign.
The trainee and supervising driver were both looking for the indication displayed on the eastern end enhancer, located to the left of the track ahead. From the driving position, the trainee could not discern any indication among the trackside vegetation and was waiting for the supervising driver’s call that he had sighted an indication from the observer’s position. Shortly after, the supervising driver, unable to sight any indication, calmly said to the trainee ‘brakes’. The supervising driver continued to look ahead, searching for the indication.
About 1,700 m from Coonana and travelling at 115 km/h the trainee understood the instruction from the supervisor was in relation to slowing the train in preparation for the 80 km/h speed restriction ahead. The trainee subsequently applied a minimum service airbrake application before incrementally reducing the throttle setting from notch T8 towards idle. Shortly after the supervising driver, still unable to sight an indication, realised the brake application was minimal and that the throttle setting was in power. The supervising driver told the trainee to make a full service application then, shortly after, to put the automatic brake into the emergency position.
About 1,200 m from Coonana and travelling at 110 km/h, the trainee moved the throttle control rapidly through idle to notch D8, the full dynamic braking position. Shortly after, the trainee moved the automatic brake handle toward the emergency position. About 750 m from Coonana, the supervising driver told the trainee to apply the independent brake also. Initially the trainee manipulated the independent brake handle position in order to maintain a light application before the supervising driver said to apply the independent brake fully. About 550 m from Coonana, the supervising driver left his seat and operated the End-of-Train emergency switch located on the driver’s console, in an attempt to exhaust air in the brake pipe from the rear of the train in addition to the automatic brake control setting.
The indication on the enhancer was still unsighted, but the trainee recalled the point indicator appeared to display a green arrow as they approached. Around 500 m from the points, the supervising driver saw a red light displayed on the enhancer. Shortly after, the supervising driver saw that the points were not fully set for the main line and warned the trainee to brace for a derailment (Figure 2).
Figure 2: 7MP7 approaching Coonana eastern end indicators and points.
Source: Pacific National, annotated by ATSB
At about 1045, train 7MP7 traversed the eastern points travelling at 44 km/h and derailed, destroying around 200 m of the main and crossing loop tracks. The two lead locomotives, an unoccupied crew car and wagons RQFY 58G and RRQY 733K-platforms 4 and 5 derailed all wheels (Figure 3). The train crew were uninjured.
Figure 3: Derailed locomotives NR 54 (lead) and NR 120 (trailing).
Source: Pacific National, annotated by ATSB
Post-derailment
Investigators from Pacific National and the Australian Rail Track Corporation (ARTC) attended the site after the derailment to gather evidence. ARTC undertook the onsite inspection and testing of the point machine, point control system and indicators.
Investigators identified that an unsecured locking pin from a point clamp stored on the eastern Point Indicator stand had fouled the pivot mechanism of the Point Indicator, preventing the complete travel of the throw arm and the attached point blade (Figure 4). The left point blade in the direction of travel had not closed against the stock rail, meaning the gauge face[8] of the left running rail was not continuous through the main line. The wheel flanges of the leading locomotive split the points, resulting in the derailment.
Investigators also verified that following the departure of 7MP5 from the eastern end of Coonana, the trackside interlocking restored the enhancer to display a red light. The points commenced motoring from the reverse position toward normal, but were not detected as being locked in the normal position (set for the main line). Additionally, the point indicator attached mechanically to the points had not rotated fully 90⁰ to display a complete green arrow target. The trackside interlocking functioned as designed, with the light indication on the enhancer remaining at red and the point indicator not rotating fully.
On the morning of 23 August 2018, train services resumed via a temporary deviation track. The main line at Coonana remained closed until the completion of the track infrastructure replacement works.
Figure 4: Light and point indicators at eastern end of Coonana post-derailment.
Coonana is located about 170 km east of Kalgoorlie in Western Australia at the 1610.942 km point[9] on the Australian Rail Track Corporation (ARTC) interstate rail network. A Network Control Officer (NCO) manages train movements through Coonana from the ARTC Network Control Centre located at Mile End, Adelaide, South Australia,
Approaching Coonana from the east, the last 10 km of track is tangent, with falling grades of around 1:100 transitioning about 4 km from the points through level to primarily rising grades of around 1:200.
The environment along the train line between Cook and Kalgoorlie is comprised of predominately gently undulating terrain, with low-lying saltbush and scattered over-story of western Myall or Mulga vegetation. At Coonana, there were numerous tall trees bordering the rail corridor on the eastern approach to the enhancer (Figure 6).
Train and crew information
Train 7MP7
Train 7MP7 was an intermodal freight service operated by Pacific National between Melbourne and Perth via Adelaide. The train consisted of locomotives NR 54 (leading) and NR 120 (trailing) hauling 27 wagons for a total length of 1,639 m and gross mass of 3,702 t.
Based on an analysis of the available information, the condition and serviceability of train 7MP7 did not affect its handling in the lead-up to the occurrence, and were therefore not factors in the derailment.
Train crew
The supervising driver was a senior driver, holding a Certificate III in Transport and Logistics (Rail Operations) with around five years’ driving experience. The supervising driver had arranged a shift swap with the mentor driver, who normally worked with and tutored the trainee driver. Prior to the shift, the supervising driver and mentor driver had discussed the proficiency of the trainee.
The trainee driver commenced work with Pacific National in mid-December 2017. Following completion of the classroom component of the training in mid-February 2018, the trainee commenced the practical training (on the-job) component, operating various train services from Kalgoorlie on track sections toward Merredin to the west and Cook to the east. The trainee had driven sections of the track between Kalgoorlie and Cook for about six months, but mainly in the direction toward Cook.
The duration of the Pacific National practical training component was typically 12 months, but a planned train crewing change at the Kalgoorlie depot brought forward the trainee groups’ assessment to October 2018. The rescheduling of the assessment increased the trainee driver’s awareness of the need for additional experience in operating trains on the undulating grades toward Kalgoorlie. This provided impetus for the trainee driver continuing to drive from Zanthus, rather than changing roles with the supervising driver as originally planned.
Toxicology, medical and physiological factors
On returning to the Pacific National offices at Kalgoorlie at about 1800, the crew of 7MP7 submitted to a post-incident screening test for the presence of alcohol or drugs. Each crewmember tested negative to the presence of alcohol or prescribed drugs.
An examination of the trainee and supervising driver’s health assessment records confirmed that their health assessments were current and that the individuals met the required standard prescribed by the National Standard for Health Assessment of Rail Safety Workers. There was no evidence to suggest that any medical or physiological factors affected either crewmember’s performance leading up to or during the incident.
Fatigue
Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission (Battelle Memorial Institute, 1998). Due to these negative effects on cognitive performance, fatigue is a factor that increases the risk of transport accidents.
The crew of 7MP7 had worked train 6PS7 from Kalgoorlie to Cook the previous day (18 August 2018), signing off at about 1720. After signing off, they went to their designated accommodation in Cook and retired for the evening.
The following day, the crew were rostered to commence their shift at 0240 but, as train 7MP7 was running late, Pacific National delayed the crew’s wakeup call until about 0220. The crew commenced their shift at about 0320 on the morning of the 19 August 2018. The crew were about 7 hours and 25 minutes into their shift when the derailment occurred.
The off-duty period provided an opportunity for the crew to attain restorative sleep prior to commencing work. Each driver advised that they had a good sleep and felt rested when they commenced duty. It is unlikely that fatigue adversely affected the crew’s performance during this shift.
Environmental Conditions
The train crew reported that, on departure from Cook, the weather was cold and foggy. The fog cleared shortly after sunrise and approaching Coonana, the weather was clear. The crew advised that the position of the sun (rising directly behind them) could at times adversely affect their ability to sight an enhancer ahead. The signals at Coonana, like many signals from Cook to Parkeston, were oriented approximately due east.
Safeworking system
ARTC managed the safe movement of trains between Cook and Parkeston via a verbal communications based Train Order Working system (TOW). Before issuing a Train Authority (TA), the NCO would verify, through manual procedures, that the proposed route was clear. The NCO could then issue an authority to the train crew, who then recorded the authority on a paper based Train Authority form. The train crew reading the TA back to the NCO validated its content. The TA, once validated, then authorised the train crew to proceed between specified locations and in accordance with any additional instructions, if included.
The train crew were responsible for the setting and verification of points at the locations between Cook and Parkeston. The NCO does not have any visibility of the position of points or the status of trackside light indicators (enhancers) at the locations.
A train crew executing a TA were therefore required to comply with the instructions of the TA together with any additional trackside signs or indications. The train crew were required to implement the applicable operational rules and procedures contained in the ARTC Code of Practice for the Interstate Rail Network (CoP) and ARTC Addendum to the Code of Practice for the Defined Interstate Rail Network (Addendum).
For this occurrence, the NCO issued a sequence of four TA’s to the crew of 7MP7 for the trip from Cook. Each TA authorised the crew to travel along the main line to the next location where a cross with an opposing train would occur (Reid, Mundrabilla and Rawlinna). The Addendum required each train crew undertaking a cross at a train order location to implement specified crossing and passing procedures. The train crew were also required to comply with various Pacific National operational procedures to mitigate the potential for passing a signal at stop.
Train order locations
Between Cook and Parkeston, 22 locations were available to cross or pass trains to a maximum length of 1,800 m. Each location had the facility to operate the points via local controls (push buttons installed on the wall of the equipment tank) or remotely from locomotives equipped with an ‘In-Cab Activated Points System’ (ICAPS). Both the local and remote controls interfaced through trackside interlocking equipment to operate the facing points and the aspect displayed on the respective light indicator. The trackside interlocking also provided the auto-normalisation feature of the point machines.
Remote operation was available provided the locomotive’s ICAPS GPS detected that it was located within a set limit (window), typically a two-kilometre long strike point located five to eight kilometres from the train order location. Within this limit, the train crew could enter a selection to control the facing points ahead. The points were normally set and locked for travel through the main line, therefore a selection by the train crew was only required if the TA instructed the crew to take the crossing loop track.
Each location was similar in track configuration, equipped with trackside signage, targets and light indicators adjacent to the track. The features provided additional information to train crew approaching the self-restoring point machines[10] located at either end (Figure 5).
Figure 5: Typical Train Order Location with Light Indicators and self-restoring points.
Source: Australian Rail Track Corporation
Trains crossing at train order locations
The Addendum contained various procedures for sequencing the crossing or passing of trains at train order locations. In the majority of cases, train crews would undertake a cross, where the authority of the first train crew train to arrive at the location required them to occupy the crossing loop track.
This required the train crew to operate the points to reverse via ICAPS, and reduce train speed toward the target speed of 35 km/h for the turnout at the points. After confirming the correct indications, they were to enter the crossing track and clear the main line.
After stopping prior to the clearance point at the opposite end of the loop, the train crew were to confirm the points ahead were correctly set for the approaching train to travel along the main line. After confirming the points, the train crew were also required to report their arrival at the location to the NCO. The train crew also communicated via UHF radio with the train crew of the approaching train to provide admittance into the location. The train crew of the approaching train were not to proceed beyond the Yard Limit Sign until they received the admittance from the train crew of the opposing train.
Predicted braking distance based on particular train type
The selected trackside location for signals, indicators and signage considered a range of factors in providing train crews with sufficient opportunity to sight and react to the trackside indications. The Train Braking Application Design Standard[11] detailed the typical stopping distances for the particular train-type travelling at various speeds, on an applicable track gradient.
The configuration of train 7MP7 was consistent with the specified train type of a ‘1800 m long Super-freighter braking 115 km/h max’. The ARTC GW-50 brake table illustrated the calculated braking performance for this train type travelling at varying speeds and gradients (Table 1).
The table indicated that the designated stopping distance (with full service brake application to point of stop) for a train travelling at the maximum permitted track speed of 115 km/h and on the track grade approaching the eastern end of the Coonana location would be about 2,124 m.
Table 1: GW-50 Super-freighter stopping distance
Source: Australian Rail Track Corporation. Annotation by ATSB
Trackside signs
Trackside signs provided train crew with either operational or advisory information defined by the shape and colour of the particular sign. The Location Ahead sign provided operational information and was a caution sign, warning train crew of the approach and distance to a location and recognition of its designated name (Figure 6). For the ARTC TOW safeworking system, the typical approach warning distance from the Location Ahead sign to the location’s yard limit advisory sign was 2,500 m. The Addendum described requirements for train crews:
At the location sign in advance of a location equipped with light indicators and/or with point indicators.
The train shall reduce speed, and be prepared to stop before the facing points. The maximum speed may be maintained or resumed when the Train Crew has confirmed that the correct indication is displayed.
The points installed at each end of the train order locations between Cook and Parkeston were equipped with a Point Indicator, positioned adjacent to the main line and mechanically connected via rodding to the self-restoring motorised point assembly. The Point Indicator displayed a standard day/night reflectorised target, indicating to the train crew the direction the points were set (Table 2). Movement of the points operated the mechanical rodding and an attached vertical spindle that rotated the Points Indicator targets through 90⁰ so that only one target faced the oncoming train crew and the other obscured from the drivers view by being side-on. The position of the points normal or reverse determined which target displayed. The positioning of the target next to the track should afford train crew adequate sighting and convey a clear and unambiguous message about the state (direction of lie) of the attached points.
Table 2: Point indicator target aspects
To depart a crossing loop track, a member of the train crew would detrain and operate a local push button control to motor the points to the reverse position. Prior to moving off, there was ample time for the train crew to sight the target indication and confirm the correct lie of the points ahead. Similarly, a crew departing from the main line after stopping for a cross or pass would also have ample time to confirm the lie of the points ahead before moving off. In both scenarios, once the rear of the train cleared the points the trackside interlocking auto-normalisation feature would control the points to return to the normal position (set for the main line) and a corresponding green arrow target displayed on the Point indicator.
A train crew approaching a train order location should also have reasonable opportunity to sight the target indication to determine the correct lie of the points. The engineering standard Signal Sighting and Position[12] defined the primary minimum sighting distances applicable to the Point Indicator target, relative to the approach speed of the train (Table 3). The standard indicated that the positioning of the Point Indicator target should allow the train crew a minimum approach view of 8 seconds.
For locations fitted with point indicators only, the Addendum limited the maximum permissible speed over the points to 70 km/h. The minimum sighting distance for a train travelling at 70 km/h, was 156 m in order to ensure the required 8 seconds of viewing distance. To ensure sufficient distance remained available to stop the train upon sighting the indicator, the driver needed to commence braking approaching the location, prepared for a stop at each location.
Table 3: Minimum sighting distance
Source: Australian Rail Track Corporation
The trainee recalled sighting a green arrow target on the Point Indicator when train 7MP7 was further than 550 m from the eastern end of Coonana. The points were not set for the main line and the Point Indicator had not completed a full 90⁰ rotation due to the Point Clamp pin fouling the pivot mechanism. Although the trainee recalled sighting a green arrow on the target ahead, this was not consistent with the information intended from the Point Indicator display.
Point indicators at train order locations do not confirm that the attached point machine is locked in the indicated position (normal or reverse) consequently train crews needed to slow the train to a speed where the correct target display could be confirmed and points checked, while allowing sufficient distance to stop the train if necessary.
Colour light indicators (enhancer and repeater)
The colour light indicator (enhancer) installed adjacent the Point Indicator provided an enhancement to the standard day/night reflectorised target.[13] The enhancer provided a more conspicuous indicator that the train crew should be able to sight at a greater distance from the facing point[14] enabling them to confirm earlier during the approach that the point machine had set and locked for the correct track. The greater sighting distance meant that if the train crew could confirm a correct indication displayed on the enhancer during the approach to the Location Ahead sign, the train crew could then maintain or resume speed, up to the maximum track speed of 110 km/h, to traverse the facing points.
The colour light indicators were typically equipped with a K3-style Searchlight unit containing an optical system of an incandescent globe, reflector, coloured roundels and lenses intended to provide long-range sighting from a distance of 2,500 m. Following the introduction of the enhancers, ARTC undertook modifications to the K3-style units to rectify significant variations in sighting distance provided between locations. ARTC also substituted the K3-style optical system with a single head colour light unit with a tricolour light-emitting diode (LED) or a multi-head colour light unit with red, yellow and green LEDs at new or upgraded enhancer or repeater installations.
The enhancer indicated the position of the adjacent points and provided additional information on the status of the points at the opposite end of that location (Table 4). Due to sighting limitations caused by topography or other obstructions at some locations, an additional colour light indicator (repeater) may be installed (about 2,500 m before the enhancer) that 'repeats' the indicator aspect (colour) of the enhancer in order to give train crews advance warning of its condition. Coonana did not have repeaters installed.
Table 4: Colour light enhancer aspects
If the points at either end of the location were correctly set for the main line (as was intended in this case), the enhancer should display a steady green light. If the points did not fully transition and set for the main line, the enhancer should display a red light (as occurred in this case). The required action to a red light is to stop and inspect the points.
As the status of the points or enhancers were not known to the NCO, the ARTC Addendum to the Code of Practice required a train crew departing from the crossing loop of a location to:
Where possible, following departure observe that the points have restored for the main line and a steady green aspect is displayed by the light indicator.
The aim of this requirement was to identify any failures before the passage of the next train. In this case, train 7PM5 was the last train to depart the eastern end of Coonana loop. However, given the length of the train, exit speed and the distanced travelled it may not have been possible for the crew to observe the points or light indicator via the locomotive driver's mirrors once the train had completely cleared the crossing loop, and the points had completed the intended function and returned to the normal position.
The train crew of the next opposing direction train (7MP7) stated that as they approached Coonana, they did not see the indication displayed by the enhancer until the train was about 500 m from the facing points at the eastern end.
ARTC engineering documentation
The optimal visibility of the aspect displayed by railway infrastructure defined as a trackside colour light signal or a colour light indicator (enhancer or repeater), of any luminaire type, is dependent on routine maintenance and the correct alignment of the light beam relative to the railway track.
The engineering standard Signal Sighting and Position specified the primary maximum distance to obtain optimal sighting, the maximum sighting distance, was 10 seconds for trackside colour light signals equipped with a standard-type luminaire. The specification of minimum and maximum distances provided drivers with reasonable opportunity to sight and react to the indication, while controlling the risk of read through to a signal in advance. While not specifically referencing being applicable to enhancers or repeaters installed under the TOW safe working system applicable to the Nullarbor Plain, the standard stipulated:
Where there is an absence of geographic markers for the driver (e.g. Nullarbor Plain) or the signal is not significant against the horizon or the sun may be directly behind the signal then the application of long range luminaries is acceptable.
The intention of providing a long-range type luminaire was therefore to provide a sighting distance greater than the typical 10 seconds at the nominated track speed.
The specification Signals–Work on Asset outlined the alignment requirements applicable to trackside colour light signals (including the Searchlight-type) and the routine servicing procedure applicable to both a signal, and enhancer/repeater lamp.[15] The specification required the alignment of Searchlight-type signals (sighting point)[16] to provide a sighting distance[17] of 1,000 m on a main line with straight approach. The specification did not identify whether the signal was fitted with a standard or long-range luminaire nor if the sighting point applied to enhancers/repeaters equipped with Searchlight type units. In contrast, the ARTC documents Signalling Technical Maintenance Plans applicable to Colour Light Type signals (multi-head colour light units) fitted with incandescent or LED type luminaires specified a long-range sighting point of 400 m. The documents did not specifically reference if the sighting point applied to the similar multi-head colour light units fitted to some enhancer/repeater installations.
ARTC engineering documents specified varying sighting points (either 400 m or 1,000 m) dependent on luminaire type. Although the documents specifically related to fixed signals, applicable to safe working systems of signalled areas in the ARTC network the light indications provided by enhancer/repeater luminaires that are similar in appearance to fixed signal luminaires (Searchlight and Colour Light type) were not specifically addressed. The ARTC CoP and Addendum purposely did not classify the enhancer as a fixed signal.
Notwithstanding the related ARTC specifications, no ARTC standards or maintenance procedures contained corresponding reference to the sighting point or distance applicable to colour light indicators (enhancers/repeaters). ARTC confirmed the practice in the field was to align enhancers (and repeaters) to a sighting point 1,500 m in the rear of (approaching) the enhancer/repeater.
Pacific National conducted audits of the enhancer sighting on the east and west approaches to each location between Kalgoorlie and Cook. On each occasion, train crew recorded the distance at which they observed the light indication, together with the time of day and environmental conditions. Crews reported significant variations in the sighting distance to enhancers between each location, due to the direction of approach at a particular location, the time of day or ambient light conditions.
Observations for the western approaches identified four locations[18] where a train crew reported difficulty in distinguishing the green light displayed on the enhancer. Observations for the eastern approaches identified four locations[19] where sighting was difficult due to the ambient light conditions at that time of day or other environmental conditions. Each of the locations identified were equipped with K3 style Searchlight units with an optic system containing incandescent lamps. The two records for the eastern approach to Coonana indicated that in the late afternoon, with overcast conditions, the train crew undertaking the audit sighted an indication from a distance of around 2,250 m.
The drivers of 7MP7 stated that approaching Coonana, the trees adjacent to the corridor, and variations in ambient conditions, made it more difficult to sight enhancer indications at a distance, particularly the enhancers fitted with an incandescent globe such as the one at Coonana. The drivers stated that, for that reason, the eastern approach to Coonana was a particularly difficult location for sighting the enhancer from the driving positon. The drivers stated that from previous experiences, the first sighting of the light indication would usually be from the observer’s position at around 2,000 m from the points. The first sighting of the indication from the driving position would typically occur at around 1,800 m from the points.
Reported enhancer issues Cook to Parkeston
Train crews encountering issues with the operation of the trackside equipment at train order locations report the occurrence to the ARTC Network Control Officer (NCO). Following receipt, the NCO generates a Train Control Report (TCR), logs the report for attendance by maintenance staff and, depending on the nature of the issue, provides warning to other train crews via the ‘Condition Affecting the Network’ procedures.
Between April 2016 and August 2018, ARTC recorded 177 TCR reports relating to issues with trackside equipment between Cook and Parkeston. ARTC recorded ten TCRs related to issues with the enhancer at the eastern approach to Coonana where the indication was displaying red, blacked out, or cycling due to a fault. None of the TCRs related to issues associated with poor visibility of the enhancer indication.
Following the derailment of 3MP5 at Rawlinna in April 2016, Pacific National undertook an audit of sighting distances to enhancers between Cook and Parkeston. The audit identified large variance between the locations in the distance at which the crew sighted the enhancer indication. Notations against the respective enhancer attributed the variations to the type of luminaire (incandescent/LED) and time of day at which the train crew made the observation. Sighting distances recorded against the eastern approach to Coonana varied between 1,500 and 2,300 m. These observations were recorded during the afternoon in overcast to twilight conditions.
Point clamp
ARTC provided a point clamp at selected locations for use by authorised personnel (typically train crew) in the event that a failure of the points prevented them from being correctly set and locked. Once the points are set to the correct position, authorised personnel use the point clamp to secure the points for the desired route, as advised by the NCO. At crossing locations between Cook and Parkeston, point clamps were located on a spigot attached to the point indicator stand.
Post-incident, ARTC provided an image depicting the correct storage method with the point clamp placed on the spigot with the locking pin retained in position (Figure 7). However ARTC could not provide any documentation that instructed authorised personnel on the use of this storage arrangement for the point clamp, or requirements that the point clamp be secured against unauthorised use by installation of a railway ‘S’ type padlock.
Figure 7: ARTC example of correct storage arrangement for a point clamp on a point indicator stand.
Source: Australian Rail Track Corporation
At some time prior to the passage of 7MP7, the point clamp at the eastern end of Coonana was placed on the spigot incorrectly: it was not secured by a ‘S’ type lock and the locking pin was stored in a manner that allowed it to hang loose at the end of its attachment chain. The practice of storing the point clamp on the point indicator stand increased the risk of the point indicator throw arm pivot mechanism becoming fouled.
There was no record of a recent point failure where the NCO authorised the use of point clamp by train crew. ARTC maintenance records indicate the last electrical maintenance inspection of the points occurred on the 22 June 2018. There was, however, no requirement within the electrical maintenance or other inspection procedures for a routine check of point clamp positioning or security.
Pacific National systems
In-cab activated points and GPS location alert systems
The Pacific National NR-Class locomotives were equipped with interconnected ICAPS, and the Pacific National AWARE[20] and GPS location alert systems. The ICAPS equipment facilitated train crews setting the required route at the train order location ahead from within the locomotive cab without having to stop the train at the facing points.
When ICAPS activated, a screen in the locomotive cab displayed a message showing the location name and two touch-screen buttons. An audible tone accompanied the message, alerting the driver that the system was active. If a crossing loop movement is authorised, the crew can command the points to set for the crossing loop. If a main line movement is authorised, the crew can dismiss the message and leave the points in their current position. Similarly, if the crew take no action, the points will remain in their current position (usually set for the main line).
The GPS location alert system is an enhancement to the AWARE system that provides track position information to the train crew when approaching a crossing loop or block point location. The purpose of the system is to ‘prompt the train crew to check their current limit of authority’.[21] If the crew has already made an ICAPS selection for the loop, the alert will not activate since the crew has taken action relevant to the train authority.
The GPS location alert system displays a message on the AWARE screen when the locomotive is about 5 km from the crossing location. A single audible beep also sounds, but there is no requirement to acknowledge the message.
When a locomotive is within 3 km of the crossing location, the system sounds three audible beeps and a message on the AWARE screen. For this alert, the system requires acknowledgement within 10 seconds, using the AWARE system touchscreen located adjacent the co-driver’s position. If not acknowledged, the audible beeps continue with increasing volume until actioned or if the train has travelled 3 km past that particular crossing location.
When the locomotive is about 3 km past the crossing location, the AWARE screen displays a message identifying the name and track kilometre point for the next crossing loop. No audible tone accompanies this message nor is there a requirement for the train crew to acknowledge it.
Together, the combination of systems provide a sequence of messages and audible alerts to the train crew at each location. The systems do not (nor are they required to have) the functionality to provide real-time train location information to network control. Similarly, the systems do not provide information relating to the condition of the points or indicator ahead.
NR locomotive controls
Master controller - Throttle/Dynamic brake handle
The movement of the throttle/dynamic brake handle enables the control of engine speed (Throttle and Idle) and the application of dynamic braking (Setup and Dynamic brake). Movement of the handle toward the driver, through each of the nine available detent positions (Idle to T8) increases the locomotive traction power applied. By pushing the handle to the right through a spring-loaded gate, the driver sets up a dynamic brake application. After passing through the setup detent, the handle’s position can move smoothly through the dynamic operating range from one to eight.
In applying dynamic braking, the NR-class locomotive operations manual recommended drivers apply a 10-second delay when moving the throttle/dynamic brake handle between each of the idle and setup positions before moving into the dynamic braking zone. Pausing the handle operation acts to protect against electrical component failure and prevent excessive train forces.
Automatic brake control
Locomotive NR 54 was equipped with the Wabtec Fast Brake electronic air brake system. The Wabtec system consisted of two major components, the Handle Controller Unit (HCU) and the Pneumatic Operating Unit. The HCU provided the driver with the ability to control separately the application of train or locomotive braking through the operation of the automatic or independent brake handles respectively (Figure 8). The locomotive event logger recorded the brake pipe and brake cylinder pressures resulting from the manipulation of the HCU handles.
Figure 8: Handle control unit located in the locomotive cab to the left of the drivers position.
Source: Pacific National annotated by ATSB
The automatic brake handle had seven detent positions available through the operating range:
Release (REL)
Minimum Reduction (MIN)
70 kPa Reduction (70 kPa)
Full Service (FULL)
Suppression (SUP)
Handle Off (HO)
Emergency (EM).
The operational area between the Minimum Reduction (MIN) and the Full Service (FULL) detent comprised the normal service-braking zone. Positioning the automatic brake handle through this area resulted in typical brake pipe pressure reductions of between 50 and 150 kPa respectively.
Positioning the automatic brake handle further forward engages the detent positons of Handle Off (HO) or Emergency (EM). A driver configures the HCU in the HO position during the setup of the non-driving position whenever a locomotive is a trailing unit in a multi-unit consist or being towed ‘dead’. In the HO position, the brake pipe pressure will reduce at the service rate to 0 kPa. The locomotive brake cylinder pressure will rise to approximately 350 kPa.
The automatic brake handle, when placed in Emergency (EM), will immediately initiate evacuation of the brake pipe air, subsequently reducing the brake pipe pressure to 0 kPa. In addition to the reduction in the brake pipe pressure, placing the handle in the EM position on NR class locomotives will cause the sanding system to deliver sand to the railhead in front of the leading wheels of each bogie. Additionally, if the master controller setting was set in the dynamic braking operational range, the selection of EM will cause the automatic release of dynamic braking and the application of the air brake.
The independent brake handle had two positions available through its operating range:
Release
Full Application.
Moving the handle from Release toward the Full Application position increases locomotive brake cylinder pressure, dependent on the position of the handle through the application zone. Alternatively, when in the application zone, moving the handle toward Release would reduce the brake cylinder pressure.
In the Release position, no independent locomotive braking occurs but the driver has the option to release fully (Bail Off) any locomotive brake cylinder pressure increase resulting from the operation of the automatic brake handle. To Bail Off, the driver depressed the independent handle in the Release position. Similarly, depressing the handle while in the application zone could partially Bail Off the locomotive’s brake cylinder pressure corresponding to the Independent Brake Handles position.
Sense and Brake Unit
The Sense and Brake Unit (SBU) fitted to the rear vehicle of the train provided End-Of-Train information to the cab display unit in the lead locomotive and End-Of-Train emergency braking in response to a driver-initiated command. The operation of an Emergency EOT Switch located on the left side of the driver’s screen console activated an Emergency Dump Valve via the SBU, initiating the release of the brake pipe pressure from the end of the train in an emergency.
End-Of-Train emergency brake application was only available with the SBU ‘Armed’ and confirmed ‘Armed Two Way’. The NR class locomotive event logger did not record the ‘Armed’ status of the SBU.
Locomotive NR54 event logger
Data extracted from the Wabtec event logger on locomotive NR54 displayed the timing of control inputs and braking application during the approach of train 7MP7 to Coonana (Figure 9).
Figure 9: Event logger locomotive NR54
Note: DB = dynamic brake, EAB BP = train brake pipe pressure, EAB BC = Locomotive brake cylinder pressure, TMC = Traction motor current
Source: Australian Transport Safety Bureau
At about 10:41:40, around 2,500 m from the eastern end points at Coonana and passing the Location Ahead sign, the throttle control of locomotive NR54 remained set to full power (Notch T8) and train 7MP7 was travelling at 115 km/h. Around 25 seconds later, a minimum service brake application (50 kPa reduction in brake pipe pressure) commenced. The brake application was likely in response to the supervising driver’s instruction to ‘brake’. The absence of an increase in the locomotive’s brake cylinder pressure, which would typically occur with an automatic brake application, indicated the trainee likely bailed-off using the independent brake handle control.
Shortly after, the trainee rapidly moved the throttle/dynamic brake handle to maximum dynamic braking, Notch D8. The trainee also moved the automatic brake control from the minimum service position further into the service zone, exhausting additional air from the brake pipe and increasing braking effort along the train. The locomotive did not develop brake cylinder pressure due to the dynamic brake interlock functionality. The trainee’s action was likely in response to the supervising driver’s instruction to apply full service and then emergency braking. Train 7MP7 was travelling at around 110 km/h and 1,200 m from the points at Coonana.
The train speed reduced to around 70 km/h, when the trainee driver commenced an application of the independent brake causing an increase in the locomotive brake cylinder pressure. The initial independent brake application was light, with the position of the handle likely adjusted to maintain light independent braking. Around this time, the Supervising driver operated the EOT Emergency switch. Train 7MP7 was 400 m from the points at Coonana.
There was no appreciable change recorded in the rate that air exhausted from the brake pipe following the operation of the EOT Emergency switch. Around 140 m from the points, a full application of the independent brake occurred. Train 7MP7 was travelling at 50 km/h.
The event logger indicated that air continued to exhaust from the brake pipe at a relatively constant rate to a pressure of around 300 kPa immediately before locomotive NR54 derailed. At that time, the remaining air vented almost instantaneously to atmosphere level. This was almost certainly due to a break in brake pipe continuity during the derailment.
The venting rate of the brake pipe prior to the derailment is consistent with a controlled release of air at a service rate, rather than the almost instantaneous release that would typically occur with an automatic brake handle placed in the emergency position.
The braking response of the locomotive and the brake pipe pressure falling to below the 150 kPa reduction, typically attained from a full service application, indicated that the automatic brake handle was likely moved through the service zone to the ‘handle off’ position. The event logger also recorded that the locomotive maintained full dynamic braking from initiation through to the point of derailment, which would not occur following the placement of the automatic brake handle into the emergency position.
Pacific National driver training
Pacific National was an enterprise-based Registered Training Organisation, resourced with facilitators and assessors to conduct training in the workplace at multiple regional sites. The Pacific National worker competency program derived from the applicable Transport and Logistics Training Packages. The Pacific National Certificate IV in Train Driving program instructed train crew in the safe operation of Pacific National train services through a suite of core, specialised elective units of competency, and various supporting Safety Point Lessons delivered through facilitator-led and on-the-job training.
To manage risk associated with multi-site delivery, administrative and regulatory requirements were centralised with the monitoring of the programs by the regional-based line management of the facilitators at the multiple sites. The Pacific National Kalgoorlie Depot managed the delivery of the training syllabus to trainee drivers based at that location.
Competencies in defensive driving
To mitigate the potential for a train crew to pass a signal at stop or exceed their limit of authority, the core and specialist units included training on topics related to the Identification and Response to Signals and Trackside Signs, and Defensive Train Handling Techniques and Strategies. The training associated with defensive train handling encouraged a conservative approach requiring the driver to be aware of the risks and to implement safety actions that suit the environment. Defensive driving relied on the driver knowing the route thoroughly and understanding the capabilities of the tractive effort of the locomotives, and the braking capacity of the train and rolling stock operated.[22]
The associated Single Point lessons provided train crew with a variety of proactive strategies to implement when approaching safety critical situations. Single Point lessons included:
The safety critical zone related to a set time or distance from a known area of increased risk, such as a stopping location, or limit of authority. While in a safety critical zone, train crew were to direct their attention and actions toward safety critical tasks and the implementation of defensive driving and train-handling techniques, to ensure that they controlled train speed during the approach to stop prior to the designated stopping point. The active teamwork strategies reinforced the importance of shared responsibility to ensure safety would not be compromised by any action, inaction, miscommunication or misunderstanding between crewmembers.
Although Pacific National promulgated these lessons within the organisation, the train crew of 7MP7 maintained track speed at the Location Ahead sign and into the safety critical zone at the eastern end of Coonana.
Competencies in operating a train and responding to abnormal conditions and emergencies
Core and specialist units of competency included respectively, responding to abnormal conditions and emergencies when driving a train and driving a train to operational requirements. The delivery strategy for the training activities included a mixture of facilitator-led activities (eight and 16 hours’ duration respectively) and on the job practice/work experience supervised by a mentor driver (30 and 184 hours’ duration respectively).[23]
The training delivery comprised three streams:
Theory and activities in the training room environment.
Practicals/learning on site and on the equipment to gain familiarisation prior to operating.
The on-the-job learning component, with trainees performing the task of driving a train supervised by a mentor driver.
The training room component provided trainees with an understanding of the fundamentals of operating a train and to recognise, report and manage an abnormal situation or emergency. Abnormal situations were identified as incidents or issues during train operations that required an alteration to behaviour, mindset or the performance of an action to correct, but were not life-threatening. Emergencies were incidents that resulted in major impact to the network operations and infrastructure or had the potential for a fatality. The context of the training in responding to emergency and hazardous situations focused on reporting the emergency to the network manager, Pacific National or emergency services. Following completion of the training room component, the trainee transitioned into the on-the-job component.
Trainees were assigned to a mentor driver, working various train services and routes to obtain the necessary competencies in operating rolling stock to Pacific National’s operating requirement. The mentor driver guidelines[24] detailed the expectations of the mentor driver and the training plan for the trainee during the on-the-job component. At the completion of the on-the-job component, a Driver Trainer assessed the trainee against a verification of competence checklist (VOC).[25] The mentor driver should have discussed all parts of this checklist with the trainee to determine that they were both satisfied that all aspects were understood before the assessment by the driver trainer commenced.
The VOC section covering train management on the main line included an assessment task on the operation the automatic brake handle. A driver undergoing assessment was to perform a split, cycle, balance, full service and emergency application. The emergency application included a notation ‘can simulate’. Pacific National advised it did not carry out practical (on-the-job) training in controlling a train when responding to an emergency event, due to operational practicalities and the potential risk to a train if the training was conducted during normal train operations.
Trainees recorded their experiences gained and the demonstration of practical competencies during the on-the job component in a logbook. A variety of assessment processes determined the trainee’s verbal/written knowledge and the practical application of the knowledge/skills for the competency.
Pacific National worker competency programs instructed and assessed the competency of a trainee in responding to abnormal conditions and emergencies through off-the-job training and ad-hoc discussions during on-the-job training between the trainee, mentor driver and finally the assessor. Trainees and assessors recorded the undertaking of these discussions in the trainee’s individual logbook and VOC to provide evidence the training provided, and the assessment of the trainee’s understanding of the theoretical execution of the competency.
Pacific National provided records of the off-the-job training component for the driver of 7MP7 but were unable to verify the content, or if delivery of the on-the-job discussions related to the automatic brake operation competency, occurred prior to the 19 August 2018 accident.
Previous occurrence
The ATSB investigated a similar derailment of train 3MP5 at Rawlinna, Western Australia on 21 April 2016 (RO-2016-005).
Train 3MP5, travelling from Melbourne to Perth, derailed while traversing the eastern end points at Rawlinna. The points failed to fully restore to the normal position (set for the main line) after the previous train departed the loop track, leaving the points in an unsafe open positon. The colour light point indicator (enhancer) worked as designed by displaying a red light when the points were unable to be detected and locked in a safe position. There were minor injuries sustained by the crew.
The ATSB found that the driver’s expectation that the system was likely set for the main line contributed to train 3MP5 travelling at a speed where it could not be stopped before the open points. Additionally, it was likely a common practice for drivers to approach crossing locations without slowing when authorised for the main line. Compounding this was the points enhancer sighting distance being less than the effective braking distance of trains travelling at line speed, thereby increasing the risk of overrun if not displaying a green aspect.
An incorrectly secured locking pin from a point clamp stored on the point indicator stand fouled the indicator pivot mechanism, preventing the self-restoring point machine from motoring the points fully to the normal position (set for the main line). The practice of storing the point clamp on the point indicator stand increased the risk that the moving point indicator throw arm pivot mechanism could become fouled and prevented from operating as designed.
The points were in an unsafe condition for the passage of rail traffic, causing the enhancer to display a red light (stop indication). The fouled pivot mechanism also prevented the point indicator from rotating fully to display a complete green arrow target. (However, it did rotate enough for the green arrow to be a prominent display to the driver.)
There was no automated system to alert the network control officer (NCO) to the condition of the points or enhancers at the train order locations between Malbooma and Kalgoorlie. Around 2.5 hours after the trackside interlocking at Coonana detected that the points had not correctly set, the NCO issued an authority for the crew of train 7MP7 to travel from Rawlinna to Golden Ridge, passing through the main line at Coonana.
The points at train order locations were normally set for the main line, with corresponding green light displayed on the enhancer and green arrow on the point indicator target. Indications other than green should only display following the initiation of crossing or passing procedures by a train crew or when a failure has occurred, such as the points were not correctly set. The timely identification and response to an abnormal indication relied on the actions of the train crew to either sight the red indication at a distance greater than 2,500 m or applying the organisations’ rules and procedures to ensure there was sufficient distance available to stop their train safely should the enhancer indication be at red or blacked out.
The layout of Coonana was typical of all train order locations between Malbooma and Parkeston. ARTC provided a location ahead sign at 2,500 m (nominal braking distance) and an enhancer that theoretically should be visible by crew at a distance of around 2,500 m. The drivers stated that due to the trees adjacent to the corridor combined with variations to ambient conditions and the luminaire type (incandescent globe) used at Coonana, made sighting the enhancer more difficult and first sighting of the indication would usually be from the observer’s position at around 2,000 m from the points. The enhancer at Coonana displayed a red light, which the crew stated did not come into view until train 7MP7 was around 500 m from the points, after the trainee driver could see the Points Indicator.
Generally, the conspicuity of a signal is determined by its size and intensity, its contrast with the surrounding environment, and the visual angle at which it is perceived.[26] It is likely a combination of enhancer luminaire type (incandescent globe), beam alignment, trackside vegetation, ambient lighting and other environmental conditions present at the time adversely affected the conspicuity of the enhancer indication at the eastern approach to Coonana during the approach of 7MP7.
Although sighting the light indicator aspect at 2,500 m or greater is optimal, audits of the sighting points at train order locations found significant variation in distance existed, dependent on the type of luminaire and environmental conditions at the time. Generally, light indicators fitted with LED type luminaires were more conspicuous to the approaching crew providing a greater sighting distance. However, if the train crew could not confirm the light indicator aspect during the approach to the Location Ahead sign, rules and operational procedures required the crew to reduce speed at the sign and be prepared to stop before the facing points until the light indicator aspect could be confirmed. During the approach of 7MP7 this action was delayed until the train was around 1,700 m from the facing points, less than the stopping distance required.
Given the significant distance required to stop a freight train travelling at main line speeds, the vigilance of the crew is essential to ensure that indications, trackside signs and other cues are perceived and actioned appropriately to enable effective train handling. Having established that the train crew had trouble in sighting the enhancer indication and that a reduction in train speed did not commence until around 1,700 m from the points, the remaining analysis focuses on factors influencing the actions of the trainee and supervising driver in the delayed response to cues.
After departing Cook, train 7MP7 travelled along the main line through each of the 16 train order locations before approaching Coonana. The enhancer indication (green light) displayed the correct route had set at each location traversed. With the correct route set, the train crew were able to maintain track speed through the majority of the locations, reducing speed en-route where required to comply with speed restrictions or when crossing an opposing train.
During crossing or passing procedures, train crews of the first train approaching a train order location would be cognisant that they were nearing the limit of their authority, requiring them to stop. Crews would also be preparing to operate point controls to traverse a turnout if their train was to occupy the loop track. In both situations, train crew were actioning instructions contained in their latest train authority (TA) and were therefore conscious of the requirement to reduce train speed toward achieving target values.
Train crews of the second train approaching a location where a cross/pass was to occur were also actioning instructions on their respective TA. Communications between the train crews provided confirmation to the approaching train that the points were set correctly. In each case, the train crews were responding to specific cues requiring an immediate action to reduce train speed approaching a location.
Where the TA authorised travel through a location where no cross or pass was scheduled, the respective organisation’s rules required the train crew to reduce speed at the ‘location ahead’ sign and be prepared to stop before the points, unless they had sighted and confirmed the enhancer displaying a correct indication for the intended route.
The train crew’s experiences in 7MP7 that morning were that the majority of locations did not require a reduction in train speed during the approach. This, coupled with the previous experience that the enhancer at the eastern end of Coonana was difficult to detect and would typically not come into view by both crewmembers until around 1,800 m from the points, probably contributed to the delayed defensive driving actions in response to an unsighted indication and a low expectancy of encountering a restricted signal.
Systems where vigilance tasks (reducing speed at the location ahead sign) are associated with a low likelihood of an outcome (such as there being a restricted indication displayed) tend to produce lower levels of response compliance. High false-alarm rates, where compliance rarely leads to the avoidance of an actual risk, lead to ‘cry wolf’ phenomena, where individuals start ignoring the warnings.[27], [28] As such, the low incidence of unexpected restricted indications at these locations reduces the likelihood of train crews rigorously complying with the organisations’ rules and procedures to reduce speed to target values approaching a location.
This is consistent with other investigations of rail accidents, such as the UK Health and Safety Executive examination of the Ladbroke Grove rail accident, which found:
The chance of human error can be considered to be enhanced where drivers have a high level of expectation regarding the likely signal aspects which will be displayed.
Focussed attention
Human information processing is limited in that each person has finite mental or attentional resources available to attend to information or perform tasks at any particular time. In general, if a person is focusing on one particular task, then their performance on other tasks will be degraded.[29]
Approaching Coonana, the supervising driver focussed attention on sighting the enhancer, predicting that it would come into view, from his position in the locomotive cab, around 500 m after passing the Location Ahead sign. From previous experience, the supervising driver described the task of identifying the incandescent aspect of the enhancer as very difficult, requiring train crew to scan constantly to identify it amongst the background. Attention to this task likely reduced the supervising driver’s awareness of the control inputs and the speed of the train as it passed the Location Ahead sign and approached the points.
The trainee driver focused attention on identifying the speed restriction ahead and on maintaining the train’s momentum in preparation for the rising grades ahead. The trainee had only previously experienced one instance of an abnormal indication displayed on an enhancer. On that occasion, the train was already slowing in preparation to travel along the main line to cross a train in the crossing loop.
Braking actions
Train 7MP7 approached the Location Ahead sign under power at a speed of 115 km/h and no action was taken to reduce power or brake until the call from the supervising driver. The trainee’s previous experiences approaching train order locations, limited route knowledge of the track ahead and understanding that the supervising driver would be the first to identify the enhancer indication likely influenced the trainee’s actions.
When responding to the supervising driver’s instruction to put the automatic brake handle into the emergency position, the trainee’s response of rapidly placing the throttle into the full dynamic position and operating the automatic brake handle to the notch corresponding to the ‘handle out’ position was inconsistent with the action the supervising driver had called for.
Although not placing the automatic brake handle in the emergency position as instructed, the trainee’s action in moving the throttle to the full dynamic position with the brake handle in the ‘handle out’ position resulted in the application of braking effort similar to a service rate of application, while maintaining full dynamic braking on the locomotives. Placing the handle in the emergency position would have resulted in a more rapid reduction in brake pipe pressure but would have also disconnected the additional dynamic braking effort applied by the locomotives.
In-cab communications
The transfer of concise and explicit information between train crew is essential to identify and respond to abnormal or emergency situations promptly, especially when one of the crew is undergoing on-the-job training. Oral communication is imperfect, and meaning is derived both from what is said and how it is said, as well as the nature of the interpretation of the receiver. As noted by Salas, Sims and Burke (2005), ‘very often, individuals will receive very different messages when hearing the same communication because of their own perspectives and biases’.[30] Barriers to effective communication also arise from distraction, stress, incomplete messages and/or ambiguous wording.[31] Lack of common experience, task proficiency and situational awareness additionally impede effective communication of messages between supervisor and trainee.[32]
Due to a roster change with the trainee’s assigned mentor driver, the trainee and supervising driver were working together as train crew for the first time. During the trip from Cook, the supervising driver provided instruction to the trainee on driving techniques and addressing issues experienced with locomotive wheel slip without any misunderstanding of the meaning of the communication between the parties.
Approaching Coonana, the supervisor intended to communicate that the he was unable to sight the enhancer, and that the trainee needed to brake urgently, and substantially. The trainee did not understand the call in this way, interpreting the instruction as being related to reducing speed for the 80 km/h restriction ahead. The trainee subsequently applied a minimum 50 kPa brake application and reduced the throttle power setting. The trainee recounted that the supervising driver was very calm when giving the instruction to brake, and did not appear convey any sense of alarm when speaking. The trainee likely perceived the verbal and non-verbal characteristics of the supervising driver’s communication as routine, and the inability to sight the enhancer indication as inconsistent with a possible impending emergency.
In this case, a breakdown in verbal communication between the supervising and trainee driver resulted in a misunderstanding of the significance of not sighting the enhancer indication, and the urgency of the intended action to brake the train.
A widely practiced approach for supporting effective communication is the use of standardised calls and terminology. An example of this is air traffic control clearances, which are required to adhere to standardised content and structure.[33] Using standard terminology for known, predictable procedures and scenarios reduces the ambiguity of spoken messages. It also provides operational personnel with a standardised lexicon for communicating urgent messages and instructions when identifying and responding to an abnormal event or emergency.
Task competence
Responding to abnormal conditions and emergencies is a core competency. Trainees are required to undertake a minimum of 8 hours of practicals/learning on the equipment to gain familiarisation and 30 hours of on-the-job operation of a train. Although the training program specifies a practical component to the competency, Pacific National advised that they do not provide any practical training to trainee drivers in the application of emergency braking either in a simulator, on a locomotive (static or moving) or during the operation of a train.
The importance of providing a trainee with opportunity to practice new skills is well-established. However, unstructured practice without objectives, appropriate stimulation, and useful feedback has been shown to be counterproductive.[34] Research in aviation shows that training in abnormal and emergency events improves flight crews’ responses to these situations.[35] In a rail context, an abnormal or emergency event might call for heavy brake application.
The absence of equipment-based practicals/learning to gain familiarisation and the on-the-job operation/simulation as part of the Pacific National Certificate IV in Train Driving competency program potentially removes an important learning opportunity in preparing trainee drivers to control a train in response to abnormal situations or in an emergency.
From the evidence available, the following findings are made with respect to the derailment of train 7MP7 at Coonana, WA on 19 August 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
An incorrectly stored lock pin from a point clamp fouled the indicator’s throw arm pivot mechanism, preventing the points from auto-normalising.
The practice of storing the point clamp on the point indicator stand increased risk of the point indicator throw arm pivot mechanism becoming fouled.
The speed of 7MP7 was not reduced sufficiently at the Location Ahead sign to ensure the train could stop before the facing points should the light indicator not display a green aspect.
A breakdown in verbal communication between the supervising and trainee driver resulted in a misunderstanding of the significance of not sighting the light enhancer, and the urgency of the intended action to brake the train.
Other factors that increased risk
The combination of enhancer luminaire type, positioning, and trackside vegetation likely reduced the conspicuity of the light indicator to the train crew of 7MP7.
The driver competency program did not adequately prepare the trainee driver to control the train in response to an emergency.
Other findings
The east end Light Indicator (enhancer) displayed a red lamp to the train crew.
It is unlikely a rolling-stock condition contributed to the derailment.
There was no evidence to suggest that any medical or physiological factor affected the train crew’s performance leading up to or during the incident.
It is unlikely that fatigue adversely affected the train crew's performance during this shift.
Safety issues and actions
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are provided separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Additional safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence
ARTC
Post the derailment of 7MP7, Australian Rail Track Corporation (ARTC) removed all point clamps from the point indicator stands and relocated them to the adjacent equipment huts at each location between Malbooma (South Australia) and Parkeston (Western Australia). Additionally ARTC have replaced all K3 searchlight units with long-range LED luminaire type units between Malbooma and Parkeston.
Pacific National
Pacific National introduced a SPAD reduction program and reinforced that train crews reduce speed in preparation for stopping short of facing points until both drivers confirm recognition and understanding of indicator aspects. Additionally PN discussed with ARTC the implementation of improvements to point indicators between Kalgoorlie (Western Australia) and Cook (South Australia).
Sources and submissions
Sources of information
The sources of information during the investigation included the:
Australian Rail Track Corporation
Pacific National
Train crew of 7MP7
References
Australian Rail Track Corporation, Addendum to the Code of Practice for the Defined Interstate Rail Network, Revision 5.0, 1 July 2018.
Australian Rail Track Corporation, Code of Practice for the Defined Interstate Rail Network, Volume 3, Operations and Safeworking, Part 1 Rules, ARTC Version 3.0, 1 July 2018.
Australian Rail Track Corporation, Engineering (Signalling) Standard, ESC-04-01 Signal Sighting and Position, Version 1.4, 27 October 2010, pp 5.
Australian Rail Track Corporation, Specification, Signals – Work on Asset, Issue 1.1, 4 May 1999.
Australian Rail Track Corporation, Standard Train Braking Application design, ESD-05-03, version 1.1, 21 August 2018
Australian Rail Track Corporation, Train Braking Application Design Standard,ESD-05-03, Version 1.1, 21 August 2018.
Australian Rail Track Corporation, Signalling Technical Maintenance Plans, Signal Colour Light (Incandescent Type) Generic, Service Schedule SS07 12 01 01
Australian Rail Track Corporation, Signalling Technical Maintenance Plans, Signal Colour Light (LED Type) Generic, Service Schedule SS 07 12 11 01
Breznitz, S. (1983), Cry Wolf: The Psychology of False Alarms, Lawrence Erlbaum Associates, Mahwah, NJ.
Burian, B. K., Barshi, I., & Dismukes, K. (2005). The challenge of aviation emergency and abnormal situations. NASA/TM-2005-213462. NASA.
Cannon-Bowers, J.A., Rhodenizer, L., Salas, E., & Bowers, C.A. (1998). A framework for understanding pre-practice conditions and their impact on learning. Personnel Psychology, 51, 291-320.
Civil Aviation Safety Authority (2019). Resource booklet 4: Communication. In Civil Aviation Safety Authority. Safety Behaviours: Human Factors for Pilots (2nd Edition). Australian Government Publishing.
Conference on Railway Engineering, Wollongong, 10 -13 November 2002, RTSA Trans Australian Railway Self Restoring Point System, E.N Fletcher and R.B Kempster, Australian Rail Track Corporation.
Department of Transport and Regional Services, Code of Practice for the Defined Interstate Rail Network, Operations and Safeworking Part 1: Rules, ARTC Version 3.0, 1 July 2018.
Kahneman, D. (2011). Thinking Fast and Slow. Farrar, Straus & Giroux: New York
Kirby, J (1997). Crew Resource Management (CRM) PowerPoint presentation. A presentation of the Salt Lake City Flight Standards District Office (FSDO).
O'Brien, K. A., Cole, B. L., Maddocks, J. D., & Forbes, A. B. (2002). Color and defective color vision as factors in the conspicuity of signs and signals. Human factors, 44(4), 665-675.
Pacific National (NSW) Pty Ltd, Cv40-9i NR Class Locomotive Operators Manual, Version 2.0
Pacific National Accredited course TLIC2078, Learners Guide Part 4 Responding to Network Signals and Indicators/Signs, Version 3.2 10 September 2018.
Pacific National Learning and Assessment Strategy Certificate IV Train Driving, 8 December 2017
Pacific National Learners Guide, TLIC4019 Drive train to operational requirements, Version 3.2, 10/09/2018
Pacific National Learner Guide, TLIC2078 Identify and respond to signals and trackside signs, Version 3.2, 10/09/2018
Pacific National Learners Guide, TLIF4110 Respond to abnormal situations and emergencies when driving a train, version 3.2, 12/09/2018
Pacific National Information Bulletin No. 54A, AWARE Train Radio System, GPS Location Alerter – Driver Information System.
Pacific National Mentor Driver Guidelines, Perth Drivers Depot
Pacific National Driver Mainline Verification of Competence (VOC) Combined Checklist, Version 2.1 November 2016
Rantanen, E. M., & Kokayeff, N. K. (2002, September). Pilot error in copying air traffic control clearances. In Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 46(1), pp. 145-149. Sage CA: Los Angeles, CA: SAGE Publications.
Salas, E., Sims, D. E., & Burke, C. S. (2005). Is there a “big five” in teamwork?. Small group research, 36(5), 555-599.
Sorkin, R. (1989), Why Are People Turning Off Our Alarms? Human Factors Bulletin, 32, pp. 3-4.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Australian Rail Track Corporation, Pacific National, train crew of 7MP7 and the Office of the National Rail Safety Regulator.
Submissions were received from the Australian Rail Track Corporation, Pacific National, train crew of 7MP7 and the Office of the National Rail Safety Regulator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
