Executive summary

What happened

On 28 December 2020, at about 1438 local time, a Dynaero MCR-01 VLA, registered VH-SIP, departed Serpentine Airfield, Western Australia, to conduct a post-maintenance check flight. At about 300 ft above ground level, the engine began to run rough, however continued to operate. The pilot commenced a turn to the left, and the aircraft appeared to decelerate in a nose-high attitude without gaining height. Shortly after, the aircraft was observed to aerodynamically stall, pitch nose-down, and impact terrain. The pilot, who was the sole occupant, was fatally injured, and the aircraft was destroyed.

What the ATSB found

The ATSB found that multiple tasks in the aircraft’s return to service after a significant period of inactivity were not adequately carried out, and that the left carburettor of the aircraft’s engine was missing a component and contained a significant amount of contamination. This likely resulted in over-fuelling of the carburettor at a low power setting, and likely produced subsequent engine rough running at high power settings.

The pilot was unfamiliar with the aircraft and engine type, which increased the risk of not being able to adequately manage an inflight emergency. During the partial power loss on take-off, the pilot turned the aircraft in a likely attempt to land on another runway, when the aircraft stalled.

The ATSB found that the pilot had probably consumed a significant amount of alcohol the night before the accident, which increased the risk of post-alcohol impairment.

Safety message

Ongoing maintenance of an aircraft’s fuel system is essential to ensure fault-free operation of its engine. In particular, the reliability of carburettors is dependent on their condition, and by following the manufacturer’s maintenance requirements and service bulletins.

The ATSB encourages pilots to review and practice the conduct of a pre-take off safety brief before each flight, and highlights the importance of preparedness for possible emergencies on take-off leading to an off-airfield landing. The ATSB further encourages pilots to review the recommended partial power loss procedure in the aircraft pilot operating handbook if available, and cautions against turning back towards the runway unless in controlled situations where sufficient altitude exists. Further information can be found in the ATSB booklet, Avoidable Accidents No.3: Managing partial power loss after take-off in single engine aircraft AR-2010-055.

Pilots transferring from one type of aircraft to another are reminded that there is as much risk in moving to lower performance aircraft, as there is moving to higher performance aircraft. The ATSB encourages pilots to manage this transition using a risk-based approach such as Federal Aviation Administration (FAA) advisory circular AC90-109A – Transition to Unfamiliar Aircraft (U.S. Department of Transportation Federal Aviation Administration, 2015).

This accident is also a reminder that blood-alcohol can persist the day after significant alcohol consumption, and the residual effects of alcohol may impair performance, especially in demanding and time critical situations.

The occurrence

Overview

On 28 December 2020, at about 1438 local time, a Dynaero MCR-01 VLA, registered VH-SIP, departed Serpentine aircraft landing area (ALA), Western Australia, to conduct a post-maintenance check flight. At about 300 ft above ground level, the engine began to run rough, however continued to operate. Shortly after, the aircraft was observed to aerodynamically stall,[1] pitch nose-down, and impact terrain. The pilot, who was the sole occupant, was fatally injured, and the aircraft was destroyed.

Aircraft return to service

Post-maintenance flight checks

On 27 December 2020, the new owner and a flight instructor were a conducting post-maintenance check flight of VH-SIP at Serpentine ALA, after undergoing maintenance after an extended period of inactivity (see Return to service tasks). As they departed from runway 05[2] on climb, at about 200–300 ft above ground level (AGL), the engine lost power and began to run rough. The instructor, who was the pilot in command, reported that they lowered the nose and reduced power, which cleared the rough running and allowed the aircraft to continue flight. There was sufficient power available to continue a reduced climb and conduct a circuit back onto runway 05.

The instructor recalled they then initiated a missed approach on short final approach to runway 05 and commenced a full power climb. While the aircraft engine power initially responded, rough running was again experienced at about 200–300 ft AGL. The instructor again reduced power, cleared the rough running, and conducted a slow climb before making a final landing back on runway 09. Both occupants identified the smell of fuel in the cockpit at the time.

The instructor, the new owner and several other people including the pilot of the accident flight (pilot) assisted a licenced aircraft maintenance engineer (LAME) with troubleshooting the engine rough running that afternoon. Numerous engine-runs were conducted on the ground with multiple witnesses stating that they were able to replicate the rough running and partial power loss during the static full power tests on the ground, both with and without the electric fuel pump assistance. The owner stated that the engine seemed to run smoother with the electric fuel pump on, however engine coughing and rough running was replicated on all of the full power runs to varying degrees. Other witnesses recalled the engine stopping when the throttle was reduced after the engine runs, one capturing the stoppage on video.

Engine troubleshooting

To try and diagnose the problem, basic fuel system troubleshooting was conducted by another LAME on behalf of the original LAME, who was no longer at the airfield. This included the draining and cleaning of the fuel filter on direction of the original LAME by phone. A witness described the contaminants within the fuel drain sample and filter as a significant amount of ‘brown gunk’. The engine troubleshooting continued until early evening, when the aircraft was then hangered for the night with the original LAME scheduled to conduct troubleshooting on the aircraft the next day.

The owner and instructor made the decision to return back to Queensland without the aircraft and have the aircraft ferried over when the rectification work was completed. The pilot, who was known to the LAME, volunteered to ferry VH-SIP from Serpentine to Queensland after working with the LAME to correct the engine problem. The owner accepted the offer before departing Serpentine Airfield back to Perth.

Evening activities

That evening, the local aero club held a dinner at the airfield (see social function). Witnesses confirmed that the pilot attended the event, retiring to their accommodation at about 0200 the following morning.

Accident flight

On 28 December 2020, the pilot and LAME met at the airfield at about 1100. The LAME did not recall the pilot was any different to usual, however did remark that the pilot was consuming significant amounts of water. The pilot assisted the LAME with the running of the engine and mentioned that they had never flown an aircraft as small or light before and had not operated a Rotax engine previously. Subsequently, the LAME explained the absence of a mixture control, use of ignition systems and the operation of the electric inflight adjustable propeller.

The LAME removed the aircraft cowls and inspected the engine compartment for a fuel leak before replacing a newly installed mechanical engine driven fuel pump with the old pump to test positive fuel flow without any blockages as part of the troubleshooting sequence. The LAME identified that the fuel flow increased with the activation of the electric fuel pump.

The pilot conducted a troubleshooting check flight in VH-SIP at about 1415, with the support of a number of ground crew including several LAMEs. On return from the first flight, the pilot reported that the engine was not developing full power (5,500 RPM),[3] and was not able to produce much greater than 4,000 RPM. The LAME provided an additional brief to the pilot on the use of the automatic propeller system and requested further ground runs of the engine.

At about 1438, the pilot conducted a further post-maintenance troubleshooting flight from runway 09 (Figure 1). The LAME stated that they expected the aircraft operation to be a high-speed ground run. At about 300 ft AGL, witnesses described audible changes in the aircraft engine noise, and observed a noticeable change in aircraft performance. They observed the aircraft visibly slow and begin a left turn. Further change in the engine noise was heard before the aircraft was described to commence another left turn towards runway 23. At about 200 ft AGL, witnesses described the left turn beginning to tighten and the aircraft visibly slowing with a nose-high attitude. At about 150 ft AGL, the aircraft’s left wing dropped and the aircraft entered a steep rotating descent to the left. The pilot was unable to recover control of the aircraft before it impacted with terrain.

Figure 1: Aircraft’s flight path and accident site location

Source: Google Earth, modified by the ATSB

Context

Pilot information

Licencing

The pilot held an air transport (Aeroplane) pilot licence. This licence was for single and multi-engine aircraft, with endorsements for tailwheel aircraft, manual propeller pitch change, gas turbine engines, pressurisation and for aircraft with retractable undercarriage.

Aeronautical experience

General experience

The pilot’s logbook showed a total flying experience of 5,999.8 hours, up to the last recorded flight on 31 November 2019, when the pilot ceased airline flying with a carrier in the US, before moving back to Australia.

Aircraft specific experience

The majority of the pilot’s total flight time was conducted in multi-engine, piston and turbine aircraft operations. However, since the pilot’s return to Australia, they had conducted a tailwheel design feature endorsement, an aeroplane flight review, and a number of private flights of the local aeroclub aircraft based at Serpentine ALA.

Although the pilot had considerable experience, a review of the pilot’s logbook records found that they had not previously flown Rotax-powered aircraft or the Dynaero MCR-01 VLA.

Medical

The pilot held a valid class 1 and class 2 medical certificate, with the last examination conducted on 23 January 2020. The pilot’s class 2 medical was valid until 23 January 2022 and included restrictions requiring the wearing of distance vision correction and additionally, that reading correction must also be available whilst exercising the privileges of the licence.

Recent history

The night before the accident, a number of airfield members met for an informal social dinner at the clubhouse facilities. It was reported that a number of people attended the dinner, and that alcohol was consumed as part of the social event. Witnesses reported seeing the pilot drinking alcohol during the dinner, 1 witness recalled that the pilot engaged in a ‘fairly heavy’ drinking session consuming a significant quantity of alcohol. The witness recalled the pilot being in a good state of mind, being exceptionally chatty and, later on, recalled them stating that the pilot was ‘really drunk’.

The social function ended at about 0130 on the morning of the accident. Another witness recalled seeing the pilot shortly before driving home from the airport at about 0147, but did not believe that the pilot was significantly impaired by alcohol at that time. The pilot’s quantity and quality of sleep could not be determined.

Post-mortem and toxicology

A post-mortem indicated that the cause of death was due to multiple injuries that were sustained as a result of the collision with terrain. Toxicology indicated low levels of carbon monoxide, consistent within normal levels, and did not detect any common drugs. Toxicology did not detect levels of alcohol within either blood or urine samples.

Aircraft information

General

The Dynaero MCR-01 VLA is a low-wing, high performance, experimental amateur-built aircraft. It was supplied in kit form and VH-SIP was constructed for the education and recreation of the previous owner. The Dynaero MCR-01 VLA was promoted as suitable for cross-country flying, with an airspeed range from 56 to 200 kt. It could be operated between +3.8 g and -1.5 g,[4] however aerobatic flight and intentional spinning of the aircraft were prohibited.

Airworthiness and maintenance history

The aircraft was constructed from a kit and had a special certificate of airworthiness issued on 15 May 2003, and was first flown on 22 May 2003. The aircraft was powered by a horizontally opposed, 4-cylinder, dual carburettor, Rotax 912 ULS-FR, that was manufactured in May 2002.

On 6 November 2003, the canopy of VH-SIP shattered while the aircraft was in flight. This led to a loss of control and the aircraft entering a spin at altitude. After recovering controlled flight, the pilot conducted a forced landing into a paddock, which resulted in significant damage to the aircraft. VH-SIP was repaired over a period of about 18 months, and during this time, the carburettors were removed, cleaned and refitted. The aircraft was returned to service in April 2005.

Among other work carried out on the aircraft, the logbook recorded that, in September 2006, the carburettors were again cleaned and refitted. The aircraft did not fly between November 2009 and November 2013 (4 years). In August 2013, the original owner conducted maintenance on the aircraft for the last time. The aircraft was flown on 4 occasions in 2014, and then was inactive for over 5 years.

On 13 January 2019 the aircraft logbook indicated that work had been conducted on the fuel system and carburettors of VH-SIP, including a new fuel drain valve, removal and cleaning of the carburettors, the installation of new idle jets, O rings and new carburettor float bowl gaskets. Oil and oil filter replacements were also carried out, and the fuel system was flushed with 10 L of aviation gasoline (AVGAS) before being ground run.

In 2020, the aircraft was offered for sale. A pre-purchase inspection was undertaken on 22 May 2020 by a Recreational Aviation Australia Level 2 maintenance engineer on behalf of a prospective buyer. The engineer did not consider the aircraft to be in an airworthy condition due to contaminants in the carburettors, unactioned carburettor float service bulletins, and the mandatory rubber component replacement requirements had not been carried out. Subsequently, the condition of the aircraft was reported to the prospective buyer and the sale did not proceed.

The licenced aircraft maintenance engineer (LAME) at Serpentine ALA was contacted by another prospective buyer in early December 2020 to conduct a pre-purchase inspection before the aircraft was due to be auctioned. The LAME advised the prospective owner that they considered the aircraft to be in good condition, however it would require an annual inspection. Several days later the LAME was contacted by the buyer and advised of the successful acquisition of the aircraft and requested that the LAME carry out the work required to issue a maintenance release. The last entry in the aircraft maintenance log was on 27 December 2020, the day prior to the accident. It showed the most recent work conducted by the LAME.

Engine preservation and return to service

Preservation and storage requirements apply to aircraft engines fitted to an aircraft, as well as uninstalled engines. The Rotax operator’s manual had preservation and storage requirements for long out-of-service periods that were required to be repeated every year the engine was inactive. This included inhibiting the engine both internally and externally and covering all of the engine’s openings to protect it from dirt and humidity. The line maintenance manual limited the storage period for engines to 24 months, and if this period had been exceeded, the engine required overhaul.

The engine manufacturer had an aircraft engine return to service schedule for Rotax 912 engines after a prolonged period or during preservation. These requirements included conducting the normal 100-hour inspection before flight if the engine has been preserved for greater than 12 months.

Return to service tasks

At the request of the new owner, the LAME performed the return to service over a period of several days. The LAME recalled that, during this work, the floats were removed from the carburettor bowls and weighed for discrepancies, refitted, and a carburettor balance was conducted. The LAME also recalled conducting a fuel calibration by draining and replacing the fuel at set increments to ascertain if the fuel quantity markings were correct. Additional work carried out included a periodic inspection, instrument and systems checks, a compression test, engine idle adjustment, and engine ground runs.

Logbook entries detailed that the airframe was inspected in accordance with the Dynaero schedule and considered airworthy along with entries stating:

• the propeller was inspected and found to have nil defects evident
• the engine was inspected in accordance with the BRP-Rotax 912 maintenance manual and CASA AD/ENG/4 with nil defects evident
• service bulletins for the flaps, main landing gear attach, trim tab attach, and canopy attach were carried out
• pitot-static leak tests
• engine-driven fuel pump was replaced
• the 5-year carburettor rubber part and coolant hose replacement was carried out in addition to fitting a new fuel pump and spark plugs.

A maintenance release was issued by the LAME on 27 December 2020 at an aircraft time in service of 439.3 hours. There were 3 endorsements on the maintenance release:

• an engine oil and filter change at 489.3 hours
• a periodic inspection by 539.3 hours or 26 December 2021
• the oil and fuel hoses to be changed by February 2021.

The LAME recalled that the oil and fuel hose replacement entry had been added because the required parts were not available to be sourced and therefore could not be fitted during the aircraft’s return to service.

The other required parts were supplied by the engine importer directly to the LAME in mid-December 2020. Some of these parts were replaced during the return to service, however a few unused parts in their original packaging were found in the aircraft at the accident site.

After the aircraft was returned to service, it underwent a number of other maintenance troubleshooting checks the day prior to, and the morning of the accident. These checks included the removal and replacement of key parts, such as the refitting the original time-expired engine‑driven fuel pump for troubleshooting purposes, however these changes were not documented.

The pilot also conducted several ground runs along runway 09 before becoming airborne and conducting a circuit.

Fuel

The aircraft operated on AVGAS and had the capacity to carry 79 L of usable fuel, in one 80 L main tank. The aircraft was reportedly refuelled prior to the proposed departure from Serpentine ALA the day before the accident, and the new owner estimated that about 60-65 L would have been on board at the time of the accident. ATSB investigators confirmed a strong smell of fuel at the accident site.

Weight and balance

Weight and balance information retrieved from the accident site indicated the aircraft had an empty weight of 261 kg and a maximum take-off weight of 490 kg. The difference left about 229 kg of useable payload for the pilot and fuel. Weight and balance calculations placed the centre of gravity towards the forward limit of the envelope, and within limits.

Amateur-built aircraft

Pilots and passengers of experimental aircraft in Australia accept the risk that the aircraft may not meet the same airworthiness safety standards as certified aircraft, and operate these aircraft on the basis of informed participation.[5] Most amateur-built aircraft are constructed in Australia for the owners education and leisure, however in time many are sold to other private operators.

Operating limitations

Aircraft operating limitations were contained within the aircraft flight manual and the relevant stall airspeed limitations are detailed in Table 1.

Table 1: Stall speeds at 400 kg maximum take-off weight

Bank angle	0° flaps,[6] power off, knots indicated airspeed (KIAS)	10° flaps, power off, KIAS	25° flaps, power off, KIAS
0º	58	51	44
30º	62	53	47
60º	81	72	62

The flight manual also described the recommended glide speed of the Dynaero MCR‑01 VLA of 70 KIAS with a 13.4:1 glide ratio,[7] indicating that the Dynaero MCR-01 VLA has a higher glide speed compared to many other low inertia aircraft in a similar weight category.

Aerodynamic stall speeds considerably increase beyond a 30° angle of bank turn (Table 1). Pilots should be aware these of characteristics during emergency manoeuvring.

The Dynaero MCR-01 VLA flight manual indicates the emergency procedure for an engine failure after take-off (Figure 2). Specifically mentioned, for engine failures immediately after take-off, is not to attempt a 180° turn to return to the runway.

Figure 2: Engine failure on take-off procedure

Source: Dynaero MCR-01 VLA flight manual

Meteorological information

Bureau of Meteorology graphical area forecast for the Serpentine local area indicated that at the time of the accident, that visibility was greater than 10 km with nil significant weather issues. However, moderate turbulence was expected below 10,000 ft over land in thermals and dust devils.

At about the time of the accident, Jandakot Airport, about 30 km to the north of Serpentine, recorded an easterly wind of about 13 kt with visibility greater than 10 km and no significant cloud or weather.

Witnesses at the airfield described the weather as a ‘belting easterly’ and similar to the previous day with hot, dry and windy conditions.

Wreckage information

Site and wreckage examination

The accident site was located in relatively flat and open farmland (Figure 3), about 200 m east of the threshold of runway 23 at Serpentine ALA. The ATSB conducted an examination of the site and wreckage and identified:

• ground impact marks indicated that the aircraft had impacted terrain nose-down, upright and with left rotation
• flaps were in the retracted position.

No pre-impact defects were identified with flight controls or aircraft structure. The fuel tank, located between the cockpit and engine compartment, had ruptured and a quantity of fuel had leaked into the soil. There was no pre- or post-accident fire.

A damaged GPS device, instrumentation including a fuel flow indicator, the engine, propeller, and fuel lines, were recovered from the accident site for further technical examination by the ATSB.

Figure 3: Accident site

Source: ATSB

Engine examination

The engine was disassembled and examined at a Civil Aviation Safety Authority (CASA) approved engine overhaul facility under the supervision of the ATSB. Apart from impact damage, the main engine components were generally in good condition.

Testing and dis-assembly of the carburettors and fuel system identified:

• the left carburettor was missing a clip that attached the float needle valve to the float hinge bracket
• corrosion was identified in both carburettor bowls and on both sets of carburettor floats
• significant corrosion deposits were found on the float needle valve, seat and on the valve tip
• carburettor floats were the incorrect type
• the right carburettor float guide pin was bent, causing float contact with side of carburettor bowl
• fuel line internals were perished and brittle with splitting at the securing end.

Further details relating to the engine teardown can be found in Appendix B – Engine examination.

Partial power loss

Partial power loss on take-off

The ATSB booklet, Avoidable Accidents No.3: Managing partial power loss after take-off in single engine aircraft (AR-2010-055) (Australian Transport Safety Bureau, 2013), describes partial engine power loss as a situation when the engine provides less power than commanded by the pilot, but more power than idle thrust:

This kind of power loss is more complex than a complete failure, and it can be much harder to stay ahead of the aircraft. The pilot is thrust into a situation where the engine is still providing some power; however, the power may be unreliable, and the reliability may be difficult to assess. As a result, pilots are uncertain about the capabilities of their aircraft, and what their options are.

Partial engine power loss can range from providing very little power to almost full power, with varying levels of reliability of the remaining engine power. When faced with a partial power loss, pilots should not try to diagnose the engine problems at the expense of maintaining aircraft control.

On take-off, once the aircraft climbs to a point where it does not have enough runway to land straight ahead, but is not high enough to safely return to the aerodrome for a landing, it has reached a ’no return’ to the runway decision point (Figure 4). From this point, until the aircraft climbs to a height allowing safe return to the runway, the pilot is faced with conducting a forced landing beyond the prepared surface of the airfield. Decisions made by the pilot in command can be critical to the safety of flight at this point. 

Figure 4: No return decision point

Source: Google Earth, modified by the ATSB

In the event of any emergency during critical phases of flight, such as below 200 ft above ground level (AGL) on take-off in a single engine aircraft without runway remaining, pilots should focus on the priorities of:

• Aviate: maintain glide speed and assess whether the aircraft is maintaining, gaining or losing height to gauge aircraft performance
• Navigate: fly the aircraft to make a landing, if height and power are limited, then an into wind landing, 30° left or right of the centreline is a safer option
• Communicate: Mayday call as appropriate.

Pre-take-off safety brief

The pre-take-off safety brief is a verbal and mentally prepared response, through the pre-visualisation of an emergency on take-off and is generally conducted once all engine run-ups are complete and prior to entering the runway. The brief mentally prepares a pilot with pre-programmed responses to possible unexpected events during this critical phase of flight when decision making time is short.

These anticipated actions in response to certain stimuli, assist pilots in making better decisions in accepting emergency circumstances and safely managing emergencies, especially when an off-airfield landing may be the safest option.

The briefing should include the pilot in command’s intentions in the event of an engine related problem during the take-off roll and after take-off, both with runway remaining and without. This formulates pre-existing mental models of possible actions should an emergency arise. 

A pre-take off safety brief should include:

• consideration of the runway in use, it’s length, surface, boundary fencing and possible forced landing areas beyond the runway, including terrain and obstacles
• wind direction and strength, which will indicate the safest into wind turning options to safely maintain airspeed and provide a lower groundspeed in case of a forced landing beyond the airfield boundary
• consideration of required height and direction of turn, to conduct a turn back to the runway

The ATSB Avoidable Accidents booklet provides sound guidance to pilots on this subject and concludes that:

Generally speaking, if you self-brief your plan of action just before flight, you have more chance of ‘staying ahead’ of the aircraft and being able to concentrate on flying.

The turn back

The turn back is described as the conduct of an emergency manoeuvre to reverse the direction back towards the take-off runway, to either conduct a landing on the reciprocal runway or to land at another runway at the original departure point.

During this critical time, the pilot must assess four main considerations for the safe conduct of a turnback:

• Is the height sufficient to safely turn the aircraft back to the runway?
• Is there remaining power available to continue to climb or maintain height?
• Can a safe airspeed be maintained during the turn, taking into account the increased stall Speed associated with an increased angle of bank to prevent aerodynamic stall?
• assuming that the engine may fail at any time, is the remaining power reliable?

The ATSB Avoidable Accidents booklet noted:

A turnback requires accurate flying during a period of high stress to prevent a stall and possibly a spin occurring. If an aerodynamic stall and or spin occurs, given that these circumstances are likely to be at low level, there is little likelihood of a successful recovery.

There are many scenarios where it might be considered inappropriate to conduct a turnback. For example, consideration should be given to additional hazards such as other aircraft, obstacles, an unfavourable wind component, increased stall risk during a low-level turn and surrounding terrain.

Pilot decision making during partial power loss

The ATSB Avoidable Accidents booklet also detailed influences on decision making affecting pilots:

The course of action chosen following such a partial power loss after take-off can be strongly influenced by the fact that the engine is still providing some power, but this power may be unreliable. As the pilot, you may also have a strong desire to return the aircraft to the runway to avoid aircraft damage associated with a forced landing on an unprepared surface.

Based on an analysis of partial power loss accidents after takeoff, the booklet further noted that pilot decision making is also influenced by the amount of power loss experienced. In situations where power loss is substantial, pilots are more likely to recognise this as being close to a complete loss of power and typically conduct a forced landing outside of the runway environment. However, if the remaining power is sufficient to continue climb, albeit at a reduced rate, pilots were able to take advantage of increased options, such as a continuing a circuit or conducting a turn back towards the runway.

However, the ATSB identified a period between these 2 areas that represented a region of heightened uncertainty (Figure 5). In this region, excess power was not available to climb but there was sufficient power to prevent appreciable descent, resulting in a period of flight uncertainty where the aircraft may not be able to maintain height without bleeding off airspeed, eventually resulting in the aircraft slowing to maintain or gain height and increasing the risk of aerodynamic stall.

Figure 5: Region of heightened uncertainty during partial power failures on take-off

Source: ATSB

The ATSB identified that 8 out of 9 partial power loss accidents resulting in fatal injuries occurred with mid-range power loss. Inconsistent power or engine surging from high to low RPM present complex problems to the pilot. Inability to maintain height with partial power loss usually leads to aircraft stall and loss of control, mostly resulting in collision with terrain.

Transition to unfamiliar aircraft

General competency

In order for a pilot to operate a different aircraft type already covered by their licence category and class rating, they need only be satisfied that they are competent under Civil Aviation Safety Regulation (CASR) 1998.

CASR 61.385 Limitations on exercise of privileges of pilot licences – general competency requirement stated:

(1) The holder of a pilot licence is authorised to exercise the privileges of the licence in an aircraft only if the holder is competent in operating the aircraft to the standards mentioned in the Part 61 Manual of Standards for the class or type to which the aircraft belongs, including in all of the following areas:

(a) operating the aircraft’s navigation and operating systems;

(b) conducting all normal, abnormal and emergency flight procedures for the aircraft;

(c) applying operating limitations;

(d) weight and balance requirements;

(e) applying aircraft performance data, including take-off and landing performance data, for the aircraft.

Guidance on transition

While no definitive Australian guidance provided advice on the transition of pilots to unfamiliar aircraft, the Federal Aviation Administration (FAA) advisory circular AC90-109A – Transition to Unfamiliar Aircraft (U.S. Department of Transportation Federal Aviation Administration, 2015) is a widely recognised and utilised publication providing a sound basis to consider the hazards of transitioning to unfamiliar types of aircraft, whether certified or experimental.

The AC recognises the importance of providing guidance to pilots transitioning between aircraft types, or to experimental aircraft with differing design features to high performance and complex aircraft. It recommends that pilots’ should develop a training strategy (Figure 6) for mitigating the risks of operation of an unfamiliar aircraft type.

The FAA AC recommend that:

Prior to flying an unfamiliar airplane, all pilots should review the hazards and risks outlined in this AC, and complete the training recommended before operating the airplane. Accident data has shown that there is as much risk in “moving down” in performance as “moving up.” For example, consider a pilot who has substantial experience in high-performance corporate, airline, or military airplanes. The knowledge and skills used to safely fly at high speeds, high altitudes, and over long flights will, by themselves, not prepare the pilot for the challenges of a low-inertia, high-drag airplane.

Figure 6: FAA recommended airplane transition training approach

Source: FAA AC90-109A

The guidance recommends firstly that pilots should consider undertaking flight training with a qualified flying instructor in the proposed transition aircraft, the same make and model or an aircraft that exhibits the same design features or characteristics of the transition type. If instruction is unavailable, seek another experienced pilot to conduct a familiarisation flight; however, if unwilling, at least discuss the differences and expected characteristics of the transition aircraft.

The guidance further recommended that pilots take a risk management approach to formally identify the hazards and mitigate any known or elevated risks identified.

These may include:

• specific type training in the transition aircraft or similar type/design features
• safety equipment such as helmets, fire extinguishers or parachute
• condition, maintenance and history of the transition aircraft
• review of aircraft operating limitations
• plan transition flights to conservatively build up manoeuvres and aircraft experience
• conducting initial flights in benign weather conditions

Fitness for flight

Regulatory requirements

CASA identifies that any amount of alcohol in your body may affect a pilot’s fitness to safely operate an aircraft.

Subparagraphs 91.520(2)(b)(i), (ii) and subregulation 91.520(5) of CASR outlines a crew member for a flight (pilot) commits an offence if they consume alcohol at any time during the period of 8 hours ending when the flight begins, or if a test of a body sample of the crew member to determine the level of alcohol in the sample was taken at the time of carrying out the duty (and) the test reveals that the permitted level for alcohol (within the meaning of Part 99) is exceeded.

Part 99 of CASR defines –

permitted level means:

• (a)    for a testable drug—a level of the drug specified in subregulation (2A) for the purposes of this paragraph; and
• (b)   for alcohol—a level of alcohol of less than 0.02 grams of alcohol in 210 litres of breath.

This means pilots should give considerable and reasonable thought to the amount and rate of alcohol consumption in order to determine if residual alcohol levels may affect cognitive functions, such as decision making, reduced attention and physical ability during the intended flight.

Post alcohol impairment

Post-alcohol impairment (PAI) has been defined as performance impairment after alcohol is no longer detectable. While the performance decrement of pilots under the influence of alcohol is well known and documented, the effect of post-alcohol impairment, commonly known as a ‘hangover’, is less tangible.

Although pilots must not operate an aircraft within 8 hours of the consumption of alcohol, a pilot’s ability to make normal and emergency decisions may be impaired even after the blood alcohol concentration (BAC) has returned to zero.

Research conducted for the ATSB (Newman, 2004) into alcohol and human performance highlighted that:

In simple terms, alcohol impairs human performance…

It has detrimental effects on cognitive functions and psychomotor abilities. Risk taking behaviour may result, and a full appreciation of the consequences of a planned action may not be possible… Adverse effects can also persist the day after alcohol ingestion, with reductions in alertness, concentration and vestibule-ocular function, and increases in anxiety all being reported…

Alcohol has been shown to impair registration, recall, and organisation of information, leading to increased reaction times and/or a greater number of errors…

…performance has also been found to suffer most when an unexpected or unanticipated event occurs.

A study found that 14 hours after alcohol ingestion leading to a BAC of at least 0.10%, pilots performed much worse at a flight simulator task at a time when their BAC had returned to 0 (Yesavage & Leirer, 1986). Pilot performance was measured and found worse on almost every level, with detriments to precision and accuracy being highlighted. It was also found that pilots were not able to accurately judge their own degree of impairment and concluded that such performance effects would still be measurable sometime after 14 hours.

The ATSB study (Newman, 2004) also found that:

The alcohol-induced impairment of cognitive performance becomes more evident when the nature of the flying task becomes more complex and demanding, such as in an emergency situation. A pilot suffering from the effects of post-alcohol impairment may not handle such a high-workload emergency appropriately, due to reduced attention, a slower rate of information processing, increased reaction time, and poor decision-making. All of these could ultimately result in an accident.

Safety analysis

Introduction

On 28 December 2020, the pilot of a Dynaero MCR-01 VLA, registered VH-SIP, was conducting post-maintenance troubleshooting check flights at Serpentine Airfield, Western Australia. While at about 300 ft above ground level (AGL), on the second flight for the day, the engine began to run rough. Shortly after, and while most likely attempting to return to the airfield, the aircraft’s left wing was observed to drop, the nose pitched down, rotate to the left, and impact terrain.

This analysis will explore airworthiness considerations pertaining to VH-SIP, its return to service, the pilot’s experience on the aircraft type and its effect on emergency management, and the effects of post-alcohol impairment.

Return to airfield and stall

A partial power loss occurred at about 300 ft AGL on take-off from runway 09. Although alternative ‘off-runway’ landing areas were available, the pilot elected to continue flight while manoeuvring the aircraft towards the eastern end of runway 15. 

Manoeuvring an aircraft to return to the airport during critical periods of the initial climb, with inconsistent and unreliable power output, significantly increases risk.

With a combination of turning downwind, marginal power and performance, potentially an attempt to maintain altitude, probably led to the aircraft decelerating. During a further left turn towards runway 15, this decrease in airspeed likely resulted in the left-wing stall at about 200 ft AGL, that did not afford the pilot an opportunity to successfully recover.

Airworthiness of VH-SIP

Return to service

VH-SIP had 3 periods of inactivity, about 18 months, 4 years, then 5 years. There was no record in the logbooks for VH-SIP to indicate its engine had been preserved, however the logbook states the carburettors were cleaned on 3 occasions, with the most recent being in January 2019.

The requirement to replace time-limited components every 5 years was partially carried out. Some of the fuel lines that were not replaced were found to be in poor condition when examined at the overhaul facility after the accident. However, it could not be determined if this contributed to the engine rough running prior to, and on the day of the accident.

Engine defects and partial power loss

The preliminary examination of the engine at the accident site, and the subsequent engine examination at an overhaul facility did not identify any pre-impact mechanical defects. However, both carburettors were found to contain contamination, most likely forming during the aircraft’s extended periods of inactivity.

This contamination that was not rectified prior to the aircraft being released for service, or during the subsequent troubleshooting of the engine rough running. Additionally, there was no record of the fuel system being inspected and cleaned in accordance with the manufacturer’s requirements when carburettor contamination has been identified.

The flooding that was observed during multiple tests of the left carburettor, was the result of significant contamination on its float needle valve and seat. Given the amount of contamination, the left carburettor was likely flooding prior to the accident, and as carburettor flooding is known to result in fuel odour, would have been the likely source of the reported fuel smell.

It’s possible the contamination in both carburettors, along with the absence of the clip that attached the float needle valve to the float hinge bracket, resulted in the rough running of the engine at high power settings.

Ongoing maintenance of an aircraft’s fuel system is essential to ensure fault-free operation of its engine. In particular, the reliability of carburettors is dependent on their condition, and by following the manufacturers maintenance requirements and service bulletins.

Unfamiliarity with aircraft type

Although experienced in passenger transport operations and heavier multi-engine aircraft, the pilot was not as experienced in flying lighter general aviation aircraft, with even less experience in very light, low inertia aircraft such as the Dynaero MCR-01 VLA.

The safe conduct of post maintenance flights and troubleshooting of aircraft systems requires pilot familiarity and experience in the aircraft type, its design features and its normal and emergency operating parameters.

Although appropriately licenced, the pilot had never flown a Dynaero MCR-01 VLA previously and had limited experience with low inertia aircraft, as well as the engine and the propeller type fitted to VH-SIP.

The conduct of a post maintenance flight with limited pilot experience and knowledge in the aircraft and its systems, increased the likelihood that the pilot would be unable to effectively manage any in-flight emergency.

Post alcohol impairment

Post-alcohol impairment is of particular importance in aviation. While regulations require a minimum time between drinking and flying, there is considerable evidence that pilot performance may be impaired for much longer periods. Post-alcohol impairment can increase the potential for spatial disorientation for up to 48 hours. While a pilot may be legally able to fly eight hours after drinking, the residual effects of alcohol may seriously impair their performance when they need it most, such as during an emergency.

Witness accounts of reported alcohol consumption the night before the accident, increased the likelihood that the pilot would have been experiencing some level of post alcohol impairment that may have contributed to reduced cognitive function which could have affected the pilot’s decision making during the partial power loss after take-off.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition, ‘other findings’ may be included to provide important information about topics other than safety factors.  These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the partial power loss and collision with terrain involving, Dynaero MCR-01 VLA, VH-SIP near Serpentine Airfield, Western Australia, on 28 December 2020.

Contributing factors

• Shortly after take-off, the engine experienced a partial power loss. The pilot turned the aircraft to the left most likely in an attempt to return for landing.
• At about 200 ft above ground level, with low airspeed and no flap selected, the left wing aerodynamically stalled. This resulted in the aircraft entering into an upright spin, at an altitude that limited an effective recovery.
• Multiple tasks in the aircraft’s return to service after a significant period of inactivity were not carried out adequately before the aircraft was released to service.
• The left carburettor contained contamination that likely resulted in flooding at low power, and rough running at high power settings.
• The pilot did not adequately manage the risk of transitioning to an unfamiliar aircraft type, further increasing the risk of not being able to adequately manage in-flight emergencies during post maintenance flights.

Other factors that increased risk

• The pilot had probably consumed a significant amount of alcohol the night before the accident, which increased the risk of post-alcohol impairment.

Glossary

AGL                  Above ground level

ALA                  Aircraft Landing Area

ATSB                Australian Transport Safety Bureau

AVGAS             Aviation gasoline

BAC                 Blood alcohol concentration

CASA               Civil Aviation Safety Authority

FAA                  Federal Aviation Administration

GPS                 Global positioning system

KIAS                 Indicated airspeed

LAME               Licenced aircraft maintenance engineer

PAI                   Post alcohol impairment

RPM                 Revolutions per minute

VFR                  Visual flight rules.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• witnesses that operated the aircraft the day before the accident flight
• Civil Aviation Safety Authority
• Western Australian Police Service
• aircraft manufacturer
• engine manufacturer
• maintenance organisation
• Airservices Australia
• Bureau of Meteorology
• accident witnesses
• video footage of VH-SIP the day before the accident flight and other photographs and videos.

References

Australian Transport Safety Bureau. (2013). Avoidable Accidents No. 3 Managing partial power loss after takeoff in single-engine aircraft. Canberra: Australian Transport Safety Bureau.

Newman, D. G. (2004). Alcohol and Human Performance from an Aviation Perspective: A Review. Canberra: Australian Transport Safety Bureau.

U.S. Department of Transportation Federal Aviation Administration. (2015, July 06). AC 90-109A Transition to Unfamiliar Aircraft. Washington DC: U.S. Department of Transportation Federal Aviation Administration.

Yesavage, J. A., & Leirer, V. O. (1986). Hangover effects on pilots 14 hours after alcohol ingestion: a preliminary report. American Journal of Psychiatry, 1546-1550.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Civil Aviation Safety Authority
• the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile
• engine manufacturer
• a LAME witness
• the aircraft owner
• maintenance organisation.

Submissions were received from:

• Civil Aviation Safety Authority
• A LAME witness.
• the Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Sequence of events

Source: ATSB
 

Appendix B – Engine examination

The engine was disassembled and examined at a Civil Aviation Safety Authority (CASA) approved engine overhaul facility under the supervision of the ATSB.

Some impact damage was identified; however, the main engine components were found generally in working order.

Review of the engine systems found that the left carburettor was missing a clip that attached the float needle valve to the float hinge bracket (Figure B 1 and Figure B 2). During multiple tests under controlled conditions, the left carburettor flooded[8] repeatably. It was later determined that this was likely due to the presence of significant amounts of corrosion on the float needle valve, its seat, and a deposit on the on the valve tip (Figure B 3).

Figure B 1: Carburettor components

Source: BRP-Rotax, modified by the ATSB

Additionally, both carburettor float bowls were contaminated. The floats fitted to both carburettors were the original type (Figure B 4), which were required to be replaced as part of a mandatory service bulletin. Pre-service bulletin floats could lose buoyancy and increase the likelihood of carburettor flooding, also characterised by the presence of fuel odour. 

The float bowl of the right carburettor was also contaminated, and one of the float guide pins was bent, causing a float to contact the side of the bowl.

A number of fuel lines were destructively inspected. The internal surfaces in some fuel lines were perished and had become brittle, compromising the security of their end fittings. Some of the fire sleeves covering the fuel lines had marks where securing clamps had previously been removed.

Figure B 2: VH-SIP left carburettor condition

Source: ATSB

Figure B 3: VH-SIP left carburettor float needle valve and seat

Source: ATSB

Figure B 4: Left carburettor float condition

Source: ATSB, BRP-Rotax, modified by the ATSB

Carburettor contamination

ATSB technical analysis found that the contamination on the left carburettor float needle valve showed that it was corrosion, and the deposit on the valve tip was a carbon-based material. The contamination in the bowls of both carburettors was considered a likely corrosion by-product from the bowls.

The engine manufacturer advised the ATSB that faultless function of the engine could not be guaranteed if contaminants were found in the carburettor bowls. Corrosion on the float needle valve, and the absence of the clip that attaches the float needle valve to the float hinge bracket further increased the risk that the engine would not satisfactorily perform. The engine manufacturer also advised that the deposit on the left carburettor float needle valve could cause flooding and engine rough running at low power settings.

Service bulletins from the manufacturer recommended that if any contamination was found within the carburettor bowl, that the entire fuel system must be inspected and cleaned.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

This investigation was conducted under the Transport Safety Investigation Act 2003 (Commonwealth) by the Office of Transport Safety Investigations (NSW Government) on behalf of the ATSB in accordance with the Collaboration Agreement. Released in accordance with section 25 of the Transport Safety Investigation Act 2003.

Safety summary

What happened

At approximately 0407 on 8 January 2021, freight train 5936, travelling in the up direction (towards Sydney) failed as a result of wheel slip, on the steep Cowan bank inside Boronia tunnel No. 3. To keep the up main line clear the train crew were directed by Sydney Trains network control to propel¹the train backwards into Hawkesbury River up refuge siding.

Network rules for propelling trains require crew to direct the movement from the rear of the train via radio communication with the driver. Due to the terrain, the assistant driver and a trainee were required to walk to the rear of the train on the adjacent down main line, as there was no alternate pathway beside the track. To protect these workers from passing trains, the driver of 5936 requested track protection from the Sydney Trains signaller. This protection was provided in the form of rail signals placed to stop to prevent a train from entering the section of track where the workers were walking.

On arrival at the rear of the train the two workers and the driver of 5936 proceeded to propel the train back towards Hawkesbury River up refuge siding in accordance with procedures, with the two workers walking in advance of the train on the adjacent down main line. During the propelling movement the workers observed the lights of an oncoming train on the down main line on which they were walking. The two workers told the driver of 5936 to stop the propelling movement and the train was brought to a stand. The workers jumped clear of the oncoming train onto the adjacent cess area, with one of the workers suffering an injury. A passenger train, 247B, passed the workers, travelling around train 5936 in the up direction towards Sydney on the down main line.

The driver of 5936 contacted the Sydney Trains signaller and requested an explanation about why a train had been permitted to run on the down main while there was meant to be a signal block in place to protect the workers.

The Sydney Trains signaller told the driver the signal block had been removed once the propelling movement started, due to the signaller mistakenly thinking the workers were clear of the down main line. The incident was not reported at the time by the Sydney Trains signaller. The incident was reported by the driver of 5936 to their control centre, but it was not acted on at the time. The incident came to notice when the trainee worker reported an injury resulting from jumping out of the way of train 247B.

What the ATSB found

The Sydney Trains signaller and the driver of train 5936 did not observe the requirements of the relevant Train Working Network Rules and Procedures for protecting workers on track with in-service rail traffic, specifically rule NTR 432, Protecting activities associated with in-service rail traffic and associated procedure NPR 750. The Sydney Trains signaller and the driver of train 5936 did not observe the relevant safety critical communications requirements during the application and removal of the protection. The Sydney Trains signaller placed blocks on the signals manually as if protecting an emergency situation or Condition Affecting the Network and did not use the electronic forms as required under NTR 432 and NPR 750. The Sydney Trains signaller removed the signal block protection without confirmation from the driver of train 5936 that the workers were clear of the danger zone as required by NTR 432 and NPR 750.

The Sydney Trains signaller did not understand the details of the tasks required for propelling movements, was not familiar with the terrain, and assumed the workers were clear of the down main line once the propelling movement had commenced. Sydney Trains signaller safeworking refresher training, which may have identified a knowledge gap or non-compliance with procedures, has not been in place since 2009.

What has been done as a result

Sydney Trains delivered the following actions following the occurrence:

• Issued two Safe Tracks alerts to reinforce the requirements of Network Rule NTR 432, Protecting activities associated with in-service rail traffic, and related procedure NPR 750.
• Issued an Operating Instruction 02/2022 to staff who manage this type of incident that deals specifically with propelling movements on Cowan Bank.
• Adjusted the rail lubricators on Cowan Bank to provide optimum balance between lubrication of the rails while still permitting the train to retain traction on the rail surface.
• Reintroduced Safety Refresher Training for signallers.
• Delivered to all signallers an e-learning course on the use of NTR 432.
• Use of NTR432 will be added to Signaller Competency assurance scenarios and the next annual round of Safety Refresher Training commencing during 2023.
• Line managers have been required to focus safety engagements, undertaken with signallers, on ensuring signaller understanding of NTR 432. If non conformances are identified remedial coaching/training will be undertaken with the signaller.
• From 18 November 2022 all Signallers have been instructed to report each use of NTR432 to their line manager and line managers have been instructed to submit an audio compliance request for all reported uses of NTR432 for a compliance review.
• A communications cue card on use of NTR 432 for Signallers and Rail traffic crew was developed and distributed and is published on the RailSafe website.
• A review of the network hazard of instance of worker in path of rail vehicle (protecting activities associated with in service rail traffic) is currently being undertaken.

Transport for NSW delivered the following action following the occurrence:

• Assisted Sydney Trains through the provision of project support and vendor engagement for the design and development of safety refresher training.

Safety message

To provide confidence that rules and procedures are being followed and that they are effective in managing relevant risks, rail operator assurance processes need to detect non-conformances.

Training and competence management regimes for rail safety workers need to provide relevant and meaningful content, such as scenario-based training, and site based network familiarisation, to allow workers to perform safely and effectively.

The occurrence

Train information

Train 5936 consist

Train 5936 was a Pacific National freight train hauling grain from Moree Wheat Silo to Bomaderry. It consisted of four 82 class diesel electric locomotives (8214, 8213, 8244, 8232) hauling a consist of 52 loaded wheat hopper wagons (25 x NGKF wagons and 27 x NGPF wagons).

The train length was 831.6 m and the mass was 4134 t.

Figure 1: 82 class Pacific National locomotive

Source: Pacific National 

Train 5936 journey

Train 5936 departed Moree Wheat Silo on Thursday 7 January 2021 at 1230. There was a crew change at Morandoo at 0030 on Friday 8 January 2021. The incoming crew consisted of a driver, an assistant driver and a trainee assistant driver.

Train 247B

247B was an eight car OSCar NSW TrainLink passenger service operating from Newcastle to Central.

Train crew information 5936

Driver

The driver was an employee of Pacific National with 21 years and four months experience. The driver possessed the requisite qualifications to operate the type of train and to operate over the route. They were trained in protection arrangements for in-service rail traffic in 2016.

Assistant driver

The assistant driver was an employee of RailTrain, a rail labour hire company with a contract with Pacific National, with four months experience. The assistant driver possessed the qualifications to be a second person but did not possess the requisite qualifications to operate the type of train over the route. The assistant driver was trained in protection arrangements for in-service rail traffic in September 2020.

Trainee assistant driver

The trainee assistant driver was an employee of RailTrain with three weeks experience. The trainee assistant driver did not possess the requisite qualifications to be a second person or operate the type of train over the route. The trainee assistant driver was trained in protection arrangements for in-service rail traffic in December 2020.

Signaller information

The SHN advised they were first qualified in signalling in 2002, however Sydney Trains could not locate any signaller training records for this worker until 2007. The SHN had worked at a variety of signal boxes and control centres including Penrith, Springwood, Auburn, Katoomba, Blacktown, and a number of control panels in the Homebush Control Centre.

Signaller performance

Between 2015 and 2021 the SHN had received coaching, counselling or retraining, post incident on 18 separate occasions. These incidents included:

• Faulty manipulation of signalling equipment that resulted in delays
• Misrouting of trains
• Incorrect setting of train route
• Delays in setting of routes.

The most serious incident involved an occurrence at Penrith where the SHN had allowed a freight train to enter a section that was subject to Block Working. Block Working is an operational method where rail traffic is not permitted to enter a section until previous rail traffic is reported as clear of the block ahead. In this case it was a set of track machines that do not operate signalling track circuits like a train. To secure their safety, these machines operate under Block Working conditions.

Allowing a following train to enter the section without ensuring the track machines were clear of the block ahead ran the risk of a collision.

Signaller training

The SHN held all the necessary safeworking qualifications to operate the Hornsby North panel at HCC. Sydney Trains manages the safeworking certification and qualifications arrangements for rail safety workers through two standards, the Network Rules and Network Procedures Certification Standard, and the Network Rules and Network Procedures Training Standard.

Each standard contains a matrix of information. The Certification Standard details those competencies applicable to each role and assigns a code to that role. The code is then expanded upon in the Training Standard that details the specific Rules and Procedures applicable to that role, and what must be contained in the training package for that role.

The code for a signaller is C105, Control Rail Traffic Movements level 1. For the code C105, a training package must contain instruction in 51 Network Rules, 39 Network procedures and how to complete 10 different Network Forms. The training package for signallers includes the Train Working Network Rules for propelling trains, NTR 424, and protecting activities associated with in-service rail traffic, NTR 432.

Each Rule, Procedure and associated forms may have several individual requirements, so the knowledge requirement for a signaller runs into several hundred individual steps, processes and tasks.

In addition to the Network Rules and Network Procedures, Sydney Trains has other operating requirements known as Operator Specific Procedures, Special Instructions and General Orders. The signaller role training requirements in these procedures, instructions and orders are not captured by the Network Rules and Network Procedures training process.

A signaller must have current knowledge and competency in a large array of rules, procedures, instructions, and orders to perform safely and efficiently.

Localised training and assessment

Each signal control panel in the Sydney Trains network has its own Localised Training and Assessment (LTA) process. The LTA for Hornsby North panel does not include scenario-based training to deal with a failed train on Cowan Bank, despite it being a common occurrence, nor any network familiarisation training to ensure that signallers can visualise the network they are managing.

Network Control

Rail Operations Centre (ROC)

Sydney Trains has a centralised control room called the Rail Operations Centre (ROC) where a number of functions are co-located. The functions include train control and supervision, incident management, customer information, security and infrastructure control. Working within the ROC are Train Service Delivery Managers (TSDM) and Network Incident Managers (NIM) who work with signallers, train crew and others to manage train operations, work on track and other functions.

Train Service Delivery Manager (TSDM)

TSDM is the Sydney Trains business term used for what is referred to in the Sydney Trains Network Rules and Procedures as the Network Controller. TSDM are responsible for train running, planned possessions and planned work on track authorities. There are five TSDM areas, Central Coast, North, Main, Illawarra, and South West.

The TSDM principally involved in this incident was the TSDM Central Coast. The TSDM Central Coast is described as the TSDMCC in this report.

ATSB observation The role description for the TSDM does not have mandatory requirements for rail safeworking or train operations qualifications or experience. These are listed as desirable criteria. However, the TSDMCC was responsible for train running, and safeworking decisions such as the train movement to Hawkesbury River Up Refuge.

Figure 2 Rail Operations Centre (ROC) control room

Source: Sydney Trains

Signal box operations

Sydney Trains has a number of small signal boxes and larger control centres in the network where signallers control the trackside signals to give proceed authorities[1] for trains to operate. Signallers also provide protection for workers doing maintenance and other activities, such as train crew attending to their train while in service.

Signallers do this by putting signals to stop and applying blocking facilities[2] to prevent them from being cleared, thereby excluding trains from entering the area where work is occurring. There are several Network Rules and Procedures that govern this activity.

Assurance and oversight of signallers is undertaken by Signal Box Operations (SBO), who provide line management functions and ensure operational requirements are delivered safely and in accordance with the relevant rules, procedures and standards. This assurance activity can take the form of:

• review of recorded audio to check compliance with communications protocols and application of rules and procedures
• review of applicable forms and documents to ensure that details have been completed as required
• review of similar incident types to check on outcomes and application of standard requirements.

SBO is an operating section of the Sydney Trains Customer Operations Branch. SBO is responsible for managing all signallers and signal boxes in the network.

Location

Sydney Trains network – Cowan Bank

Cowan Bank is a steep and curving section of track that runs from Hawkesbury River up to Cowan station, a distance of approximately 9 km. The section consists of the Up and Down Main lines, features four tunnels and the signalling system is rail vehicle detection bi-directional.

Trains travelling in the up direction towards Sydney from Hawkesbury River encounter steep rising gradients as much as 1:37. A rising gradient refers to the graded rate of ascent. A 1:37 rising gradient means that for every 37 m travelled, the track rises 1 m.

The bi-directional signalling system means trains can operate in either direction on either track as there are signals provided to control movements in both directions. This type of signalling is a feature in areas on the network where there are steep grades and trains have a greater risk of being unable to continue due to mechanical faults, or as in the case with 5936, excessive wheel slip.

The rail line winds through a narrow corridor and access and space is limited. The line in the section from Hawkesbury River to Cowan station is formed of many cuttings made into the hillside to house the rail tracks.

Figure 3: Entry to Boronia Tunnel No. 3 in the up direction

Source: Sydney Trains

Hawkesbury River Up Refuge siding

The Hawkesbury River Up Refuge siding is located within the Hawkesbury River yard. The yard consists of the Up and Down Main lines, the Up Refuge siding, No. 1 and 2 sidings and various points and signals to permit trains to operate. The Up Refuge siding has a stowing capacity of 877 m including the use of No. 2 siding.

Figure 4: Diagram of Hawkesbury River

Rail lubricators

Rail lubricators are engineering devices designed to deliver rail lubrication to the wheel-rail interface to reduce wear and wheel squeal noise. Three rail lubricators were installed and active on the Up Main track between Hawkesbury River and Cowan at the time of the incident.

Delivery of excessive lubricant to the rail can induce wheel slip in a train, leading to a lack of adhesion between the rail and the wheel face and the train being unable to continue.

Rail safety systems and rules and application

Protecting activities for in service rail traffic

Sydney Trains describes their Train Working (NTR) Rules as prescribing the Network requirements for operating trains and track vehicles, including the maintenance of train integrity, and management of equipment defects by Operators, Train Crews and Track Vehicle Crews. Train Working Network Procedures (NPR) describe how particular actions are to be done to apply the Network Rules.

Sydney Trains has specific Train Working Network Rules (NTR) and Procedures (NPR) for protecting people when attending to trains which are in service on the network. The Network Rule is NTR 432 Protecting activities associated with in-service rail traffic and the associated Network Procedure is NPR 750.

The rule and procedure cover situations including where train crew leave their cab to get down on the track and conduct repairs or undertake other activities.

The activities that are undertaken by workers and subject to this form of protection include minor repairs to rolling stock, re-coupling burst air hoses, removing minor obstructions from the track and conducting roll by inspections.

This Train Working rule for protecting people when attending to trains in service and the associated procedure were introduced in 2016, after the SHN had received their foundation training and qualifications, to provide a greater level of prescription about how these on track activities were managed. Previously these activities were managed under the Work on Track (NWT) suite of rules using Absolute Signal Blocking rule NWT 308.

According to RailSafe, Work on Track (NWT) rules prescribe the Network requirements for undertaking activities in the rail corridor and mandate the ways to plan for and achieve the separation of rail traffic from people working on or about track. Principally aimed at maintenance and infrastructure repair, not in-traffic protection.

The new rule and procedure under Train Working (NTR) rules provided a level of assurance for both the signaller applying the protection and the in-traffic worker seeking the protection by compelling the parties to give and receive assurances about the location of the work and the type of work being done. It has similar assurances to the work on track requirements for other tasks like maintenance and infrastructure repair.

NTR 432 operational requirements

NTR 432, Protecting activities associated with in-service rail traffic, has very explicit instructions about what information must be exchanged between the Qualified Worker requesting the protection and the signaller.

Requesting protection

When requesting the protection of activities associated with in-service rail traffic, the Qualified Worker must:

• Provide the train number or track vehicle number
• Identify the lines on which the protection is required
• Nominate the activity location as being:
  • between any two stations
  • completely within a nominated dead-end siding, or
  • completely within the limits of a platform.

Absolute Signal Blocking (ASB)

ASB is a network rule for working on track, Work on Track NWT 308, Absolute Signal Blocking. It works on the principle of rail signals being set to stop with blocking facilities applied to exclude rail traffic from the work area. Within the rule there are several options to provide protection, including:

• Having two controlled absolute signals set to stop with blocking facilities applied or
• Having one controlled absolute signal set to stop with blocking facilities applied and
• Removing an ESML/EOL key, or
• Securing points to prevent access, or
• There being an easily reached safe place available and providing a lookout.

In the case of protecting workers under NTR 432 and NPR 750 Protecting activities associated with in-service rail traffic, while signals are used to protect workers, similar to using ASB, the protection itself is not ASB, as the assurances and requirements are different to ASB and are contained in separate train working rules and procedures, NTR 432 and NPR 750. It is a subtle but important distinction.

ATRICS overview

ATRICS stands for Advanced Train Running and Information Control System, a bespoke system developed in-house by Sydney Trains. ATRICS is a computer-based control system that interfaces with signalling assets to control and monitor their status. It also has an interface with the timetable to automatically set routes for rail traffic.

A signaller will oversee rail traffic operating through the control area of each signalling panel, however in normal circumstances, ATRICS will set routes based on the timetable inputs. The signaller intervenes to control signals manually when there is a need, such as protecting work on track.

The signal control panel the SHN was operating was an ATRICS controlled panel within Homebush Control Centre.

Applying and removing blocks to signals

When a signaller applies blocks to signals on an ATRICS control panel, there are two methods to do so. Manually placing blocks on signals is done directly by the signaller in response to an incident or another circumstance such as a Condition Affecting the Network, where there may be a potential obstruction to the track or other hazard. In this circumstance, the signaller can place and remove signal blocks with no other intervention.

However, when placing signals to stop and placing blocks to protect work on track or workers attending to in-service trains, there are very specific requirements in the rules and procedures about how this is done.

According to NTR 432, Protecting activities associated with in-service rail traffic, the signaller must use an electronic Absolute Signal Blocking (ASB) form to record the application of the signal protection. The extract of the rule is below:

The Signaller must:

• Use a system-generated ASB form, or if that is unavailable, an NRF 018 Absolute Signal Blocking (ASB) form to record the protection details
• Issue a unique protection number to the Qualified Worker requesting the protection.

When using the system-generated ASB form, ATRICS generates a unique code which is associated with the protection and is provided to the worker who has requested the protection. This code is used when ending the protection as an identifier of the correct protection.

NTR 432 requires the use of a system generated form, if it is available, to record the details of the protection. This form is the same as used when applying protection for ASB.

Figure 5: ASB form on ATRICS workstation

Propelling trains

Propelling trains under the network rule NTR 424, Propelling rail traffic, can be a dangerous activity, as a worker or workers may be walking in front of a moving train, and as the driver is not at the end of the movement in the direction of travel, they do not have visibility of the worker(s). There is no procedure that accompanies the network rule to identify and manage risks associated with this activity, unlike other activities that are governed by a rule and a procedure.

Network Communications

NGE 204 is the network General Rule (NGE) applicable to communications. NGE 204 says, in part:

Communication in the Network must be:

• Clear, brief and unambiguous
• Relevant to the task at hand
• Agreed to its meaning before being acted upon.

Communication between the SHN and the driver 5936

The driver of 5936 did not specifically request protection under NTR 432, Protecting activities associated with in-service rail traffic. They requested that a block be put on the signals, and that is what the signaller did. Neither party followed the requirements of NTR 432 in particular the required safety critical communication exchange. The transcript of the recorded audio between the SHN and the driver of 5936 at the time protection was requested is below.

SHN: OK um do you need any protection there for that?

Driver 5936: Yes, if he’s gotta walk on the ah on the opposite track, we definitely need protection. A block for the whole way over.

HNAC: Righto then …ok so …. I’m just putting some blocks on there now….. Just stand by while I do that.

DR5936: Roger that over.

HNAC: Righto I’ve done that there now, so um, I haven’t, so nothing can come up….on that line for ya there so, when you’re ready to walk back and get into position you’re able to do that for me now please.

DR5936: Roger that my mate will walk back now ah so his got the blocks, so his gotta walk back another 832 metres and then get ahead of me. Bit of a way. And then I will proceed down as safely as I can possibly can over.

HNAC: ok thank you for that driver.

Neither party to this conversation specifically mentioned protection being required under NTR 432, which is the relevant rule in this circumstance. All they refer to is “blocks”.

The driver of 5936 did not specify where and for how long the two crew members would be required to walk on the Down Main line while the propelling movement was taking place.

Fatigue management

The SHN was subject to the Sydney Trains rostering and fatigue management arrangements contained in the procedure Managing Shift Work and Rostering procedure, SMS-08-OP-3128 V1.2.

The Pacific National train crew were subject to fatigue management requirements that were derived from their labour management system. No issues of concern were discovered with the fatigue management requirements for the train crew.

The Sydney Trains rostering and fatigue procedure included eight rostering principles to be observed in order to reduce or manage the cumulative effects of fatigue. These eight rostering principles, and a description of these principles, are reproduced below from the Sydney Trains procedure:

Principle	Description
Acclimatisation	Workers new to shift work and those returning after an extended period of annual or sick leave should not be rostered on night work or an early morning start for their first shift. When on leave, human circadian rhythms quickly re-establish a pattern of sleeping at night and being active during the day. Returning to night or early morning starts may be difficult, a bit like ‘Mondayitis’.
Shift length	The length of a shift should not exceed 12 hours including overtime, especially if it involves a night shift. Human performance declines significantly when people have been working for 12 hours or more, especially where work is done at night or in the early morning.
Total hours worked	Aim for no more than 48 hours per week including overtime, which can be averaged across the roster cycle. The risk of fatigue increases towards the end of a week/roster cycle. This is because a sleep debt has accumulated. Limiting the number of hours worked in a week or roster cycle, provides time off to recover and repay the sleep debt.
Limit night shifts and early morning starts	Aim for no more than: four consecutive shifts where 12 hour shifts are worked five consecutive shifts where 10 hour shifts are worked six consecutive shifts where 8 hour shifts are worked. Working a series of night/early morning shifts disrupts circadian rhythms and leads to accumulation of a sleep debt.
Break during a shift	Schedule frequent breaks especially during a night shift or if the work involves sustained mental or physical activity, if local arrangements allow. Breaks during a shift provide workers with an opportunity to rehydrate and get a short rest. Breaks during a shift may be rostered or managed informally, depending on local arrangements and the nature of the work.
Break between shifts	Aim for at least 12 hours from the end of a shift and the start of the next shift. Industrial agreements may allow for less than 12 hours, however, to reduce the risk of fatigue, a minimum of 12 hours break is needed. Breaks between shifts need to allow enough time for recovery and sleep. Night shifts may need longer breaks between shifts. This is because workers will need to sleep during the day when it is difficult to get good quality sleep
Breaks between cycles	Make sure there are adequate breaks between shift cycles. For example: Two days off in a 7 day shift cycle Four days off in a 14 day shift cycle Eight days off in a 28 day shift cycle. Days off should be a minimum of two consecutive days. Evidence indicates shift workers need at least two consecutive nights sleep per week to enable them to report to work feeling refreshed.
Shift cycles	Schedule consistent start times where possible, or if rotating rosters are used, shift start times should move in a forward rotation i.e. morning-afternoon-night. Consistent start times can help shift workers get into a routine. Where rotating rosters are used, there is evidence that a forward rotating roster allows shift workers to delay sleep and wake up later. This is easier to do than going to sleep earlier or waking up earlier.

The planned, or master, roster and shifts the SHN actually worked for the period from 28 December 2020 to 8 January 2021 is included in the table below.

Date	Planned shift times	Actual shift times	Hours worked	Time until next shifts
28 December 2020	Rostered off
29 December 2020	Rostered off
30 December 2020	Rostered off
31 December 2020	2200 - 0600	2200 - 0600	8	24
1 January 2021	Rostered off
2 January 2021	0600 - 1400	0600 - 1400	8	16
3 January 2021	0600 - 1400	0600 - 1400	8	32
4 January 2021	2200 - 0600	2200 - 0600	8	16
5 January 2021	2200 - 0600	2200 - 0600	8	16
6 January 2021	2200 - 0600	2200 - 0600	8	16
7 January 2021 (incident 0405 8 Jan)	2200 - 0600	2200 - 0600	8	16
8 January 2021	2200 - 0600	Off roster

Environmental conditions

The Bureau of Meteorology (BOM) Terry Hills weather station (located approximately 12.0 km from Cowan Station) recorded a minimum temperature of 15.4˚C and maximum temperature of 20.6˚C. The weather station also recorded 2 millimetres of rain on the date of the incident. The track was wet and slippery and the driver of 5936 reported these conditions added to the degree of difficulty in conducting the propelling movement of a train in excess of 4000 t down a steep gradient. However, while the conditions made the propelling movement difficult, it did not contribute to the incident itself.

Breathing apparatus and welfare of the train driver

Train 5936 was stopped in Boronia tunnel no. 3 for over thirty minutes before the propelling movement commenced. The driver reported at interview suffering health effects from exposure to diesel fumes while stopped in the tunnel. Unlike their coal fleet, Pacific National bulk trains carrying products such as grain do not carry breathing apparatus as part of their standard on board kit.

Reporting incidents

NGE 234, Responsibilities of Signallers is the network rule applicable to the responsibilities of signallers and contains a requirement relating to reporting incidents. Specifically stating, Signallers must:

…..promptly report breaches of Network Rules and Network Procedures to the controlling officer and the Network Controller.

Related occurrences

On 2 March 2022 at 0121, Pacific National freight train CA80 failed on the Down main line at Wondabyne, NSW in the Sydney Trains network. The recovery process for this train, as determined by the Sydney Trains Network Incident Manager, involved attaching a following freight train, 1423, to the rear of CA80 and pushing it out of the section to Gosford.

A member of the crew of CA80 was on the track and attached the air hoses of 1423 to CA80. No protection was provided to this worker and as a result, a passenger train, 282L, passed by on the adjacent Up Main line as the worker was walking back to the crew cab of CA80. This worker had to take evasive action and move off the track to avoid being struck by 282L.

No protection was provided to this worker using the required network rules and procedures, NTR 432 Protecting activities associated with in-service rail traffic and related procedure NPR 750.

At approximately 0030 on 21 August 2019, freight train 4WM2 operated by Pacific National stopped at signal W26U near Waterfall, NSW. The train crew consisting of driver A and B were directed by the Waterfall Signaller at 0200 to remarshal the train. The train could not continue and was required to return to Coalcliff to clear the main line.

Remarshalling the train required one of the drivers to enter the danger zone to apply hand brakes on the wagons. Driver A requested safeworking protection from the Waterfall Signaller before entering the danger zone without incident.

The locomotives were detached and operated to Waterfall, before travelling to Helensburgh and returning to the stabled wagons near Waterfall.

On arrival at the stabled wagons, driver B requested safeworking protection again from the Waterfall Signaller. Driver B entered the danger zone to release the hand brakes from the stabled wagons. At about 0417, driver A signalled (hand signals and red marker lights) to the driver of an approaching passenger train (404A) to stop. The train was travelling on the adjacent track towards driver B in the danger zone and the driver of 404A made an emergency brake application to stop the train. The train stopped before arriving at the location of driver B and there were no physical injuries.

The safeworking network rule and procedure for protecting activities associated with in-service rail traffic, NTR 432 and NPR 750, were not used effectively to ensure workers were protected from rail traffic. The requests for protection were informal and did not detail the required activities or protection. Both drivers of 4WM2 unknowingly entered the danger zone without appropriate protection and were at risk of being struck by rail traffic.
 

Safety analysis

Sources of information

The sources of information during the investigation included the:

• Sydney Trains Systemic investigation report
• Sydney Trains recorded audio from Homebush Control Centre and the Rail Operations Centre
• Rostering data for the Sydney Trains signaller
• Sydney Trains Network Rules and Procedures
• Pacific National investigation report
• Interviews with the Sydney Trains signaller and Pacific National train driver

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Sydney Trains
• Transport for NSW
• Pacific National
• The Office of the National Rail Safety Regulator

Any submissions from those parties will be reviewed and, where considered appropriate, the text of the draft report will be amended accordingly.

Submissions were received from:

• Sydney Trains
• Transport for NSW
• Pacific National
• The Office of the National Rail Safety Regulator

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

[1] A propelling movement is a rail movement where the train is travelling in the reverse direction, with the locomotives pushing the train rather than hauling it.

Executive summary

What happened

On 22 December 2020, the pilot of a Robinson R44 II helicopter was conducting aerial agricultural spray operations on a property about 13 km south-east of Clare Valley Aerodrome, South Australia. After completing numerous spraying runs throughout the morning, the pilot started a gentle descending turn to the landing site to replenish with chemical product when a loud bang emanated from the rear of the helicopter. The pilot reported that the helicopter descended rapidly, and the flight controls appeared to be jammed. The helicopter collided heavily with the loading vehicle, coming to rest on its side. The pilot and ground crewman were uninjured, and the helicopter was substantially damaged.  

What the ATSB found

The ATSB found that the forward yoke of the helicopter’s clutch shaft had failed due to an undetected fatigue crack that originated from an indent in one of the arms of the yoke. This resulted in loss of drive to the main and tail rotor systems. The unrestrained clutch shaft caused the displacement of the hydraulic reservoir and the loss of fluid. The loss of hydraulic fluid removed hydraulic power assistance to the flight control servos leading to increased control stick forces to operate the helicopter.

The pilot experienced difficulties in controlling the helicopter and executed an emergency descent from a low height without hydraulic power assistance and no tail rotor control. The pilot was presented with a compound emergency for which no training had been provided and for which they had no prior experience.

The ATSB found that the helicopter manufacturer’s maintenance instructions requiring verification that no cracks, corrosion or fretting were present on the yoke, lacked specific instructions on the method to be employed. The visual inspection that was employed increased the risk that a crack in the yoke arm may not be detected.

What has been done as a result

The helicopter manufacturer, the Robinson Helicopter Company, introduced new maintenance inspection requirements for the clutch shaft forward yoke at the 2,200/2,400-hourly inspection for the R44 helicopter. This included replacement of yokes of earlier revision status (A through G) and for later revision (H and subsequent), the option of replacement, or a more detailed examination that included a magnetic particle inspection. This update was included in the R44 maintenance manual in August 2022. The manufacturer also changed the paint colour of the yokes at the forward flex coupling from dark grey to white. This was to enhance the visibility of fretting dust during inspections, in the event of loose hardware.

Following the accident, the ATSB issued a Safety Advisory Notice, AO-2020-064-SAN-014 advising operators of R44 helicopters that based on the preliminary finding of fatigue cracking, to look for the presence of corrosion, fretting or cracking, which may not be visually obvious during all inspections of the clutch shaft yoke.

The Civil Aviation Safety Authority issued an Airworthiness Bulletin, AWB 63-010 advising industry of the failure of the yoke based on the ATSB investigation preliminary finding. It advised pilots and maintenance personnel to exercise vigilance for any signs of deterioration in the helicopter drive train components. This was further supported by the release of similar bulletins by the European Union Aviation Safety Agency and the US Federal Aviation Administration.

Safety message

This occurrence highlighted how non-life limited components such as a drive train yoke may still develop defects and fail in-flight. Aircraft owners and maintenance personnel are reminded of the importance of applying inspection and maintenance criteria specified in the aircraft manufacturer’s publications. Should maintenance information be lacking or unclear, the manufacturer or authorised representative should be contacted for appropriate, additional information.

The occurrence also serves as a reminder to pilots and maintenance personnel that when conducting inspections to be prepared for the unexpected, and to remain vigilant for defects in parts with an established history of reliability.

The occurrence

On the morning of 22 December 2020, the pilot of a Robinson Helicopter Company R44 II, registered VH-HOB, prepared the helicopter for aerial agricultural spray operations to be conducted on a property located about 13 km to the south-east of Clare Valley Aerodrome, South Australia. The pilot completed the daily inspection and departed the Clare Valley hangar at 0652 Central Daylight-saving Time[1] for the short flight to the loading zone, from where operations would be based.

The pilot arrived at the loading zone at 0700 and departed at 0702 with the property owner on board to conduct a short survey flight of the area to be sprayed, returning to the loading zone at 0708. Following the arrival of the ground crewman, the helicopter was loaded with chemical product, and at 0728 the pilot departed and conducted a series of spraying runs.

Numerous spraying runs were completed during the morning between 0728 and 0920 with the pilot returning to the loading zone periodically to replenish with chemical product and to refuel the helicopter. The pilot reported that the operation proceeded smoothly, and the long spray runs with minimal obstacles made for ideal spraying conditions. 

During the final descent to the loading zone at about 0926, the pilot momentarily increased altitude to gain a better view of a light shower approaching from the south-west, and to assess its potential impact on further spraying operations. The pilot slowed the helicopter, and once satisfied that the shower did not pose a threat, started a gentle, right descending turn at 0926:20 towards the ground loading vehicle with the intent to land alongside as on previous occasions (Figure 1).

Figure 1: VH-HOB flight path showing return to loading zone and descent and inset providing accident location

Source: Google and DGPS data, annotated by the ATSB

About 10 seconds into the turn, at 0926:30, a loud bang from the rear of the helicopter was heard, followed by vibrations from the rotor systems. The ground crewman recalled looking up and seeing that the tail rotor had stopped turning. The pilot reported that the cockpit flight controls appeared to have jammed and of not being able to move the tail rotor pedals. The helicopter’s rate of descent increased to 550 ft/min and as reported by the pilot, its movement towards the ground loading vehicle was generally unaffected by the pilot’s attempts at control inputs. The helicopter’s flight path continued until its landing gear impacted the vehicle’s roof, which resulted in it rolling onto its right side and colliding with terrain at 0926:46.

The pilot was not injured in the collision and was assisted from the helicopter wreckage by the ground crewman. There was no post-impact fire, and the helicopter was substantially damaged.

Context

Pilot information

The pilot of VH-HOB held a Commercial Pilot Licence (Helicopter) and a Private Pilot Licence (Aeroplane), both issued in March 2015. The pilot held class ratings included single engine helicopters and helicopter low-level rating. From 2017, the pilot also held an aerial application rating for helicopter operations.

The pilot completed an aerial application proficiency check for single engine helicopters and a night Visual Flight Rules (Helicopter) flight review for Robinson R44 helicopters on 23 July 2020. Both were valid until 31 July 2021.

The pilot held a Class 2 Aviation Medical Certificate issued by the Civil Aviation Safety Authority (CASA), without medical restrictions, which was valid until 23 January 2023.   

The pilot’s logbook indicated that at the time of the accident, the pilot had a total flying experience of about 6,521 hours. Of these, about 1,337 hours were in the Robinson R44 helicopter and 1,018 hours conducting aerial application work. The pilot had flown about 105 hours on type in the previous 90 days, and about 54 hours on type in the previous 30 days.

Aircraft information

VH-HOB was a Robinson Helicopter Company R44 II helicopter that was manufactured in the United States in 2005 with serial number 10801. It was first registered in Australia in 2005.

The R44 II is a single-engine, light utility and training helicopter with a semi-rigid, two-bladed main rotor, a two‑bladed tail rotor and skid type landing gear. It had an enclosed cabin with two rows of side‑by‑side seating for a pilot and three passengers.

The helicopter was powered by a Textron Lycoming IO-540-AE1A5, 6-cylinder, fuel-injected piston engine and was fitted with hydraulic servo-actuators providing hydraulic power assistance to the main rotor, flight control system.

VH-HOB was configured for aerial application work that included a belly-mounted storage tank and laterally mounted spray booms for chemical product dispersal.

The helicopter’s current maintenance release was issued on 20 October 2020, about 92 flight hours prior to the accident. It was valid for 12 months or 100 hours, whichever occurred sooner. At the time of the accident, VH-HOB had accumulated about 4,579 hours, total time-in-service. There were no open defects recorded on the maintenance release and no outstanding or overdue maintenance was noted.

Maintenance records also showed that about 188 flight hours prior to the accident, at an aircraft time-in-service of 4,391.0 hours, an airframe 2,200-hour/12-year inspection was completed.

Meteorological information

The forecast meteorological conditions for Clare Valley Aerodrome (13 km north-west of the accident site) area, indicated winds from the south-south-west at 19 kt and a temperature of 12 ⁰C. Visibility was forecast to be greater than 5 km with isolated showers of rain and broken cloud above 1,200 ft.

The METAR[2] for Clare Valley township issued at 0930 recorded wind from the south-west at 7 kt and a temperature of 14 ⁰C. This was consistent with witness in the accident area who reported that some cloud was present with isolated showers to the south.

Wreckage information

The ATSB did not attend the accident site and based assessment of the helicopter on imagery and reports supplied by the operator, maintenance personnel, interview records and witness account.

The helicopter presented as relatively intact with the tailboom broken aft of its forward mount point. The operator’s examination identified that one of the arms of the clutch shaft forward yoke had fractured resulting in loss of drive to the main and tail rotor systems. The tubular steel structure surrounding the shaft was damaged by the rotation of the unrestrained clutch shaft. The hydraulic reservoir was also found displaced from its mounting base and was located within the wreckage (Figure 2).

Figure 2: VH-HOB following the collision with inset showing clutch shaft with upper drive sheaves and displaced hydraulic reservoir

Source: Supplied, annotated by the ATSB

Following the accident, attending maintenance personnel reported they conducted a functional check of the flight control system and found the cyclic[3] and collective[4] controls had full and free movement. However, one of the tail rotor control tubes exhibited bending damage that was likely the result of contact with the unrestrained clutch shaft.

Both the pilot and the ground crewman reported that the engine stopped operating shortly before the collision. Images showed that a cutting action of the unrestrained clutch shaft forward yoke (see R44 rotor drive system below) penetrated the engine upper firewall and damaged the engine fuel system flow divider located on the engine below. The yoke perforated the flow divider top housing, which likely interrupted fuel flow to the engine, resulting in engine stoppage.

Both of the fuel tanks were found intact and there was little external distortion of the auxiliary tank following the impact with the ground.

At interview, the ground crewman commented that the helicopter was observed to approach at a low rate of descent, and had it not struck the vehicle, the landing would likely have resulted in significantly less damage to the helicopter.

R44 rotor drive system

The clutch shaft forward yoke assembly is part of the R44 rotor drive system. The R44 pilot’s operating handbook provided the following description of the main and tail rotor drive system and is illustrated in Figure 3.

A vee-belt sheave is bolted directly to the engine output shaft. Vee-belts transmit power to the upper sheave which has an overrunning clutch contained in its hub. The inner shaft of the clutch transmits power forward to the main rotor and aft to the tail rotor. Flexible couplings are located at the main gearbox input and at each end of the long tail rotor drive shaft.

Figure 3: R44 drive train with inset showing clutch shaft forward yoke and flex plate providing input power to the main and tail rotor gearboxes

Source: Robinson Helicopter Company R44 maintenance manual, annotated by the ATSB

Images provided by maintenance personnel showed that during the accident sequence, the vee‑belts had dislodged from the upper sheave.

A manual, cable operated rotor brake was mounted on the aft end of the main gearbox and when applied via the pull handle in the cabin ceiling, friction pads of the braking mechanism would contact the main gearbox input yoke to stop the rotor system. Images showed that the actuating cable was displaced from its guide pulley and was disconnected from the braking mechanism (Figure 4).

Figure 4: Rotor brake mechanism minus actuating cable attached and trapped wire material around the main gearbox input yoke shaft

Source: Maintenance organisation, annotated by the ATSB

The action of separating the cable from the braking mechanism likely caused the rotor brake to be momentarily actuated, and while considered minimal, may have affected the speed of the main rotor system.

R44 II hydraulic system

The R44 II hydraulic system consists of a pump mounted to the main rotor gearbox, a servo at each of the control tubes connecting the cockpit controls to the swashplate, a reservoir assembly, hydraulic fluid and interconnecting flexible hoses (Figure 5). Should a loss of hydraulic pressure occur, the servos contain an irreversible feature to reduce main rotor feedback forces to the pilot’s controls. However, in the absence of hydraulic pressure, the manufacturer advised that the cyclic control system is harder to move in the fore-and-aft and lateral planes, while the collective control can be easily lowered, but becomes harder to raise.

Following the accident, the hydraulic system was provided to the ATSB for further examination. Without hydraulic pressure applied, examination of each servo showed that the irreversible feature was functional. The forces required to move each servo were noted to be slightly higher in comparison to new servos but were considered acceptable.  

The hydraulic reservoir had separated from the hydraulic manifold mounted to the tubular frame likely from the clutch shaft striking the manifold (mounting location circled, Figure 5). This resulted in significant loss of hydraulic fluid. The ATSB’s examination of the hydraulic reservoir revealed multiple impact marks attributed to striking, or being struck repeatedly by a rotating component, likely the main gearbox input yoke.

Figure 5: Hydraulic system and main gearbox installation from VH-HOB

Source: Maintenance organisation, annotated by ATSB

Yoke examination

The clutch shaft with the fractured yoke arm, the forward flex plate and the attaching hardware were provided to the ATSB for detailed examination (Figure 6). A portion of the flex plate that remained connected to the yoke and the separated section of the arm was also provided for examination.             

The yoke presented with one arm intact, to which a portion of the forward flex plate and its attaching hardware were present. The opposite arm had fractured at the bolt hole that secured the arm to flex plate.

The surfaces of the yoke presented with scoring marks and indentations to the painted surfaces. Mechanical impact damage and gouging was also present with smearing damage to the arm fracture surfaces obscuring some of the original fracture features.

Figure 6: Fractured forward yoke arm with inset showing clutch shaft assembly and flex plate

Source: ATSB

A detailed visual inspection of the yoke arms using an optical microscope and a magnetic particle inspection of the yoke surfaces and bolt hole regions, did not identify additional cracks.

Red-coloured corrosion products were observed on the forward face of the yoke where it contacted the bonded stainless-steel washer from of the forward flex plate (Figure 7). Fretting damage was present on the aft face that was in contact with the attaching hardware. Microscopic examination of the red-coloured product identified it to have been produced from general corrosion/oxidation of the underlying steel surface. There were no indications of pitting corrosion.

Figure 7: Fractured yoke arm and separated section front and rear surface condition

Source: ATSB

Visual examination of the fracture surfaces on either side of the bolt hole showed evidence of fatigue fracture. The fracture surface showed concentric beach marks indicative of a progressive crack mechanism, which radiated outwards from the likely origin at the inner bolt hole surface on the front face of the yoke (Figure 8). The fatigue crack had propagated from the front to the aft face, and initially obscured from view by the presence of the attaching hardware.

Crack propagation continued across a substantial portion of the cross section (about 98% of fracture # 1 and about 80% of fracture #2), with a visible portion on the rear face of about 6 mm before final overstress fracture and separation occurred. 

Figure 8: Separated yoke tip with fracture features identified

Source: ATSB

A scanning electron microscope (SEM) was used to further qualify the fracture surfaces at high magnifications. The SEM examination confirmed:

• many hundreds of crack progression bands were observed, which indicated crack growth occurred as a result of high-cycle fatigue[5]
• surface damage (an indent) approximately 0.10 mm in depth at the fatigue crack origin of fracture #1 had likely influenced the initiation of cracking within the yoke arm at the point of fracture
• a clear boundary on the fracture surface existed between the region of corrosion and the region that was not corroded (Figure 9).

Figure 9: Fracture surface of separated section showing corrosion boundary with inset showing crack surface discoloration

Source: ATSB

Metallurgical, chemical and dimensional analysis established that the yoke conformed to the manufacturer’s specification for material type, hardness, and physical dimensions.

Overall corrosion protection had been specified by the manufacturer that was for the yoke to be cadmium-plated, primed and then painted. These corrosion protection schemes were confirmed during metallurgical examination of the yoke.

Manufacturer’s clutch shaft forward yoke inspections

The manufacturer’s instructions for continuing airworthiness of the clutch shaft forward yoke (part number C907) were contained in the Robinson R44 II pilot’s operating handbook (POH) and the aircraft maintenance manual. The following was noted:

• At each daily or pre-flight inspection, the yoke flanges[6] (yoke arms) were to be checked. No cracks were permitted.
• At each 100-hour or annual airframe inspection, the yoke was to be checked for condition and to verify no cracks, corrosion or fretting was present. The yoke was also to be checked for security and operating clearance.
• At each 2,200-hour inspection, a 100-hour or annual inspection is also conducted, and the yoke was to be checked for condition. Additionally, the aircraft maintenance manual provided a list of components that were to be replaced with new or overhauled exchanged parts when they had accumulated 2,200/2,400-hours time‑in‑service. There was no requirement for the yoke to be replaced with a new or overhauled part once those hours had accumulated.

Other than for unscheduled maintenance, the yoke was only separated from the forward flex plate (see Figure 3 insert) when parts were replaced at their assigned 2,200/2,400-hour service interval. The yoke was treated as an ‘on-condition’ item and was not assigned an operating time‑in‑service, fatigue, or calendar life-limit.

Maintenance personnel reported that when installed, the yoke can be viewed on a daily inspection via an access panel located on the right side of the helicopter. During the 100-hour or annual inspection, the yoke can also be inspected from above when the upper panel between the fuel tanks was removed. It was noted that cracking on the front face of the yoke arm would not be visible during these inspections as there was no requirement to remove the yoke from the flex plate.

The aircraft maintenance manual specified a range of examination methods for the detection of defects and identified specific parts that warranted examination above that provided by visual inspection means. Higher levels of examination for nominated parts included the use of a suitably powered magnifying glass, and fluorescent penetrant and magnetic particle inspection processes. However, the yoke was not included in the nominated parts list.

Maintenance practices

The pilot reported that on the day of the accident, a pre-flight inspection was completed, and no defects were noted. Maintenance personnel also reported that no defects associated with the forward yoke were noted during the 100-hour inspection that was conducted 92 hours prior to the accident.

During the most recent 2,200-hour inspection, the helicopter’s main rotor gearbox was refitted, and the three flex plates of the rotor system drive train were replaced with new items.

Records showed that the engine-to-gearbox clutch shaft assembly had been replaced about 701 hours prior to the 2,200-hour inspection with the forward yoke transferred to the replacement shaft. This may have provided another opportunity for detailed inspection of all yoke surfaces.

Maintenance personnel involved in the 2,200-hour inspection reported that at the time of replacing the flex plates, following separation from the forward flex plate, the yoke surfaces were visually examined for defects and the yoke was determined to be serviceable.

The manufacturer advised that yokes were commonly removed from service due to the presence of corrosion or fretting damage, but not due to cracks. When forward yokes were returned to the manufacturer as part of the clutch shaft for overhaul, the surface finish was removed, and a magnetic particle inspection for defects would be completed prior to release to service.

Helicopter emergency procedures

Hydraulic system normal and emergency procedures

The R44 II POH advised pilots that for training purposes, a hydraulic system failure may be simulated by switching the hydraulic system off by using the cyclic-mounted hydraulic switch. With hydraulics switched off, controlling the helicopter in a hover may be difficult due to control system feedback forces.

The handbook also advised pilots to expect control stiffness and feedback when conducting hydraulic systems checks or pre-take off control checks with the hydraulic system switched off.

The handbook described the symptoms for a hydraulic system failure as indicated by heavy or stiff cyclic and collective controls, and loss of hydraulic fluid may cause intermittent and/or vibrating feedback in the controls. Should that occur, the POH stated that control of the helicopter would be normal except for the increase in stick forces. Additionally, if hydraulic power was not restored after verifying that the hydraulic switch is in the ‘ON’ position, the pilot is to switch hydraulics to ‘OFF’ and to land as soon as practical.

Engine power loss or loss of tail rotor function

In the event of an engine or drive system failure, the POH advised pilots to immediately lower the collective lever and enter autorotation[7] while observing airspeed requirements. Pilots were also instructed to enter an autorotation if loss of tail rotor thrust in forward flight occurs.

An autorotation is typically conducted at a specified forward airspeed and rotor RPM at which a power-off glide is most efficient. Autorotation airspeed and RPM is different for each helicopter type and is characterised as a controlled descent. The flight controls are used to manoeuvre the helicopter during the autorotation, through to completion of the landing sequence.

Although the tail rotor is used to counteract the yawing effect of the main rotor at low speed, a loss of tail rotor control or drive to the tail rotor, is manageable provided adequate airspeed is maintained, as directional stability is provided by the helicopter’s vertical and/or dorsal fin.

Pilots are trained to perform autorotational descents, and autorotational capability is a certification requirement for helicopters.

At interview, the pilot reported that simulated engine failures, tail rotor system malfunctions and hydraulic failures were practised during training and flight reviews. However, they were trained and assessed as independent emergencies and were never conducted simultaneously as a compound emergency.

Recorded data

VH-HOB was not equipped with a flight data or cockpit voice recorder, nor was it required to be. Differential GPS[8] flight path data from the on-board SatLoc Bantam[9] aerial application tracking device was provided to the ATSB.

Speed and position data from the SatLoc device was used in the analysis of the helicopter’s movements in the final 3 minutes of flight (Table 1).

Table 1: Key events involving VH-HOB during the final minutes of flight with approximate values of flight behaviour

From 09:26:40 to collision at 09:26:46, the aircraft track varied by about 4 degrees. In the last two seconds of flight, the track varied by less than one degree, and aligned the helicopter’s movement with the position of the stationary ground vehicle (Figure 10).

Figure 10: VH-HOB flight path showing landing approach with momentary climb and descent towards ground vehicle

Source: Google, annotated by the ATSB

Related occurrences

This accident involving the clutch shaft forward yoke (part number C907) was the first occurrence to be investigated by the ATSB that involved an in-flight failure of a yoke on a helicopter model in the Robinson range.

Robinson advised of no other reports of fatigue cracks associated with forward yokes. Searches of the CASA, the US Federal Aviation Administration (FAA) and New Zealand Civil Aviation Authority (CAA) Service Difficulty Report databases did not reveal other documented cases of fatigue related cracking.

There was one similar R44 occurrence, involving loss of drive to the main and tail rotor due to weld failure of the forward yoke. The incident occurred during cruise flight in which the pilot heard a bang and experienced a loss of tail rotor effectiveness due to the failure of a weld joint in the forward yoke.

As a result of this incident, an airworthiness directive was issued by the FAA in August 1999 (FAA Priority Letter Airworthiness Directive AD 99-17-17), requiring the replacement of certain yoke assemblies in R44 helicopters before further flight. The manufacturer identified manufacturing lots associated with the failed yoke and retired the affected yokes from service. If uncorrected, the FAA advised that the condition could result in failure of the yoke assembly, loss of main and tail rotor drive, and subsequent loss of control of the helicopter. In October 1999, CASA issued AD/R44/13 in support of FAA action.

Safety analysis

The collision with terrain involving Robinson R44 II VH-HOB, about 13 km south-east of Clare Valley Aerodrome, South Australia, was the result of the loss of drive to the main and tail rotor systems due to fracture of the clutch shaft forward yoke. This analysis will focus on the failure of the yoke, the emergency descent, and the subsequent collision with terrain. The analysis will also consider maintenance information for the continued airworthiness of the yoke and management of in-flight emergencies.

Yoke failure and separation

The yoke failed as a result of fatigue crack propagation that initiated on the forward face of the yoke arm coincident with the bolt hole. On one side, the crack had initiated from a mechanical surface defect. The fatigue cracking was assessed to have propagated slowly as evidenced by the many hundreds of crack progression bands, with failure of the yoke arm occurring when minimal intact cross-sectional area remained. 

A distinctly corroded region was identified on the forward-most surface of the yoke. A similarly corroded/stained region was identified on the fracture surface. The corroded regions were underneath where the bonded washer from the forward flex plate would normally be clamped. The varying nature of the corrosion within the fatigue crack and the demarcation between the various regions suggested that the crack had existed during an overhaul cycle of the component.

Following the fracture of the yoke, the clutch shaft became disconnected from the main gearbox creating misalignment of the upper and lower sheaves and displacement of the vee-belts. This resulted in a loss of drive from the engine to both the main and tail rotor systems. The loss of drive committed the pilot to find a suitable place to land the helicopter while conducting an emergency descent without tail rotor control.  

Yoke inspections

The manufacturer’s in-service requirements for yoke serviceability specified that the yoke be inspected for cracks, fretting or corrosion at specific intervals that included the daily inspection, at scheduled time in service intervals and during the 2,200-hour inspection.

The drive train was inspected on the morning of the accident flight and at the previous scheduled inspection, and no defects were found. However, with the yoke connected to the forward flex plate, there was no opportunity to visually detect the crack on the forward face during the daily and 100-hour inspections. Once the crack had progressed to the rear surface of the yoke arm, it would have been difficult to see, given that the crack was estimated to be about 6 mm in length, and the area would have needed to have been sufficiently clean.

The only opportunity for detecting a crack initiating on the front face of the yoke would be when all yoke surfaces were exposed and not obscured by the presence of the flex plate and attaching hardware. This would be at the 2,200‑hour inspections, or at unscheduled clutch shaft or flex plate removal. The last time the yoke was separated from the forward flex plate was at the recent 2,200-hour inspection, about two months and 188 flight hours prior to the accident.

The presence of corrosion deposits in part of the cracked region indicated that the crack was likely present at that inspection. Once the yoke arm was re-installed, the forward face was obscured by the flex plate and the crack would not have been visible during the subsequent routine inspections.

Maintenance instructions for critical item

The forward yoke was not assigned a service life by the manufacturer so its continuation in service was dependent on it meeting specific inspection criteria to determine on-going serviceability. The maintenance instructions for continued airworthiness specified that the yoke be inspected for condition, and maintenance personnel were required to verify that no cracks, corrosion or fretting was present. No specific method on how to accomplish this was provided in the manufacturer’s documentation, and as such, a visual inspection would be acceptable.

Defects related to corrosion and fretting damage are likely detected by the un-aided eye, but crack identification may be not as obvious. At the 2,200-hour inspection, the yoke was separated from the forward flex plate and the visual inspection method that was used to detect cracks that existed on the helicopter’s forward yoke, was unsuccessful.

The methods used to verify the absence of cracks varied between this maintenance organisation and the aircraft manufacturer. When yokes were returned to the manufacturer as part of the clutch shaft assembly, the yokes were subject to magnetic particle inspection, which would have a greater chance of identifying a crack than visual inspection alone. This suggested that the inspection instruction was open to interpretation and was not consistently applied.

On this occasion, the failure of the yoke led to a loss of drive to both the main and tail rotor systems. The failure of this critical item further resulted in a secondary failure of the hydraulic system under the action of the unrestrained clutch shaft. This presented the pilot with a compound emergency resulting in an emergency descent and subsequent collision with the ground vehicle and terrain.

The reliability of the yoke and lack of history of removal from service due to cracking, likely influenced the use of visual inspection methods and reduced the expectation for a crack to be present. However, that further reduced the probability of detecting the crack when all the yoke surfaces are available for inspection.

Helicopter control

The pilot reported that when the yoke fractured the helicopter was configured for a gentle descent and turn towards the loading vehicle. However, the consequential failures that followed the failure of the yoke, which included a loss of tail rotor drive, resulted in degraded directional control. The pilot also reported that the cyclic and collective controls felt like they were jammed.

The significant bending of the tail rotor pitch control tube following impact by the intermediate flex coupling/clutch shaft aft yoke, likely restricted the movement of the tail rotor pedals, adding to the sense of difficulty in controlling the helicopter.

Post-accident examination of the collective and cyclic control systems found that they moved freely within their travel range. The loss of hydraulic power assistance would have increased the cyclic and collective feedback forces required by the pilot to control the helicopter. An unexpected increase in the control forces while flying with a normal relaxed grip on the cyclic and collective might have led the pilot to perceive the controls were jammed.

The multiple impact marks that presented on the hydraulic reservoir body indicated that the reservoir had become dislodged in flight rather than when the helicopter collided with terrain. The ATSB considered the possibility that the displaced hydraulic reservoir impeded the movement of the hydraulic servos or their control system, or that in the attempt to position the helicopter away from the ground vehicle, the flight controls were moved to their mechanical stops, which prevented further movement. However, based on the evidence available, neither of these possibilities could be confirmed.

The pilot’s usual practice was to land beside the loading vehicle to enable replenishment of chemical product and had configured the helicopter accordingly. Analysis of the flight path following the initial turn towards the ground support vehicle, revealed that the helicopter’s rate of descent repeatedly changed, as did the rate of turn as it approached the vehicle. This suggested that the helicopter was likely responding to some pilot control inputs and therefore some control of the helicopter was likely available. However, it was insufficient for the pilot to avoid a collision with the loading vehicle.

Multiple emergencies

The pilot reported that during their initial training and subsequent flight reviews, there was a requirement to demonstrate competency in performing autorotational descents and flying and landing the helicopter without hydraulic power assistance. However, there was no requirement to conduct compound major emergencies, such as the loss of tail rotor control coupled with a loss of hydraulic power assistance.

The hydraulic pump is driven by the helicopter’s main gearbox, so the hydraulic system is expected to continue providing hydraulic power during autorotation training. Consequently, this accident presented the pilot with a scenario for which they had no prior experience. It also occurred at a low height and low forward speed, which provided the pilot with very little time to diagnose the situation and manage the emergency landing.

Findings

From the evidence available, the following findings are made with respect to the loss of control and collision with terrain involving Robinson R44, VH-HOB, near Clare, South Australia, on 22 December 2020.

Contributing factors

• Fatigue cracks in the clutch shaft forward yoke progressed until the yoke fractured during operation, which led to a loss of drive to the main rotor system that necessitated an emergency descent.
• During the emergency descent from a height of about 100 feet, the pilot experienced difficulties in controlling the helicopter and was unable to avoid colliding with the ground vehicle, which increased the severity of the collision with terrain.
• Although it was very likely that a crack was present when the clutch shaft yoke was last disassembled from the forward flex plate, it was not detected during inspection. Once assembled, the crack, which had formed on the forward face of the yoke arm, was obscured by the presence of the flex plate.
• Although the helicopter manufacturer’s instructions for continuation in service for the clutch shaft forward yoke specified that the condition of the yoke was to be inspected to verify that no cracks, corrosion, or fretting was present, it did not provide specific instructions for the method to be employed. The visual inspection that was employed increased the risk that a crack in that area may not be detected [Safety issue].

Other (key) finding

• The emergency descent was performed without hydraulic power assistance to the main rotor control systems and without drive to the tail rotor. That required the pilot to manage simultaneous emergencies that were not concurrently presented during training sessions and for which they had no prior experience.

Safety issues and actions

Critical item

Safety issue number: AO-2020-064-S1-01

Safety issue description: Although the helicopter manufacturer’s instructions for continuation in service for the clutch shaft forward yoke specified that the condition of the yoke was to be inspected to verify that no cracks, corrosion, or fretting was present, it did not provide specific instructions for the method to be employed. The visual inspection that was employed increased the risk that a crack in that area may not be detected.

Safety action not associated with an identified safety issue

Safety advisory notice to operators of R44 helicopters

The ATSB advises operators of R44 helicopters to note the preliminary finding of this accident and to look for the presence of corrosion, fretting or cracking, which may not be visually obvious, during all inspections of the clutch shaft yoke. Any identified defects should be notified to both the ATSB and the Civil Aviation Safety Authority.

Additional safety action taken by CASA

CASA issued Airworthiness Bulletin AWB 63-010 Issue 1 to inform owners, registered operators, maintenance organisations and Licensed Aircraft Maintenance Engineers of a failure in a Robinson R44 drive train component (the yoke) that was found by the ATSB during investigation AO-2020-064 and that the ATSB has issued a Safety Notice AO-2020-064-SAN-014 to highlight the component failure.

A revision to the AWB (Issue 2) was issued by the CASA on 23 September 2021. Further to original references that signs of loose fasteners, corrosion or discolouration warrant further investigation, Issue 2 advised that further investigation may require the use of specialised inspection methods such as non-destructive testing (NDT). The manufacturer's maintenance data should be consulted and if lacking sufficient detail for the required inspection or method/s, then the manufacturer is to be contacted for the appropriate inspection data, or if a specialised inspection is required, then the inspection data will need to be generated and approved under civil aviation legislation. Further, any specialised inspections will need to be conducted using approved data by an appropriately authorised person.

Additional safety action taken by European Union Aviation Safety Agency (EASA)

Following the release of CASA AWB 63-010 Issue 1 dated 21 June 2021, EASA issued Safety Information Bulletin No. 2021-13 on 29 June 2021 advising owners and operators that EASA concurs with the AWB's recommendations and to ensure that owners and operators are aware of the recommendations.

Additional safety action taken by Federal Aviation Administration (FAA)

Following receipt of a report of a failed C907 yoke in the R44 main rotor drive system, the FAA issued a Special Airworthiness Information Bulletin (SAIB: AIR-22-08) to remind owners and operators of any Robinson R44 rotorcraft of the importance of adhering to existing inspection procedures in the applicable operating handbooks and maintenance manuals.

The SAIB advised of the presence of a fatigue crack near the bolt hole of the arm of the C907 yoke, and that an initial metallurgical examination found corrosion products and fretting damage on the surface near the fatigue crack. The yoke failure may have been caused by corrosion and/or improper hardware torque. Further, inadequate inspection and maintenance of all driveshaft yokes may result in undetected wear and/or corrosion that could lead to yoke failure and loss of main and tail rotor drive.

The FAA recommended that owners and operators of R22 and R44 series rotorcraft follow Robinson's published pre-flight inspection and periodic maintenance criteria regarding main and tail rotor driveshaft yokes in order to prevent future failures.

Glossary

FAA                  Federal Aviation Administration

CAA                 Civil Aviation Authority

GPS                 Global Positioning System

METAR             Meteorological Terminal Air Report

POH                 Pilot Operating Handbook

RHC                 Robinson Helicopter Company

SAN                 Safety Advisory Notice

SDR                 Service Difficulty Report

TAF                  Terminal Aerodrome Forecast

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• accident witnesses
• aircraft manufacturer
• Bureau of Meteorology
• Civil Aviation Safety Authority
• maintenance organisations for VH-HOB
• County Helicopters Pty Ltd
• photographs and videos taken on the day of the accident
• pilot of the accident flight
• recorded data from the DGPS unit on the aircraft.

References

Federal Aviation Administration (2019), Helicopter Flying Handbook, U.S. Department of Transportation, FAA-H-8083-21B

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• aircraft manufacturer
• Civil Aviation Safety Authority
• County Helicopters Pty Ltd
• pilot of the accident flight
• maintenance organisations for VH-HOB.

Submissions were received from:

• aircraft manufacturer
• Civil Aviation Safety Authority

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

This investigation was conducted under the Transport Safety Investigation Act 2003 (Commonwealth) by the Office of Transport Safety Investigations (NSW) on behalf of the ATSB in accordance with the Collaboration Agreement. Released in accordance with section 25 of the Transport Safety Investigation Act 2003.

Safety summary

What happened

On Tuesday, 15 December 2020 at 0454, the crew of Qube loaded grain train 3966, consisting of 41 wagons and two CM class locomotives, reported a runaway on the descent of the Moss Vale to Unanderra rail line. The train reached speeds up to 100 km/h on a 30 km/h section of track before it derailed and separated at two points between Dombarton and Farmborough Heights, New South Wales (NSW). Shortly after, the train crew advised they had brought the two locomotives and the remaining two wagons to a stand at Farmborough Heights. The train crew were not physically injured.

What the ATSB found

The investigation identified that ineffective braking caused by several factors contributed to the runaway. The ineffective application of train braking systems was influenced by a heavily loaded train with some overloaded wagons, wagons with variable net brake ratio (NBR), reduced brake cylinder pressure through the train, and train handling and locomotive dynamic braking affected by low track adhesion conditions.

The weight of the train was near, but likely not over, the maximum allowable tonnage limit specified by the Australian Rail Track Corporation (ARTC)’s Train Operating Conditions (TOC) Waiver 16002. It was likely, however, that several individual wagons across the train consist were over the allowable limit for a single wagon.

Measurements of NBR at different times and on different wagons returned varying results ranging from 10.7% to 19.5%. The minimum required NBR for these wagons, specified by Australian Standards was 13%. While modifications were made to improve braking performance on the wagons, the NBR on some wagons continued to change over time. The wagon type test met the NBR requirement when introduced into service and met NBR requirements when tested post modifications, however there was no requirement for regular testing of NBR, which may have identified the changes in NBR.

The mix of wagons with variable NBRs and variability in loading likely reduced braking effort on some of the wagons during the steep descent along the rail line.

During the occurrence, the second automatic brake application made by the driver was made before the brake pipe had fully recharged. This resulted in a reduced amount of available brake cylinder pressure and lessened braking effort on the trailing wagons.

The driver's operation of the train and braking actions did not always conform to the operator (Qube)’s instructions, and it is likely some of the driver’s decisions on the morning of the accident were affected by fatigue.

Once control was lost, the driver elected not to use the emergency brake because they believed, in accordance with Qube’s procedures, that the locomotive braking would have been diminished. This in turn lessened the opportunity to regain control of the train.

Qube’s operational procedure for train management between Moss Vale and Inner Harbour did not consider locomotive configurations that maintained locomotive dynamic braking during emergency applications. This increased the risk of train drivers not applying the emergency brake during a runaway event. This assumption was also found to be embedded within other rolling stock operators’ procedures with similarly configured locomotives in NSW.

The conditions on the rail line from Summit Tank to Farmborough Heights on the morning of the incident included wet rail and track contaminant that likely contributed to low track adhesion and also reduced dynamic braking effort by the locomotives. The wheel slip/slide protection system worked as designed to maximise traction through the use of auto sanding to increase friction and derated the dynamic braking effort through the wheels to match the lower adhesion conditions.

Several rail flange lubricators, which provided lubrication to the down and up rail, were less than the 500 m minimum separation requirement specified in ARTC’s engineering practices manual RC2411. A review of these to ensure consistency with the engineering practice and to minimise the risk of excess track lubrication on a steep gradient was warranted.

Finally, the brake pipe charging flow indicator on CM class locomotives only provided a numerical display without any corresponding audio or visual warning system to alert the driver of its status. This limited the ability of the driver to detect derailment or train separation events and, as in this incident, effectively monitor recharge of main reservoir air into the brake pipe to ensure it was fully charged before making another brake application.

What has been done as a result

During the investigation, a Safety Advisory Notice was issued by the Office of Transport Safety Investigations (OTSI) in collaboration with the ATSB to the rail industry to raise awareness of variable locomotive braking system configurations on locomotives across Australia. Qube and other affected rollingstock operators took immediate actions to review their locomotive configurations, to ensure their locomotive drivers had a clear understanding of the braking systems on the locomotives they were operating.

A forum was chaired by the Office of the National Rail Safety Regulator (ONRSR) in March 2023 with Rail Infrastructure Managers (RIMs) and Rollingstock Operators (RSOs) that operated on the Moss Vale to Unanderra rail line. This provided an opportunity to discuss and communicate the risks of operating on the rail line and how to manage them to mitigate runaway events.

The two RIMs, Sydney Trains and ARTC conducted a review and alignment of Transport for NSW (TfNSW) TOC Manual Illawarra operations and the ARTC Route Access Standard - Section Page D52 Moss Vale - Unanderra. The focus of the review was on providing interoperable train configuration and operating conditions between the two RIM interfaces. Additionally, conditions for managing degraded dynamic brakes and hauling dead attached locomotives were developed. All changes were held in consultation with RSOs, ARTC operations and Network Control stakeholders.

In consultation with TfNSW, ARTC developed joint assessment criterion for Unanderra Trial train configurations, operating conditions, and implementation plans. The RSO will be required to submit supporting documentation as part of a variation to existing approved train configurations.

ARTC has updated NBRs for vehicle classes following physical testing and has worked with others in the rail industry to promote NBR testing as part of preventive maintenance.

Safety message

The rail line between Summit Tank and Unanderra is one of the steepest sections of rail line in NSW. To prevent runaway occurrences on this rail line, operators must regularly review the effectiveness of their risk controls and proactively manage conditions that present greater risk of runaway.

RSOs should ensure their trains have sufficient braking, are loaded within safe load limits and are operated in accordance with their procedures.

RSOs and RIMs should ensure that risk assessments identify critical operational requirements to safely run trains down such steep sections of track. They should also ensure that there is sufficient error tolerance to enable control of trains on sections of rail line that present increased risks from long and steep descents.

RSOs should review the locomotive specifications and test those locomotives under their control to understand how the braking systems are configured and the associated error tolerance. RSOs must communicate this information through their organisation’s procedures and training material to ensure train crew have knowledge of and competence in operating locomotive braking systems, including emergency braking in the event of a runaway.

The use of two-pipe wagon braking systems significantly reduces the recharge times for the brake pipe after a brake application, but the starting air pressure of a wagon’s auxiliary reservoir remains a critical consideration. For example, low auxiliary reservoir starting pressure at the beginning of an automatic brake application reduces the response of a wagon’s supplementary reservoir, resulting in lower wagon brake cylinder pressure and therefore less effective braking effort.

Finally, while a ‘full service’ automatic brake application typically provides the maximum pneumatic braking force available on a train, in the unique circumstance of a train with low auxiliary reservoir starting pressure, lowering the brake pipe pressure further through the application of the emergency brake, will result in an increase in the available braking force. However, this increased braking force will remain less than that which would have been available in full service had the auxiliary reservoir been fully charged at the time of the brake application.

The occurrence

Overview

On 14 December 2020, at approximately 1815 Eastern Standard Time (EST),[1] Qube loaded grain train 3966 departed Temora, New South Wales (NSW) bound for Inner Harbour Port Kembla, NSW. The train travelled through the night and in the early hours of 15 December 2020 commenced the descent on the Moss Vale to Unanderra rail line. Between Summit Tank and Farmborough Heights, the train ran away,[2] derailed and separated at two locations. The 29^th to 41^st wagons derailed and separated at approximately 93.730 km from Sydney’s Central Station. Then the 3^rd to the 28^th wagons derailed and separated at approximately 93.220 km, before the locomotives and two remaining wagons came to a stop at Farmborough Heights (Figure 1).

Figure 1: Section of Moss Vale to Unanderra rail line between Summit Tank and Farmborough Heights

 
This image shows where the train stopped prior to descending the mountain, the points of derailment and where the train stopped. The inset is the track gradient diagram with corresponding stop points and derailments.
Source: Google Earth and QUBE, annotated by OTSI

Start of shift

On 14 December 2020, the train crew, consisting of a driver and driver’s assistant, signed on at 2000 at the Junee depot for an 11-hour shift. They were scheduled to start at 1430 but were laid back[3] to 2000. They travelled to Cootamundra and relieved the train crew on service 3966 at approximately 2110. They were rostered to work the train from Cootamundra to Port Kembla. The driver operated the train, for the near seven-hour journey, reporting at interview that the journey was uneventful with the train operating predictably to the start of the descent at Summit Tank.  

Start of the descent (~107.5 km)

On 15 December 2020, at approximately 0415, the driver made an automatic brake[4] application (about 70 kPa reduction) and brought train 3966 to a stop at the level crossing just after Summit Tank (see A in Figure 2), as required by Qube’s operational procedure. Once stopped, the driver applied the independent brake.[5]

After a stop of approximately four minutes, the driver released the independent brake and with the automatic (train) brake still applied, powered the locomotives to commence movement against the still applied train brakes.

This stop and start process conducted by the driver at Summit Tank differed to Qube’s operational procedure, which stated that the train should be stopped using a 100 kPa brake pipe reduction (refer to Brake release rollaway time test for further information).

The driver then maintained the automatic brake at a 70 kPa brake pipe reduction and graduated the dynamic brake[6] to manage the speed of the train. This form of brake management was known as ‘balanced braking’.[7] The driver descended the rail line between Summit Tank and the No.2 Tunnel using this method of braking control.

Figure 2: Sequence of events

This image shows the sequence of events leading up to the loss of control and derailments.
Source: QUBE, annotated by OTSI

No.2 Tunnel (~102.5.0 km) to No.1 Tunnel (~99.0 km)

At 0436 the train entered No.2 Tunnel travelling at 24 km/h. The driver applied full dynamic brake and released the automatic brake (see B in Figure 2).

Releasing the automatic brake allowed the brake pipe to fully recharge[8] after about 50 seconds. The train slowed to approximately 6 km/h at this time (see C in Figure 2).

The driver then reduced the dynamic brake. Over the next minute, the train speed increased to about 15 km/h.

The driver applied the dynamic brake in full again (see D in Figure 2), then approximately 30 seconds later, with the train travelling at 17 km/h, the driver made a ‘minimum service’[9] automatic brake application (see E in Figure 2).

The train continued to increase speed over the next 30 seconds, with auto sanding[10] occurring three times as the train approached 18 km/h. The train then started to slow slightly over the next 45 seconds and auto sanding occurred another three times.

Over the next 2.5 minutes, without any further input from the driver, the train began to increase speed again. Auto sanding occurred 12 times, as the train speed reached 24 km/h. The driver increased the automatic brake application to about an 80 kPa brake pipe pressure reduction and the train started to slow (see F in Figure 2).

The frequent auto sanding on the descent from Summit Tank, in misty and wet weather conditions, indicated the locomotives' wheel slip/slide protection systems were working as designed to maintain dynamic braking under the adhesion conditions. The driver stated at interview that there were no wheel slip indications received on the locomotive to indicate reduced wheel-rail adhesion, and so they felt the dynamic brake was working effectively.[11]

The train speed reduced over the next 2.5 minutes to about 16 km/h, and auto sanding occurred 11 times. With the dynamic brake fully applied and the auto brake at 80 kPa reduction, the train speed continued to decrease over the next 2.25 minutes to 4 km/h, during which auto sanding occurred another four times (see G in Figure 2).

As the train slowed, the driver released the automatic brake and maintained the dynamic brake in full applied mode. The driver then managed the train speed using serial/cycling braking,[12] as per Qube work instruction WI-540 (Moss Vale to Inner Harbour Train Management). The braking instruction stated that if train speed could not be managed using a 75 kPa reduction and altering the dynamic braking to maintain speed, then the serial/cycle braking method must be used.

At 0448, at about 99.673 km,[13] with the train travelling at 15 km/h, the driver applied a minimum service brake application (see H in Figure 2). The automatic brake handle had been in the release position and charging for 43 seconds since the brakes were last applied.

Although the brake pipe pressure at the locomotive had, by this stage, recharged to 489 kPa on the cab gauge, the brake pipe charging flow indicator was still registering an air flow of 934 litres per minute. This meant that the brake pipe had not yet fully recharged throughout the length of the train (refer to Brake pipe charging flow indicator for further information). In interview, the driver recalled observing the flow meter indicating air flow of 934 litres per minute and judged the train brake pipe to be charged to about 90–95%.

The minimum reduction in brake pipe pressure did not appear to slow the train as the speed increased to 21 km/h over the following 14 seconds. The driver reduced the brake pipe by a further 14 kPa (425 kPa) but the speed continued to increase. The dynamic brake remained in the fully applied position and auto sanding was triggered regularly.

As the train’s speed reached the track section speed limit of 30 km/h, the driver reduced the brake pipe pressure by a further 7 kPa (418 kPa) and the train entered No.1 Tunnel.

No.1 Tunnel (~99.0) to Farmborough Heights (~92.0)

In interview the driver indicated that it was at this point they felt the train was behaving ‘unpredictably’, compared to its responsiveness to the two previous brake applications between Summit Tank and No.1 tunnel.

While in No.1 tunnel, the driver increased the automatic brake application, reducing the brake pipe pressure by a further 14 kPa (404 kPa). The train’s speed continued to increase to 32 km/h, just over the track speed limit of 30 km/h. The train passed through the tunnel and auto sanding was triggered eight times.

At 0450, at about 98.5 km, the driver increased the brake application again, reducing the brake pipe by another 7 kPa (397 kPa). The train was travelling at 34 km/h when the driver commented to the driver’s assistant, ‘I’m on the edge’. Auto sanding occurred two times.

Thirty seconds later, the driver increased the brake application. This reduced the brake pipe pressure by another 7 kPa, to 390 kPa. The train speed remained 34 km/h. Auto sanding occurred three times.

At this time, the head of the train was at about 98.2 km, entering a relatively straight section of track. The rear of the train was still passing through a series of 200 m curve radius left and right‑hand turns.

At about 98.0 km, the driver made another brake application (383 kPa). The train remained at 34 km/h.

As the head of the train reached 97.5 km, the speed increased from 34 km/h to 37 km/h over a 20 second period. At this point, the locomotives entered a 200m right hand curve with the full length of the trailing load on straight track behind it. This would have resulted in reduced dynamic locomotive braking and zero curve resistance on the wagons, which likely contributed to the acceleration. Although the driver made a further brake application (376 kPa), the train continued to increase speed over the next 15 seconds.

At 0453, at about 97.1 km, with the train speed at 42 km/h, the driver applied the automatic brake to ‘full service’[14] (see I in Figure 2). The train continued to increase speed up to 45 km/h over the next 20 seconds. The driver was heard on the in-cab recorder to say, ‘we’re not going to stop’, and then contacted Network Control. Over the next 90 seconds the speed increased to over 60 km/h.

The driver said to Network Control, ‘Can you guarantee me the road there at Unanderra, I’m having trouble stopping this train’. The network controller called Wollongong Panel and requested the rail line to be cleared at Unanderra and Wollongong Panel confirmed it would be done.

At 0455, the network controller called the driver of 3966 and confirmed the scale of the emergency. The driver said, ‘…I’m doing about 70 [km/h] and I’ve got it in full service, I don’t want to put it in emergency[15] because I’ll drop my dyno [dynamic brake] out.’ The network controller said, ‘so fairly dire then is it?’. The driver replied, ‘yeah I’m doing about 80 [km/h] now’.

The network controller kept the driver on the line while they called Wollongong Panel to confirm that the rail line was clear at Unanderra. Wollongong Panel confirmed it was, then the network controller asked the driver for an update. There was no response from the driver.

At 0456, the driver fully applied the independent brake with no apparent effect on reducing the speed of the train. The train was travelling at about 85 km/h, at track position 94.159 km. At this time wheel slide was recorded on the locomotives.

Seconds later, as the train passed the Dombarton distant signal WG1042U at 93.810 km, it went into a left-hand 200 m radius curve in the direction of travel, reaching a peak speed of about 100 km/h. The train was 70 km/h over the track speed limit of 30km/h. At this time, the 29^th wagon and trailing wagons derailed and separated from the front part of the train (see J in Figure 2).

At 0457, with the front of the train at 93.100 km and travelling at about 98 km/h, the 3^rd wagon up to the 28^th wagon derailed and separated from the front part of the train. The train was on a right‑hand 200 m radius curve in the direction of travel (see K in Figure 2).

The train had started to slow after the first separation and at 0458, the two locomotives and remaining two wagons came to a stop at 92.040 km (see L in Figure 2).

As the train came to a stop, the driver advised Network Control ‘I’m at Farmborough Heights and all of a sudden it decided to grab [train started to slow]’.

Post occurrence

With the train immobile, the driver’s assistant stepped off the lead locomotive to check the rest of the train and secure it. They reported back to the driver, via radio, that there were only two wagons attached to the two locomotives.

The driver conveyed this information to Network Control and the Qube Control Centre shortly after.

Recovery teams and emergency services were arranged to attend the site. Inspection of the rail track and rolling stock commenced at approximately 0700 and at 1140 recovery operations commenced.

The locomotives and two attached wagons were inspected by Qube and Chicago Freight Car Leasing Australia (CFLCA, the owner) before being transferred to Port Kembla.

At Port Kembla, the wagons were emptied, and grain weighed to confirm the weight of the remaining two wagons. The tonnage in the wagons was within load limits.

Context

Incident Location

The runaway and derailment occurred between Summit Tank and Farmborough Heights on the Moss Vale to Unanderra rail line, near Dombarton, New South Wales (NSW). Dombarton is on the Illawarra Escarpment approximately 97 rail km south of Sydney Central Station. The train journey started in Temora and the train crew took control of the train at Jindalee (Cootamundra) (Figure 3).

Figure 3: Path of 3966

The orange line represents the rail route of 3966 from Temora to where it stopped at Farmborough Heights. Other key locations are identified. 
Source: Google Maps, annotated by OTSI

Moss Vale to Unanderra rail line

The Moss Vale to Unanderra rail line is a 57 km section of track connecting the Main South rail line with the Illawarra rail line. The 20 kilometres of track between Summit Tank and Unanderra traverses down the Illawarra escarpment through multiple curves varying in radius between 185 m and 2020 m, transitions and straights. The grade[16] is primarily 1 in 30, other than small sections through No.2 tunnel and Farmborough Heights where the grades are 1 in 120 and 1 in 105 respectively (Figure 1). It is a single-track rail line at Summit Tank, mostly tree lined (Figure 4) and passes through two tunnels and a Rock Fall Shelter before reaching Dombarton where the rail line becomes double-track.

Figure 4: Front of train footage of track

Taken from 3966 front of train camera between 104.000 km and prior to entering No.2 tunnel. Tree foliage lines the track.

Source: Qube

The rail line then remains double-track winding through more tree lined areas before reaching Farmborough Heights. At this location, the grade eases to 1 in 105 then changes back to 1 in 30 grade, winding down through more tree lined areas to Unanderra (see Figure 1 inset for track gradient).

Weather information

There were two Bureau of Meteorology weather stations in proximity to the occurrence: Moss Vale in the Southern Highlands, located at the top of the Illawarra escarpment, and Albion Park in the Illawarra region, located close to the bottom of the escarpment. The site of the incident was between these two locations.

The weather pattern recorded at both weather stations was similar. Recorded weather data logged light rain and moderate winds on the Moss Vale to Unanderra rail line (Table 1). In interview, the driver recalled the weather conditions on departure from Summit Tank to be that of ‘very misty rain’. The data logger also indicated the windscreen wipers of locomotive 3316 were activated between Tunnel 2 and Tunnel 1.

Table 1: Weather recorded at Moss Vale and Albion Park

Source: Bureau of Meteorology

Rail Transport Operators

Qube Holdings

Qube Holdings was a logistics and infrastructure company that provides import and export logistics services across Australia. Its rail logistics division, Qube Logistics (Rail) Pty Ltd (Qube), was accredited by the Office of the National Rail Safety Regulator (ONRSR) as a Rail Infrastructure Manager (RIM) and Rollingstock Operator (RSO) on the 20 January 2013, in the states of NSW, South Australia, Victoria, Western Australia and Queensland.

Qube was the RSO responsible for the operation of grain train 3966.

CFCL Australia Pty Ltd

Chicago Freight Car leasing Australia (CFCLA) was the owner and lessor of the locomotives and wagons. They were accredited as a RSO by ONRSR on 20 January 2013 and were primarily a locomotive and rollingstock leasing company providing assets to other RSOs in the Australian rail industry.

In January 2020, CFCLA was acquired by Anchorage Capital Partners and the company was rebranded as Rail First Asset Management in 2021.

Australian Rail Track Corporation

The Australian Rail Track Corporation (ARTC) manages and maintains approximately 8500 km of rail network across five states in Australia.

In NSW, ARTC leases the mainline interstate corridors from the NSW Government (Figure 5). ARTC is responsible for managing and maintaining these rail corridors in accordance with their accredited system standards.

Figure 5: ARTC leased rail network from NSW Government

Dark lines are the corridors managed and maintained by ARTC. The route of 3966 was between Cootamundra and PT (Port) Kembla
Source: ARTC

ARTC was accredited by ONRSR as a RIM and RSO on 20 January 2013 in the states of South Australia, New South Wales, Victoria, Western Australia and Queensland.

ARTC was the RIM responsible for the management and maintenance of the section of track between Summit Tank and Farmborough Heights on the rail line between Moss Vale and Unanderra. Slightly further down the rail line from Farmborough Heights, at 91.080 km, is the interface between ARTC and Sydney Trains rail networks. Above rail operators that use the Moss Vale to Unanderra rail line are required to operate their trains in accordance with the train operating conditions[17] of both RIMs.

Train Crew

The train crew consisted of a driver and driver’s assistant. Both were employed by Qube.

Driver

The driver started working for Qube in September 2012. They were qualified as a locomotive driver for 23 years.

Before working with Qube, the driver had operated train services on the Moss Vale to Unanderra rail line with another freight operator.

The driver was assessed and deemed competent to operate services on the Moss Vale to Unanderra line by Qube. The driver operated five other services on that line in the week prior to the incident train service on the 15 December 2020.

During post incident interview with the driver, they said (of the incident train, 3966) they had taken a mental note of the train weight and got a feel for the train as they operated the train from Cootamundra, but did not calculate the train’s tonnes per operated brake (TOB) as required in their procedure.

The driver’s sleep-wake activity in the days prior to the incident was also established (Table 2). The previous train service operated by the driver was an empty grain service from Port Kembla to Cootamundra that departed at 1315 on 13 December 2020. The driver completed this shift at approximately 0100 on 14 December 2020.

At interview, the driver indicated that they were not feeling fatigued at the time of the incident.

The front of train recordings also captured the time when the train passes Robertson station, near the start of the descent of the Illawarra Mountain. The driver was heard yawning, and shortly after the driver’s assistant starts a discussion about the use of ‘No Doz’[18] to keep you awake. The driver indicated they were not aware of the tablets.

Qube calculated the driver’s FAID[19] score at the time of the incident to be 82.99. Scores between 80 to 100 represented high fatigue likelihood.

Table 2: Driver sleep-wake diary
 

This is the driver’s account of fatigue related factors and activities in the week leading up to the incident. Actual work hours from Qube 
Source: OTSI

According to Qube training records, the driver had current qualifications required to operate train services on the Moss Vale to Unanderra rail line. The relevant qualifications included:

• Level 5 – Driver Trainer[20]
• Driver competency against Work Instruction WI-540 (Train Management Moss Vale to Inner Harbour [Port Kembla]) was assessed as part of FM-781 (Train Driver Route Assessment Checklist). It was conducted on 28 and 29 November 2020. Competency was current.
• Rail Safety Worker medical last completed 28 July 2017, valid until 28 July 2022
• FM-780 (Train Operations Performance Checklist) last completed 11 February 2020, valid until 11 February 2023, and
• Qualified in CM locomotive operations on 11 April 2014 and competency was current.

Driver’s Assistant

The Driver’s Assistant started working for Qube in September 2020. They were qualified as a driver’s assistant and had no previous rail experience, prior to working for Qube.

According to Qube training records, the driver’s assistant had current qualifications required to assist train services on the Moss Vale to Unanderra rail line. Their relevant qualifications included:

• Level 2 – Second Person[21]
• Deemed competent to operate as an assistant under work instruction WI-540 (Train Management Moss Vale to Inner Harbour [Port Kembla], sign-off dated 9 October 2020 on Acknowledgement of Safety Critical Documents pro-forma. Competency was current, and
• Rail Safety Worker medical last completed 7 September 2020, valid until 7 September 2025.

Post incident interviews with the driver’s assistant established their sleep-wake activity in the days prior to the incident (see Table 3).

Qube calculated the driver’s assistant FAID score at the time of the incident to be 79.41.

Table 3: Driver’s Assistant sleep-wake diary

This is the driver’s assistant’s account of fatigue related factors and activities in the week leading up to the incident. Actual work hours from Qube. 
Source:  OTSI

Prior train services

ARTC provided information from ICE train radio[22] data to establish the volume of rail traffic that had descended the Moss Vale to Unanderra rail line in the months leading up to the incident. The data set included the average train speed of all train operators travelling in the Up direction (downhill) between Summit Tank and Unanderra.

Between 1 September 2020 and 15 December 2020 there were 412 services. Each coloured line on Figure 6 represents an RSO and the average speed of their combined services.

ARTC also noted that there had not been any reports of Condition Affecting the Network (CAN)[23] from the drivers of these services specifically related to lack of adhesion. Further, there had not been any reports of CANs from services travelling in the down direction (Uphill) related to lack of adhesion or loss of traction.

Generally, a train travelling up a hill requires a higher coefficient of friction at the wheel rail interface for the wheels to maintain traction (before the wheels start to slip). The same train, coming down the same hill can maintain adhesion (before the wheels start to slide) at a lower coefficient of friction.

Figure 6: Average train speed all RSOs 1 September 2020 to 15 December 2020

Each coloured line represents a RSO and the average speed of all their train services that travelled down the mountain. The red dotted line indicates the speed limit in that section of track.

Source: ARTC

Track inspection and measurements

Transport safety investigators inspected the track on the day of the incident. The track area inspected extended from the stop point of the two locomotives and two wagons (approximately 92.000 km) up to 600 m prior to the first derailment site (approximately 94.300 km).

Observations of the track leading up to the first derailment site and the second derailment site were documented and photographs taken (Figures 7, 8 and 9). Initial assessment of the track condition was noted as not having any obvious defects that could be expected to increase the risk of derailment. Track measurements were taken by ARTC post incident. Superelevation[24] measurements were compared against design superelevation and short twist and long twist[25] were calculated.

The track leading up to the first derailment site, 93.810 km to 93.714 km was measured. ARTC had identified a point of first derailment at 93.710 km. The results of the track measurements at this location showed no exceedances of short or long twist.

Figure 7: Rail line leading to first derailment site

Facing Up direction (towards Unanderra and down the mountain)

Source: OTSI

Figure 8: Rail line between first derailment site and Signal WG1042U

Facing Down direction (towards Moss Vale and up the mountain)

Source: OTSI

Figure 9: Signal WG1042U to second derailment site

Facing Up direction (towards Unanderra and down the mountain)

Source:  OTSI

Qube also contracted an engineering group to inspect the track post incident, who identified evidence of a derailment point, for the second derailment, at 93.220 km. However, the associated wagon and wheelset that made the markings could not be conclusively determined.

ARTC also took measurements of the rail track before and after the second derailment site. There were no exceedances of short or long twist found.

A contaminant was observed on the head of the rail lines across the area of track that was inspected. The contamination was more prominent in areas with more tree foliage. There was evidence of wheels rolling over and skidding through the contaminant at 94.000 km (Figure 10 and Figure 11).

Figure 10: Track contaminant at 94.000 km

Figure 11: Close up of track contaminant at 94.000 km

Pictures of the contaminant in Figures 10 and 11 were taken approximately 300 m prior to the first derailment, evidence of wheels rolling over and skidding through the contaminant 
Source: OTSI

Investigators collected a sample of the track contaminant from the rail head, near the site of the second derailment (93.150 km), for testing at the ATSB laboratories.

The ATSB testing indicated the substance was leaf matter. There appeared to be a secondary substance which was described as balled up and highly compressed (dark and greasy) in appearance which was probably from the leaves but could not be ruled out as coming from another source.

Track maintenance

The preceding six months’ maintenance history for the Unanderra to Moss Vale rail line was reviewed. ARTC had undertaken inspections of the running line between 91.080 km (the ARTC rail network boundary with Sydney Trains Rail Network) and 150.600 km (Moss Vale Junction).

Inspections undertaken included track geometry, rail wear, front of train inspection, rail lubrication and rail lubrication devices.

The frequency of these inspections was specified in ETE-00-03 (Civil Technical Maintenance Plan (CTMP)) and ARTC records indicated these inspections had been completed as required.

However, the requested maintenance history records did not account for a rail lubrication device located at 97.030 km (Figure 12). This lubricator was located close to the Landmark and Dombarton (Figure 1 inset).

Following draft report feedback, ARTC produced a listing of all rail flange lubricators which included a rail flange lubricator at 97.030 km. ARTC also stated that this rail flange lubricator serviced trains travelling on the down (uphill) (Figure 12). No additional maintenance records were provided with the revised list.

Figure 12: Rail flange lubrication device at 97.030 km and grease plume

Facing Up direction (towards Unanderra and down the mountain) device (left) and close up (right), this section of track was bi-directional

Source: Qube

General inspection of rail flange lubrication over this section of the rail line was last conducted between 96.893 km and 150.600 km on 14 June 2020, approximately six months prior to the incident.

The inspection intervals for rail flange lubricators were specified as once every 365 days. All rail flange lubrication devices listed in the maintenance records provided, from the ARTC boundary to Moss Vale Junction were inspected and deemed compliant on 30 August 2020, approximately 3.5 months prior to the incident.

The closest rail flange lubrication device to the one located at 97.030 km to have had a recorded general inspection was at 95.580 km on 30 August 2020.

Track Standards

ARTC’s Engineering Practices Manual, Civil Engineering, RC 2411 (Guidelines for Trackside Lubrication) stated on page 4:

Approximately 1.2 km before the first derailment site, two rail flange lubricators providing lubrication for the down rail line (uphill) were located at 94.26 km and 94.30 km, 40 metres apart, the rail flange lubricator at 94.30 km was not listed on ARTC’s maintenance history records (see Figure 13).

Additionally, two rail flange lubricators listed in ARTC’s maintenance history records at 94.958 km and 94.535 km were less than the required 500 m separation stipulated in RC 2411.

Figure 13: Rail lubrication devices leading to left hand curve and site of first derailment

Facing Down direction (towards Moss Vale and up the mountain).

Source: OTSI

ARTC CoP (Code of Practice Rail) section 1.2.6.4 Performance Requirements stated:

ARTC was requested to provide results of any friction testing undertaken on the Moss Vale to Unanderra rail line between Summit Tank Service Crossing (100.222 km) and Dombarton Down Signal WG1043 (92.222km), in the period from 1 January 2017 to 31 December 2021. They did not provide any results from friction testing conducted, in the requested period and stated in feedback that the Code of Practice does not require on-going coefficient of friction measurements.

ARTC noted:

On 3 June 2021, 6 months post the incident, friction tests were conducted by Monash Institute of Railway Technology, commissioned by Qube. The testing was conducted between 97.580km (500 m before Dombarton in the direction of travel) and 95.461km (1.5 km after Dombarton in the direction of travel). The tests were undertaken using a push tribometer as required in the ARTC Code of Practice.

All tribometer measurements were performed under dry conditions and were conducted at four separate sites. The results are in Table 4.

Table 4: Tribometer measurements

Rollingstock

The rollingstock was supplied to Qube by CFCLA under a lease agreement. The locomotives were maintained by CFCLA under its agreement with Qube. The wagons were primarily maintained by a contracted rollingstock maintainer to CFCLA and Qube in line with the lease agreement.

The rollingstock involved in the incident included:

• 2 CM Class Locomotives, CM3316 and CM3304
• 39 CGSY bottom dump grain hopper wagons
• 2 CGDY bottom dump grain hopper wagons.

The length of the train was 679.3 m.

CM class locomotives

The CM class locomotives were manufactured in 2012-13. They had a 22 t axle load and maximum gross power of 3300 hp (2460 kW). They were fitted with a Wabtec Fastbrake braking system and dynamic brake. They were also fitted with the Q-Tron QES-III locomotive control system that would provide an adhesion control function. The functional requirements for the adhesion control function as specified in Schedule 3 (Technical Specifications of MP33 Locomotive for CFCLA Rail JV) were:

The Locomotive Information Pack for the CM class locomotives[27] provided the operating conditions which included;

Maximum tractive effort – 414 kN, and continuous tractive effort – 363 kN, at a speed of 16 km/h

Peak dynamic braking effort – 244.6 kN, at a speed of 23.3 km/h.  

The locomotive design fully provisioned mass at rail was 132 tonnes. The locomotive can carry 10000 litres of diesel fuel which would weigh 8500 kilograms and the weight of other provisions such as lube oil, water and sand, approximately 1 tonne. Therefore, the dry weight of the locomotive would be approximately 122.5 tonne.

Grain hopper wagons

There were two types of grain hopper wagons, making up the train consist of the grain train 3966. Thirty-nine wagons were CGSY type, brought into service on the NSW rail network in 2015. The other two wagons were CGDY type, brought into service on the NSW rail network in 2013. The grain hopper wagons were manufactured by China International Marine Containers Group Australia (CIMC), for CFCLA.

Before any rail vehicle was permitted to operate on a rail network, they were required to comply with the minimum operating standards of the rail network owner. The measurement of brake block forces was one of several vehicle compatibility tests conducted to ensure the vehicle complied with the minimum operating standards for rollingstock. Tests were conducted on one of every type of vehicle, prior to that type of vehicle operating on the rail network. This is known as the Type Test.

The average measured brake block force was used to calculate the net brake ratio (NBR). NBR is the sum of the measured forces applied by the brake blocks onto the wheels divided by the weight of the vehicle and is determined for both tare and gross (loaded) vehicle mass. For a loaded vehicle the minimum NBR specified by AS7510.2:2014 was 13% with a brake cylinder pressure of 350 kPa, for vehicles fitted with high friction composite brake blocks. ARTC’s standard WOS 01.400 also recommended an NBR of 13% in order to provide effective braking without skidding wheels. The brake blocks fitted to the CGSY and CGDY wagons were FIP HA30 high friction brake blocks.

The results of the type tests for the CGSY and CGDY wagons were provided by CFCLA. A brake block force test conducted on 13 September 2015, on wagon CGSY 4519A, achieved an NBR of 14.23% for the loaded vehicle. A brake force test conducted on CGDY 4027, on 14 September 2013, achieved an NBR of 15.79%.

Both wagon types had CIMC 120AK brake componentry, a two-pipe train braking system. The two pipes being a brake pipe and main reservoir. This system allowed for an improved recharge time of the brake pipe pressure and greater control of the train braking performance (see Means of operation – wagons).

Two-pipe braking systems on grain wagons was a requirement in ARTC’s Route Access Standard for the Moss Vale to Unanderra rail line, where the trailing tonnes was greater than 2400 t, as with 3966.

Inspection and maintenance of the brake blocks and brake adjustments were primarily completed by a contracted rollingstock maintainer, consistent with the lease agreement.

History of CGSY wagons

After delivery of the CGSY wagons into service, issues with the braking performance of the wagons were identified. CFCLA had investigated the issue and concluded the braking performance was unsatisfactory. As a result, CFCLA required the brake rigging ratio to be increased to improve the braking performance.

To achieve this, slack adjuster pivot holes were re-drilled in the brake lever (Figure 14).  

Following this modification to the brake lever, CFCLA found that the braking performance of the wagons had not improved and advised the original engineering manufacturer (OEM) CIMC that they had undertaken modifications to the brake lever ratio to improve brake performance which was not successful and requested advice from CIMC on a possible fix. The detail of the modifications made by CFCLA was not provided to CIMC.

CIMC’s review of the wagon’s design identified an error in the brake rigging system, in the setup of the control rod on the slack adjuster. The control rod on the slack adjuster had been fixed to the wagon structure. This did not permit the slack adjuster to perform its primary function of reducing the slack in the brake system. This resulted in the brake cylinder piston travel increasing as brake blocks wear, with an eventual reduction in brake block forces on the wheels.

CIMC revised the design to incorporate a control lever.

Figure 14: Revised slack adjuster pivot holes

Source: Wayne Clift Consulting

When the revised control lever design was fitted by CFCLA to a trial wagon, they found there was no change to the operation of the brakes. The slack adjuster was still unable to reduce the slack in the brake rigging.

In March 2017, an independent subject matter expert (SME) was engaged by CIMC, to assess and determine the root cause of the braking issue on the CGSY wagons.

Conclusions and recommendations from the SME were as follows:

On 20 April 2017, the same SME was engaged by CFCLA to conduct the first article compliance inspection and testing sign-off and to provide a report on the revised control lever design. The SME conducted testing on CGSY 4542H and found and recommended the following:

On 22 April 2017, a train consisting of 40 CGSY wagons was involved in a runaway down the Illawarra Mountain (see Related Occurrences).

On 18 May 2017, as a result of the runaway on 22 April 2017, the NBR was tested on CGSY 4502V and found to be 13.9%. This wagon was the 38^th wagon in the train consist and was randomly chosen for testing.

On 10 July 2017, the CGSY wagons were returned to CFCLA and taken to Goulburn for care and maintenance. During this time, the CGSY wagons were modified with the slack adjuster control lever. They were returned to service on 3 April 2018, to service other bulk grain contracts.

On 16 November 2020, the CGSY wagons recommenced operation on the Moss Vale to Unanderra rail line. Qube provided information to confirm the wagons had received a 28 day periodical maintenance on 5 November 2020 and assurance FX exam brake tests had been conducted post return of the wagons to Qube.

The wagons completed 12 journeys on the Moss Vale to Unanderra rail corridor, including a trip two days prior to this incident journey on 15December 2020.

Train weight

There were several sources of data providing varying values of the weight of the train.

The load out tonnes[28] from Temora BFB[29] was 2703.9 t in 40 wagons + 1 empty wagon. This equated to a trailing tonnage of (39 x 23.2 t + 2 x 22.7 t + 2703.9 t) = 3654.1 t.

The train driver’s hand-written train consist stated the trailing tonnage was 3690 t. However, each loaded wagon was noted as 90 t which equated to a trailing tonnage of (40 x 90 t + 22.7 t) = 3622.7 t.

Qube’s computer printed train consist, provided when requested for copies of the train consist, had loaded wagons weighing 89 t each which equated to a trailing tonnage of (40 x 89 t + 1 x 22.7 t) = 3582.7 t.

The train consist provided to ARTC, from Qube, had a declared weight of the train of 3198 t, which included a declared weight of the locomotives at 123 t each. The trailing tonnage, according to this train consist, was (41 x 72 t) = 2952 t. The 41^st wagon was indicating it was loaded which was incorrect. This declared weight was significantly lower (by 456.1 t) than the weight of the train calculated on the Temora BFB load out tonnes. This was a 12.5% difference.

The two remaining wagons from the derailment were taken to Port Kembla for unloading and weighing. CGSY 4516T and 4518Y total grain weight was 134.385 t, as observed on the belt weigh system at Port Kembla. The average weight for each wagon was therefore (67.2 t + 23.2 t) = 90.4 t.

Using this figure to estimate the trailing tonnage equated to (40 x 90.4 t + 22.7 t) = 3638.7 t.

This weight was greater than the declared weight to ARTC, the driver’s hand-written train consist and Qube’s computer printed train consist, but less than the trailing weight calculated using the load out tonnes from Temora BFB and below the maximum allowable trailing weight (3680 t) as per ARTC TOC Waiver 16002[30].

It was noted that the train journey required 3966 to traverse the TfNSW rail network[31]. As per the TfNSW TOC Manual (TS TOC.2.2020 Issue 2 v19.0 2 September 2020), the load tones for freight trains travelling on the rail line from 91.080 km to Unanderra was a maximum of 3300 t for locomotives of class L3, as the CM locomotives were. Based on this, the train weight was greater than the allowable tonnage (on the TfNSW rail network) on all records of the train weight, other than the train consist provided by Qube to ARTC and TfNSW, which had a declared weight of 3198 t.

The trailing load was also measured by ARTC’s Exeter wayside detector at 0248 hrs, 15 December 2020. The wayside detector calculates a weight in motion and uses specific locomotive classes as weight references to conduct an automatic calibration at every pass of one of the reference locomotives. ARTC stated the wayside was not a certified weighbridge but achieved a +/- 3% accuracy.

It was noted that the weight of the locomotives provided by the wayside detector were within 1% of the calculated weight of the locomotives, accounting for indicative fuel levels in the locomotives (taken from the data logger) and their tare weight.

It was also noted the wayside detector recorded the last wagon in the consist CGDY 4026 at 27.67 t, approximately 4.5 t higher than its documented tare weight. ARTC provided data from the wayside of the previous two tare weights taken of CGDY 4026, which indicated the tare weight as 25.53 t on 5 December 2020, and 26.0 t on 21 October 2020. The tare weights of other CGDY wagons taken by the wayside monitor on 21 October 2020 indicated the average tare weight of the CGDY wagons was 27.5 t.

These readings indicated the tare weight of the CGDY class wagon was not the documented 22.7 t as registered with the infrastructure manager.

The total trailing weight measured was 3748.5 t. With consideration of the +/-3% accuracy, the train was between 3636.045 t and 3860.95 t (Figure 15). This indicated the train may have been running heavier than allowable tonnage limit of 3680 t.

There was also variability in wagon weights of approximately 7%, ranging from 90.65 t to 96.44 t. The wayside data indicated 20 of the 41 wagons were over the allowable loaded wagon weight limit of 92 t.

Figure 15: Exeter wayside detector read out

Source: ARTC

While it could not be established with 100% certainty what the trailing weight of the train was, the total load out tonnes from Temora BFB plus the tare weight of the wagons was considered most representative as all other sources were only estimates of the grain weight in the wagons.

ARTC’s wayside detector at Exeter was considered an indicative source of weight in each wagon, which highlighted a 7% degree of variability in the amount of grain loaded in each wagon across the train consist. It also highlighted specific wagons were likely overloaded.

These combined indicated the weight of the train was near maximum allowable tonnage and probably under the 3680 t limit for the train. However, it was likely a number of these wagons were over the allowable limit for a single wagon and there was variation in loading across the train consist.

Rollingstock inspections

Prior inspections

The most recent wagon periodical maintenance (28 day) inspection was conducted in Goulburn by a contracted wagon maintainer and signed off for release back into service on 25 November 2020, 20 days prior to the incident.

Post-incident inspections

Transport safety investigators’ observations of the rollingstock on the day of the incident included the portion of the train which had not derailed, the locomotives and two wagons (Figure 16), and both sites where rollingstock had derailed.

Figure 16: Stop point of runaway train 3966

Source: OTSI

On arrival at the locomotives and two wagons it was observed that the coupler knuckle was closed and locked on the back of the second wagon CGSY 04518Y and that both main reservoir (MR) and brake pipe (BP) isolation cocks were closed. It was later confirmed that the driver’s assistant had isolated the cocks post derailment to stop air leaking from the main reservoir and brake pipe.

The locomotives were shut down because noise from the running engines was disturbing nearby residents. Isolation cocks for the locomotive’s bogies and brake equipment appeared to be in the correct orientation when inspected.

The wheels on the remaining connected wagons showed some signs of heat (see Figure 17). There were no visual signs of flat spots on the wheels. This was later confirmed when the rolling stock was tested on 17 December 2020, prior to moving to Port Kembla to unload the wagons. Sand was also evident on the rail head located under the wagons and locomotives.

Figure 17: Back of 2^nd wagon CGSY 04518Y

Source: OTSI

The brake shoes were in contact with the wheels across both locomotives and wagons. The contact patch of the brake shoes was not aligned with the wheel diameter on some wagons (Figure 18).

Figure 18: Side of 1^st wagon CGSY 04516T brake shoe

Source: OTSI

On 17 December 2020, two days after the incident, testing on the rollingstock that had not derailed was conducted, to ensure the braking systems were operating to standard. The wagons were tested for brake pipe leakage rate (5 kPa/min) and given a brake holding test (13 mins). These were within specified limits.

The lead locomotive CM3316 had a functional brake test conducted by CFCLA and was given a Locomotive Ready to Go Certificate prior to the locomotives and two wagons being driven down to Port Kembla to unload and weigh the grain.

The trailing locomotive CM3304 brake function test was not conducted post incident. The locomotive event logger data for CM3304 indicated the control system acted as designed, with the air brake system and dynamic brake system performance recorded.

Net braking ratio tests

The NBR is the ratio of the sum of the measured actual brake block forces in kilograms divided by the total vehicle mass, in kilograms, at rail.

Qube conducted NBR tests on the two remaining CGSY wagons (4516T and 4518Y) that did not derail in the incident. The testing was conducted at Junee on 9 February 2021 by a qualified rollingstock engineer, under the observation of representatives from CFCLA.

The NBR test results were:

• CGSY 4516T was 12.45%
• CGSY 4518Y was 10.7%.

These results did not meet the minimum design standard net braking ratio for vehicles fitted with high friction composition brake blocks. Noting that the standard applied to new vehicles only and there was no requirement to test NBR on an ongoing basis.

The RISSB Standard AS 7510.2: 2014 Braking Systems – Part 2 – Hauled Rolling Stock stated:

As per ARTC’s WOS 01.400 Freight Vehicle Specific Interface Requirements Issue 1.0 Dec 2005, the NBR for vehicles fitted with high friction brake blocks, fully loaded, recommended 13% to provide effective braking without skidding wheels.

Transport for NSW RSU 400 Series – Minimum Operating Standards for Rolling Stock – Freight Vehicle Specific Interface Requirements V2.0, issued 24 August 2017 required 16% NBR to be used as a minimum for all new rollingstock and provided the conditions when the net braking ratio was lower than 16% but higher than 13% (for existing rollingstock):

As mentioned in Grain hopper wagons, the type test for the CGSY wagons was found to be greater than 13% but lower than 16%. The type test conducted on CGSY 4519A confirmed the NBR for the wagon was 14.23%.

It was understood by CFCLA at the time that the requirement for all new bulk commodity type wagons became effective as of 1 January 2018. The CGSY wagon type was published in the ASA Train Operating Conditions (TOC) Manual version 11.0 on 15 December 2017 with unrestricted operating conditions.

The two NBR tests on the remaining wagons could not statistically be considered representative of the entire consist. However, the NBR on a freight wagon should not be significantly different to other wagons of the same design assuming they are all built to the same drawings. The CGSY wagons had varying measured NBRs from 19.5% down to 10.7%, as seen from the various tests conducted on different CGSY wagons over their service life.

Post this incident on 15 December 2020, there remained five CGSY wagons in the fleet.

As noted in Net braking ratio tests, the NBR tests conducted on 9 February 2021 returned 12.45% and 10.7%.

The other three CGSY wagons not involved in the incident were tested on the 12 May 2021 and results were, CGSY 4542H – 12%; CGSY 4503H – 19.5%; CGSY 4513P – 14.5%.

It was noted that CGSY 4542H was modified by the SME to improve its brake performance. The NBR of this wagon when tested on 20 April 2017, post modifications, was 15.0% (see History of CGSY wagons).

Wagon brake pipe continuity

The ‘brake pipe’ is critical to the functionality of a train’s braking system. This pipe, which runs along the length of the train, provides the means through changes in air pressure to effect application and release of the train’s brakes (see Means of operation – wagons). A disruption in the continuity of this pipe, such as a brake pipe tap closed between wagons, will result in less wagons providing braking force.

To ensure brake pipe continuity and the correct functionality of a train’s brakes throughout the consist, the brake system is tested prior to commencement of a train’s journey. For the accident train, these tests were performed the previous day, with one wagon (of the 41 attached to the train) identified as having its brake components isolated.

In addition, Qube undertook a comparison of the time taken to recharge the brake pipe on the day of the accident (15 December 2020), against that of the train’s previous journey on 12 December 2020.

Qube found that there was no appreciable difference in the time taken to recharge the brake pipe between the two services, supporting the brake pipe was fully connected and continuous throughout the train consist on the day of the accident.

Contact patch of brake blocks

It was observed in the post incident inspection that some of the brake blocks on the wagons were not in contact with the wheel on the leading edge of the brake block. Qube also found this during their inspections and considered the gap at the outer edge of the brake blocks a contributor to lowered coefficient of friction[32] at the brake block/wheel interface. The reduced contact area between block and wheel also results in higher heat in the block contact area, which increases the risk of brake fade.

The manufacturer of the brake blocks had conducted tests of the high friction brake blocks in 2017. The testing indicated that brake block friction generally reduced as speed increased; and when the brake blocks were wet. Additionally, brake blocks were more susceptible to reduced friction with the wheel when the block had a gap at the leading edge of the brake block.

Of the 41 wagons attached to the accident train, the two remaining upright wagons with brakes applied were observable and found with gaps at the outer edge of the brake block.

There was evidence of a heat stripe (blue discolouration on metal occurs at approximately 300 degrees Celsius) on the left rear wheel of wagon CGSY 04518Y (see Figure 17). This indicated the contact patch from the brake block to the wheel was not consistent and evenly applied across the wheel. The corresponding right wheel did not show signs of heat build-up (no blue discolouration) to the same extent as found on the left wheel.

The wheels on CGSY 04516T and on the Locomotives showed very little signs of heat (no blue discolouration was present).

Train braking system

General description

There are three braking systems fitted to the CM class locomotive in addition to the parking brake. These comprise of two types of air operated (pneumatic) brake, that is, the automatic and independent, and an electrical dynamic brake. The use of each of the three braking systems is dependent on the circumstance during which braking effort is required.

Automatic brake

Introduction

The ‘automatic brake’ controls the brakes on the entire train, including the wagons and locomotive/s. Central to this system is the brake pipe, which runs along the length of the train. Changes to air pressure within the brake pipe regulate the application and release of the train’s brakes. When fully charged (that is, brakes released), the brake pipe pressure is about 500 kPa. Reduction of this pressure by the driver results in application of the train’s brakes.

Driver controls

The driver regulates the pressure within the brake pipe through operation of the automatic brake handle (see Figure 19). The brake handle positions on the CM class locomotive are:

1. Release – brake pipe charging or charged up to 500 kPa, which releases any automatic brake applied to the locomotive/s and wagons.
2. Minimum service – reduces the brake pipe pressure to 450 kPa which initiates a minimum application of the brakes on the locomotive/s and wagons.
3. Service zone – a graduated reduction of the brake pipe pressure from 450 kPa to 350 kPa, which correspondingly increases the braking forces at a graduated rate.
4. Full service – reduces the brake pipe pressure to 350 kPa which fully applies the brakes on the locomotive/s and wagons.
5. Suppression – reduces the brake pipe pressure to 350 kPa for the purposes of penalty brake[33] suppression and reset.
6. Handle off – reduces the brake pipe pressure to 0 kPa. This handle position configures the locomotive such that it cannot be used for initiating braking commands.
7. Emergency – rapidly reduces the brake pipe pressure to 0 kPa which quickly provides a full service brake application to the locomotive and wagons (see Means of operation – wagons).

Figure 19: Automatic and independent brake handles

Source: OTSI

Means of operation – wagons

In addition to the brake pipe, each CGDY and CGSY wagon was fitted with a pneumatic control valve, auxiliary reservoir, relay valve, supplementary reservoir and brake cylinders. The control valve responded to changes in pressure within the brake pipe. On sensing a reduction in brake pipe air pressure, the control valve would reduce the auxiliary reservoir air pressure by an equal amount. This auxiliary reservoir air would supply reference (signal) air to a relay valve, in-turn permitting air from the supplementary reservoir (continuously supplied by main reservoir air from the locomotive)[34] to enter the brake cylinder. A piston within the brake cylinder would then push the brake blocks against the wagon wheels, causing friction and slowing of the train (see Figure 20).

Figure 20: Wagon airbrake application process

The image is a simplified representation of an airbrake application on a wagon. The control and relay valves consist of rubber diaphragms, springs and ports that respond to air pressure differences to perform their functions.
Source: OTSI

In effect, on two-pipe trains (as with the CGDY and CGSY wagons) the pressure in the brake cylinder is directly proportional to the air pressure reduction in the auxiliary reservoir. Maximum braking effort is achieved when brake pipe pressure is reduced to 350 kPa, known as a ‘full service’ brake application. At this point the brake pipe, auxiliary reservoir and brake cylinder pressures equalise with each other at about 350 kPa. Therefore, further reductions in brake pipe pressure do not result in increased braking effort. Table 5 provides an overview of braking system pressures in response to various brake pipe pressures.

Table 5: Automatic brake pressure equalisations for a 500 kPa brake pipe[35]

[1] Auxiliary reservoir equalises with the brake pipe.
[2] Brake cylinder pressure equates to about 235% of the pressure loss in the auxiliary reservoir.
[3] Auxiliary reservoir equalises with both the brake pipe and brake cylinder.
[4] Auxiliary reservoir equalises with the brake cylinder, preventing further equalisation with the brake pipe.

In a similar manner to the wagons, a reduction in brake pipe pressure also applies the brakes on the hauling locomotives. For a CM class locomotive, the maximum automatic brake applied locomotive brake cylinder pressure attainable is also 350 kPa.  

Once the required speed reduction has taken effect, the driver places the automatic brake handle in the ‘release’ position which restores the brake pipe pressure to 500 kPa. On sensing an increase in brake pipe air pressure, the control valve allows air from the brake pipe to recharge the auxiliary reservoir to 500 kPa.[36] In addition, brake cylinder air pressure is vented to atmosphere allowing a spring within the brake cylinder to force the piston to retract, thereby removing the friction force of the brake blocks from the wagon wheels (see Figure 21).

Figure 21: Wagon airbrake release process

The image is a simplified representation of an airbrake release on a wagon. The control and relay valves consist of rubber diaphragms, springs and ports that respond to air pressure differences to perform their functions.
Source: OTSI

With brake pipe operated pneumatic braking systems, the brakes on the train do not apply simultaneously. As brake pipe pressure is vented from the lead locomotive, the brakes on the leading wagon apply first, followed sequentially by the other wagons towards the rear of the train.

Similarly, when a train’s automatic brakes are released (actioned by the lead locomotive), there is a delay in the entire train’s brake pipe (and auxiliary reservoirs) recharging, particularly towards the rear of the train. A review of the incident train’s data logger indicated that it took about 26 seconds for the brake pipe to fully recharge after a minimum service (50 kPa brake pipe reduction) application. For a 70 kPa reduction in brake pipe pressure, this increased to over 50 seconds for a full recharge. That is, the greater the brake pipe pressure reduction, the longer it took to fully recharge the brake pipe and auxiliary reservoirs back to 500 kPa along the entire length of the train in readiness for another brake application.

Brake pipe charging flow indicator

During an automatic brake release, main reservoir air, produced by the main compressor on the locomotives, recharges the brake pipe to 500 kPa. Although brake pipe pressure is restored relatively quickly at the front of the train, this does not accurately reflect brake pipe pressure along the length of the train. To assist the driver in determining whether the brake pipe is fully recharged in readiness for another brake application, a brake pipe charging flow indicator is provided.

Due to the sensitivity of the brake pipe charging flow indicator, it is possible to detect small losses in brake pipe pressure. This is particularly useful in alerting the driver to a derailment or train separation[37] event towards the rear of the train, whereas the brake pipe pressure on the locomotive may indicate little or no pressure loss.

On the CM class locomotive, the brake pipe charging flow indicator is on a computer display unit (CDU) on the driver’s control station. The indicator consists of a numeric value of main reservoir to brake pipe air flow expressed in litres per minute. It is located at the bottom of a bank of similar numeric displays including the brake pipe, main reservoir and locomotive brake cylinder pressures (see Figure 22). There is no accompanying visual annunciator tile or audible alarm to draw the driver’s attention to the activation of the brake pipe charging flow indicator.

Figure 22: Driver’s computer display unit

Source: OTSI

Running out of air

As depicted in Table 5, a full service application of brake cylinder pressure (350 kPa) is achieved when the driver reduces the brake pipe pressure to 350 kPa. However, this is dependent on the auxiliary reservoirs on each wagon being fully charged to 500 kPa at the time the brake application is made.

Where the brake pipe has not been given a sufficient opportunity after an automatic brake application to recharge the brake pipe across the entire length of the train prior to the reapplication of the automatic brake, it will result in a lower auxiliary reservoir starting pressure, particularly on wagons at the rear of the train. As a result, there is a reduced pressure drop in the auxiliary reservoir when equalising with the brake pipe on the subsequent brake application. In response, the relay valve and supplementary reservoir provide less pressurised air to the brake cylinders, resulting in a reduced braking force than would be achieved if the auxiliary reservoir starting pressure is 500 kPa. Table 6 provides an example of this reduced brake cylinder pressure where an auxiliary reservoir has recharged to only 450 kPa prior to the reapplication of the automatic brake.

Table 6: Brake pressure equalisations from 450 kPa auxiliary reservoir starting pressure[38]

[1] Note: Braking system still in release mode, with the brake pipe in the process of recharging the auxiliary reservoirs.
[2] Auxiliary reservoir remains equalised with the brake pipe, no brake cylinder pressure effected.
[3] Auxiliary reservoir equalises with the brake pipe.
[4] Brake cylinder pressure equates to about 235% of the pressure loss in the auxiliary reservoir.

In this example, the maximum achievable brake cylinder pressure in full service is about 235 kPa, where the auxiliary reservoir starting pressure is 450 kPa. This is one-third less than the 350 kPa brake cylinder pressure in full service where the auxiliary reservoir starting pressure is fully recharged to 500 kPa (refer Table 5).

This phenomenon of reduced available braking force due to low starting auxiliary reservoir pressure is termed ‘running out of air’. In summary, the lower the starting pressure of the auxiliary reservoir at commencement of an automatic brake application, the lower the braking force available.

Partial braking force recovery when running out of air

As explained in Means of operation – wagons, the maximum braking effort achievable is a full service brake application, due to the concurrent equalisation of the brake pipe, auxiliary reservoir and brake cylinder pressures. That is, further reductions in brake pipe pressure below 350 kPa do not result in increased braking effort. The only exception is when the train’s braking system is running out of air.

In this unique scenario a further reduction in brake pipe pressure will result in increased brake cylinder pressure. By lowering the auxiliary reservoir pressure below 350 kPa, it is possible to force an equalisation of the brake cylinder pressure at a higher rate than is by then achievable in full service. For example, as discussed in Running out of air, where an auxiliary reservoir is only recharged to 450 kPa prior to the reapplication of the automatic brake, the maximum brake cylinder pressure available in full service will be about 235 kPa. However, by reducing the brake pipe pressure further, an equalisation between the auxiliary reservoir and brake cylinder pressures will occur at about 314 kPa (see Table 7).

As described in Driver controls, it is not possible for the driver to graduate the brake pipe below 350kPa, for example, to 314 kPa as noted above. The next available command after full service is either ‘handle off’ or ‘emergency’, both of which result in 0 kPa brake pipe pressure, at a service (controlled) rate for the former and at a rapid rate for the latter.

Table 7 summarises various scenarios of reduced auxiliary reservoir starting pressures. This is then compared to the maximum brake cylinder pressures available in full service, versus the maximum brake cylinder pressures available with the brake pipe pressure reduced to 0 kPa.

Table 7: Approximate maximum brake cylinder pressures from auxiliary reservoir starting pressure[39]^, [40]

[1] Fully charged auxiliary reservoir, with expected starting pressure during normal operations.
[2] Brake cylinder pressure equates to about 235% of the pressure loss in the auxiliary reservoir.
[3] Brake pipe reduced to 350 kPa.

Importantly, despite the ability to increase available brake cylinder pressure with the brake pipe reduced to 0 kPa in instances of running out of air, it is not possible to again obtain the maximum braking force available as would be provided by full service with a fully charged auxiliary reservoir starting pressure.

Independent brake

The ‘independent brake’ applies pneumatic brakes to the locomotive/s only, independently of any trailing wagons. It is operated by the driver using the independent brake handle on the driver’s control station (see Figure 19). On the CM class locomotive, it has two positions: ‘release’ and ‘apply’, with an intermediate graduated service zone. The independent brake can be graduated in both application and release. In the fully applied position, the locomotive brake cylinder pressure is about 500 kPa.

Dynamic brake

The electrical dynamic brake is designed to reduce locomotive fuel usage and wear on wagon componentry as occurs with pneumatically operated friction brakes. It provides a supplementary means of train-speed control that complements the train’s pneumatic automatic brake.

When dynamic brake is selected, it alters the locomotive’s traction motor fields from a tractive power to a generator configuration. The subsequent power generated by the rotating locomotive wheels is fed to resistor grids and dissipated as heat, resulting in a retarding force. This retarding force is limited to the locomotive wheelsets only, rather than dispersed across the entire train. Increasing or decreasing the amount of electrical resistance varies the braking effort on the rotating locomotive wheels.

On the CM class locomotive, the dynamic brake is selected by the driver moving the throttle/dynamic brake handle on the driver’s control station into the dynamic braking zone (see Figure 23).

Figure 23: Dynamic brake / throttle handle

Source: OTSI

Automatic brake relationship with dynamic brake

As described in Means of operation – wagons, when the automatic brake is applied air pressure develops in the locomotive’s brake cylinders. Simultaneous application of both the dynamic brake and locomotive brake cylinder pressure can result in potential wheel lock-up and wheel slide. To prevent this, a dynamic brake inhibit (DBI) function[41] is supplied as part of the Fastbrake air brake system. The DBI automatically releases any automatic brake applied locomotive brake cylinder pressure whilst dynamic brake is in use. Independent brake applied locomotive brake cylinder pressure is not affected by the DBI.[42]

The Fastbrake system provides the option for the owner/operator to specify during the locomotive design the activation of the dynamic brake knockout (DKO) function during an emergency brake application. When activated, the DKO causes the locomotive’s dynamic brake to disengage, and the automatic brake applied locomotive brake cylinder pressure to be restored. Wabtec advised, that where the optional DKO function is not fitted, the dynamic brake is retained during an emergency brake application, resulting in extra available braking effort.

CM class locomotive braking systems

General

Braking system specifications for the CM class locomotives was contained in Schedule 3 (Technical specifications of MP33 locomotive for CFCLA Rail JV).

Information (page 12) included:

CM class locomotive dynamic brake

As discussed in Dynamic brake, Wabtec manual 31394P (FASTBRAKE Operations and Maintenance MPI-CFCLA Locomotives) allowed for a DKO option, specifically:

Neither this manual or the driver’s manual[44] for the CM class locomotive stipulated if the DKO function was active or omitted for the CM class locomotive. Wabtec Australia advised that the Wabtec manual included the statement (set out above) as the owner/operator of the locomotive could determine and specify the way they wanted this feature to work.

Subsequent testing found that the CM class locomotive DKO option was not active, resulting in the retention of the dynamic brake during emergency automatic brake applications.

While not related to the incident, additional testing by OTSI also found that retention of the dynamic brake during an emergency brake application resulted in the automatic brake applied locomotive brake cylinder pressure being suppressed by the DBI on the CM class locomotive. This meant that when travelling as a light engine[45] the stopping distance could increase in the event of an emergency, if:

• dynamic brake was engaged
• the automatic brake was placed in the emergency position
• the independent brake was not applied.

While Wabtec addressed this issue in earlier brake system designs by stipulating that ‘during independent, emergency, or penalty brake applications, the dynamic brake interlock magnet [DBI] MUST NOT restrict the flow of air to the [locomotive] brake cylinders’,[46] Wabtec Fastbrake did not. Rather, the Fastbrake manual (31394P) stated that during an emergency brake application the:

In recognition of the possibility of increased stopping distances on light engines, 31394P advised that in the event of an emergency:

• firstly, the independent brake was to be fully applied
• secondly, the automatic brake was to be applied to the emergency position.

This critical instruction was not replicated in the driver’s manual for the CM class locomotive.

CM class locomotive power cut-out switch

The power cut-out switch (PCS) activates in circumstances of low brake pipe pressure, for example, if the driver selects ‘handle off’ or ‘emergency’. Once activated, it automatically removes tractive effort from the traction motors and returns the locomotive to idle. The purpose of this is to prevent locomotive traction power working against the train’s brakes in the event of an emergency brake application.

The CM class locomotive was fitted with this function, as stated in the operator’s manual (MP33C Locomotives MP33C Units CM3301 – CM3316), page 2-29:

Similar information was contained in the driver training materials supplied by Wabtec to CFCLA on handover of the CM class locomotive. For the CM class locomotive, the PCS activated at pressures below ~280 kPa.

Historically, the PCS and DKO were both contained on the same electrical circuit, whereby at low brake pipe pressures both locomotive traction power and dynamic brake would disengage.

However, the electrical circuit configuration allowed for the separation of the two functions. Static testing by OTSI on a CM class locomotive found that:

• An ‘emergency’ automatic brake application during dynamic braking resulted in a PCS, but dynamic brake stayed engaged.
• A ‘handle out’ automatic brake application during dynamic braking resulted in a PCS, but dynamic brake stayed engaged.

Qube later repeated these tests on a moving locomotive with the same results.

Operational procedures

Qube had a documented work instruction for operations on the Moss Vale to Unanderra rail line. WI-540 (Moss Vale to Inner Harbour [Port Kembla] Train Management).

Requirements in WI-540 included a calculation of the tonnes per operative brake (TOB) and a requirement to record a brake release rollaway time at Summit Tank. These actions were in the instruction to ensure train crew were aware of key train handling characteristics, to assist train management.

Tonnes per operative brake

TOB is calculated by dividing the gross weight of the train (3966 was 3922.1 t) by the number of wagons with operable brakes. The 14^th wagon CGSY4539Q had been identified on the train inspector’s certificate for 3966 as having non-operative air brakes. Therefore, the number of wagons with operable brakes was 40. For 3966, the TOB was 98.

WI-540 also specified the TOB for grain trains could vary in value up to 100. Train crews were required to calculate the TOB to determine braking effort required on down grades. Grain trains with a TOB that exceeded 80 generally required higher brake cylinder pressures to bring the train to a stop or control the train speed. Drivers needed to be mindful of this when operating trains down steep grades.

Brake release rollaway time test

The brake release rollaway time test was required to be performed to give the driver an appreciation of the brake release and recharge times of the automatic brake. The train was required to be stopped using a 100 kPa brake pipe reduction. Once stopped, the driver would release the automatic brake and the train crew recorded the time it took for the train to start moving without the application of traction power. If the train moved following the 100 kPa reduction in less than 45 seconds, extra care was required to ensure sufficient recharge of the automatic brake after a stop was made, before continuing down the grade. Further information to clarify what ‘extra care’ meant was not detailed in the work instruction, but this may have been appropriate due to the subjective nature of the term ‘extra care’.

Serial/Cycle Braking

WI-540 specified serial/cycle braking, where the dynamic brake is fully applied and the air brake graduated to control the speed of the train, as the preferred method if the TOB was less than 80 and only two locomotives were provided for dynamic braking. The procedure for serial/cycle braking was:

• When speed reached 15 km/h, apply automatic brake to minimum reduction.
• Apply further reduction in brake pipe pressure to ensure train speed is not increasing on the grade, do not exceed 100 kPa reduction if possible. The dynamic brake must be left in full applied position.
• If train speed increased towards 30 km/h, make a heavier brake pipe pressure reduction or stop the train.
• The train must be brought to a stop using the fourth consecutive brake application cycle.

Balance Braking

WI-540 specified balance braking, where the dynamic brake is graduated, as the preferred braking method if the TOB was more than 80 and two or more locomotives are provided for dynamic brake purposes. The procedure for balance braking was:

• When speed reached 15 km/h, apply automatic brake to minimum reduction.
• Check if weight of the train can be balanced on the grade, maintaining about 25 km/h.
• If train speed increased, reduce brake pipe pressure to 425 kPa. If speed then balanced, maintain control using the dynamic brake.
• If weight and speed could not be balanced using 75 kPa brake pipe pressure reduction and full dynamic brake, serial / cycle braking was to be used.

Additional instructions were provided in section 10 which required the train crew to stop the train and apply the locomotive independent brakes if at any time the brake pipe pressure needed to exceed 100kPa to control the train speed.

Section 13 of WI-540 re-iterated the requirements from the ARTC RAS General Information 10.6:

In an emergency situation, Section 14 of WI-540 provided the Emergency Train Management Procedures which stated:

Related occurrences

El Zorro Transport, 7 February 2011

Loaded grain train 3996, travelling to Inner Harbour, Port Kembla, ran away as it descended the rail line between Summit Tank and Unanderra. The driver was unable to control the speed of the train towards the end of the descent. The 2988 t train was 691 m in length.

The investigation found that the driver did not test their air brakes at any stage after leaving Moss Vale although this was common practice. Several other RSO’s driving procedures included the requirement for a driver to stop in the vicinity of 107.000 km and make a 100 kPa automatic brake application. After coming to a stand and only after all pressures had equalised, was the driver to release the independent brakes on the locomotive and then release the automatic brake. As soon as the brakes were released, the driver was to note the elapsed time in seconds before the train began rolling. This gave the driver an understanding of the recharge rate for the brake pipe and the timing of the release of the exhaust chokes on the wagons.

Between Summit Tank and the point at which 3996 came to a stand, the driver made several brake application and releases. Only on two of these occasions did the brake pipe air pressure return to full pressure (500 kPa). Also, successive brake applications were greater than the preceding application, indicating the driver was having trouble controlling the train as it increased speed due to ‘running out of air’.

Qube Logistics, 22 April 2017

Loaded grain train 8960, travelling from Bogan Gate to Inner Harbour, Port Kembla, ran away as it descended the rail line between Summit Tank and Unanderra. After passing Dombarton, the driver realised he had lost control of the train. At 1248, the driver contacted the ARTC network controller who, in conjunction with Sydney Trains’ train controller, cleared a pathway for 8960.

The maximum allowable speed for the Dombarton to Unanderra line was 30 km/h; however, the train reached a maximum speed of 107 km/h. At 1255, the train stopped, assisted by a shallower gradient near Unanderra station. There were no injuries or damage because of the incident.

The investigation found that as train 8960 was operated down the rail line between Summit Tank and Unanderra, the train management actions by the driver did not conform to Qube’s train handling procedures. After passing Summit Tank, the driver made ten brake applications and releases and in doing so did not allow the train’s automatic brake system to fully recharge. This resulted in a loss of necessary braking capability to be able to control the train’s speed on the steep continuous descent. The incident was further compounded when the driver’s actions (applying the independent brake) caused the locomotive’s dynamic braking system to be rendered inoperative, further reducing control of the train.

The braking system of 8960 was operating within specification and wagons were loaded below the maximum allowable payload (3680 t). However, the train was loaded by approximately 10% more than that recorded on the train’s consist record. It is probable that the additional mass placed an extra load on the braking system and affected the handling characteristics of the train.

Safety analysis

The loss of control leading to the runaway of the train was influenced by several factors. The primary contributing factors included wagons with variable net brake ratio (NBR), reduced brake cylinder pressure, a heavy train with some overloaded wagons, and dynamic braking affected by low adhesion conditions. Several individual actions by the driver that were inconsistent with the requirements in the work instruction contributed to the loss of control. These are discussed in more detail below.

Operation and braking did not control the train

WI-540 work instruction required the train’s tonne per operative brake to be calculated prior to descending the Illawarra Mountain. Qube’s internal report documented that this was not performed in this occurrence. The tonnes per operative brake (TOB) of the train was 98. A TOB that exceeded 80 generally required higher brake cylinder pressures to bring the train to a stop or control the train speed. Drivers needed to be mindful of this when operating trains down steep grades.

WI-540 also required the driver stop using a 100kPa reduction and check the brake release and recharge time at Summit Tank. The driver did not do this and stated in Qube’s internal investigation that they had made a mental note of the train rollaway time and got a feel for the train brake during operation of the train. According to the data logger, the driver stopped the train using a 69 kPa reduction and did not release the brakes. This led to the driver dragging the train to commence descent down the mountain.

Without conducting this test, the driver was not aware if the train brakes would release in under 45 seconds, which would be an indicator for the driver to use extra care to ensure brakes were recharged after an automatic brake application. The absence of this brake test meant the driver was unable to confirm the effectiveness of the braking system, before commencing descent.

WI-540 also stated ‘The brake pipe air flow must indicate a fully charged or almost fully charged brake pipe before second and subsequent brake applications are initiated’. The data logger record shows that a second serial braking application was initiated with 934 lpm flow of air into the brake pipe, indicating a significant flow of air was still filling the brake pipe so it was not yet fully charged.

It was also noted, this instruction presented a challenge to a driver having regard for the small margins for error. Adding 'almost' is not quantifiable and so leaves the driver to make difficult decisions, with little margin for error, on when to apply brakes.

For high risk operations in particular, steep gradient management, drivers must constantly weigh the demand to reduce the fast-accelerating speed against the demand to delay application so that the brake pipe can charge.

WI-540 further required the train to be stopped in the event of a greater than 100 kPa brake pipe reduction or when speed exceeded 30 km/h. During the second serial / cycle braking (final brake application sequence), the data logger record indicated no attempt to stop the train when the speed exceeded 30 km/h. After 42 km/h was reached, the driver applied a full-service brake application. Just prior to this, at 0422:55 a 103 kPa equalising reservoir reduction while travelling at 35 km/h was reached, but full service was still not applied.

At 38 km/h the driver increased the brake pipe reduction to about 120 kPa. The driver increased this to about 135 kPa at 41 km/h and finally to a ‘full service’ application (150 kPa brake pipe reduction) at 42 km/h. The driver applied the maximum braking effort which they believed to be achievable. However, once the train had reached 42 km/h, control of the train was lost.

The train remained in this braking configuration until it reached a speed of 85 km/h, at which time the driver applied the independent brake. The train did not immediately slow as a result of this brake application and continued to increase speed until the rear portion of the train, from the 29^th wagon derailed as it rounded a 200 m left-hand radius curve, at a speed of 100 km/h. The 3^rd to the 28^th wagons then derailed seconds later as the train rounded a right-hand 200 m radius curve at a speed of 98 km/h. The locomotives and remaining two wagons then slowed significantly, stopping about one kilometre later.

Appreciation of brake recharge time

According to work instruction WI-540 (Moss Vale to Inner Harbour Train Management), Qube drivers were required to calculate the train’s tonne per operative brake (TOB) prior to descending the Illawarra Mountain to estimate braking effectiveness. The TOB calculated for 3966 was 98, which was at the upper limit of 80−100 for grain trains. This meant that the train was almost at braking capacity limits for the long descending grade from Summit Tank to Unanderra. However, Qube found that the driver did not conduct this calculation prior to the descent.

To further assist drivers in judging the braking characteristics of their train consist, WI-540 required drivers to perform a running brake test enroute (that is, without stopping the train) and a rollaway time check at Summit Tank at the top of the grade. In the 45 minutes prior to arrival at Summit Tank, the driver made 15 running automatic brake applications and releases. In interview, the driver advised that at that stage the train appeared to brake normally.

For the rollaway time check, drivers were required to stop their train at Summit Tank using a 100 kPa brake pipe reduction and verify the amount of time it took for the train to commence rolling once the automatic brake was released. In addition to gauging the release time for the automatic brake, the stop and brake release at Summit Tank provided the driver with an indication of the brake pipe recharge time after a large service brake reduction.

This was one of the most critical checks conducted by train drivers prior to descending the mountain as it provided an indication of how much time it would take for the train’s brakes to recharge following a significant brake application (100 kPa).

Although the driver stopped the train on arrival at Summit Tank, they did so with a 70 kPa brake pipe reduction, 30 kPa less than that required by the instruction. Further, once stopped, the driver applied traction power against the still applied automatic brake and commenced the descent, rather than releasing and assessing the brake release, and recharge time as per the instruction.

While the driver stated he had gained an appreciation of how the train was handling along the journey, not conducting this brake stop and release rate test, may have deprived the driver of some critical information, that was, the recharge time of the train’s brake pipe following a significant brake application.

Discussions with other train drivers who have descended the same route over many years indicated the stop and check of the recharge time was an important step before descending the mountain because the recharge time on trains can vary.

Reduced dynamic braking

The driver made the first of the cycle braking applications with full dynamic brake at about 17 km/h. Sand operated automatically to assist in increasing the adhesion of the locomotive wheels under the heavy dynamic braking.  

Wheel slip and slide occurs when adhesion between the wheel and rail interface is low.[48] The automatic sanding function on a locomotive occurs to improve or increase adhesion during braking. It also improves traction when locomotives are powering. In this case, frequent auto sanding occurred which was indicative that reduced or low friction impacted the ability of the locomotive’s dynamic brakes to effectively provide optimal braking force.

Based on the CM class locomotive specifications, the mass of the locomotive and the maximum dynamic braking force, to achieve the maximum dynamic braking force the required coefficient of friction at the wheel rail interface was 0.18. The top of rail friction measurements taken approximately 6 months after the event, in dry conditions indicated the coefficient of friction was in the range of 0.2 to 0.36. It is likely that at the time of the train’s descent, when the rail line was wet and featured significant leaf matter contamination that the coefficient of friction on the top of rail was lower than the locomotive required.

The dynamic brake was less effective under the low adhesion conditions than it would have been under higher adhesion conditions. The wheel slip/slide protection system, worked to maintain traction by use of auto sanding to increase friction and derating the dynamic braking effort through the wheels (as evidenced in the data logger, as dynamic brake power lowered sanding was initiated)

As the train’s speed increased, the driver increased the brake pipe reduction to 83 kPa which was initially effective in slowing the train. With additional braking effort applied to the 40 wagons with operable brakes, the train driver was able to successfully reduce the train’s speed. As discussed in Rollingstock adhesion requirements the friction level required by loaded freight wagons for braking was not compromised under the prevailing track conditions.

Wagons with variable net brake ratio

Measurements of NBR on various CGSY wagons ranged from 10.7% to 19.5%, which was a significant variation in NBR for a wagon type. These wagons were required by Australian Standards to achieve an NBR of 13% to 16% with a brake cylinder pressure of 350 kPa. ARTC recommended an NBR of 13% in order to provide effective braking without skidding wheels.

When these wagons were placed into service in September 2015, the type test, which was the industry standard requirement was met, with 14.23% NBR.

As stated in History of CGSY wagons, a design error that affected the braking performance on the CGSY wagons was identified shortly after their introduction into service. Although a few interventions were made to rectify the braking system, uncertainty remained as to the effectiveness of the modifications.

Evidence supported a degree of variability in the braking system in the CGSY fleet with varying results from NBR tests conducted on different wagons over time:

On 12 May 2021, three CGSY wagons that were not involved in this incident were tested and achieved the following NBR results:

As CGSY 4542H did not meet the AS requirements for braking while in a loaded condition, Chicago Freight Car Leasing Australia (CFCLA) cleaned and greased the brake rigging and repeated the brake test on the 20 May 2021. This resulted in the wagon returning an NBR of 15.8%.

On 9 July 2021, after consultation of the AAR standard S401, which prevented the addition of grease on brake rigging for testing, CGSY 4542H brake rigging was cleaned and all evidence of grease removed. The NBR test was then repeated several times in the loaded and empty conditions. The NBR in the loaded condition was found to have an average of 13.85%.

CGSY 4542H

This wagon was of particular interest, as modifications and tests could be observed over its life cycle.

Based on the wagon type test conducted in September 2015, it’s NBR should have remained in the vicinity of 14.23%

The wagon’s slack adjuster pivot holes were re-drilled on its brake levers by CFCLA. It had a CIMC revised control lever design fitted by CFCLA. It was further modified by CFCLA in accordance with the recommendations from the SME.

In April 2017, the SME tested the wagon and made some minor adjustments before determining that the slack adjuster on the wagon was fully compliant with industry practice and brake force testing showed the wagon had an NBR of 15%.

While this wagon was not involved in the runaway of train 8960 that occurred on 22 April 2017, nor was it involved in this runaway of train 3966, it was brake tested on 12 May 2021 and achieved an NBR of 12%.

Following the cleaning and greasing of its brake rigging by CFCLA, a re-test on the 20 May 2021 achieved an NBR of 15.8%.

Then on the 9 July 2021, with removal of the grease and being tested multiple times, it achieved an average NBR of 13.85%.

The modifications and testing on this wagon indicated its braking performance varied over its life cycle. After modifications to improve the brake performance, it did fade over time to drop below the standard requirements. With interventions, such as cleaning and greasing, which were not permitted by Engineering standards (EPR 005), the NBR was raised above requirements and were proven to remain above requirements once the greasing of the brake rigging was rectified.

Reduced brake cylinder air pressure

At 0448 travelling at 15 km/h, and consistent with WI-540, the driver reapplied the automatic brake in ‘minimum service’ and then increased the brake pipe reduction to 70 kPa. However, as noted by the driver in interview, the brake pipe had not yet fully recharged.

The brake pipe at the locomotive was registering 489 kPa and the brake pipe charging flow indicator was still registering a rate of recharge of 934 litres per minute.

This second cycle braking automatic brake application was made before the brake pipe had fully recharged after the release of the first cycle braking brake application. This resulted in a reduced amount of available brake cylinder pressure to the driver for that and subsequent brake pipe reductions, and a lessened braking effort on the 40 trailing wagons with operational air brakes.

As a result, the train continued to increase speed with this 70 kPa brake pipe reduction.

For the driver, this was likely considered an appropriate brake pipe reduction to slow the train. However, as discussed in Running out of air, when the brake pipe has not been given a sufficient opportunity to recharge across the entire length of the train prior to the reapplication of the automatic brake, it will result in a lower auxiliary reservoir starting pressure, particularly on wagons at the rear of the train. As a result, there is a reduced pressure drop in the auxiliary reservoir when equalising with the brake pipe on the subsequent brake application. In response, the relay valve and supplementary reservoir provide less pressurised air to the brake cylinders, resulting in a reduced braking force than would be achieved if the auxiliary reservoir starting pressure was 500 kPa.

As the driver experienced nil effect from the brake application, they continued to reduce brake pipe pressure incrementally against a faster moving train which required greater braking force than was being applied, to stop. Each incremental brake application made by the driver at this time was against a gradually increasing speed of train, with increasing momentum requiring an even greater braking force to slow or stop the train.

Heavy train with some overloaded wagons

The weight of the train was near maximum allowable tonnage and probably under the 3680 t limit. Notwithstanding, it was likely a number of these wagons were over the allowable limit for a single wagon.

As detailed in Train weight, the wagons had been loaded inconsistently with some wagons being heavier than others. While the overall weight of the train consist was likely under the allowable weight limit for grain trains, it was apparent there were some wagons that were overloaded.

With a train near peak weight, there would be less scope for error with train handling and maintaining appropriate speed when descending the 1 in 30 grade on the Illawarra Mountain. Minor over speeds result in much greater downhill force for the train braking system to retard.

With individual wagons overloaded, the dynamics of these wagons is also affected impacting the ability of the wagon to operate as designed.

It is likely the driver expected he was operating a heavy train as the handwritten tonnage on the train consist was 3690 t. This should have been a trigger that the train was overloaded, even though the addition of the nominated individual wagon weights of 90 t each equated to 3622.7 t.

At interview the driver said they took a mental note of the weight of the train even though they had not calculated the tonnes per operative brake.

While the driver said they were aware of the train being heavy, it did not appear to change their method of operating the train on the descent.

Train driver decisions affected by fatigue

Fatigue research has shown that increasing fatigue is typically associated with an increasing likelihood of error.

There were factors which may have increased the driver’s level of fatigue and consequently influenced their decision-making and handling of the train. Factors considered included prior sleep, wakefulness, hours of service and task demand.

Prior sleep

It is reasonably well established in the literature that sleep loss reduces the duration that a person can sustain alertness.[49] In a working environment (such as train driving) that requires the driver to remain vigilant and alert for several hours during the day and night, it is essential that drivers have enough sleep in the 24 and 48 hours prior to work to maximise opportunity for sustained alertness.

The sleep-wake history established during interview with the driver indicated they had slept 12 hours in the previous 48 hours, with 3 of the sleep hours being in the previous 24 hours leading up to the time of incident. These 3 hours consisted of the last 2 hours in regular sleep time (0500 to 0700) and 1 hour in the afternoon (1500) prior to commencing work.

The driver’s block of sleep in the early hours of 14 December was 6 hours (0100 to 0700). The recommended sleep time for adults in the National Sleep Foundation Guidelines is 7-9 hours.[50]

The driver had also worked the night shift on the previous night (17:00 12^th December to 06:00 13^th December) and had only 5 hours of sleep in the day (07:00 to 12:00). Including the first 4 hours of the driver’s sleep block on the 14^th December, the driver had 9 hours sleep for that 24‑hour period.

It is likely that the 12 hours of sleep in the previous 48 hours created a sleep debt[51]. The typical sleep hours of the driver were 8 hours in a 24-hour cycle.

It is likely a sleep debt contributed to the driver’s level of fatigue.

Wakefulness

The time of the occurrence suggests the driver’s level of alertness may have been influenced by the natural circadian rhythm or sleep-wake cycle.[52] Humans have a natural circadian rhythm which governs sleeping and waking. In the early hours of the morning (0300 to 0500), the body is driven to sleep and hence is not as alert as it would be later in the morning when the sun has risen.

Due to the time of day leading up to the occurrence, it was likely the sleep-wake cycle contributed to the driver’s level of fatigue.

Hours of service

Leading up to the day of the incident, the driver was rostered and had worked an 11-hour night shift, had a 6-hour break, then an 11-hour afternoon shift, then a 20-hour break and was 10 hours into an 11-hour night shift when the incident happened.

The roster for the driver on the 14^th December was planned to commence at 14:30, however, due to late running services the driver was informed approximately 2 hours prior to commencement that the shift was laid back to commence at 20:00.

The original roster was assessed by Qube and found to have a FAID score of 82.99. Scores between 80 to 100 represent a high fatigue likelihood. As this score was based on the driver’s rostered hours, it is an indicator the rostered working hours likely to contributed to fatigue. Additionally, the layback of the start time on the 14^th December would only have exacerbated the driver’s level of fatigue.

Task demand

The driver commenced driving duties from Cootamundra and remained at the controls for the entire time leading up to the incident. This meant they were on the task of driving for approximately seven hours before starting the descent.

The second person was unable to relive the driver as they were not qualified to drive the route.

According to the train crew, they did not stop on the journey from Cootamundra, except for a momentary stop at Moss Vale to pick up a crew pass. This stop did not allow enough time for the driver to have a reasonable break from driving duties.

The time the driver spent driving the train without a significant break to relieve him from the task demand of driving the train likely contributed to the driver’s level of fatigue.

Considering each of these factors, it was likely the driver’s ability to make decisions at the time of driving the train between Summit Tank and Farmborough Heights was affected by fatigue. This was supported in review of the driver’s actions and from in-cab recordings described below.

While the driver made increasingly heavier automatic brake applications in response to increases in speed, these decisions were delayed. According to WI-540, the balance point at which efforts should have been made to stop the train and fully recharge the braking system was when the brake pipe pressure reduction exceeded 100 kPa or, the speed of the train approached 30 km/h. The driver did not exceed a 100 kPa brake pipe pressure reduction until the train was travelling at 38 km/h (about 25% over speed). The driver also delayed the use of a ‘full service’ brake application with full dynamic braking (the maximum braking effort they believed to be achievable), until 42 km/h.

Operational decisions made by the driver on the morning of the incident, such as delaying the full service brake application until after the train was travelling above 30 km/h, may have been affected by fatigue.

The driver was an experienced shift worker and had descended that section of track on previous occasions and at similar times of the morning, At interview, the driver indicated they were not feeling fatigued at the time of the incident.

The physiological effects of fatigue result from hours of wakefulness and high cognitive task demands. Individuals are not always aware of the impacts or effects and the momentary lapses in concentration which may occur as a result.

The fact that the driver indicated at interview that he was not fatigued is not necessarily reliable given the high levels of stress and high cognitive workload he would have experienced at the time and in the early hours of the morning.

Driver did not apply the emergency brake

Dynamic braking in an emergency

In interview, the driver advised that during the second cycle braking application after leaving Summit Tank the train began behaving ‘unpredictably’. That is, it was not slowing as expected based on the previous braking sequences.

Once the driver identified that control of the train had been lost, the driver advised the network control officer. During an update of the emergency to the network control officer, the driver stated ‘…I don’t want to put it in emergency because I’ll drop my dyno [dynamic brake] out’. The driver explained that as the automatic brake was already in the ‘full service’ position, they believed no further braking effort would be available in the ‘emergency’ position. Further, the driver believed that if the automatic brake was placed in the emergency position, the locomotive’s dynamic brake would disengage, thereby reducing braking capacity and worsening the runaway situation.

The driver’s actions were supported by Qube’s work instruction WI-540 (Moss Vale to Inner Harbour Train Management), which in part, stated that in the event of an emergency:

This was due to Qube’s similar understanding that the loss of dynamic brake with no increase in wagon braking effort would result if the automatic brake was placed in the emergency position.

However, testing by OTSI found that on the CM class locomotive the dynamic brake remained engaged and functional when the automatic brake was placed in emergency.

Low auxiliary reservoir starting pressure

In relation to the automatic brake on the day of the accident, analysis of the data logger of 3966 found that:

• On average, the brake pipe took 10 seconds to reduce to a commanded ‘minimum service’ brake pipe reduction (50 kPa).
• The second cycle braking sequence commenced before the brake pipe had fully recharged from the first cycle braking sequence. Specifically, at the time of the brake application, the brake pipe charging flow indicator indicated a rate of recharge of 934 litres per minute and the brake pipe pressure at the locomotive was 489 kPa, rather than 500 kPa.
• The brake pipe took 3 seconds, rather than 10 from a full brake pipe, to reduce to the commanded ‘minimum service’ brake pipe reduction (50 kPa) for the second cycle braking sequence.

During a brake pipe recharge the brake pipe air pressure throughout the length of a train varied, with the rear of the train lower in pressure than the front. Further, as it was recharged by the brake pipe, auxiliary reservoir pressure would lag the brake pipe pressure. As such, the brake pipe pressure reading at the front of the train was an unreliable indicator of auxiliary reservoir pressure, which was markedly lower (particularly at the rear of a train).

The low starting level and rapid drop in brake pipe pressure at the commencement of the second cycle braking sequence, indicated that the auxiliary reservoirs on 3966 were not fully recharged to 500 kPa. Given the rapid attainment of the minimum service brake pipe reduction at commencement of the second cycle braking sequence, it was highly likely that the true brake pipe pressure (and therefore auxiliary reservoirs), particularly towards the rear of the train, was closer to about 450 kPa.

On two-pipe wagons such as the CGSY and CGDY, brake cylinder pressure was provided by a supplementary reservoir which was supplied continuously with main reservoir air pressure. This meant that provided main reservoir air supply was available, the brake cylinders could always be supplied with air pressure. However, this was reliant on a reference (signal) air supply from the auxiliary reservoir acting on the relay valve, which enabled supplementary reservoir air to enter the brake cylinders. So, unless air pressure from the auxiliary reservoir was available to activate the relay valve, the supplementary reservoir could not apply a wagon’s brake.

In normal braking circumstances, a full service automatic brake application would result in a concurrent equalisation of the brake pipe, auxiliary reservoir and brake cylinders (via the relay valve) at about 350 kPa. So, reducing the brake pipe further would not increase braking effort. However, in instances of low auxiliary reservoir starting pressure, the equalisation of the brake pipe with auxiliary reservoir in full service would result in a lower brake cylinder pressure. Specifically, for an auxiliary reservoir starting pressure of 450 kPa, the maximum brake cylinder pressure achievable in full service was substantially lower at approximately 235 kPa. This is consistent with the driver’s observation that the brakes were not as effective as they had been during the previous brake application sequences since leaving Summit Tank.

However, in the unique circumstance of a low auxiliary reservoir starting pressure as was in this incident, it was possible to force an equalisation of the brake cylinder pressure at a higher rate than was by then achievable in full service. Where the auxiliary reservoir starting pressure was for example, 450 kPa, through further reduction of the brake pipe pressure to zero, an equalisation between the auxiliary reservoir and brake cylinder pressures would occur at about 314 kPa, thereby resulting in an increase in wagon braking effort. As it was not possible for the driver to graduate the brake pipe below 350 kPa, this would have required the driver to select either the ‘handle off’ or ‘emergency’ automatic brake positions, both of which would result in 0 kPa brake pipe pressure.

The effect of this increased brake cylinder pressure would have been apparent across the 40 wagons with operating air brakes on the day of the accident, particularly where low rail adhesion was causing a reduction of the dynamic braking effort on the two lead locomotives. Without an indication in the form of an in-cabin warning light and/or alarm the driver lacked awareness of the situation. Although it cannot be said with certainty that the train could have been stopped with this increased braking effort, it is more likely than not that a lower speed could have at the very least been maintained. Particularly if the emergency automatic brake application had been made early during the incident sequence and at a lower speed. That is, at the time the train was found to be exceeding the speed limit and not responding as expected to braking commands.

Operational procedure and training discouraged use of emergency brakes

Work instruction WI-540 (Moss Vale to Inner Harbour Train Management) provided specific instructions to be followed in an emergency, including the requirement to place the brake handle into full service, not emergency.

The driver had been trained to respond to a loss of control down the Moss Vale to Unanderra rail line in accordance with the work instruction as recently as two weeks prior to the incident. During that training, the driver completed a route assessment of the Moss Vale to Inner Harbour rail line with one of Qube’s trainer assessors and was assessed as competent, including against the requirements of WI-540.

As discussed earlier in the analysis, in a situation where maximum braking from a full service application was not achievable due to less than full auxiliary reservoir starting pressure, the greatest braking power available would have come from reducing the brake pipe to 0 kPa. On the CM class locomotive, this would have resulted in a combination of full train air braking plus electrical dynamic braking from the locomotives.

In summary, Qube’s operational procedure for train management between Moss Vale and Inner Harbour did not account for locomotive configurations that maintained dynamic brakes during emergency brake applications. This meant that a driver who lost control while descending the Illawarra Mountain was highly unlikely to use the emergency brakes. The use of the emergency brake in conjunction with the dynamic brake in this accident may have acted to slow or at least better control the speed of the train, thereby reducing the risk of derailment.

Train operators unaware of locomotive specifications

It was evident from the RSO’s procedures that there were assumptions about the functionality of the dynamic brake, based on historical locomotive brake configurations and standards. That was, that dynamic brake functionality would be lost if the automatic brake handle was placed into the emergency position. This assumption was incorrect.

Wabtec, the manufacturer of the locomotive including its braking system, had stated in their Operations and Maintenance Manual for the CM class locomotives that the dynamic brake could be configured to remain active or to cut out in the event of low brake pipe pressure, but did not specify how the CM class was configured.

The technical specification provided to CFCLA and Qube was silent on whether the dynamic brake remained active after emergency automatic brake applications.

Post incident testing found the dynamic did in fact remain active with an emergency automatic brake application and Wabtec later advised, through the course of the investigation, that the dynamic brake cut out function had not been implemented on the CM locomotive class.

The Wabtec-developed driver training presentation also did not specifically mention that the dynamic brake would remain active when an emergency brake application was made. Conversely, there was no mention of the dynamic brake cutting out when an emergency brake application was made, so the assumption could be made that the dynamic brake would remain active, which is how the locomotive was configured.

Review of the locomotive handover information from the manufacturer to the owner (CFCLA) and the operator (Qube), did not provide a clear understanding as to what the dynamic brake would do when the emergency brake was applied. Given the significant change in functionality from what was historically understood by the RSO to be common practice, it was reasonable to expect that the details of the dynamic brake function would have been clearly articulated as part of the handover.

However, in the handover of the CM class locomotives, it was apparent that incorrect assumptions were made by the owner and operator about the dynamic brake and how it operated. These incorrect assumptions flowed into their procedures and training materials and so onto their drivers.

Other locomotives with functional changes

Similar functional changes on locomotives were identified more broadly across industry that were unknown to other operators. Dynamic brake functionality was found to be inconsistent across locomotives with electronic braking systems. While some locomotives would disengage the dynamic brake when an emergency brake application was made, this was not the case across all locomotive types.

This inconsistency in dynamic brake functionality coupled with this being unknown by many operators was considered significant as it reduced the ability of drivers to appropriately manage their trains.

As a result, the OTSI in collaboration with the ATSB published a Safety Advisory Notice about this safety issue (see Appendix A – Safety Advisory Notice).

Factors affecting rail adhesion

Wet rail

The weather conditions reported by the Bureau of Meteorology indicated there was moderate wind and light rain on the escarpment in the hours leading up to and at the time of the incident. These conditions likely increased the presence of water and leaf litter on the head of the rail.

At interview the driver stated there was ‘very misty rain’ when they started the descent between Summit Tank and Unanderra. The train data logger supported this statement, indicating the windscreen wipers activated between Tunnel 2 and Tunnel 1 for a duration over 6 minutes.

The United Kingdom’s Rail Safety Standards Board’s (RSSB) 2016 study[53] to model and quantify the influence of water on wheel rail adhesion coefficients found that light drizzle conditions had the greatest effect on reducing the adhesion coefficient. In these scenario’s friction values could get as low as 0.05, with light quantities of water that would mix with wear debris or surface rust to form a lubricating paste.[54]

Track contaminant

The effect of leaf matter in reducing the wheel rail adhesion coefficient on rail lines is a known issue[55] and was found in a previous ATSB investigation.[56] Trees drop leaves onto the rail track which are then crushed when rollingstock passes over the leaf littered rail head. This plant matter contributes to reduced wheel rail adhesion coefficients.

The wheel rail adhesion coefficient has been found to be lower than 0.05 under severe rail contamination such as dampened leaf contamination.[57]

Front of train footage from the night of the accident showed trees lining the rail corridor from Summit Tank through to Farmborough Heights. Leaf matter was present on various parts of the rail line and was observed on the rail line at the derailment sites during the post incident inspections.

The weather conditions leading up to the 15 December 2020 had been wet and windy likely causing leaves to fall from the trees onto the rail track.

During the post incident track inspections, the contaminant observed on the head of the rail lines was more prominent in areas where the tree foliage was denser and dissipated as the trees cleared. The condition of the rail line closer to the top of the escarpment near Summit Tank was not observed during the site inspection, however it was considered likely the condition of the rail line at that time would have been similar to that observed at the derailment sites. The front of train footage (see Figure 3) indicated the density of tree foliage to be similar.

The sample of the contaminant tested was found to be primarily leaf matter. Leaf matter on rail head is a known contaminant that reduces adhesion of the wheel rail interface.

Rollingstock adhesion requirements

To help understand whether the condition of the rail line effected braking of the train, braking adhesion requirements were provided by ARTC.

For a loaded wagon, under the assumptions the NBR was 13% and the brake block coefficient of friction was 0.3, the required friction level = 0.039, or 3.9% required braking adhesion.

For the CM class locomotive, given the max dynamic braking power was 230 kN, the required friction level = 0.18, or 18% required braking adhesion. Other factors considered which would have influenced adhesion between the rollingstock and the top of rail includes:

1)  on long freight trains the adhesion improves back along the train as wheels successively clean and dry the rail - so the average adhesion for train 3966 was likely higher than the referenced single-wheel adhesion.

2)  tread-braked wheels, such as on train 3966, are cleaned and dried by the brake block, which aids maintenance of higher adhesion between wheel and rail. It is noted the referenced report RO-2013-005 was a passenger train with disk-braked wheels.

Considering these values and factors, it is likely the dynamic braking on the CM class locomotives was affected by the conditions on the rail line. This was evidenced by the frequent automatic sanding and dynamic brake power derating seen on the data logger of CM3316.

However, the wagons braking capacity should not have been affected by the conditions as the required braking adhesion levels of loaded freight wagons is significantly lower (at 3.9%) than the dry adhesion levels found on the rail line when measured on the 3 June 2021 (lowest at 20%). Additionally, the braked train wheels would have been successively cleaning and drying the rail line as they ran over making it even less likely the wagon wheels were affected by water and contaminant.

In summary, the conditions on the rail line from Summit Tank to Farmborough Heights on the morning of the incident presented a mix of factors including wet rail and track contaminant that likely increased the risk of reduced adhesion at the wheel-rail interface. This reduced adhesion likely affected the locomotive dynamic braking power but not so much as to affect the braking of the freight wagons.

Management of rail friction

Friction at the wheel-rail interface is the bond linking the tangential and normal forces that varies depending on vehicle speed, vehicle weight, contact patch and other material characteristics.[58]

Managing the coefficient of friction at the interface of the top of rail and the wheel is important for predictable operation of the train’s acceleration and braking systems.

While ARTC specified the design friction coefficients in their Code of Practice, these requirements were for design only. In the operational system, the friction coefficient can vary significantly as a result of various factors, including the nature of the steel in the rail and wheels, temperature and presence of materials such as, water, grease, oil, sand and vegetative material.

It is reasonable to consider the friction coefficient on the top of rail could change between two trains running along the same rail line if water and leaf matter were introduced, such as from a localised storm occurring in between the two trains passing a given location. The introduction of water (rain) and leaf matter on the top of rail could reduce the coefficient of friction at the wheel rail interface.

For this reason, a regular testing and monitoring program, even if conducted monthly is unlikely to provide assurance of the top of rail friction remaining at the value measured on the day.

For the descent of the Moss Vale to Unanderra rail line, the risk of a train running away has been realised on a few occasions. For this incident, it was likely a number of factors contributed to the eventual loss of control and runaway of the train. The top of rail friction was only one element that affected the performance of the train.

In this regard, when known factors present which increase the risk of reducing top of rail friction levels, such as, localised rain and wind events, it would be reasonable to afford some level of warning to train drivers that the line may present added risk and should be taken with extra care. There are existing processes in place, such as reporting of conditions affecting the network (CAN), that once reported by a train driver, warnings to other train drivers are made. However, this control mechanism relies on the first train driver being exposed to the risk without any warning.

Rail flange lubricators and track lubrication

ARTC maintenance records indicated the rail lubrication devices on the rail line between Summit Tank and Unanderra had been serviced in accordance with standards and the general inspection of rail lubrication conducted on 14 June 2020 did not identify any issues with the spread of rail grease from the lubricators.

Approximately six months after the incident, observations made by Qube of a rail track lubricator at Dombarton (97.030 km, in between No.1 Tunnel and the first point of derailment), showed a grease plume extending from the rail track lubricator, indicative of the lubricant being picked up and flung from the wheels and deposited in the surrounding area, including on the top of the rail head.

It was noted that the location of this rail track lubricator did not coincide with any of the rail lubrication devices listed in ARTC’s maintenance history records and therefore could not be reconciled as to when its last general inspection was completed. It was not the only unlisted rail flange lubricator in the section as another at 94.30 km could not be reconciled with the maintenance history records. This rail flange lubricator was in very close proximity to the listed rail flange lubricator at 94.26 km. Visual inspection of these lubricators indicated both were operational.

These rail flange lubricators providing lubrication to the down rail, at 94.30 kms and 94.26 kms, were less than the 500 m minimum separation requirement specified in ARTC’s engineering practices manual RC2411. Another two listed rail flange lubricators located at 94.95 kms and 94.53 kms, servicing the up rail were also less the 500 m minimum separation requirement.

Although the number and positioning of these rail flange lubricators was possibly intended for the strategic delivery of flange lubrication, a review of these to ensure consistency with the engineering practice and minimise the risk of excess track lubrication on a steep gradient was warranted.

Monitoring air flow

Maximum brake cylinder pressure on wagons is reliant on auxiliary reservoirs being fully charged (500 kPa) before a brake application is made. The brake pipe charging flow indicator instrumentation is available to the driver to help determine when the brake pipe, and therefore the auxiliary reservoirs are fully recharged after a brake release.

Although the brake pipe gauge in the driver’s cabin may indicate a 500 kPa at the locomotive, where the brake pipe charging flow rate is above zero litres per minute, it is indicative of an incomplete brake pipe recharge throughout the train, particularly toward the back of the train. That is, main reservoir air is flowing into the brake pipe and auxiliary reservoirs. Whilst this is occurring, they are not fully charged and hence, it is not possible to reach maximum brake cylinder pressure if a brake application was made.

Knowing if and when main reservoir air was flowing into the brake system is important to the driver because it enables them to understand the condition (i.e. whether fully charged) of the brake pipe and auxiliary reservoir pressures across the entire train.

At interview, the driver recalled observing the brake pipe charging flow indicator and the brake pipe pressure gauge and judged the brake pipe to be about 90-95% recharged. The data logger recorded that the brake pipe pressure gauge was reading 489 kPa (that is, close to full pressure of 500 kPa) however, the brake pipe charging flow indicator was still registering a significant air flow of 934 litres per minute. This indicated that the train’s brake pipe and auxiliary reservoirs were still charging and not yet fully recharged.

The driver’s judgement of the brake pipe being 90-95% recharged was likely in relation to the brake pipe pressure gauge reading 489 kPa. Further, there was limited guidance for drivers of the significance of flow indicator gauge readings, in particular the level of recharge these were quantifying. For example, in this instance, 934 litres per minute, and what that indicated in relation to the physical state of recharge of the auxiliary reservoirs and the brake pipe across the train.

The brake pipe pressure and brake pipe charging flow indicator consisted of small numerical digital displays situated in the top left-hand corner of the driver’s HMI screen. In the case of the latter, the display did not provide an obvious or distinct representation of the critical values that could be easily understood or quantified by the driver. For example, at maximum recharge (more than 3000 litres per minute), the value remained the same colour (green) as it did when recharge was almost complete (low litres per minute value). In addition, no audible indication was associated with the recharge. That is, there were no indications, apart from a small numerical display, to alert the driver that main reservoir air flow to recharge the brake pipe was occurring or continuing.

Amongst the other tasks conducted while driving a train, a driver may only make a momentary glance at the gauges. As a result, it is possible a driver could miss the importance of the value the brake pipe charging flow indicator was providing where no further alert stimulus was provided.

In contrast, it was noted during the investigation that on some locomotives fitted with an identical braking system to the CM class locomotive, an audible alarm was provided in conjunction with a red flashing tile when high air flow from the main reservoir to the brake pipe was detected. This assisted in proactively drawing a driver’s attention to the state and condition of the brake pipe charging flow indicator. This assisted in the driver’s ability to detect uncommanded brake pipe pressure loss (for example, derailment) and monitor when the train’s brake pipe and auxiliary reservoirs were fully charged in preparation for an automatic brake application.

Communication of design changes

Prior to the design error in the CGSY wagons being identified by the CIMC, CFCLA considered the braking force on the wagons as not performing as required. CFCLA concluded the brake rigging ratio needed to be increased to improve the braking performance.

To achieve this, slack adjuster pivot holes were re-drilled in the brake lever. CIMC were advised that CFCLA were undertaking these modifications to the brake lever ratio, but the detail of the dimensional changes was not provided to CIMC.

Without the specifics of the design changes to the brake lever ratio, CIMC developed a design fault repair, that being a revised control lever, which when installed made no change to the operation of the brakes with the slack adjuster still unable to reduce the slack in the brake rigging.

Wayne Clift Consulting was engaged by CIMC to determine the root cause of the braking system performance.

The consultant found that changes had been made to the wagons braking system by CFCLA that had not been passed back to CIMC which resulted in the modified design failing to correct the issue.

CFCLA accepted the report from Wayne Clift Consulting and later engaged the consultant to complete the compliance and inspection report of the first modified wagons, in accordance with the Consultants recommendations.

The original change made to the brake levers by CFCLA were instigated without full consultation with the OEM, so the OEM was unaware of the details when they developed a repair. It is unclear whether CFCLA followed a systematic change management process when making the design changes to the brake levers.

Generally, any changes to equipment should be assessed and undertaken following a sound change management process. The rail industry in Australia has standards for management of change, such as AS7472:2018 Railway operations – Management of change.[59]

The standard describes the requirements to be applied by all rail organisations to ensure that safety risks associated with changes to railway operations, assets, or systems are identified and eliminated or reduced so far as is reasonably practicable.

Amongst other requirements in the standard, an integral step in the change process is to consult and communicate with relevant stakeholders. Prior to CFCLA making changes to the design of the braking system, consultation with the OEM (CIMC) would likely have assured a better outcome as input from the designer would have identified the design fault sooner and any ensuing changes would have considered this. However, CIMC was eventually informed of the changes made by CFLCA but the details of the changes, that is, the dimensions of the drilled holes from the original, were not provided, leaving CIMC to design a fault repair without full knowledge of the brake lever configuration.

Only through review of the fault by a contracted rollingstock specialist was the issue identified and further modifications made to address the issue.

CFCLA made changes to the CGSY wagons to improve the brake performance. While CIMC was informed of the changes, the details of the change were not provided which resulted in a design fault repair developed by the OEM being ineffective.

Findings

From the evidence available, the following findings are made with respect to the runaway and derailment of loaded grain train 3966 near Dombarton, NSW, on 15 December 2020.

Contributing Factors

• The weight of the train was near, but likely not over, the maximum allowable tonnage limit specified by the Australian Rail Track Corporation (ARTC)’s Train Operating Conditions (TOC) Waiver 16002. It was likely however that several individual wagons across the train consist were over the allowable limit for a single wagon.
• The second automatic brake application was made before the brake pipe had fully recharged. This resulted in a reduced amount of available brake cylinder pressure to the driver for that and subsequent brake pipe reductions, and a lessened braking effort on the 40 trailing wagons with operational air brakes.
• The train driver did not effectively manage the train’s speed or comply with operator prescribed braking, which resulted in the last cycle braking sequence not adequately controlling the train’s speed, leading to the runaway.
• Some of the driver’s decisions on the morning of the accident were likely affected by fatigue.
• Once control was lost, the driver did not select the emergency brake position based on the mistaken understanding that the dynamic brake would cut out when the emergency brake was applied. This resulted in less available braking effort, reducing the ability to control the speed of the train.
• Qube’s operational procedure for train management between Moss Vale and Inner Harbour did not account for locomotive configurations that maintained locomotive dynamic braking during emergency applications. This increased the risk of the train driver not using the emergency brake during a runaway event. (Safety issue)
• The conditions on the rail line from Summit Tank to Farmborough Heights on the morning of the incident presented a mix of factors including wet rail and track contaminant that likely contributed to a reduced dynamic braking effort by the locomotives.
• Measurements of net brake ratio (NBR) at different times and on different wagons returned varying results ranging from 10.7% to 19.5%. While various modifications were made in order to improve braking performance on the wagons, the NBR on some wagons continued to change over time.

Other factors that increased risk

• The wagon type test met the NBR requirement when introduced into service and met NBR requirements when tested post modifications, however there was no requirement for regular testing of net brake ratio, which may have identified the changes in NBR.
• The assumptions regarding locomotive configurations that cut-out locomotive dynamic braking during emergency applications was found embedded in other rollingstock operator’s procedures with similarly configured locomotives in NSW. (Safety issue)
• Several rail flange lubricators, which provided lubrication to the down and up rail were less than the 500 m minimum separation requirement specified in ARTC’s engineering practices manual RC2411. A review of these to ensure consistency with the engineering practice and to minimise the risk of excess track lubrication on a steep gradient was warranted.
• The brake pipe charging flow indicator on CM class locomotives only provided a numerical display without any corresponding audio or visual warning system to alert the driver. This limited the ability for the driver to detect derailment or train separation events, and in this incident, effectively monitor recharge of main reservoir air to the brake pipe.
• CFCLA made changes to the CGSY wagons to improve the brake performance. While CIMC (the Original Equipment Manufacturer) was informed of the changes, the details of the change were not provided which resulted in a design fault repair developed by the OEM that was ineffective.

Safety issues and actions

Train Operators unaware of locomotive specifications

Safety issue number: RO-2020-022-SI-03

Safety issue description: The assumptions regarding locomotive configurations that cut-out locomotive dynamic braking during emergency applications was found embedded in other rollingstock operator’s procedures with similarly configured locomotives in NSW.

Safety advisory notice to Rail Transport Operators: The ATSB advises that all Rollingstock Operators (RSO) should review the specifications and test the locomotives under their control to understand how the braking systems are configured. RSO’s must communicate this knowledge through the organisation’s procedures and training material to ensure train crew knowledge and competence in operating locomotive braking systems.

Operational procedure and training discouraged use of emergency brakes

Safety issue number: RO-2020-022-SI-04

Safety issue description: Qube’s operational procedure for train management between Moss Vale and Inner Harbour did not account for locomotive configurations that maintained locomotive dynamic braking during emergency applications. This increased the risk of the train driver avoiding the use of the emergency brake during a runaway event.

Sources and submissions