On 1 June 2018, a Qantas Airways Limited Airbus A330 aircraft, registered VH-QPI (QPI), was operating a scheduled passenger flight from Sydney, New South Wales to Bangkok, Thailand. On board were 13 crewmembers and 297 passengers.
Shortly after take-off, a ‘pop’ sound was heard, followed by light airframe vibration and a reduction in the rotational speed of the right engine. A cockpit advisory message relating to the right engine’s vibration level was also displayed to the crew.
The flight crew discontinued the climb and consulted the ‘High Engine Vibration’ checklist, which directed them to reduce the right engine’s thrust to idle. With the reduction in thrust, the vibration on the right engine reduced but remained relatively high. To prevent further engine damage the flight crew decided to shut the engine down. With the engine shut down, the airframe vibration ceased.
Following an uneventful descent and return to Sydney Airport, an overweight landing with one engine inoperative was conducted.
Initial inspection by engineering staff revealed visible damage to the right engine low-pressure turbine, and engine debris generated impact damage to the aircraft’s wing flap lower surfaces and body fairings. The engine was removed and sent to the operator’s overhaul facility for detailed examination and repair.
What the ATSB found
Technical examination identified that the effects of oxidation and deterioration of the protective coating of the low‑pressure turbine stage 4 nozzle guide vane segments, led to intergranular oxidation, crack development and loss of an aerofoil from the No. 5 segment. The liberated aerofoil impacted downstream rotating components, resulting in a loss of turbine blade material, rotor imbalance and subsequent airframe vibration.
What’s been done as a result
In response to the loss of the aerofoil from the No. 5 nozzle guide vane segment, the operator initiated a borescope inspection program to identify segments that exhibited evidence of cracking. Affected engines were removed from service. The operator also specified that at engine overhaul, all nozzle guide vane segments that had cracks were to be replaced, and that only new (rather than overhauled) segments were to be installed.
The engine manufacturer made a change to the type of protective coating used on the nozzle guide vane segments to reduce oxidation. Service instructions were issued in mid‑2019 to implement the coating replacement.
Safety message
This incident illustrates that, despite the high reliability of modern turbine engines, flight crews can still be faced with malfunctions that require their combined judgement and expertise to safely manage the situation.
The occurrence
What happened
On 1 June 2018, a Qantas Airways Limited Airbus A330 aircraft, registered VH-QPI (QPI), was operating a scheduled passenger flight from Sydney, New South Wales to Bangkok, Thailand. On board were 13 crewmembers and 297 passengers. The flight crew consisted of the aircraft captain who was the pilot flying (PF), the first officer as the pilot monitoring (PM) and a second officer.[1]
QPI departed Sydney at 1219 Eastern Standard Time.[2] As the engine thrust was being reduced from the take‑off setting, the PM heard a ‘pop’ sound and the flight crew recalled receiving a flight deck advisory message, followed by light airframe vibration. A reduction of about 5 per cent in N1[3] revolutions per minute of the right (No. 2) engine was also noticed. The advisory message from the aircraft’s electronic centralised aircraft monitor (ECAM) indicated that the No. 2 engine’s vibration level had reached the maximum recordable level of 10 units. A later review of quick access recorder[4] data showed that the ECAM message was generated at 1220:25 as the aircraft climbed through an altitude of 1,696 ft.
The PF reported that, despite the right engine vibration and reduction in N1, no yawing[5] was present. The aircraft was configured with the undercarriage retracted, and autopilot engaged. As the aircraft gained altitude, the PF retracted the wing flaps and leading-edge slats. The flight crew then responded to the advisory message and referred to the aircraft’s quick reference handbook, which directed them to the 'High Engine Vibration’ checklist.
By 1224:22, the flight crew had discontinued the climb and were maintaining an altitude of 7,000 ft in order to complete the ’High Engine Vibration’ checklist. The PF reported that in accordance with the checklist, the No. 2 engine’s thrust lever was reduced to idle, and the No. 1 (left) engine set to maximum continuous thrust.
With the No. 2 engine at idle, the vibration level reduced to 6.5 units. However, the advisory message remained displayed as the threshold to remove the advisory was 5.7 units. The flight crew considered this level of vibration to be excessive and discussed shutting down the No. 2 engine to prevent further damage. No additional alerts or advisory messages from the ECAM that related to engine parameters were presented to the flight crew for the remainder of the flight. Given the ‘pop’ sound heard immediately prior to the onset of vibration, the ‘Engine Stall’ checklist was actioned. At 1231:47, about 12 minutes after take-off, the PF shut down the No. 2 engine.
With the No. 2 engine shut down, the airframe vibration ceased, and a holding pattern over Richmond, New South Wales was initiated. While holding, the flight crew communicated with air traffic control, appraised company representatives of the event, and briefed the cabin crew and passengers on the situation. The decision was made to return to Sydney and perform an overweight landing. The aircraft was not equipped with a fuel dump system and company procedures required that, when an aircraft was damaged, an overweight landing was to be performed to allow the aircraft to land as soon as practicable.
The flight crew referred to the ‘Overweight Landing’ checklist and discussed how they would conduct a single-engine approach and utilise the aircraft’s auto-land system as procedurally required. At 1307, after about half an hour of holding, a descent into Sydney was commenced. The PF reported that the descent was initially unstable, however between 1,000 and 500 ft above ground level, a stable approach was established. At 1317, QPI touched down at Sydney Airport on runway 16R[6]. It was taxied clear of the runway and inspected by airport fire services. On receiving clearance from the fire warden, the aircraft was taxied to the terminal and shutdown at 1319.
An initial inspection by engineering staff revealed visible damage to the No. 2 engine low-pressure turbine stages four and five. It also revealed that engine debris had caused impact damage to the lower surfaces of the aircraft’s right-wing flaps and body fairings. The engine was subsequently removed and shipped to the engine manufacturer’s overhaul facility in Taiwan for detailed examination and repair.
Engine description and examination
QPI was fitted with two General Electric Company CF6-80E1 engines, which are dual-rotor, axial‑flow, high by-pass, turbo fan engines. They are capable of delivering in excess of 58,000 pounds of static thrust. A 2-stage high-pressure turbine drives the 14-stage high-pressure compressor (Figure 1). The integrated fan and low-pressure compressor is driven by a 5-stage, low-pressure turbine.
Figure 1: Profile of General Electric CF6-80 engine showing layout of rotating assemblies and position of stage four nozzle guide vane assembly
Source: Supplied by operator and annotated by the ATSB
Stationary nozzle guide vanes are fitted ahead of each turbine wheel. Gasses coming from the combustion chamber pass through the nozzle guide vanes, which, due to their convergent shape, accelerate the airflow and drive the turbine at high rotational speed.
The No. 2 engine from QPI was disassembled and examined at the engine manufacture’s repair facility. Examination of the engine’s low-pressure turbine stages found that aerofoil No. 6 from the No. 5 segment of the stage four nozzle guide vane (NGV) was missing (Figures 2 and 3). The liberated aerofoil caused downstream damage to the stage four and five low-pressure turbine and the stage five NGV segments. Both turbine stages sustained loss of blade material consistent with impacts from the aerofoil and other liberated fragments. Additionally, while the low-pressure turbine case outer wall was perforated and showed signs of bulging, there was no loss of containment of the fragments via the outer case wall. No damage was found upstream of the stage four NGV assembly.
Figure 2: Low-pressure turbine stage four NGV assembly with segment No. 5 showing loss of aerofoil
Source: Supplied by the operator and annotated by the ATSB
Figure 3: Segment No. 5 showing loss of aerofoil No. 6 and fracture area detail
Source: Supplied by the operator and annotated by the ATSB
Detailed examination of the stage four NGV assembly showed that another three segments exhibited cracks through the entire chord width of various aerofoils. The engine manufacturer identified that oxidation and deterioration of the aerofoil’s chromide protective coating had occurred due to engine operating temperatures, stress and time. The deterioration led to the formation of intergranular oxidation in the NGV aerofoil material. As intergranular oxidation levels increased, cracks formed on the NGV leading edges, resulting in eventual failure of the No. 6 aerofoil.
The engine manufacturer also identified that the highest intensity of intergranular oxidation indications was concentrated in the leading edge of aerofoil No. 6, the highest stressed location in segment No. 5 of the stage four, low-pressure turbine, nozzle guide vane assembly.
Additional examination by the manufacturer identified the presence of intergranular oxidation on a number of new NGV segments at their first overhaul shop visit (first run parts), but with less severity than that found on multiple-run parts.
History of stage four NGV aerofoil failures
A review of past occurrences identified that low-pressure turbine stage four NGV aerofoil liberations on General Electric CF6-80E1 engines have occurred on 17 occasions since 2006. The operator experienced seven of those occurrences and was the only operator of CF6 engines to have initiated a consequent engine shutdown in flight.
The engine manufacturer initially assessed that the most likely cause of the failures was associated with movement of the NGV segments relative to each other. This was due to low‑pressure turbine case rail wear, resulting in increased stress at the leading edge of aerofoil No. 6. In response, service bulletin CF6-80E1 SB 72-0545 was issued in August 2016, introducing an anti‑wear shim to eliminate undesirable nozzle movement.
The manufacturer later recognised that while the anti-wear shim addressed the effects of static stresses and the potential for high cycle fatigue[7] cracking of the NGV segments, it did not prevent intergranular oxidation. The progression of intergranular oxidation was subsequently identified as an additional failure mode for aerofoil liberation. This occurrence was the first liberation in the Qantas fleet, following implementation of the anti-wear shim.
Protective coatings on engine hot section components
To protect against erosion and corrosion, engine manufacturers utilise protective coatings to increase the durability and in-service performance of highly stressed parts. For example, in the fan and compressor areas, erosion-resistant coatings are used to minimise blade wear, and corrosion-resistant coatings are applied to surfaces of turbine blades and nozzle guide vanes.[8]
Oxidation of hot section parts
Oxidation is a form of corrosion in aircraft turbine engines[9] that involves the chemical reaction of oxygen, in the engine core gas stream, with the surface coating or base metal of the part. This chemical reaction creates oxide molecules as it consumes the coating or base metal. The oxides generally build up as an oxide surface film, but can also transition to an intergranular mode, penetrating below the protective coating on the surface and into the base material. Over time, oxidation will consume these materials and in certain cases, cause premature failure of the part.
Thermally induced fatigue can also affect the integrity of the protective surface coating, brought on by repeated application of thermally induced stresses due to rapid and non-uniform heating and cooling cycles during engine power changes.[10] These thermal and mechanical stresses may result in cracking of the surface coating or base metal. Breakdown of the surface coating allows the gas stream to impinge on the base metal and accelerate the overall oxidation process leading to part failure.
Action by the manufacturer and operator
In response to the aerofoil liberation in this occurrence, the engine manufacturer investigated changing the type of protective coating of the NGV segments from chromide to vapour-phased aluminide. The vapour-phased aluminide coating, in use on stage 3 NGVs, has lower instances of intergranular oxidation, and an absence of NGV material deterioration. SB 72-575 was issued in July 2019 to implement the coating replacement.
The engine manufacturer also assessed that the operator’s stage four NGVs had higher levels of deterioration when compared to NGVs from other operators. They attributed this to engine thrust settings, reporting that the operator’s aircraft spent relatively more time at high thrust, operated at heavier weights, and spent more time in the take-off and climb segments. The manufacturer concluded that the operator’s engine duty cycle likely exposed the low-pressure turbine components to higher temperatures and stress.
The operator made several changes with respect to treatment of the low-pressure turbine stage four NGV that included:
replacing all NGV segments that exhibited cracking of the aerofoil leading edge
introducing a requirement that only new segments were to be installed during overhaul (no multiple run segments)
introducing a borescope[11] inspection program targeting the low-pressure turbine, stage four NGV assembly. The borescope inspection subsequently identified five engines with aerofoil cracking that warranted engine removal.
revising the CF6 engine removal plan to reduce the time in service for those engines identified as at-risk of aerofoil liberation.
In-flight engine vibration management
The captain considered that the ‘High Engine Vibration’ checklist lacked sufficient guidance to address high residual engine vibration, which led the operator to seek clarification from the aircraft manufacturer. The aircraft manufacturer advised that high engine vibration alone did not require an engine shutdown, and crews had the discretion to monitor the engine for other symptoms and to continue operation. However, the manufacturer also advised that the flight crews could consider shutting an engine down if the vibration was considered excessive.
Following review, both the aircraft manufacturer and the operator concluded that sufficient information was available for crews to respond appropriately in an abnormal or emergency situation.
Safety analysis
Gas turbine engine, nozzle guide vanes (NGV) and turbine assemblies are subject to high mechanical loading and temperatures in a corrosive and erosive environment. Detailed technical examination identified that, following oxidation and deterioration of the protective coating on the stage four NGV, No. 5 segment, inter-granular oxidation developed in the base material of the aerofoils. This resulted in cracking of the highly stressed leading edge of the No. 6 aerofoil and its subsequent fracture and liberation.
The lack of damage ahead of the stage four NGV assembly indicated that the liberated aerofoil was the initial event that led to the engine damage. As the aerofoil continued aft in the gas stream, the stage four and stage five low-pressure turbines and the stage five NGV were damaged. The loss of turbine blade material caused a rotor imbalance that was felt as airframe vibration. The airframe vibration was still present following the power lever reduction to idle. Due to the level of residual vibration, the flight crew decided to shut the engine down in flight and return to the departure airport.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Oxidation and deterioration of the stage four No. 5 nozzle guide vane segment protective coating resulted in the development of intergranular oxidation in the parent material of the No. 6 aerofoil. This led to crack development, fracture and liberation of the aerofoil.
The loss of the aerofoil led to downstream turbine rotor damage with significant loss of blade material and engine vibration. Due to the vibration, and in consideration of the potential for further engine damage, the flight crew decided to shut the engine down in flight and return to the departure airport.
Safety action
Following this occurrence, the engine manufacturer changed the protective coating on the NVG segments from chromide to vapour-phased aluminide, citing better resistance to oxidation effects.
The operator also worked proactively by ensuring stage four, low-pressure turbine NGV segments that exhibited cracking of the aerofoil leading edge were removed from service, and that only new, not overhauled segments were fitted to the operator’s engines. The operator also introduced a borescope inspection program that was successful in identifying other engines with aerofoil cracking and removed the affected engines from service.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 3 June 2018, OOCL Kuala Lumpur’s electro-technical officer (ETO) was testing the ship’s personnel elevator after completing mechanical repairs. While driving the elevator from the cage top, the ETO became trapped between the moving cage and the bulkhead, and was fatally injured.
What the ATSB found
The ATSB investigation found that the ETO was last seen alone, on top of the elevator cage, in the prescribed safe zone with the elevator control in ‘MANUAL’. The exact circumstances explaining how and why the ETO then came to be trapped while the elevator moved between floors could not be determined. For the accident to have occurred, however, the ETO had to have moved from the safe zone, the elevator control had to have been changed from ‘MANUAL’ to ‘AUTO’ and the elevator called.
The investigation also found that safety barriers prescribed in the electrical work permit were not put in place before the work commenced. All ship’s crew were not warned against using the elevator as there had been no warning announcement and there were no warning signs posted at all elevator access doors. This allowed an elevator call to be made while the work was underway. Aspects of the supervision and communications throughout the task were ineffective, which meant that opportunities to stop or alter the method of work were missed.
What's been done as a result
Following this accident the ship’s management company instigated an education programme throughout the company and fleet which addressed its safe work practices, permit to work system, risk assessment, and elevator maintenance. The company safety management system was also amended to more clearly define and detail elevator maintenance responsibilities, processes and procedures.
Elevator maintenance and risk identification training has been provided to all shipboard and shore‑based technical staff. This training will be ongoing and required prior to joining a ship equipped with an elevator. In addition to this, all fleet elevators have been assessed to ensure they meet current elevator cage top control station standards for functions and access. A process for modification, if necessary, has also been implemented.
Safety message
Elevator accidents continue to occur around the world and result in about one fatality per year. Many of these accidents involved the failure to apply existing safety management procedures and/or identified safety barriers that have proven effective in reducing the risks associated with elevator maintenance. These include procedures related to communications, supervision and machinery isolation/lockout. Furthermore, the injured person was often working alone and riding the elevator cage. For any task that is performed on multiple occasions without any adverse consequence, there is the potential for an individual’s perception of risk (or expectancy of a problem) to decrease. This makes it all the more important to always follow documented procedures and safe working practices, even when the operation is considered safe.
It is imperative that close and careful supervision is maintained for any elevator testing and tasks. Supervisory oversight provides an opportunity for experienced, senior technical staff to scrutinise and assess the plans and intentions of those completing the task. This provides an external check and safety barrier before, and during, the work.
The occurrence
During the afternoon and evening of 2 June 2018, the 280 m, 5,888 TEU[1] fully cellular container ship OOCL Kuala Lumpur (Figure 1) was stopped and drifting about 20 NM[2] south-east of Port Botany, New South Wales. Weather had deteriorated with winds in excess of 40 knots, and the ship’s arrival time into Port Botany had been pushed back because of disruptions to port operations. The officer of the watch (OOW) recorded in the ship’s bridge log that the ship was rolling easily to moderately in about 30 knot winds from the south and 4 to 5 metre seas from the south-east. The main engine was on short notice and the ship’s engineers maintained watches.
There had been problems with a refrigerated cargo container not maintaining temperature and from about 1800[3] the electro-technical officer (ETO) and fitter had been on deck attending to the container. At about 2145, the ETO contacted the chief engineer to update him on the work and seek advice. Together they attended the container and by 2230 the repair was complete. They returned to the ship’s accommodation and completed paperwork recording the work, some of which was passed to the master for forwarding to shore management.
Figure 1: OOCL Kuala Lumpur
Source: Owen Foley, Shipspotting.com
Just before 0400 on 3 June, the second engineer[4] left his cabin to go to the engine room to commence his engineering watch and found the elevator to be inoperative. It was stopped on the third deck, the lowest level of its travel. It was usual to position the elevator at this level and lock it out when there was a fault with it or rough weather meant it was advisable not to use it. During the watch handover from the third engineer, the second engineer was informed that the lift was faulty. He decided he would discuss the fault and its repair during the scheduled morning toolbox meeting.
In Port Botany, pilotage operations resumed at 0700 on 3 June and OOCL Kuala Lumpur’s master was notified that pilot boarding time was 1000 that morning. At 0800, the OOW began preparing for standby and manoeuvring.
At about the same time, the master and chief engineer were making their way to breakfast. They called the elevator so as to go to the mess room several decks below. The elevator did not respond to the call so they used the stairs. In the mess room they met the ETO and discussed the unserviceable elevator. The ETO advised that he was aware of the fault—the elevator cage doors were not closing because the drive chain sprocket had come adrift and would require refitting. He stated that he would make preparations to repair the fault and discuss with the chief engineer after breakfast.
Elevator maintenance
The fourth engineer had taken the engineering watch at 0800 and was preparing the machinery for manoeuvring. In the engine control room (ECR), the daily work toolbox discussion was held, led by the second engineer. Also present were the chief, fourth and fifth engineers, the fitter and the ETO. During this meeting, among other tasks, the elevator fault was discussed. The ETO said he knew of and understood the fault and would complete the repair with the fitter. He then went about completing the required paperwork, including an electrical work permit (EWP) and a hazard identification and risk assessment form.
The chief engineer authorised the EWP at 0820. The requirements of the task were discussed and the ETO showed the chief engineer the chain drive sprocket and explained the repair. They discussed how the work was to be completed, agreeing that the ETO would isolate the elevator and access the elevator cage top (Figure 2) through the engine room second deck elevator entrance door, and the fitter would complete the repair. The ETO undertook to notify the chief engineer when the repair work was complete and testing would proceed. The ETO and fitter went to do the work and the chief engineer turned his attention to the imminent main engine movements.
Figure 2: Elevator cage top from entrance door (forward)
Source: Singapore Transport Safety Investigation Bureau; Worksafe Victoria and ATSB
The EWP required that warning notices were placed on all decks and elevator doors, and that a public address announcement was made informing all crew members that the elevator was out of service and was not to be used. During the ATSB investigation, no evidence was provided to show that these precautions were put in place. The master and the OOW were aware that the work would take place but were not informed that it was underway.
At 0836, the main engine was tested ahead and astern, followed by steering gear checks. Passage to the pilot boarding ground (7.5 NM to the north-west) resumed at 0845. By 0900, the ship had a speed of just over 8 knots and was on a northerly heading. Winds were south-westerly at about 20 knots, with seas about 2.5 m from the south-east. The weather and movement of the ship in the following sea were not considered sufficiently hazardous to prevent the elevator work from continuing.
For the elevator work, the ETO isolated the electrical power supply in the elevator machinery room, returned to the engine room and opened the second deck elevator access door. The elevator cage top was about 1 m above the second deck and this provided relatively easy access to the cage top and the cage door drive mechanism which was to be repaired. The ETO activated the local emergency stop and set the control switch from ‘AUTO’ to ‘MANUAL’ on the cage top operating panel (see the section titled Elevator in Context).
The fitter then went about the repair. A replacement key was fabricated for the chain drive sprocket and together these were fitted in place on the drive shaft and the chain fitted. The repair took about 10 minutes. The ETO satisfied himself that the repair was complete and that the elevator could be tested before being brought back into service.
At about 0915, the ETO returned to the ECR to speak with the chief engineer. The chief engineer recalled that the ETO advised that he intended to restore electrical power and test the elevator from inside the elevator cage. This would entail driving the cage up and down between floors and ensuring that the cage doors operated correctly and consistently at each level.
Elevator testing
The ETO went to the elevator machinery room and de-isolated the machinery. He then returned to the second deck elevator landing and gave instructions to the fitter to close the door behind him. He then climbed onto the top of the elevator cage. The fitter last saw the ETO standing at the back of the cage, atop the elevator cage emergency escape door and behind the operating panel, facing the fitter. He recalled that the emergency stop button was depressed and the elevator control selector switch was in ‘MANUAL’. As instructed, the fitter closed the door.
Soon thereafter, the fitter heard the lift operate, noticed the up and down indicating lamps activate briefly and the landing door handle move. This was followed by impact noises (thuds) and continuous clicking. In response to the unusual sounds, he attempted to open the access door. However, the landing door interlock mechanism was now engaged and he was unable to open it.
At 0930, in the ECR, the chief engineer decided to check on the progress of the elevator work and went into the engine room. He went to the elevator landing and saw the fitter attempting to open the door. The fitter explained about the noises he had heard and that he was concerned. The chief engineer then attempted to open the door. After some effort the door opened. Inside, he could see that the upper section of the door frame and the door closer were damaged.
The chief engineer looked into the elevator shaft and saw the ETO hanging, unresponsive, head-down, from the bottom of the elevator cage, about half a metre above the doorway. He was caught between the cage and the forward bulkhead.
Accident response
The chief engineer hurried to the ECR to raise the alarm and summon help. The fourth engineer called the bridge and asked that the elevator shaft emergency escape door (on the wheelhouse top) be opened as this would activate the escape door micro-switch and prevent movement of the elevator.
At 0936, they activated a manual call point which triggered the general alarm and alerted all crew to the unfolding emergency. The chief engineer reported to the master and at 0937 the master contacted Sydney vessel traffic service (VTS) seeking urgent medical assistance. VTS contacted the Ambulance Service of New South Wales for assistance and also went about making arrangements to get paramedics to the ship. The harbour master, container terminal management, and other authorities were also notified.
On board, the cage was stopped midway between the second and upper decks. Many of the ship’s crew had mustered at the upper deck elevator entrance door and it was opened to allow access to the top of the cage. The chief mate, fourth engineer and fitter entered the lift trunking and climbed down onto the cage. They activated the emergency stop, opened the cage escape door and entered the cage. The cage sliding doors were closed, with one panel showing signs of damage. The ETO could not be seen and they went about removing one of the door panels to gain access to him.
Meanwhile, ashore, soon after being notified, a VTS officer went to the adjacent pilot office and informed the duty pilot of the accident. The duty pilot was in the office performing administrative duties (such as taking bookings and making pilot allocations) to assist the rostered pilot and was not required to pilot ships during this time. However, the rostered pilot was in the midst of guiding a ship out of port and had been scheduled to transfer from that ship to OOCL Kuala Lumpur at 1000 to bring it into port. Once notified of the accident and the need to get OOCL Kuala Lumpur into port for medical assistance, the duty pilot quickly prepared to attend the ship and conduct the pilotage. He gathered his things, proceeded to the wharf and boarded the waiting pilot launch. At 0944 the pilot boat left the wharf.
At 1015, the pilot boat was alongside OOCL Kuala Lumpur and the duty pilot boarded the ship. Once on board and on the bridge he obtained an update of the emergency and notified VTS. At this stage the ETO was still trapped. Discussions were held regarding the most suitable option for boarding medical staff. The heavy weather restricted access for a helicopter and also limited the suitable locations for personnel to board from a boat. The decision was taken to bring the ship in as far as the swing basin off Brotherson Dock,[5] create a lee, and have the medical staff board from the pilot launch. The duty pilot took the con[6] while the master and OOW were busy with communications and on board happenings.
The pilot boat departed OOCL Kuala Lumpur, proceeded to the outbound ship and embarked the rostered pilot at 1026. After discussions between the two pilots, it was agreed that the rostered pilot would return to port in the pilot boat. There he would assist the embarkation of an emergency response team (paramedics and rescue personnel) and return to OOCL Kuala Lumpur with them.
At 1033, two harbour tugs were approaching the ship as it was passing Henry Head at a speed of 10.3 knots. Discussions between the two pilots and VTS had agreed to also use a third tug which was available and at 1035 this tug departed the tug den in Brotherson Dock.
At about this time, the ETO was freed and taken into the elevator cage. The cage was manually moved to the upper deck where the ETO was moved to the ship’s hospital. At 1042, the first tug was made fast centre lead aft while the second tug approached to tie-up on the port shoulder.
Ashore, emergency services personnel including paramedics were assembled. They boarded the pilot launch and at 1049 departed. Meanwhile, the second tug had been made fast on OOCL Kuala Lumpur’s port shoulder and the third tug was alongside. At this time, the duty pilot guided the ship in toward Brotherson dock, washed off speed, and commenced swinging the bow to port to bring the ship round with the starboard side towards the intended berth. At about 1050, as the ship swung round, the pilot launch came alongside and the emergency services personnel and the rostered pilot boarded.
Once on board, at about 1054, the paramedics were directed to the ETO and the rostered pilot proceeded to the bridge. At 1100, the pilot launch departed the ship as it was manoeuvred into dock. At 1118, the first line was ashore.
The paramedics provided what assistance they could but at 1135 the ETO was declared deceased. OOCL Kuala Lumpur was all fast alongside Brotherson Dock 7 at 1148.
Post-accident
Authorities boarded the ship at Port Botany and commenced investigation of the accident. Cargo operations commenced at 1518,
At 0118 on 6 June, OOCL Kuala Lumpur departed Port Botany bound for Melbourne, Victoria. The elevator remained out of service. On 8 June, while alongside in Melbourne, an inspection of the elevator cage top electrical and control equipment was completed by the Principal Engineer of Worksafe Victoria. Close visual and physical inspection of the cage top operating panel buttons did not reveal any faults or indicate that the buttons may have malfunctioned.
From Melbourne, the ship continued its voyage until arrival into Singapore on 23 June. During this port call, the vessel manager, Synergy Marine, had arranged for the elevator to be serviced and brought back into use by the elevator manufacturer. Marine Safety Investigators from the Singapore Transport Safety Investigation Bureau attended and reported their observations of the elevator to the ATSB.
Damaged components were repaired and refitted to the elevator cage and the second deck landing door. The elevator was recommissioned after verification of operation in ‘MANUAL’ and ‘AUTO’ modes. An annual safety inspection was completed, a certificate issued and the elevator declared in good working order. No operational malfunctions were reported during inspection, repair and testing of the elevator.
At the time of the accident, OOCL Kuala Lumpur was registered in Singapore, owned by Grace Ocean (Singapore), managed by Synergy Marine (Singapore) and classed with ClassNK (Nippon Kaiji Kyokai).
OOCL Kuala Lumpur had a complement of 23 Indian nationals, including 3 trainees and a supernumerary. All were qualified for the positions which they held.
The master joined the ship as chief mate in January 2018 and was promoted to master after one voyage, about 2 months before the accident. OOCL Kuala Lumpur was his first command. He held a Deck Officer Class 1 (Master) certificate of competency from Singapore (obtained in 2016) and had worked with Synergy Marine for 9 years.
The chief engineer held a Singapore Class 1 Marine Engineer’s certificate of competency obtained in 2017 after earlier completing a Bachelor of Engineering (Mechanical) in India. This was his first ship as chief engineer and his third time on board OOCL Kuala Lumpur; previous trips had been as second engineer. He joined the ship about 4 months prior to the accident and had worked for Synergy Marine for 6 years.
The electro-technical officer (ETO) first went to sea in 2013 and had worked with Synergy Marine since 2014 as a trainee and then as a qualified electrical officer. In 2018 he obtained an Indian certificate of competency as electro-technical officer and joined OOCL Kuala Lumpur in this capacity in February 2018. All the ETO’s sea service had been on container ships.
Safety management system
General
Elevator maintenance was considered by Synergy Marine as hazardous and thus required close attention to ensure a safe system of work. The Synergy Marine safety management system (SMS) included procedures, guidance and forms relevant to completion of unplanned elevator maintenance such as being undertaken on 3 June. In particular, the system included hazard identification and risk assessment and permit to work (PtW) documents.
Health and safety manual
The Synergy Marine Health and Safety Manual included a chapter on Permit to Work. One section of this chapter was devoted to Elevator Maintenance. The information provided included descriptions and illustrations of the hazards involved. Prominent in these pages were the dangers of being trapped by the moving elevator car, electrocution and falling from height. This information was repeated in the opening pages of the Electrical Work Permit book.
Hazard identification and risk assessment
Hazard identification and a risk assessment were required for new or unfamiliar tasks. The form consisted of two pages, and could be expanded as needed. Activity steps were listed and a table identified the hazard, consequence, control and recovery measures in place for each step. The risk for each step was then assessed and residual risk determined.
Forms completed for recent elevator maintenance were all similar in content, with each identified hazard having its review date updated to that of the form completion (Appendix A). In all, seven hazards and control measures were identified. Of these, the hazard of ‘sudden uncontrolled movement’ had control measures of:
ensure the local emergency stop button is activated
isolate and lock out the main breaker
tag out.
The likelihood of this event was adjudged remote and the residual risk very low. The highest residual risk level for any of the identified activity steps was assessed as ‘medium’ and no activity step included any additional control measures to reduce the level of risk.
Electrical work permit
The Synergy Marine Electrical Work Permit (EWP) system included permit books, each of which contained guidance and permit forms. Opening pages (17 in all) of each book contained guidance on the use of the permit to work system for electrical work, including examples. Of the guidance pages, nine pages were devoted to ‘Elevator Maintenance’. This section repeated the information provided in the Health and Safety Manual and further included a table of ‘Risk Assessment Considerations for Elevator Maintenance’. This table identified risks for different elevator related maintenance areas.
The remainder of the book contained blank EWP forms for use. The EWP form comprised two pages divided into general administrative detail and a line item list of ‘Additional Precautions’ to be completed (Appendix B). The administrative information included things such as description of the work, isolations details and permit authorities.
The ‘Additional Precautions’ section included 35 line items specific to the task being undertaken. Of these, 11 items related to all electrical jobs regardless of task content and 7 were related to high voltage (more than 650 V) tasks. The remaining 17 line items were to be completed specifically for elevator jobs, including 6 line items for ‘Additional checks when working on top of cage’.
All electrical jobs required:
a risk assessment to be carried out or an existing risk assessment to be reviewed
isolations or precautions to be in place to prevent accidental operation of the equipment
that communications were tested
a tool box meeting to be completed.
The significant portion of the EWP book and form devoted to elevator work (more than half of the risk mitigation line items to be checked) indicated that Synergy Marine considered this work to be of high inherent (residual) risk. The EWP form elevator-specific check items highlighted risk barriers to be in place for any work on the elevator (see the section titled Elevator work precautions, below).
Elevator
OOCL Kuala Lumpur is fitted with an Ushio Reinetsu, single wrap, traction geared type elevator rated to carry 6 persons or 500 kg. The elevator operates within a hoistway 39 m in height servicing 8 levels from the third deck (engine room) to the navigation bridge deck level (Figure 3).
The operation of the elevator, including all associated safety interlocks, is controlled by a micro‑processor based programmable controller. This system contained no stored memory capacity. Therefore, disruptions to the control logic due to operation of protection devices or power loss resulted in reset of the system logic. That is, all call requests outstanding at the time of the interruption were reset and not stored.
The elevator machinery and control unit are located in the elevator machinery room located on E deck, 2 decks below the navigation bridge and about 25 m above the third deck level. When there is no electrical power supply to the elevator, the elevator cage can be raised or lowered by fitting a provided hand-wheel to the electric drive motor. When the traction machine brake is released, the hand-wheel can be turned in either direction to move the elevator car up or down.
Figure 3: Elevator hoistway arrangement and location of accident
Source: Kowa Marine Service and ATSB
Latched push button ‘EMERGENCY STOP’ switches are fitted inside and on top of the cage. When activated, all elevator motion ceases and an emergency stop indicator lamp on the control panel in the elevator machinery room is illuminated. When the switches are reset, the elevator control system reactivates.
The elevator installation has two escape doors—in the cage top and from the elevator hoistway (on the navigation bridge top). These doors have micro‑switches fitted which detect when they are opened. Once operated, the escape door switch circuit requires manual reset in the elevator machinery room. The elevator cage will remain in its current location and will not operate until the escape door is closed and the circuit has been reset.
Micro-switches are also fitted to the cage and landing doors. Although the cage door is motorised and driven via a chain and sprocket, the landing doors are conventionally hinged and manually operated. In order to prevent access to the open lift shaft, the landing door also has an interlock mechanism that only permits it to be opened when the elevator is adjacent to the landing.
Operation
Normal (automatic) operation
Under normal operating conditions, the elevator will respond automatically to floor and cage operating panel floor call request inputs. Should any of the protection devices activate (emergency stop or door open) or there is a loss of power (blackout), the cage will stop moving and the call request queue is reset. The elevator cage will remain stationary until power is restored, or the protection device is reset, and a new floor request order is received.
Manual operation
The elevator can be operated in ‘MANUAL’ mode from the operating panel on top of the elevator cage. In ‘MANUAL’ mode, all operating signals come from the cage-top operating panel. This panel contains six control buttons (Figure 2):
‘AUTO’—‘MANUAL’ rotary switch
latching ‘EMERGENCY STOP’ button
four ‘push and hold to run’ buttons:
‘CAGE UP’
‘CAGE DOWN’
‘DOOR OPEN’
‘DOOR CLOSE’.
Manual operation of the cage doors requires the emergency interlocks (emergency stops and escape doors) to be reset. To manually drive the cage up or down using the push buttons requires that the interlocks are reset and that the cage and landing doors are all closed.
If power is lost, an emergency stop is activated, or a door opens, the elevator stops and remains in its current location. When the power is restored, the emergency stop reset and all doors closed, control reverts to the push buttons. Any calls for the elevator from floor panels or the cage internal panel have no effect—the calls do not queue and are not stored by the control system logic.
If control is changed from ‘MANUAL’ to ‘AUTO’ the system remains in its current state, with the cage stopped, until a call request is made. The system will then respond and move the cage to the requested deck.
Maintenance
Based on the elevator manufacturer’s guidance, OOCL Kuala Lumpur’s planned maintenance system included regular monthly, 3-monthly and annual checks.
The monthly maintenance routine included checks of equipment which was located in the elevator hoistway and outside the elevator cage. This included checks of the wire rope, the cage and counterweight guides, and the guide rail lubrication.
The 3-monthly checks included the monthly checks plus more comprehensive inspections of the entire elevator system, including in the hoistway and outside the cage. The annual check included the monthly and 3-monthly items plus additional component securing and system control checks.
It was usual that these maintenance routines included driving the elevator from the cage top.
Maintenance records showed that four routine elevator tasks (one 3-monthly and three monthly checks) had been completed since the ETO joined the vessel. Evidence was provided to show that risk assessments had been completed for at least the three most recent tasks, including the 3-monthly check. Crew members testified to having assisted the ETO to complete recent elevator checks during which the ETO operated the elevator, in ‘MANUAL’ mode, from the cage top.
Elevator maintenance by shore-based service companies
Records showed that OOCL Kuala Lumpur’s elevator had undergone inspection and repair by shore-based elevator repair companies in July and September 2016 and October 2017. These services included operational tests of the elevator, including all safety devices.
Elevator work precautions
Elevator maintenance presents risks to those completing the work. Work within the elevator hoistway and on the cage top is particularly hazardous and guidance is provided to increase awareness of the risks and advise suitable mitigators to put in place.
Elevator operating manual
The elevator manufacturer’s operation manual provided a section on cautions for inspection or maintenance. General guidance included advice to:
use a work permit
post warning signs at each entrance door
ensure alarms are operable before commencing work
not work alone
ensure good communications.
The operating manual then provided specific advice for work on the cage top. This advice included:
‘AUTO’—‘MANUAL’ switch to be in the ‘MANUAL’ position
‘EMERGENCY STOP’ to be engaged
manually operate the elevator after releasing the emergency stop.
Electrical work permit
The precautions listed in the Synergy Marine electrical work permit (EWP) expanded upon those in the operating manual. In addition to the EWP requirements for all electrical jobs, specific requirements for elevator maintenance included:
the officer of the watch, on the bridge, was to be informed
an announcement was to be made on the public address system
notices were to be placed on all decks and doors indicating the elevator was out of service
communications between the elevator machine room and the top of cage were to have been tested
an assisting person was to be nominated and was to remain in eye contact at all times
all alarms and trips were to be tested prior to maintenance
the work was to be supervised by a senior engineering officer.
Additional checks for when working on top of the cage included:
the power was to be isolated
the top of the cage was to be accessed by the elevator cage escape hatch only
elevator control was to be changed from ‘AUTO’ to ‘MANUAL’
the cage top ‘EMERGENCY STOP’ switch was to be activated
the ‘EMERGENCY STOP’ was to be released only when required to operate the elevator
persons were to stand in the ‘Safe Zone’ at all times (atop the closed elevator cage escape hatch (Figure 2)).
Once maintenance was completed, the power to the elevator was to be isolated and the escape hatch opened before changing control from ‘MANUAL’ to ‘AUTO’ and exiting the cage top. Opening the hatch required the escape reset to be pushed in the elevator machinery room. The control system would then power-up and the elevator return to normal operation.
The EWP precautions ensured that control of the elevator remained with the person on top of the cage and until they were clear. This ensured that the elevator would not move without their knowledge and direction.
Industry guidance
The United Kingdom Maritime and Coastguard Agency (MCA) publication Code of safe working practices for merchant seafarers (COSWP) is a widely referenced nautical publication which provides best practice guidance for improving health and safety on board ships. In respect to the maintenance and testing of elevators, COSWP advised that:
the work is to be completed by competent persons only, with practical and theoretical knowledge, experience and understanding of the plant being worked on
appropriate isolations must be in place
a risk assessment is required—safe work procedures are to be drawn up and followed
no person should work alone
appropriate signage must be prominently displayed
barriers must be in place to protect open doorways.
COSWP mentioned that the most important single factor in minimising risk of accidents was the avoidance of misunderstandings between personnel.
Further, the British Standard Code of practice for safe working on lifts (BS 7255:2012) provides useful guidance on safe practices when working in and around elevators. This includes advice in relation to accessing and exiting the elevator cage top.
Additionally, more targeted and specific operational guidance can be sought from elevator service organisations which provide services to the ship and company. This complements advice available from the manufacturer of the specific elevator installation in use on board.
Inspections and approvals
Post-accident inspections
Inspections of the elevator, associated equipment and machinery and the ship were completed by the ATSB and other authorities in the immediate aftermath of the accident. Subsequently, prior to recommissioning of the elevator in Singapore on 23 June, additional inspections by elevator experts, including the manufacturer, were completed. No evidence of faulty control equipment or operation was found during any of the inspections.
Flag – Singapore
The flag Administration advised that they do not have any specific regulatory requirements related to ship elevators. However Singapore advised that, under the ISM Code, the shipping company is responsible to ensure that any equipment and installation on board is inspected and maintained in good working condition. That is, the company is responsible to ensure the elevator is maintained as per the manufacturer’s requirements and is covered under the ship’s planned maintenance system (PMS) and, therefore, is maintained and safe for use.
The vessel was inspected by flag[7] twice during the preceding five years with only one observation, related to the operation of tank valves.
In addition to this, the vessel was inspected by Port State Control (PSC)[8] regularly during the preceding five years with no deficiencies found which related to elevator inspection and maintenance.
Classification – ClassNK (Nippon Kaiji Kyokai)
A classification society is a non-governmental organization that establishes and maintains technical standards for the construction and operation of ships and offshore structures. Classification is to verify the strength, integrity, function and reliability of a ship’s structure and systems in order to maintain essential services on board. Classification societies aim to achieve this through the development and application of their own rules and by verifying compliance with international and/or national statutory regulations on behalf of flag Administrations.
OOCL Kuala Lumpur’s classification society, ClassNK, advised the ATSB that there were no international rules or regulations relating to ship elevators. However, some Administrations issue their own rules for elevators. ClassNK also advised that registration of shipboard installations with a classification society is at the owner’s request and it is not mandatory to register installations such as an elevator. It is then the owner’s responsibility to maintain the ship’s elevator in accordance with the manufacturer’s instructions. If an elevator is registered with ClassNK, it will be included in the ship’s register of equipment and machinery and subjected to periodic survey.
OOCL Kuala Lumpur’s elevator was not registered with ClassNK as a surveyable item.
Previous elevator accidents
Elevator accidents continue to occur around the world and result in about one fatality per year. The ATSB last conducted such an investigation in 2007.[9] Since that time, more than 10 fatal ship elevator accidents have been reported internationally.[10]
Many of these accidents involved the failure to apply existing safety management procedures and/or identified safety barriers that have proven effective in reducing the risks associated with elevator maintenance. These include procedures related to communications, supervision and machinery isolation/lockout. Furthermore, the injured person was often working alone and riding the elevator cage.
On 3 June 2018, OOCL Kuala Lumpur’s electro-technical officer (ETO) was conducting testing of the ship’s personnel elevator after completion of mechanical repairs. While on top of the cage, the ETO became trapped between the moving cage and the bulkhead, and was fatally injured.
OOCL Kuala Lumpur’s safety management system (SMS) required that detailed planning and preparation, including multiple safety checks and barriers, were implemented prior to conducting elevator maintenance. This included the need to complete a risk assessment, an electrical work permit and a toolbox meeting before commencing the work. The ETO was the most appropriate person on board to complete this task as he had electrical qualifications and previous experience working on the elevator.
This analysis will examine the circumstances around how the ETO became trapped and will include a review of the guidance and procedural preparations and assessment of the elevator maintenance task.
The accident
After completion of mechanical repairs, the ETO notified the chief engineer of his intention to test the elevator. He then returned to the second deck elevator landing to provide a final brief to the fitter. The elevator cage top was positioned at a convenient access height above the second deck level (about 1 m) and a similar distance below the top plate of the landing door frame.
At this stage, the elevator control was isolated via the safety interlocks provided by the landing door being open, the cage top emergency stop being activated, and the control switch set to ‘MANUAL’. In this position, it was possible to de‑activate the emergency stop and manually operate the cage door using the control panel pushbuttons, without the need to drive the elevator up and down or climb on top of the cage.
However, the ETO was last observed on top of the elevator cage, standing in the safe zone, looking forward, with the elevator control in ‘MANUAL’ and the cage top emergency stop engaged. When the fitter closed the second deck elevator landing door, the door open interlock was reset and full elevator control reverted to the cage top operating box if the emergency stop was de‑activated. In this position, at this time, control of the elevator resided with the ETO.
From here, it was possible for the ETO to safely observe the operation of the elevator and sliding doors. The sliding door cams and position-sensing micro‑switches were visible and he could manually open and close the doors using the push-and-hold door buttons on the control box. With all doors closed and all interlocks reset, he was also able to drive the elevator up and down using the push-and-hold buttons on the control box. The buttons only worked while depressed and as soon as released, all motion stopped.
After the accident, the ETO was found on the forward side of the elevator, toward the port side, in an inverted position. The top plate of the second deck landing door frame was found damaged and bent upwards with the door position micro‑switch dislocated and the door closer damaged (Figure 4). This indicated, that, at some stage after the second deck elevator access door was closed, the ETO moved away from the cage top safe zone to a position that exposed him to a crush hazard beyond the side of the cage. It was not possible to determine the reason for this re‑positioning.
The elevator travelled several metres vertically from its original location until the cage bottom was about 0.5 m above the second deck doorway top plate. The push-and-hold design of the manual control buttons meant that if the ETO had been driving the cage manually, it should have stopped once he was struck and his finger was removed from the button.
Figure 4: Accident location and damage to second deck elevator landing door frame
Source: Synergy Marine, Worksafe Victoria and ATSB
Inspections and tests completed after the accident, including those by the elevator manufacturer during repair and recommissioning, found no fault with the elevator control system and equipment, in ‘AUTO’ or ‘MANUAL’. Therefore, for the cage to have continued for some distance from where the ETO was struck, the control must have been in ‘AUTO’ and the elevator movement was the result of a floor call request. It is likely that the elevator stopped when one of the door sensing micro‑switches was dislocated and indicated to the control system that a door had opened.
As the specific actions of the ETO on top of the elevator cage were not witnessed or communicated, it was not possible to determine why automatic control of the elevator was selected contrary to maintenance requirements.
Safety barrier implementation
This accident highlights that safety measures identified on the Electrical Work Permit (EWP) and in the risk assessment should be taken at all times. If not, any person conducting elevator maintenance, especially on the cage top, is exposed to significant risk. The elevator must remain under the control of the person(s) on top of the cage at all times, up to and until they have safely exited the cage top and the hoistway.
Warning signs and announcements
The EWP form included a list of checks to be filled for maintenance on elevators in addition to those for all electrical work. The first two items on this list were:
notify the bridge and have a public address announcement made
place notices for elevator maintenance on all decks and doors.
For the work to be completed on 3 June, these prominent risk barriers were annotated as being in place but the evidence showed that they were not. Amongst other evidence, when ATSB investigators attended the ship on 4 June, warning notices were not universally in place. Furthermore, interview testimony was that although the bridge team were aware that elevator maintenance would be undertaken, they had not been notified that it had started or when the work would be completed. Consequently, no public address announcement in respect to the elevator was made. No explanation for this could be determined.
Systems of safe work rely upon adherence to notices and announcements to ensure the effectiveness of the safety net placed around a task. Although announcements and warning signs are not sufficient safeguards alone, they are important in making persons whose actions may affect the safety of a task aware that this task is taking place.
Had these barriers been put in place, the likelihood of an inadvertent request for the elevator, and subsequent unexpected movement, would have been much reduced.
Supervision and other electrical work permit precautions
In addition to the warning announcement and notices mentioned above, the EWP also listed other precautions several of which were either not in place or not completely implemented. This included:
A senior engineering person was to be identified to supervise the work. This would have allowed third party technical scrutiny of the work plan and provided an opportunity to change the way in which the task was to be completed.
An attendant person was to be nominated and was directed to remain in eye contact with the person conducting the task. This meant a second person would observe the worker and might therefore be able to warn of dangers or impulsive actions.
Entry to, and exit from, the cage top was to be via the elevator cage escape hatch only, with the hatch being opened before control was changed from ‘MANUAL’ to ‘AUTO’. This would have ensured that persons were clear of the cage top before control was changed to ‘AUTO’ and power was restored to the elevator.
Prior to commencing the work, the chief engineer had discussed the job with the ETO during the morning, been present during the tool box meeting, had approved the daily work plan and the risk assessment, accepted the EWP role of supervising engineer, and had authorised and signed the permit. Subsequently, from his station in the machinery control room he would have been aware that no warning announcement was made. Furthermore, the worksite was only a short distance away, on the same deck, and the chief engineer could have readily determined if all permit conditions were in place. At this time, the work could have been stopped and the entire process and plan been re-assessed.
Later, the ETO correctly notified the chief engineer that he was going to test the elevator, after the repair had been completed. At this time, the intentions of the ETO and the details of what he was planning to do should have been clearly conveyed to and understood by the chief engineer. However, in testimony, the chief engineer stated that they discussed the testing but he did not expect that the ETO would do so by driving the elevator from the cage top.
As a consequence, opportunities were missed—initially to correct errors in not following the EWP requirements and then for final scrutiny and advice—which may have altered the actions taken or the intentions of the ETO to test the elevator. Had the EWP barriers been fully implemented and this level of oversight provided, the task might not have progressed to the point of testing which involved the ETO driving the elevator from the cage top.
Considerations
Although the exact motivation and actions of the ETO could not be determined, several possible influences were present at the time. Port calls are busy times for the ship’s personnel and there would be limited time available for the ETO to complete maintenance other than that related to the cargo and cargo operations. Possible motivations for completing the elevator maintenance at this time include logistical and time considerations, such as:
the elevator is an important part of the ship’s equipment and would be heavily utilised during the port stay
the ship was to receive a harbour pilot on board at 1000 that morning—this was a busy time for engineering staff and, for the ETO to be ready for manoeuvring, meant that the repair would need to be completed before this time
the pilot boarding point was through a gunport door at the second deck level, into the engine room; it was then 8 decks to the navigation bridge, a climb of about 30 m—having the elevator available would be beneficial and reflect positively on the ship
the repair was straightforward and only required about 10 minutes to complete—that is, the short time available was considered sufficient to complete the job
the ETO was familiar with the machinery and had completed several maintenance tasks, including driving the elevator from the cage top, since joining the ship
placing and removing notices on all decks and doors may take longer than the task itself.
Although these considerations are acknowledged, this accident illustrates the importance of following documented procedures and safe working practices. Working from the top of an elevator cage is recognised as being high risk and all identified precautions should be followed and put in place for all elevator maintenance.
For any task that is performed on multiple occasions without any adverse consequence, there is the potential for an individual’s perception of risk (or expectancy of a problem) to decrease. The individual can become more confident doing the task, and in some cases incorrectly perceive the situation is under control. Although there was insufficient evidence to determine if an incorrect perception of risk contributed to this accident, it is important to always follow documented procedures and safe working practices, even when the operation is considered safe.
Findings
From the evidence available, the following findings are made with respect to the fatality which occurred on board the container ship OOCL Kuala Lumpur about 8.5 NM south-east of Port Botany, New South Wales on 3 June 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
While riding atop the elevator cage, the electro-technical officer (ETO) became trapped between the moving cage and the bulkhead, and was fatally injured. The reasons the ETO was in this position and became trapped could not be determined.
After the second deck door was closed, the elevator control must have been set to ‘AUTO’, the cage top emergency stop must have been released and the ETO moved to a position that exposed him to a crush hazard.
Crew members were not informed that the elevator work was being conducted and warning signs were not in place indicating the elevator was out of service. This allowed an elevator call request to be made while the work was underway and the ETO was on the cage top.
Other safety management system procedural requirements, in particular supervision and communications, were not fully complied with. Had the procedures been followed, it is likely that the work would have been stopped and the plans modified. This would then have reduced the risks to which the workers were exposed.
Safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Synergy Marine—ship manager
Synergy Marine (manager of OOCL Kuala Lumpur) notified the ATSB that the following proactive safety actions had been taken.
A company audit into the understanding and use of the permit to work (PTW) system was conducted on board OOCL Kuala Lumpur. Compliance was checked and training in the PTW system was provided.
An extensive programme of education, training and review of elevator‑related processes and procedures was widely implemented within the company and fleet. This included a company-wide co-ordinated ‘Safety Stand Down’ (suspend work and meet) discussion of the accident, targeted management and elevator technical and maintenance personnel training and distribution of safety alerts and circulars.
The company safety management system was amended to
require shore management approval prior to any maintenance which involves working outside the elevator cage
include increased detail regarding elevator maintenance hazards
outline elevator maintenance personnel responsibilities
describe safety requirements for elevator maintenance
provide detail specific to working safely on top of the elevator cage including procedures for accessing and exiting the cage top (referencing standard BS 7255:2012 Code of practice for safe working on lifts).
All company vessel elevators (existing and new) were assessed for compliance with British and European standards for car top control stations and safe entry and exit. A programme of modification has been implemented to ensure non-compliant elevators meet the standards.
General details
Ship details
Name:
OOCL Kuala Lumpur
IMO number:
9367176
Call sign:
9V7671
Flag:
Singapore
Classification society:
ClassNK (Nippon Kaiji Kyokai)
Ship type:
Fully cellular container ship
Builder:
Imabari – Koyo Dockyard, Mihahara, Japan
Year built:
2007
Owner(s):
Grace Ocean, Singapore
Manager:
Synergy Marine, Singapore
Gross tonnage:
68,904.47
Deadweight (summer):
66,940 t – 5,888 TEU including 586 refrigerated
Summer draught:
14.021 m
Length overall:
280.54 m
Moulded breadth:
40.00 m
Moulded depth:
24.00 m
Main engine(s):
Mitsui MAN B&W 10K98MC (Mk VI)
Total power:
57,200 kW at 94 rpm
Speed:
25.00 knots
Damage:
Elevator taken out of service
Sources and submissions
Sources of information
The sources of information during the investigation included:
the master and crew of OOCL Kuala Lumpur
the Port Authority of New South Wales
Synergy Marine
Ushio Reinetsu (elevator manufacturer)
ClassNK
the Australian Maritime Safety Authority
Maritime and Port Authority of Singapore (MPA)
Transport Safety Investigation Bureau (TSIB), Ministry of Transport, Singapore
Worksafe Victoria.
References
Maritime and Coastguard Agency (MCA) 2018, Code of Safe Working Practices for Merchant Seafarers, MCA, Southampton, UK. Available at www.gov.uk/transport/maritime-safety
Schager, B 2008, Human Error in the Maritime Industry, Vinnova and Bengt Schager, Halmstad, Sweden.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the master, chief engineer and involved crew members of OOCL Kuala Lumpur; Synergy Marine, Maritime and Port Authority of Singapore, Transport Safety Investigation Bureau (TSIB), Ministry of Transport, Singapore, the Australian Maritime Safety Authority and the Port Authority of New South Wales.
Submissions were received from Synergy Marine, Maritime and Port Authority of Singapore, Transport Safety Investigation Bureau (TSIB), Ministry of Transport, Singapore, the Australian Maritime Safety Authority and the Port Authority of New South Wales. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendices
Appendix A – Hazard identification and risk assessment form for elevator maintenance on 3 June 2018
Page 1
Hazard identification and risk assessment form page 2:
Appendix B – Synergy Group Electrical work permit
Page 1:
Synergy Group Electrical work permit page 2:
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 30 April 2018, the surface movement controller (SMC) at Melbourne Airport, Victoria was conducting on-the-job training of a trainee air traffic controller. Runways 27 and 34 were in use, with aircraft landing on runway 27 and departing from either runway 27 or runway 34 (Figure 1).
Figure 1: Melbourne Airport apron, taxiways and runways
Source: Airservices modified by ATSB
At about 0923 Eastern Standard Time,[1] after the trainee had been in the surface movement control position for nearly 2 hours, the SMC took over in preparation for handing over the position to another controller. At that time, an Airbus A321-231 aircraft, registered VH-VWQ (VWQ) and operating Jetstar flight 730 from Launceston, Tasmania, landed on runway 27 and exited onto taxiway N and then E (Figure 1). After landing, the flight crew of VWQ contacted the SMC, who instructed them to hold short of runway 34.
At about the same time, a Boeing 737-838 aircraft, registered VH-VZB (VZB) and operating Qantas flight 610 from Melbourne to Brisbane, Queensland, had been pushed back from bay C8.
About 3 minutes after VWQ landed, it was still holding awaiting clearance to cross runway 34. Meanwhile, the flight crew of VZB requested clearance to taxi to holding point J of runway 34 for take-off. The SMC cleared VZB to ‘taxi via TANGO [T] and hold short of [taxiway] ALPHA [A]’ (Figure 2).
Figure 2: Airport diagram showing aircraft tracks
Source: Airservices Australia modified by ATSB
At 0927:43, the SMC cleared VWQ to ‘cross runway 34, taxi via ALPHA [A], hold short of JULIET [J],’ which was four intersections beyond taxiway T. As VZB was required to hold short of taxiway A, at that time, VWQ had right of way through the intersection of taxiways A and T.
Twenty seconds later (at 0928:03), the SMC commenced handover of the surface movement control position. He pressed the handover record button and selected the speaker on so the relieving controller (and the trainee) could hear all transmissions on the Ground frequency. The SMC then proceeded through the handover checklist. When ‘Traffic’ was the next item on the checklist, the controller said they would ‘work through this traffic as we go’. The relieving controller did not take over the position at that time.
At 0928:39, the SMC cleared VZB to continue via A to holding point K of runway 34.
As VWQ taxied along taxiway A and approached the intersection with taxiway T, the captain, seated in the left seat, sighted VZB approaching the intersection from the left (on taxiway T). The captain of VWQ assessed that the flight crew of VZB had not seen VWQ and that if both aircraft continued at their current speed, they might collide at the intersection. In response, he took control of the aircraft from the first officer (the operating pilot) and braked heavily.
At the same time, the flight crew of another aircraft requested clearance. The SMC responded to that request, and by the time he finished that transmission, the captain of VWQ had braked. The SMC, on looking out the window, had also seen the potential conflict and instructed the flight crew of VWQ to ‘give way to Qantas [VZB]’. When the captain of VWQ responded that the instruction was late, the SMC acknowledged the oversight.
Meanwhile, VZB continued through the intersection, taxied to holding point K for runway 34 and subsequently departed. The flight crew of VZB had not been aware of any potential conflict.
VWQ continued to taxi first to J then onwards to the bay (at 0931:06).
At 0935:25, 7 minutes after commencing the handover, the SMC returned to the checklist item of Traffic, completed the handover, and the oncoming SMC accepted handover of the position.
Electronic flight strips (Flight Data Elements)
It is possible to note a clearance limit on the flight strip (such as VZB being instructed to hold short of taxiway A). However, the SMC advised that controllers generally do not do this because the time it takes to do so makes it counterproductive to issuing fast, dynamic clearances.
A technique that controllers do use to remind themselves that a clearance limit has been issued and further instructions are required is to ‘cock’ the flight strip (Figure 3). This involves leaving the strip offset to the right side of the bay. The controller moves it to the left (‘uncocked’) when a clearance has been issued where no further instructions are required. The SMC advised that he used that technique.
This technique provides a visual trigger to remind controllers that there is an outstanding action. However, an uncocked strip when no clearance limit has been issued would not provide that cue, or alert to the potential for a proximity event.
Figure 3: Examples of flight strips cocked and uncocked
Source: Airservices Australia
Handover
It was standard procedure for a controller to hand over their position either at the end of a shift or to take a break, in this case after being in the position for 2 hours. The handover requires a division of attention between controlling traffic and communicating with the relieving controller. Along with a division of their attention, the controller’s workload increases as they pass required information to the relieving controller.
In preparation for handing over to the oncoming controller, the SMC had taken over from the trainee in actively controlling the traffic about 5 minutes prior to commencing the handover. He commented that the traffic was not necessarily sequenced the way he would have done it if he had been actively controlling and that he had taken over in order to get the traffic in a state that he considered ready to hand over.
Strategies used to mitigate the risks of the increase in workload and of divided attention at handover include the use of a checklist to ensure all vital information is passed on, and delaying the handover until there is a suitable lull in the traffic.
The controller used a checklist and started the handover, which was then delayed due to the volume of traffic. The controller commented that there is an element of distraction in having another person watching them while controlling, and having the transmissions audible on the speaker.
Previous handover occurrences
The ATSB has been notified of 13 occurrences since 2008 where the handover was identified as an influencing factor. A review of these occurrences indicated that the handover increases workload and requires a division of attention from actively controlling. The handover therefore increases the potential for errors.
Taxiway works
Melbourne Airport was conducting planned works as part of the airport’s taxiway maintenance program. The works were not directly related to the clearances issued to the two aircraft involved in this occurrence. However, the controller was planning and managing other aircraft around the taxiway closures. This reduced the efficiency of controlling taxiing aircraft, thereby increasing the controller’s workload.
Flight crew actions
Airservices Australia Aeronautical Information Publication En Route section 1.1-9 2.3.3.5 stated that the ‘separation of aircraft taxiing on the manoeuvring area is a joint pilot and controller responsibility.’
Safety analysis
Controller workload
Workload reflects ‘the interaction between a specific individual and the demands imposed by a particular task.’[2]
In this occurrence, several factors increased the controller’s task demands and therefore his workload:
a high volume of traffic associated with the morning peak period
having recently taken over from the trainee in actively controlling the traffic
ongoing taxiway works.
Additionally, and according to the European Organisation for the Safety of Air Navigation (2006),[3] handover increases workload demands and distraction, which increases the risk of errors.[4]
After commencing the handover, the controller forgot that he had issued VWQ clearance to taxi through intersection A/T, thinking that he had instructed the crew to hold short of T. Situations of high workload are likely to reduce memory performance.[5]
When the controller then cleared VZB through the same intersection, a potential conflict resulted. His workload and distraction associated with the handover probably contributed to the delay in detecting the conflict. When the conflict was detected, other radio transmissions delayed the controller instructing the flight crew of VWQ to give way to VZB until after avoiding action had already been taken.
Managing workload during handover
Workload experienced by a controller at a given time is subjective and it is difficult to assess the increase in workload that can be managed before the error rate increases. Therefore, it is important to implement strategies to reduce the risk and potential consequences of errors due to high workload. A widely accepted strategy to reduce that risk is delaying the handover until a suitable lull in the traffic.
In this occurrence, there had been 5 minutes of almost continuous radio communications then a 30-second lull before the controller started the handover. After completing some of the checklist items, the controller then delayed detailing the traffic to the relieving controller. Had the handover been delayed until a longer lull could be expected, it may have reduced the risk of error. However, without any prompt to record taxiing instructions, the controller was still reliant on remembering the issued clearance limits.
Findings
This finding should not be read as apportioning blame or liability to any particular organisation or individual.
The surface movement controller’s workload during handover probably contributed to him forgetting the taxiing instruction he had issued to VH-VWQ. Consequently, he issued a conflicting taxiing instruction to VH-VZB that resulted in a proximity event between the aircraft at an intersection.
Safety message
This occurrence highlights that increased workload and distraction can reduce performance and increase errors. In the air traffic control context, using tools/practices that reduce reliance on memory and delaying handover until lulls in activity can mitigate these effects.
The timely action taken by the captain of VH-VWQ to avoid a collision also demonstrates the importance of flight crew alertness while taxiing.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At about 0035 on 1 June 2018, YM Efficiency was en route to Sydney, steaming slowly into strong gale force winds and very rough seas off Newcastle when it suddenly rolled heavily. As a result, 81 containers were lost overboard and a further 62 were damaged. The ship also sustained structural damage to its lashing bridges, superstructure and accommodation ladder. The ship spent a further 5 days at sea before berthing in Sydney on 6 June.
At the time of publication, searches including remote underwater surveys had identified 66 containers with a few washed ashore or close offshore. Five containers have been removed with 15 containers yet to be found. The accident resulted in substantial debris washing ashore on New South Wales beaches.
What the ATSB found
The ATSB determined that the loss of containers overboard occurred because forces generated during the sudden, heavy rolling placed excessive stresses on containers stowed aft of the ship’s accommodation. This resulted in the structural failure of containers and components of the lashing system, leading to the loss of containers. All potential causes for the sudden rolling were investigated but there was insufficient evidence to establish a definitive reason for the rolling.
The ATSB found that the weights and distribution of containers in the affected bays were such that calculated forces exceeded allowable force limits as defined in the ship’s Cargo Securing Manual (CSM). The investigation also identified that the stowage arrangement was not checked for compliance with the CSM’s calculated lashing force limitations during the cargo planning process ashore. This left sole responsibility for compliance with these requirements with the ship’s officers, with limited options to resolve deficiencies at a late stage in the process without unduly impacting operations. Further, the officers did not use the ship’s loading computer system and its lashing calculation program to check if the stowage arrangement complied as they probably did not have an adequate understanding of the system.
What's been done as a result
The ship’s managers, Yang Ming, now require checks of lashing forces during the initial cargo stowage planning stage ashore. Shore planners will receive regular training in the principles of cargo loading and securing, container stowage, and the dangerous goods functionality of the computer automated stowage planning software. Further, a stowage planning examination has been introduced for trainee stowage planners.
A review of loading computer systems in use across the Yang Ming fleet resulted in the adoption of class-specified, route-specific container stowage standards for part of the fleet. YM Efficiency and the other ships of the same size and type have been equipped with class-approved container stowage planning software systems, with the same software replicated ashore.
In addition, periodic training in the use of the ship’s loading computer system will be delivered to the responsible ship’s officers. Cargo procedures were also reviewed to ensure that the requirement for lashing forces checks to be conducted, both ashore and on board, was captured.
Safety message
The safe carriage of containers at sea depends on loading, stowing and securing them in compliance with the ship’s CSM. Checking stowage plans for compliance with the CSM requirements is increasingly achieved through loading computer systems. Notwithstanding the efficiency of computerised systems, the scale and pace of modern container ship operations puts significant pressure on ships officers to check and amend or approve proposed stowage plans at a late stage.
In that context, the planning process ashore offers the best opportunity to take all practical measures to ensure that the proposed stowage plan presented to ships officers complies with the CSM and is as safe as reasonably practicable.
Weather forecasting, routing and good navigational practices in adverse weather all play a part in minimising the risk of injuries to crew and damage to ship, cargo and environment. However, safe and effective container stowage planning remains the primary control measure in managing the risks involved in carrying containers by sea.
The occurrence
What happened
On 13 May 2018, the 4,250 TEU[1] container ship YM Efficiency sailed from Kaohsiung, Taiwan, bound for Sydney, New South Wales (NSW) (Figure 1). The ship was partly loaded, carrying 2,249 cargo containers (3,307 TEU)[2] with a forward draught of 10.5 m and an aft draught of 12.5 m. The ship’s schedule required it to arrive off Sydney at 0200 Eastern Standard Time[3] on 31 May.
Figure 1: YM Efficiency
Source: ATSB
During the passage south, the ship maintained an average speed of about 10 knots[4] and received daily weather forecasts and routing advice from a commercial weather routing service.
On the afternoon of 28 May, YM Efficiency received instructions from the ship’s agent in Sydney to amend its arrival time to 1200 on 1 June 2018. In response, the master reduced the ship’s main engine speed to ‘slow ahead’ or 35 revolutions per minute (RPM) and the ship’s speed reduced to an average of about 8 knots.
On the afternoon of 29 May, the ship was off Brisbane, Queensland and by this time, the ship had also started receiving weather forecast information broadcast by Australia’s Bureau of Meteorology (BoM).
By 0930 on 30 May, YM Efficiency was off the coast of NSW, about 32 nautical miles[5] (miles) to the north‑east of Coffs Harbour. Weather forecasts received by the crew predicted steadily increasing winds and seas into the next day. The forecast estimated 4-5 m seas and swell along the NSW coast. In preparation for the expected adverse weather, the chief mate carried out checks in accordance with the ship’s heavy weather checklist. This included a check to ensure container lashings on deck were secure. The checks were completed by about 1130. By 1200, the ship was off Coffs Harbour and the weather (recorded in the ship’s logbook) was west-south-westerly winds at force 4[6] (between 11 and 16 knots) with 3 m seas and a 2 m swell.
At 1605, the BoM issued coastal waters forecasts for the Macquarie, Hunter and Sydney coastal regions of NSW. The forecasts included gale warnings for the next day, 31 May. The forecasts warned of 3 m seas and swell, increasing to 4 m by the evening. Other BoM forecasts, including marine wind warnings and high seas weather warnings, also warned of the developing adverse weather.
By 1900, YM Efficiency was off Port Macquarie and the weather had deteriorated. Consistent with the forecast conditions, it was recorded as being cloudy with force 8 (between 34 and 40 knots) west‑south‑westerly winds, 6 m seas and a 5 m swell.
By 0800 the next morning, 31 May, the ship was about 32 miles east-north-east of Port Stephens. The weather was recorded as being cloudy with west-south-westerly winds at force 8 (between 34 and 40 knots) with 7 m seas and a 5 m swell. The ship’s main engine speed remained at 35 RPM, with the ship making good about 6 knots. At about 0830, a second heavy weather checklist was completed, with the container lashings checked again. At about 1000, the ship received a weather forecast as part of the weather routing service and shortly after, BoM broadcast a coastal waters forecast. Both forecasts were consistent in predicting continuing adverse weather into the evening of 31 May.
The accident
At about 1314 on 31 May, the agent informed YM Efficiency’s master that the required arrival time had been postponed a further 8 hours to 2000 on 1 June. At about 1400, when the ship was about 84 miles from Sydney, the master stopped the main engine and began drifting about 30 miles east of Newcastle in order to adjust the ship’s arrival time (Figure 2). The weather at the time was recorded as being overcast with west‑south‑westerly winds at force 8 (between 34 and 40 knots) with 6 m seas and a 5 m swell. The ship’s officers recalled that, when the ship was drifting, there was little rolling or pitching.
The main engine was re-started for brief periods over the next few hours to maintain some control over the ship’s drift. The rough weather continued into the evening with the wind recorded as west-south-westerly and strengthening to force 9 (between 41 and 47 knots) at 2200.
At about the same time, the ship’s master completed his night orders, which instructed the officer of the watch (OOW) to continue monitoring weather forecasts and the observed weather conditions. The orders required the OOW to test the main engine and other navigational equipment by 2330 before calling the master in preparation to resume the passage.
Figure 2: Section of navigational chart Aus 489 showing YM Efficiency's track
Source: Australian Hydrographic Office, annotated by the ATSB
At about 2300, the chief engineer and duty engineer (fourth engineer) went down to man the engine room and prepare to start the main engine. Shortly before 2330, the third mate tested the engine and navigational equipment and then called the master. At about 2330, with the master on the navigation bridge (bridge), the engine was started, with the engine speed again set at ‘slow ahead’, and the passage to Sydney was resumed. The engineers left the engine room and returned to their cabins.
Shortly before midnight, having satisfied himself that the ship was on an appropriate heading, the master retired to his cabin. The master’s night orders instructed the officers to maintain 35 RPM and to use the rudder to keep the ship’s bow into the prevailing conditions to avoid a situation where the weather was on its beam.
The third mate maintained the steering in manual mode until about 2353 when he switched to autopilot with a set heading[7] of 211°. At midnight, the third mate handed over the watch to the second mate. The weather at midnight was recorded as being overcast with west-south-westerly winds at force 9 (between 41 and 47 knots) with 6 m seas and a 5 m swell.
The second mate reverted to manual steering before switching back to autopilot at about 0013 on 1 June with a set heading of 210°. The ship continued to make comfortable progress (little rolling or pitching) in the prevailing conditions at a speed of about 3 to 4 knots.
Shortly after 0034, in a position about 16 miles east-south-east of Newcastle, the ship experienced a period of sudden rolling for between 60 and 90 seconds. During this period, the ship rolled quickly and heavily at least three times. The ship’s master, who was in his cabin, recalled what he believed to be a wave crashing against the ship’s side immediately before the rolling began.
According to the master and second mate, the rolling reached angles of up to 30º to port and starboard. Almost immediately after the rolling commenced, several engine room alarms sounded. In response to the rolling, the second mate changed the steering from autopilot to manual. The second mate reported hearing loud noises on deck and suspected that there had been some container damage. He turned on the ship’s deck lights and observed that a number of containers had been damaged and possibly lost overboard from the bays aft of the accommodation. Shortly after, the main engine unexpectedly shut down, with the RPM gradually reducing to zero.
By about 0036, the rolling had subsided and the master had arrived on the bridge. The chief, second and fourth engineers went to the engine room to attend to the alarms. The second mate phoned the chief mate and alerted him to the situation. The master took over conduct of the ship’s navigation and instructed the chief mate to carry out a damage assessment.
Post-accident events
Following completion of a damage assessment at about 0040, the chief mate reported several containers damaged and lost overboard from bays 52 and 56, just aft of the accommodation.
At about 0045, the engine was successfully started and the bridge engine telegraph[8] set to ‘dead slow ahead’. Almost immediately however, the engine was stopped again following identification of a cracked outlet oil pipe on the control oil pump. The engineers immediately began repairs to the control oil pump. Meanwhile, the ship continued to drift in the gale force winds and seas. The master and mates reported that there was no significant rolling or pitching, and conditions on board were comfortable.
At about 0117, Newcastle vessel traffic information centre (VTIC) broadcast a safety call on very high frequency (VHF) radio channel 16.[9] The associated safety message was broadcast on VHF channel 09 and consisted of a gale warning for the Hunter coastal region and weather forecast information for 1 June. The message also advised all ships drifting off Newcastle to remain more than 10 miles away from the nearest coast. YM Efficiency’s VHF radios were monitoring both of these channels.
At about 0130, the master reported the incident to the company by satellite phone. At about 0200, repairs to the control oil pump were completed. The main engine was then returned to service but was not started. By this time, the ship had settled on a heading of about 290° with the prevailing wind and seas on its port beam. The master continued to attend to internal company incident reporting and other work as the ship drifted in a northerly direction at about 2.8 knots.
At about 0229, YM Efficiency’s second mate broadcast a message on VHF channel 16. The broadcast advised that containers had been lost overboard and provided the ship’s name and the position where the containers had been lost. Two minutes later, at about 0231, the second mate broadcast another message on VHF channel 16 addressed to all stations repeating the information in the previous broadcast. This broadcast was acknowledged by another ship in the vicinity. There was no response from Newcastle VTIC or any other coast radio station.
At about 0251, Newcastle VTIC called YM Efficiency on VHF channel 09 and advised that ships drifting off Newcastle were to stay more than 10 miles from the nearest coast. At that time, YM Efficiency was 9.8 miles off the coast. The second mate acknowledged the call and advised VTIC that the ship would start its engine and move. There was no reference to the loss of containers by either party during that radio exchange. At about 0252, the main engine was started and the ship resumed the passage.
Later that morning, during daylight, the ship’s crew carried out a detailed damage assessment and attempted to stabilise the damaged and collapsed containers on deck. The damage and container loss was limited to bays 52 and 56, aft of the accommodation (Figure 3). Other damage on deck included the accommodation ladder, superstructure and lashing bridges. The crew were able to confirm that no containers carrying dangerous goods had been damaged or lost overboard.
Figure 3: Damaged containers in bays 52 and 56
Source: ATSB
At about 1153, the master notified the agent in Sydney of the incident and submitted an Australian Maritime Safety Authority (AMSA) incident notification form. The agent forwarded this AMSA incident notification to the Port Authority of NSW vessel traffic service in Sydney, who in turn forwarded the notification to AMSA and Roads and Maritime Services, NSW (RMS). Subsequently, AMSA disseminated the notification and updates to others, including the ATSB. Other action initiated by AMSA included drift modelling of the lost containers and promulgating maritime safety information to alert shipping to the hazards posed by the lost and drifting containers.
At about 1440, DP World Australia[10] advised the ship’s operator (Yang Ming – see the section titled YM Efficiency) that, given the potential berthing issues and scheduling delays associated with the sustained damage, YM Efficiency would not be accepted at the Port Botany terminal as originally planned. The ship then continued to steam off the coast while waiting for decisions to be taken ashore regarding its berthing.
The adverse weather conditions persisted for several days as the ship continued steaming off the south coast of NSW. However, none of the damaged or displaced containers on deck were lost overboard.
On 4 June, DP World Australia agreed to berth YM Efficiency at the Port Botany terminal early on 6 June. At about 1030 on 5 June, AMSA issued a direction to the harbour master under the Protection of the Sea (Powers of Intervention) Act 1981, directing that a suitable berth be provided to YM Efficiency by 0800 on 6 June. An AMSA direction was also issued to the ship’s owners and master directing that they make appropriate arrangements to berth the ship.
At about 0715 on 6 June, harbour pilots boarded YM Efficiency about one mile east of the Port Botany pilot boarding ground. By about 0936, the ship was securely berthed.
Over the course of the following days, representatives of many stakeholders attended YM Efficiency, including ATSB investigators, AMSA surveyors, and surveyors from the ship’s flag State. The ship was detained by AMSA following a Port State control (PSC) inspection.
On 11 June, the first damaged container was discharged from the ship and by 21 June, all remaining damaged containers had been discharged. In total 81 containers were lost overboard from bays 52 and 56 and a further 62 containers on board had varying degrees of damage.
Following the completion of corrective actions required by the PSC inspection, AMSA released the ship from detention and YM Efficiency departed Sydney for Melbourne at about 2130 on 22 June.
Clean-up and response
In the days following the container loss, AMSA along with RMS, continued to work with the ship’s owners and insurers to detect, identify and track the lost containers and their contents on the NSW coast. In accordance with NSW[11] and Commonwealth[12] marine environmental emergency management arrangements, RMS was designated the Combat Agency[13] and assumed responsibility for responding to the incident in NSW waters. While RMS took overall charge of the response to the beached containers and debris within affected NSW waters and coastal areas, AMSA assumed responsibility for the detection of lost containers and other vessel related issues.
More than 1,000 cubic metres of incident-related debris was recovered and disposed of from affected beaches and inshore areas on the NSW coast (Figure 4). Debris from container contents was largely limited to areas of the coast in the vicinity of Port Stephens, with some debris found further north near Coffs Harbour.
Figure 4: Contents of lost containers washed ashore
Source: Roads and Maritime Services, NSW, modified by the ATSB
Detection and recovery efforts
On 22 June 2018, a hydrographic survey vessel engaged by YM Efficiency’s insurers began conducting a sub-sea search for the lost containers. The survey vessel identified a number of probable containers and associated debris on the sea floor. AMSA published the positions of the located containers and debris and issued updated notices to mariners warning of their location.
AMSA received at least three reports of trawlers hooking-up on containers or other material lost from YM Efficiency, which represented a risk to local fisheries and industry.
On 3 December, AMSA-contracted remotely operated underwater vehicles began an assessment of the lost containers. Several containers were identified and imaged at various locations off the NSW coast. The imagery allowed an assessment by salvage experts of the environmental risks and recovery prospects for the identified containers and debris. As of 6 May, a total area of about 578.3 square km had been searched with at least 54 of the lost containers identified. Four containers were found washed up ashore or in waters close offshore.
The container ship YMEfficiency was built in January 2009, one of five vessels built by the Taiwan Shipbuilding Corporation (formerly known as the China Shipbuilding Corporation). At the time of the accident, the ship was owned by All Oceans Transportation, Liberia. The ship was managed and operated by Yang Ming Marine Transport Corporation (Yang Ming), Taiwan and classed with the American Bureau of Shipping (ABS).
The ship’s propulsion was provided by a Sulzer 7RT-Flex96C engine driving a single, fixed-pitch propeller, giving it a service speed of about 24.8 knots. The ship’s manoeuvring speed (normally used when navigating in ports and harbours) ranged from about 6.5 knots at ‘dead slow ahead’ to about 17 knots at ‘full ahead’.
The bridge was equipped with the necessary navigational equipment required by SOLAS[14] for a ship of its size. The equipment included a Japan Radio Corporation JCY 1800 voyage data recorder (VDR).[15]
The ship was on a regular service between ports in China, Taiwan and Australia. The service’s southbound schedule included port calls at Ningbo, Shanghai and Shekou in China, followed by Kaohsiung, Taiwan before calling at Sydney, Melbourne and Brisbane, in that order.
YM Efficiency had a crew of 23 Chinese and Taiwanese nationals. The ship’s master was a Taiwanese national with about 18 years of seagoing experience. He held a Taiwanese and a Liberian master’s certificate of competency. This was his fifth ship as master and his first time on YM Efficiency, which he had joined about 6 months before the accident.
The chief mate was a Chinese national with about 25 years of seagoing experience. He held a Chinese chief mate’s certificate of competency and a Liberian endorsement for his certificate of competency. He had about 8 years’ experience as chief mate, all of it with Yang Ming on container ships. The chief mate had joined the ship about 6 months before the accident.
The second mate, the officer of the watch (OOW) at the time of the container loss, was also a Chinese national. He held a Chinese certificate of competency for a watch keeping officer and a Liberian endorsement for his certificate of competency. He had about 8 years’ seagoing experience, most of it with Yang Ming.
The master and chief mate had also been on board YM Efficiency in January 2018, when about 15 containers and ship’s structures sustained substantial damage in adverse weather off the Queensland coast en route to Sydney.
Safety management system
YM Efficiency held a valid safety management certificate[16] issued by DNV GL (Det Norske Veritas – Germanischer Lloyd), on behalf of the ship’s flag State, Liberia, and operated under a documented safety management system (SMS). The SMS consisted of several manuals covering key aspects of the ship’s operations such as navigation safety, deck operations, shipboard management, environment protection, emergency management and engineering.
The deck manual and the shipboard management manual contained operating procedures and checklists related to container cargo operations. The SMS placed the responsibility for cargo operations on the chief mate, assisted by the master. In particular, the SMS required the completion of a container stowage checklist for every port call, which included various checks pertaining to the safe carriage of containers on board, and ship stability.
YM Efficiency’s stability condition upon departure from Kaohsiung satisfied the International Maritime Organization’s (IMO) intact stability criteria. Yang Ming procedures required ships of YM Efficiency’s size to have a metacentric height (GM)[17] of at least 0.70 m. The ship’s fluid metacentric height or GM (fluid)[18] on departure Kaohsiung, and at the time of the accident, was 1.09 m.
The navigation safety manual and the shipboard management manual included the general principles and requirements for navigation. They also included procedures and checklists concerning passage planning, weather routing and navigation in heavy weather.
The relevant SMS procedure encouraged the master to make prudent use of the weather routing service. However, the procedure stated that this did not exempt the master from the responsibility of ensuring navigational safety and from collecting and analysing weather information independently. The master was also required to observe current and forecast weather and alter course and speed, if necessary, to avoid adverse weather, which could cause harm to the ship or crew. The procedure clarified that navigational decisions when adverse weather was encountered were at the master’s discretion.
The SMS also contained a checklist (Appendix A) for use when the ship was expected to navigate in heavy weather or tropical cyclones. Procedures required the checklist to be completed prior to the ship encountering heavy weather or tropical storms to ensure precautions against foreseeable hazards of the weather were taken.
Weather
Weather routing advice
YM Efficiency’s passage plan from Kaohsiung to Port Botany was planned and executed based on weather and routing advice provided by Weather News Incorporated (WNI), a commercial weather routing service.
WNI used company-specific weather safety thresholds when providing routing advice to Yang Ming ships. The WNI procedure indicated that the advice would aim to maintain the shortest distance between two ports except when certain weather conditions were encountered. The procedure required WNI to consider speed adjustments when wave heights were expected to exceed 4 m and route diversions when wave heights exceeded 6 m. When wave heights were expected to exceed 8 m, the procedure required routing advice to consider seeking shelter or drifting to avoid encountering adverse weather.
Based on the original required arrival time off the Port Botany container terminal at Sydney of 0200 on 31 May, WNI routing advice positioned YM Efficiency to track west of the forecast adverse weather and enter port before the weather worsened. On 29 May, the master informed WNI of a revised required arrival time of 1200 on 1 June with a resulting 34-hour delay in the schedule.
On 30 May, WNI acknowledged the delay in the schedule and assessed that, based on the new schedule and current forecast, the ship would not enter port before adverse weather developed. The WNI forecast predicted south-south-westerly winds increasing from force 5 (between 17 and 21 knots) to force 6 (between 22 and 27 knots) and force 7 (between 28 and 33 knots) as the ship proceeded further south. The forecast predicted significant wave heights of up to 4 m and advised the master to expect 4‑5 m seas and swell. The routing advice to the master was to adjust the ship’s course and speed for safety, based on actual weather conditions. The forecast and routing advice was supplemented by a phone call from WNI to confirm the master had received the warning of impending adverse weather. The master acknowledged the warning and advised that he intended to drift in a position closer to Sydney to adjust the ship’s time of arrival to align with the delayed berthing schedule.
After the accident, WNI conducted a review into the significant decisions and actions taken leading up to the master’s decision to drift. The review report stated that the master’s intention to drift was acknowledged by WNI based on the following reasoning:
the vessel was already close offshore on the east Australian coast
adverse weather was expected along the east Australian coast and an immediate stoppage might not have provided better conditions than drifting closer to Sydney
there were no possible routing options that would keep the vessel clear of the developing conditions while also maintaining the required arrival time at Sydney
the master was aware of WNI’s forecast of adverse weather when he made his decision to drift
the expected significant wave height in the forecast did not exceed the safety threshold for this type of ship.
Weather encountered
The ATSB obtained and analysed weather forecast and observation data from several sources. These included VDR data, bridge logbooks and interviews with YM Efficiency’s crew, bridge logbooks from other ships in the vicinity[19] and available forecast data. The ship’s weather forecast information came primarily from WNI and the Australian Bureau of Meteorology (BoM).[20]
31 May
The prevailing weather on the afternoon of 31 May, when the ship was drifting, as recorded in YM Efficiency’s bridge logbook, was west-south-westerly winds at force 8 (between 34 and 40 knots), 6 m seas and a 5 m swell. These conditions were reasonably consistent with the BoM coastal waters forecast, broadcast at 1018, 1605, 1902 and 2200 that day. The forecast warned of a complex low-pressure system moving east over the Tasman Sea; it predicted south-westerly winds between 30 and 40 knots, 4 m seas and a southerly 3 m swell. As the evening progressed, the weather deteriorated with the wind recorded as increasing to force 9 (between 41 and 47 knots) at about 2200.
Table 1 summarises the weather forecast information for 2200 on 31 May that was available to the master.
Table 1: Weather forecast information
Source
Wind direction
Wind speed
Seas
Swell
BoM forecast
SW
30‑40 knots
4 m
4 m (S)
WNI forecast
SSW
28‑33 knots
2 m
2 m (SSE)
At 2200, the master noted a south-westerly to south-south-westerly wind and a southerly swell in his night orders, which was consistent with the forecast. At about 2330, after resuming the passage, the master turned the ship to a heading of 211°, consistent with his instructions to the OOW in the night orders to keep the wind and swell on the ship’s bow.
1 June
Table 2 summarises the observed weather data at about midnight on 31 May (0001 on 1 June), as extracted from the bridge log books on board YM Efficiency and two other ships off Newcastle at that time (Attikos and Anangel Destiny).
Table 2: Recorded weather observations
Source
Wind direction
Wind speed
Seas
Swell
YM Efficiency
WSW
41‑47 knots
6 m
5 m (S)
Attikos
SW
41‑47 knots
7 m
4 m (SW)
Anangel Destiny
SSW
48‑55 knots
6 m
5 m (S)
Wave data
Recorded wave data was obtained from the Port Authority of NSW and Manly Hydraulics Laboratory (MHL)[21]. The Port Authority’s wave rider buoys were located off Newcastle, about 16 miles west-north-west of the position where the containers were lost. The MHL buoys were located at Crowdy Head, about 84 miles north-east of that position, and at Sydney, about 65 miles south-west of the position.
The Port Authority’s buoys and MHL buoys collected significant wave height (Hsig),[22] maximum wave height (Hmax),[23] and wave direction[24] at 10-minute and 1-hour intervals, respectively. In addition, the buoys recorded wave periods associated with, the peak of the wave energy spectrum (Tp) and the average of zero up-crossing wave periods (Tz).
Table 3 details the recorded wave data at about midnight on 31 May (0001 on 1 June) for the MHL buoys and at about 0030 on 1 June for the Newcastle buoys.
Table 3: Recorded wave data on 1 June 2018
Source
Time
Hsig
Hmax
Wave direction
Tp
MHL Crowdy Head
0001
4.8 m
7.3 m
181°
12.14 s
MHL Sydney
0001
4.2 m
8.5 m
187°
10.83 s
Newcastle outer buoy
0030
4.6 m
7.4 m
157°
12.12 s
0040
4.7 m
7.4 m
151°
12.96 s
Newcastle inner buoy
0030
4.7 m
7.6 m
166°
12.36 s
0040
4.8 m
7.6 m
168°
12.35 s
Heavy weather checks
The heavy weather checklist was completed on the morning of 30 May, and then again on 31 May. Some of the relevant items included in the checklist are summarised below.
Have the protection boxes of plug sockets for reefer containers been firmly closed and put under protection?
Have container lashings on deck been secured?
Has course and speed been adjusted as necessary?
Are weather reports being received and monitored?
Are meteorological elements being observed and entered into the ship’s log?
The container loss
On the afternoon of 31 May, YM Efficiency was to the east of Newcastle, about 84 miles from Sydney. Prompted by the agent’s advice of a further delay to the schedule, the master assessed the situation and decided to stop and drift off Newcastle. He determined that the weather further south was worse than at the ship’s location, and that its stability condition (adjusted for arrival at Sydney) was acceptable for drifting.
Navigation in adverse weather
YM Efficiency began drifting off Newcastle at about 1400 on 1 June. The ship drifted until about 2330 that day, excluding brief periods when the main engine was used. Forecast and observed weather data for this period shows that the winds and seas were predominantly from the south-west with the swell from a direction between south-south-east and south. The weather steadily deteriorated into the evening with winds increasing to force 9 (between 41 and 47 knots) with 6 m seas and a 5 m swell being recorded at 2200.
The evidence shows that, except for the periods when the main engine was operating, the ship predominantly remained on a west-north-westerly heading. This is consistent with the expected behaviour of a container ship in that condition settling beam-on to prevailing winds and seas when drifting. While the ship lay with the weather on the beam, the master and mates recalled that there was no significant rolling or pitching.
Drifting beam-on in heavy seas leaves a ship vulnerable to the risk of synchronous rolling (see the section titled Cause of the rolling). That condition can impose stresses on the ship’s structure and cargo such as containers and securing devices, thereby increasing the risk of cargo shifting. Cargo shift can result in damage and in the ship assuming a potentially dangerous stability condition. Cumulative stresses exerted on containers and lashings due to heavy rolling can ultimately result in the failure of the container structure and lashing equipment.
Sudden heavy rolling
At about 2330 on 31 May, YM Efficiency’s passage to Sydney was resumed with the ship making comfortable progress, at slow speed, with little rolling or pitching. Shortly after 0034 on 1 June, the ship rolled heavily, with containers being damaged and lost overboard, followed by the main engine shutdown. Interviews with the ship’s officers indicated that the rolling was sudden.
The second mate reported that the ship rolled about four times, that is two times to either side, and that the rolling was quick. He estimated that the rolling reached angles of up to 30° to either side. The second mate also indicated that it was likely that the ship rolled to port first but that the subsequent roll to starboard was larger. The master stated that the ship was struck by a wave, that it rolled heavily three times to angles of up to 30° and that the rolling lasted about a minute. The main engine alarms and subsequent shutdown also occurred during this period of rolling.
Analysis of VDR data, including audio data, indicated the following sequence of events (Table 4).
Table 4: Sequence of events
Time on 1June2018
Event
0034:28
Estimated start of rolling
0034:50
Engineering alarms began to sound
0035:00
Rolling intensified
0035:12
Estimated start of container loss overboard
0035:28
Steering changed from autopilot to manual
0035:38
Main engine shutdown and RPM reduces to zero
0036:00
Estimated end of container loss overboard
0036:45
Rolling subsided
Source: ATSB analysis of YM Efficiency’s VDR data
The master and second mate reported that the rolling subsided shortly after the container loss. Weather conditions after the accident remained rough and the ship settled on a north-westerly heading, drifting beam‑on to the prevailing weather but with no significant rolling or pitching reported.
Main engine shutdown
Engine room alarms sounded on YM Efficiency’s bridge soon after the rolling commenced. Alarm log data shows that the first alarms were cascade tank and expansion tank low-level alarms. Almost immediately afterwards, the main engine slowdown and shutdown pre-warning alarms sounded, followed by the main engine shut down and RPM gradually reducing to zero. The shutdown was accompanied by main bearing and piston lubricating oil low pressure alarms.
In the course of re-starting the main engine, both main engine control oil pumps were unserviceable for different reasons. As a result, the ship was left without propulsion until one of the pumps could be returned to service. Repairs continued until 0200 when the main engine was made available for use again. However, although the engine was available, the master decided to continue drifting.
At about 0252, Newcastle vessel traffic information centre (VTIC) called YM Efficiency with a reminder that ships were to stay greater than 10 miles from the coast when drifting, and that the ship was now 9.8 miles from the coast. Immediately after, the engine was started and the ship’s passage was resumed.
Potential causes for the rolling
YM Efficiency’s dynamic roll or pitch acceleration data was not recorded on board nor was there any requirement to record such data. As such, estimates of the ship’s rolling and movement were based on other evidence. The ship’s bridge was equipped with an analogue inclinometer,[25] which displayed the angle of the ship from the vertical, and registered the maximum angles reached to either side (Figure 5). Examination of the inclinometer after the ship berthed in Sydney indicated that the ship rolled to a maximum of about 29° to starboard and about 28° to port, which was consistent with the officers’ accounts of the accident. However, it was impossible to confirm if these roll angles were reached on the night of the accident.
Figure 5: Inclinometer
Note semi-fixed indicators show the maximum roll encountered. Source: ATSB
The roll response of a ship in seas is determined primarily by wave-induced rolling moments,[26] the natural roll period of the ship[27] and the wave period.[28]
The roll period is largely dependent on the ship’s GM. A ship with a relatively large GM will require larger moments to incline and, when inclined, will return to the upright more quickly. Consequently, the roll period is relatively short and the ship may roll quickly and violently. A ship in such a condition is referred to as ‘stiff’. A ship with a relatively small GM will be much easier to incline and the roll period may be comparatively long. A ship in such a condition is ‘tender’.
At the time of the container loss, the ship’s stability condition had been adjusted in preparation for arrival at Sydney. The ship had been appropriately ballasted to bring it into alignment with the planned arrival stability condition, with draughts of 10.3 m forward and 12.6 m aft, and a planned arrival GM of 1.09 m. The ship’s planned arrival condition also complied with the IMO intact stability criteria.
The ship’s roll period (calculated by the loading computer system) was 20.1 s, which was consistent with the ATSB’s calculated value of about 20 s. This is generally considered an acceptable roll period resulting in a roll behaviour that is associated with neither a stiff nor a tender condition.
Extreme roll behaviour can also result from resonance, which is the phenomenon of a ship building up extreme rolling amplitudes by the addition of roll excitation loads. This can result in ‘normal’ synchronous rolling and ‘non-linear’ parametric rolling. Consistent with the master’s recollection, the ATSB also considered the possibility that the rolling was due to an abnormal or ‘rogue’ wave.
Abnormal waves
The master stated his belief that, immediately before the accident, a large, ‘freak wave’, struck YM Efficiency and initiated the heavy rolling.
Abnormal waves, sometimes referred to as ‘rogue waves’, are very large waves that can occur at sea. Abnormal waves may occur anywhere in the world where appropriate conditions arise. A well-documented example was the 26 m wave that struck the Draupner oil platform off the coast of Norway in January 1995.
Where seas and/or swell are reinforced by waves of another wave system or where seas are influenced by a combination of two or more weather systems acting together, abnormal waves may be expected. Certain circumstances such as refractive focussing due to bathymetry or currents (where waves become distorted by meeting shoal water or a strong opposing tidal stream or current) can contribute to larger waves occurring.[29] For example, under certain conditions off the coast of South Africa, sea and swell waves moving against the Agulhas Current are known to generate abnormal waves up to 25 m high.
Research indicates that waves encountering opposing currents can become significantly amplified and steeper, potentially breaking violently.[30] This allows for the possibility that seas and swell associated with southerly winds, acting in opposition to the East Australian Current, may contribute to a steepening of waves and the occurrence of significantly larger waves.
The BoM describes ‘rogue waves’ as waves greater than twice the total wave height. Statistical distribution estimates that about one in every 2,000 or 3,000 waves will be approximately twice the total wave height. For the most part, recorded maximum wave heights obtained from buoys off Newcastle and from MHL buoys did not exceed heights greater than twice the recorded significant wave heights. However, it should be noted that the recorded wave data was only sampled at 10 minute and 1 hour intervals so the resolution of the data was insufficient to categorically rule out a larger wave event. The ATSB reviewed weather conditions recorded in the logbooks of ships in the vicinity at the time of the container loss, but found no evidence of an unusual wave event.
Therefore, while the possibility that YM Efficiency encountered abnormal waves cannot be ruled out, there is insufficient evidence to conclude that this was the case.
Synchronous rolling
Synchronous rolling occurs when the ship’s roll period coincides with the encounter wave period.[31] This can result in the excitation of large roll motions as each roll is boosted by the waves and a condition of synchronous rolling is setup. Ships are more prone to such rolling when the seas are abeam. At the time of the heavy rolling, YM Efficiency was making way under power on a heading of about 210°. Analysis of the recorded wave data indicated peak wave directions as being from south-south-east and south respectively. This meant that the ship was manoeuvring with the seas largely on the port bow (not in beam seas) reducing the likelihood of synchronous rolling.
Additionally, the wave encounter period at the time of the accident, calculated based on the ship’s heading and speed and on recorded wave data, was 11–12 s compared to the ship’s calculated roll period of about 20 s. Therefore, it is highly unlikely that synchronous rolling was the cause of the heavy rolling.
Parametric rolling
Parametric rolling is a phenomenon, which can quickly generate large roll angles coupled with significant pitching motions. Parametric rolling can be defined as the spontaneous rolling motion of the ship that occurs as a result of dynamic instability associated with variation of the ship’s stability due to the changing immersed shape of the ship’s hull when wave crests pass it.
Various theoretical studies, observations, model tests and analysis of similar incidents and accidents indicate that parametric rolling can potentially occur when the following conditions are satisfied:
the ship is navigating in head seas or following seas
the natural period of roll is equal to approximately twice the wave encounter period
the wave length[32] is of the order of the ship’s length (that is, between 0.8 and two times the ship’s length between perpendiculars)
roll damping is low (for example, due to low ship’s speed).
Based on the weather conditions at the time of the accident and YM Efficiency’s heading, it is almost certain that the ship was in head seas at a speed of about 3 knots. Calculations using recorded wave data and, the ship’s heading and speed data, provided a probable calculated wave length of between 229 m and 262 m (the ship’s length between perpendiculars was 256.5 m). The probable wave encounter period was calculated to be 11–12 s. When compared to the ship’s calculated roll period of about 20 s, the wave encounter period does not appear to satisfy the related condition required for parametric rolling. While calculations show that some criteria required for parametric rolling may have been satisfied, there was insufficient evidence to conclude that parametric rolling was a contributing factor.
WNI roll-risk prediction program
WNI provided a ship’s master and officers with a program[33] to estimate the risk of heavy rolling for a calculated ship’s position based on forecast weather and user-entered details of the ship’s dimensions, stability, heading and speed. Although available on board YM Efficiency, there was no evidence that this program was used in the time leading up to the accident.
After the accident, WNI analysed the risk of heavy rolling based on the ship’s positions and forecast data for 0100 on 1 June. The program’s calculations indicated that there was no risk of heavy rolling due to parametric or synchronous rolling at that time.
Summary
Stability parameters that influenced the roll behaviour of YM Efficiency, such as its GM and roll period were acceptable and did not indicate that the ship was in a ‘stiff’ or ‘tender’ condition. While the possibility of an abnormal wave cannot be ruled out, there was insufficient evidence to conclude that such a phenomenon contributed to the heavy rolling.
At the time of the accident, the ship was oriented with its bow into the prevailing weather and was not in what would be considered ‘beam seas’. The ship’s calculated roll period was also not within the range that would be expected for synchronous rolling to occur. While there were certain conditions that were conducive to parametric rolling, the existence of other associated conditions could not be established. Further, the WNI roll-risk prediction program analysis indicated no risk of heavy rolling due to synchronous or parametric rolling. Therefore, a definitive cause for the heavy rolling could not be determined.
Carriage of containers
YM Efficiency was designed exclusively for the carriage of containers as cargo. Containers were carried in spaces called ‘bays’, both on deck and under deck in cargo holds. The ship’s bays were numbered from bay 01 forward to bay 60 aft, with bay numbers 52 to 60 located aft of the accommodation (see Appendix B for more detail). The SOLAS regulations required that cargo, including containers be loaded, stowed and secured on board the ship so as to prevent, as far as is practicable, damage or hazard to the ship and its crew and the loss of cargo overboard.
Container units
Containers are standardised cargo units usually manufactured to a standard specified by the International Standards Organisation. They are usually either 20 or 40 feet in length although other sizes are also used. Their width is standard at 8 feet while their height varies. Most containers normally have a height of 8 feet and 6 inches. A ‘high cube’ container is a standard container that is 9 feet and 6 inches high.
In general, a container’s structure is composed of a framework with corrugated steel walls and four corner posts. The corner posts support the container’s weight and that of containers loaded above it. The corner posts are provided with corner castings at their upper and lower ends, which are also used to attach container securing fittings (twistlocks and lashing bars).
The position of a container on board a ship is defined by means of a six-digit number. The first two numbers indicated the bay in which the container is located, the next two indicated the row and the last two numbers indicate the tier (see Appendix B for more detail).
Forces on containers
Containers are stowed and secured with suitable securing arrangements so as to withstand the forces imposed on them while being transported by sea. The motions of a ship in a seaway (Figure 6) give rise to accelerations and consequently, forces. The magnitude of these accelerations, and resultant forces, will depend upon the dimensions of the ship, its GM and the wind and sea conditions being experienced.
Figure 6: Motions of a ship in a seaway
Source: MacGregor Container Securing Systems product catalogue, modified by the ATSB
When considering the forces acting on the container frames and the securing system, the following static and dynamic forces need to be taken into account:
static gravity forces
dynamic, inertial forces generated by accelerations due to roll, pitch and heave motions of the ship
wind forces
forces imposed by the securing arrangements
wave impact forces from seas.
Each force can be resolved into components acting both parallel to and perpendicular to the stack of containers (Figure 7). The resultant force acting on the container is the vector summation of the individual directional components of all forces acting at a given instant. The securing system was to be designed based on the most severe combination of static and dynamic forces as specified by classification societies, such that resultant forces on containers and securing devices remained within allowable limits.
Figure 7: Forces on a container in a seaway
Source: MacGregor Container Securing Systems product catalogue, modified by the ATSB
The resultant forces acting on an individual container and its securing system can be broadly classified into the following:
racking force
lifting force
corner post load.
Racking force (Figure 8, left) is a transverse or longitudinal force applied to the container parallel to the deck. When the ship is rolling heavily, the weight of containers in upper tiers can set up racking forces in the frame of the lowest containers. The larger the vessel’s roll, the greater the resultant racking force. Pitching sets up racking forces acting longitudinally, which are generally less than the transverse equivalent set up by rolling.
Lifting force (Figure 8, centre) is a vertical tension force or separation force. It usually occurs when the ship is rolling and results in a tipping movement of the container stack. If the lifting force is excessive, it can break or pull securing devices out of corner castings or separate corner castings from the containers themselves.
Corner post load (Figure 8, right) is a vertical compression force applied to the four container corner posts. Dynamic loadings resulting from the ship rolling can increase compression forces resulting in a failure of the container’s corner posts.
Other forces on a container include lashing forces resulting from the application of securing gear and pressure loads at the bottom of the container.
Figure 8: Resultant forces acting on containers
Source: UK P&I Club, modified and annotated by the ATSB.
Accelerations and forces acting on a stack of containers are calculated based on assumed maximum values of ship motion such as roll, pitch and heave. Forces on containers within a stack are affected by all these motions to some extent but generally, the angle of roll is the most critical. Water resistance to pitching is greater than rolling meaning ships generally roll to greater angles than they pitch. Rolling gives rise to transverse accelerations that impose racking stresses, compression forces and generates a tipping moment on the container stack.
The calculations of forces acting on containers and securings are based on a theoretical maximum angle of roll (defined by the classification society) that the ship is not expected to exceed but in practice sometimes can (as in this case). Further, calculations are based on the assumption that all containers are in good condition.
In YM Efficiency’s case, a roll angle of 25.1° was assumed as the maximum single amplitude of roll to determine the most severe combination of forces expected at sea. Therefore, the ship’s stowage and securing system was designed to withstand the expected forces, including those associated with this maximum roll, in combination with other forces. The ship’s stowage and securing system was also designed based on a maximum operational GM value of 1.61 m.
A ship’s cargo stowage arrangement and securing system is designed to ensure that the forces generated at sea remain within certain defined, allowable limits and that the container stow remain intact. Details of these maximum allowable limits of forces, stowage arrangements and container securing systems including lashing patterns and details of lashing gear are provided to the ship in its cargo securing manual (CSM).
YM Efficiency’s container stowage and securing arrangement was designed so that forces remained within the CSM‑specified maximum allowable limits (for 40-foot containers) shown in Table 5.[34]
Table 5: Allowable limits of forces acting on containers and securing systems
Racking force
150 kN
Lifting force
250 kN
Corner post load
848 kN
Source: YM Efficiency’s Cargo Securing Manual
Container stowage and securing
In accordance with SOLAS regulations, all cargoes, other than solid and liquid bulk cargoes, need to be loaded, stowed and secured in accordance with a CSM approved by the ship’s administration. This requirement also applies to containers carried by ships.
YM Efficiency’s CSM
YM Efficiency’s CSM was compiled by All Set Marine Lashing,[35] the manufacturer of the ship’s cargo securing gear and approved by the ship’s classification society, ABS, on behalf of the flag State. The cargo stowage and securing arrangements in the manual were calculated based on Lloyd’s Register[36] rules for the classification of ships and verified against those rules by ABS. Significantly though, class approval of the CSM examined only the manual’s compliance with the format and content required by the Code of Safe Practice for Cargo Stowage and Securing (CSS Code).[37] The approval did not include the acceptability of particular cargo stowage and securing arrangements.
General guidance on stowage and securing
The CSM required the master to ensure that containers on board YM Efficiency were at all times stowed and secured in a safe and efficient manner, based on prevailing conditions and the principles of safe stowage. The manual provided general information on cargo stowage, securing and evaluation of forces acting on containers, including that:
forces are generally composed of components acting relative to the longitudinal, transverse and vertical axes of the ship
forces are to be absorbed by suitable arrangements for stowage and securing to prevent cargo shifting
the most severe forces can be expected in the furthest forward, the furthest aft and highest stowage position on each side of the ship
the transverse forces exerted increase directly with the GM of the ship
cargo should be distributed such that the ship’s GM, wherever practical, remains within an acceptable upper limit to minimize the forces acting on the cargo
in addition to the forces referred to above, cargo carried on deck may be subject to forces arising from the effects of wind and seas
improper ship handling (course or speed) may create adverse forces acting on the ship and cargo
the magnitude of these forces may be estimated by using the appropriate calculation methods described in the manual
the maximum quantity of tiers stated in this manual should not be exceeded because the loading of the securing system would be increased.
In addition to general guidance on cargo securing and documenting rules upon which the stowage and securing system was designed, the manual provided information on the ship’s specific container stowage and securing arrangements.
Container securing system
YM Efficiency’s securing system was designed so that, when complied with in conjunction with the required stowage arrangement, resultant forces on the container securing devices would not exceed the allowable working loads of the equipment. The CSM described the ship’s container securing arrangement (lashing arrangement) and container securing equipment (lashing equipment) including the minimum acceptable safe working load (SWL)[38] and minimum breaking load (MBL)[39] for each item of lashing equipment. The manual also included details of the actual equipment in use on board the ship, including their SWL and MBL.
The ship’s lashing arrangement required the lashing of containers in specific patterns, depending on the container’s size and location. The CSM specified a standard container securing arrangement or an alternative container securing arrangement.[40] On board YM Efficiency, the alternative container securing arrangement was in use. The equipment used to secure containers on deck included twistlocks, lashing bars and turnbuckles.
Twistlocks were used to secure containers stowed on deck to the hatch cover or deck and to secure containers to one another vertically in a stack. On board YM Efficiency, two variants of semi-automatic twistlocks were used, depending on whether they were being used on the deck/hatch cover or between containers (Figure 9). The SWL and MBL of these twistlocks was 250 kN and 500 kN, respectively (a safety factor of two).
Figure 9: Twistlock types used in different locations in container stacks
Source: YM Efficiency’s CSM and MacGregor, modified and annotated by the ATSB
Lashing bars were used to secure containers and tension lashings in combination with turnbuckles. Turnbuckles were anchored to lashing eyes on the ship’s deck, hatch coaming or lashing bridge, depending on the location on board. Lashing bars (Figure 10) came in three variants: short, long and vertical.[41] Lashing bars and turnbuckles had a SWL of 250 kN and a MBL of 500 kN (a safety factor of two).
Figure 10: Lashing bar and turnbuckle arrangements
Source: YM Efficiency’s Cargo Securing Manual, modified and annotated by the ATSB
Condition of securing equipment
The ATSB onsite investigation examined the lashing equipment in use on the ship. They were found to be in generally good condition and appeared to be well maintained, with little corrosion or wear evident.
The examination also found a number of broken twistlocks and parts of twistlocks scattered in the vicinity of bays 52 and 56, and attached to damaged containers. Some of these containers from toppled stacks lay on their sides, but remained securely fastened to each other with twistlocks despite being in precarious positions and enduring rough weather over several days following the accident (Figure 11). Many bent or deformed lashing bars and turnbuckles attached to damaged containers or loose on deck were also found.
The ATSB also obtained records relating to the shipboard inspection and maintenance of the lashing equipment. These records showed that the lashing equipment was inspected regularly, with the last inspection performed in March 2018, about 2 months before the accident. Sub-standard lashing equipment was removed from use and repaired or discarded. The ship held ample stocks of new lashing equipment for use as spares.
Based on the examination of the ship’s lashing equipment, inspection of maintenance records and the fact that many containers remained securely restrained in the rough weather following the accident, the condition of the lashing gear was considered to have been satisfactory. As such, the condition of the lashing equipment was not considered to have contributed to the loss of containers.
Figure 11: Dislodged containers six days after the accident
Source: ATSB
Cargo operations in Kaohsiung
YM Efficiency’s cargo operations in Kaohsiung involved the discharge of two containers and the loading of 881 containers in several bays, including bay numbers 52 and 56. Loading operations involved the loading of containers of various types including standard 20-foot and 40-foot containers, 40-foot ‘high cube’ containers, refrigerated containers and containers carrying dangerous goods.
Bay 52 stowage arrangement
Bay 52 was located immediately aft of the ship’s accommodation. The bay had no under-deck cargo loading space and containers were loaded directly onto the main deck. The bay comprised 13 rows and was empty on arrival at Kaohsiung.
The middle three rows (rows 00, 01 and 02 of bays 51 and 53) were loaded with empty, 20-foot refrigerated containers to a height of eight tiers. The remaining 10 rows were used to load seventy-six 40-foot ‘high cube’ containers to a height of eight tiers with the exception of the outboard row on either side where only six tiers were loaded (see Appendix C for more detail). The outboard rows did not begin at deck level but were set on support pedestals beginning at a height equivalent to the second tier.
Of the seventy-six 40-foot ‘high cube’ containers in bay 52, more than three-quarters were lost overboard (29 from the port side and 31 from the starboard side). The remaining 40-foot ‘high cube’ containers all sustained varying degrees of damage (Figure 12). None of the 20-foot containers were lost overboard although one was damaged.
Figure 12: Bay 52 plan showing lost and damaged containers
Source: ATSB
Bay 56 stowage arrangement
Bay 56 was located immediately aft of bay 52. The bay had a cargo hold under deck and therefore, containers in this bay were loaded on top of the hatch covers. The bay comprised 13 rows and was partially loaded on arrival at Kaohsiung. The cargo already on board comprised thirty-one 40-foot ‘high cube’ containers and four 40-foot standard containers loaded in Shanghai in the middle seven rows to a height of five tiers. The under-deck space was also fully loaded on arrival at Kaohsiung.
Cargo operations in Kaohsiung involved loading three additional tiers of 40-foot ‘high cube’ containers in the middle seven rows. In addition, two tiers of 20-foot containers were loaded in the outer three rows on either side of bays 55 and 57 (see Appendix D for more detail).
Of the fifty-six 40-foot containers in bay 56, over a third (21 containers) were lost overboard. Almost all the remaining 40-foot containers sustained some degree of damage (Figure 13). None of the 20-foot containers was lost overboard although seven were damaged.
Figure 13: Bay 56 plan showing lost and damaged containers
Source: Yang Ming, modified and annotated by the ATSB
Cargo securing
The lashing of containers in Kaohsiung was performed by stevedores supervised by the ship’s crew. The chief mate confirmed that the container lashings were inspected by the crew prior to departure from Kaohsiung, and found to be satisfactory. This check was also noted in the container stowage checklist completed for Kaohsiung. The chief mate also reported that lashings were checked and tensioned as required, during actioning of the heavy weather checklist prior to the accident.
The loss and damage to numerous containers and their lashings in bays 52 and 56 made it impossible to verify the original lashing arrangement in those bays. However, the lashing arrangement in other bays were generally consistent with the CSM. Additional lashings found in some bays in excess of those required by the CSM were probably applied post-accident to prevent further loss.
Container weights
In accordance with SOLAS regulations, a verified gross mass[42] needs to be declared for all packaged containers loaded on board a ship. This regulation was adopted to increase maritime safety and reduce the dangers to cargo, containers, ships and persons resulting from the incorrect declaration of container weights.
The ATSB’s analysis of container weights in the affected bays found that, for the most part, the measured containers weights were consistent with the declared weights in the manifest with a few minor exceptions.
Container mass-distribution arrangements
The CSM contained information covering the stowage of containers on deck and in cargo holds. A general arrangement bay plan laid out how containers of different standard sizes could be loaded. In addition, mass‑distribution arrangements provided an overview for each bay of maximum stack weights and the permitted vertical distribution of weights in stacks.
The mass-distribution arrangement represented an example stowage arrangement that demonstrated the ship’s cargo-carrying capacity with calculated forces on containers and lashings at their maximum. Loading in conformance with the applicable mass-distribution arrangement was one way of complying with the allowable force limitation requirements of the CSM. Stowage arrangements that did not strictly conform to the mass‑distribution arrangements in the CSM could be acceptable provided it could be established that calculated forces did not exceed allowable limits.
Mass-distribution arrangements were provided for two values of GM (1.00 m and 1.61 m). For each GM value, depending on the size of the containers loaded, the manual provided a maximum stack weight for each stack of containers and a vertical weight distribution showing maximum container weights for each individual container slot in the stack (Figure 14).
Figure 14: Bay 52 and 56 mass-distribution arrangements for 1.61 m GM
Source: YM Efficiency’s Cargo Securing Manual, modified and annotated by the ATSB
Maximum container weights and stack weights were specified in the mass-distribution arrangement taking into consideration the effect the weights and their distribution would have on the calculated forces acting on the system. Conformance with the mass-distribution arrangements was based on the underlying principle that container weights should not exceed the maximum weight provided for each individual container slot and that stack weights should not exceed the maximum stack weight.
The mass-distribution arrangements specified in the CSM were vertically stratified (that is, individual container weights progressively reduced with stack height). This accorded with the widely recognised principle of avoiding the loading of heavy containers over light ones, which was reflected in the manual as follows:
It is a general principle that no heavy containers shall be stowed on top of light containers. In practice, this principle can to some extend [sic] be deviated from, when stack weights are not fully utilised.
There was no clarification in the manual about the extent to which the principle concerning avoiding ‘heavy over light’ loading could be deviated from. As with the mass-distribution arrangement, alternate stowage arrangements that deviated from the ‘no heavy over light’ rule could still be acceptable provided calculated forces were assessed to be within allowable limits. In practice however, it was unlikely that a stowage arrangement that significantly deviated from the ‘no heavy over light’ principle or from the manual’s mass‑distribution arrangement would still comply with the calculated force limitations of the manual.
Conformance with mass-distribution arrangements
As discussed, the ship’s GM is a key factor influencing the forces acting on containers and their securing system while the ship is at sea.
Since there was no mass-distribution arrangement in the CSM specific to YM Efficiency’s GM of 1.09 m on departure from Kaohsiung, the arrangement for the next higher GM (1.61 m) was applicable. The stowage arrangement in bays 52 and 56 were compared to this mass-distribution arrangement for 40-foot ‘high cube’ containers. This comparison revealed a number of significant deviations from the CSM.
Deviations from the applicable mass-distribution arrangement as observed in the bay 52 stowage arrangement included (Figure 15):
loading of 40-foot ‘high cube’ containers exceeded the 7-tier limit specified (loaded to a height of 8 tiers)
all stacks of 40-foot ‘high cube’ containers exceeded the maximum stack weights specified
many container weights exceeded the weights specified for individual slots
many instances of heavy containers above lighter ones, contrary to principles of vertical distribution.
Figure 15: Bay 52 stowage comparison
Figure shows the mass-distribution arrangement for bay 52 for 40-foot ‘high cube’ containers and a 1.61 m GM (left) compared to the ship’s actual stowage arrangement on departure from Kaohsiung (right). Container and stack weights in excess of those defined in the mass-distribution arrangement are highlighted in red. Source: Yang Ming, modified and annotated by the ATSB
Deviations from the applicable mass-distribution arrangement as observed in the bay 56 stowage arrangement included (Figure 16):
loading of 40-foot ‘high cube’ containers exceeded the 7-tier limit specified (loaded to a height of 8 tiers)
many container weights exceeded the weights specified for individual slots
many instances of heavy containers above lighter ones, contrary to principles of vertical distribution.
Figure 16: Bay 56 stowage comparison
Figure shows the mass-distribution arrangement for bay 56 for 40-foot ‘high cube’ containers and a 1.61-m GM (left) compared to the ship’s actual stowage arrangement on departure Kaohsiung (right). Container and stack weights in excess of those defined in the mass-distribution arrangement are highlighted in red. Source: Yang Ming, modified and annotated by the ATSB
The Australian Maritime Safety Authority (AMSA) advised that, following the previous container damage on board YM Efficiency in January 2018, its inspection identified a number of container mass and distribution irregularities. These irregularities were concentrated in the forward bays where the damage occurred.
Compliance with the mass-distribution arrangements in the CSM offered a simple, if tedious, means of planning a stowage arrangement that minimised the risk of calculated forces exceeding allowable limits. However, in practice, cargo-planning and stowage operations were conducted using a loading computer system rather than by planning in strict conformance with the mass-distribution arrangements. This was because the scale, complexity and pace of modern container ship operations means that efficient cargo stowage and planning without the use of an on board loading computer system are highly impractical if not impossible. The use of a loading computer system involved direct calculation of the resultant forces acting upon the containers and lashing systems. This approach allowed the user to confirm that calculated forces did not exceed the maximum allowable limits of forces defined in the CSM.
Loading computer system
Aids used on board ships to assist with stability and cargo planning include loading instruments, on-board stability computers and loading computer systems.
A loading instrument provides a means to easily and quickly ascertain that the still‑water bending moments, shear forces, and, where applicable, still-water torsional moments and lateral loads (wind pressure force) at specified points along the ship’s length will not exceed the specified values in any load or ballast condition. ABS requirements for YM Efficiency included carriage of an approved ‘loading instrument’.
An on-board stability computer is an instrument to ascertain that stability requirements specified for the ship in the stability booklet are met in any loaded or ballast condition. There was no class requirement for the ship to be equipped with an on-board stability computer.
A loading computer system incorporates the functions of a loading instrument and an on-board stability computer. In addition, a loading computer system may also incorporate a container or cargo loading module and a lashing calculation program. There was no class requirement for the ship to be equipped with a loading computer system.
Nevertheless, YM Efficiency was equipped with a loading computer system capable of performing the functions of a loading instrument and on-board stability computer, in addition to container stowage planning and lashing calculation capabilities.
The ship’s loading computer system was approved by ABS. However, the approval only covered the longitudinal strength and certain other stability-related aspects of the ‘loading instrument’ component of the system. There was no class approval or, requirement for class approval for the cargo-planning and stowage components of the loading computer system.
ABS Container Securing System certification
Class (ABS) offered an optional container securing systems certification. This involved class survey of the ship’s entire CSM, cargo securing equipment and loading computer system. However, YM Efficiency did not hold this certification nor was it required to. Nevertheless, the ABS Guide for Certification of Container Securing Systems contained useful information on container stowage arrangements, the securing of containers and the use of the CSM.
The key points from the guidance document were that:
container stack weights are limited by the strength of the hull structure and the securing system
permissible stack weights for each GM shall be applicable for all operating conditions with a lower GM
the higher GM shall be selected to represent a near upper bound on all possible operating conditions because it represents an upper bound on the loads that are not to be exceeded
weather effects increase the loading into the containers and lashing components
stacks located at the ends of the vessel experience the highest accelerations
outboard stacks experience higher accelerations than inboard stacks
raising portions of the stack by using taller containers in lower tiers will increase acceleration loads on the stack and reduce the permissible weights
forces into the lashing system and containers are reduced when the stack is vertically stratified, with the heaviest containers located in the lower tiers
container lashing calculation software is used to calculate and verify that the container securing arrangements comply with the applicable strength requirements and acceptance criteria
the container weight limits given by the computer lashing program are to be strictly followed in practice.
YM Efficiency’s loading computer system
YM Efficiency’s loading computer system—‘TSB Supercargo’—was designed by Total Soft Bank. The system allowed the user to perform a range of functions and checks associated with the safe stowage, loading and carriage of containers.
In particular, the system’s lashing calculation program allowed the user to calculate, for a given container stowage arrangement, the resultant forces acting upon containers and the securing system based on the class-defined assumptions for the worst combination of dynamic and static forces expected at sea. The use of a loading computer system allowed for increased flexibility in container stowage and carriage. Stowage arrangements could be assessed and accepted even if they deviated from the mass-distribution arrangement in the manual, provided the lashing calculation program was used to check that calculated forces were within allowable limits. This also made it possible for a heavy container to be accepted for loading over a light container, provided the calculated forces were found to be within allowable limits.
Operation of the TSB Supercargo
Checks of the proposed container stowage arrangements using the TSB Supercargo required an electronic file containing the stowage plan to be loaded into the system and then checked for compliance against various requirements such as the design stack weight check and lashing calculation check. In addition, the system could also be used to check the stowage plan for compliance with the International Maritime Dangerous Goods Code (IMDG Code)[43] requirements.
Design stack weight check
The ship’s design stack weight was a maximum limiting value based solely upon the strength of the ship’s deck, fittings and hatch covers. This value was different from the maximum stack weight in the mass‑distribution arrangement, which considered the effect of container weights on the calculated forces acting on containers and lashings.
The maximum design stack weight was 80 t for a stack of 20-foot containers and 110 t for a stack of 40-foot containers.
TSB Supercargo could be used to check the stowage arrangement against the ship’s design stack weight to ensure that the ship’s deck and hatch structures were not overloaded. If a container stack exceeded the design stack weight, the program indicated this by displaying the exceedance in red above the relevant stack. YM Efficiency’s chief mate stated that this check was performed with no exceedances detected. ATSB analysis confirmed that there were no design stack weight exceedances.
IMDG compliance check
The carriage of dangerous goods by sea has to be conducted in accordance with the IMDG Code. The Code classifies dangerous goods (DG) into nine classes. A key aspect of safe cargo stowage related to the carriage of dangerous goods involved the segregation of containers carrying dangerous cargo from other containers carrying incompatible classes of dangerous cargo. Containers carrying certain classes of dangerous cargo also had to be segregated from refrigerated cargo containers. A check to ensure that this was carried out was marked as completed in the chief mate’s container stowage checklist for the port call at Kaohsiung.
Checks of YM Efficiency’s container stowage arrangement after the occurrence, using the ship’s loading computer system, identified 10 unresolved IMDG segregation conflicts. These conflicts involved DG containers being stowed in proximity to other non-compatible DG containers or refrigerated containers without the separation required by the Code.
Lashing forces calculation check
The lashing forces calculation check assessed the container stowage arrangement against the maximum values for lashing forces described in the CSM. Setup for the check involved selecting appropriate values for the strength and flexibility parameters of the lashing equipment, the lashing pattern in use, limits of forces and other parameters. Alternatively, default values based on generic DNV GL container stowage and securing rules[44] and, minimum acceptable equipment SWL and MBL values from the ship’s CSM could be used. DNV GL default values for the allowable limits of calculated lashing forces were largely identical to those defined by ABS in YM Efficiency’s CSM. The program calculated the maximum forces expected to be generated on containers and securing systems based on the assumed worst combination of static and dynamic forces as defined in the CSM.
TSB Supercargo did not specifically provide an indication if container stacks exceeded the stack weights provided in the container mass-distribution arrangement (which could be less than the maximum design stack weight). Nor did it alert the user if individual container weights exceeded the maximum weights for individual slots or if the maximum number of tiers were exceeded. Instead, the program calculated the effect of container weights and their distribution, on the forces acting on the containers and their securing system.
The program indicated these calculated forces either as a percentage of the maximum allowable force or as units of force (kN). In both cases, an exceedance of the maximum allowable value of the lashing force would be indicated in red, allowing the operator to readily identify the container stacks where changes needed to be made to reduce the calculated forces to acceptable values.
Analysis of the stowage arrangement
After the accident, lashing calculation checks were performed by the ship’s manager, Yang Ming, on YM Efficiency’s container stowage arrangement as presented to the ship in Kaohsiung. The checks were performed using the same TSB Supercargo software program as was in use on board the ship. The check was performed using the program’s default values. The stowage plan, container weights and other underlying parameters, such as limits of forces, were verified by the ATSB. The outcome of the checks showed that calculated forces in a number of stacks in bays 52 and 56 exceeded allowable limits of lashing forces as indicated by the highlighted figures in red (Figure 17, see Appendix E for a larger version).
Further checks by Yang Ming at the ATSB’s request, involving minor variations to lashing force parameters, lashing equipment characteristics and vessel speed did not provide significantly different results.
Figure 17: Outcome of lashing forces calculation check (actual values)
An indicative image primarily showing the lashing forces calculation check for bays 52 and 56 with results displayed in kN. Values of lashing forces in excess of the maximum allowable forces are displayed in a red font (highlighted by the ATSB). Source: Yang Ming, modified and annotated by the ATSB
Figure 18 (and Appendix F) detail the outcome of the same lashing check expressed as a percentage of the maximum allowable forces. Calculated forces that exceeded 100 per cent of the allowable value are indicated by figures in red.
Figure 18: Outcome of lashing forces calculation check (percentage)
An indicative image primarily showing the lashing forces calculation check for bays 52 and 56 with results displayed as a percentage of the maximum allowable forces. Values of lashing forces in excess of the maximum allowable forces are displayed in a red font. Source: Yang Ming, modified by the ATSB
In addition, there were a few other instances (in bay 48 located immediately forward of the accommodation) where calculated forces exceeded allowable values. However, no containers were lost or damaged in this bay. Lashing forces in all other bays were within the allowable limits.
Lashing calculation check of bay 52
A lashing calculation check of YM Efficiency’s container stowage arrangement showed that calculated forces in at least 10 locations in bay 52 exceeded the allowable limits of various forces (Figure 19).
For example, for the container in position 520382, calculations show lifting force at 237 per cent (about 592 kN) of the allowable force of 250 kN. This indicates a lifting force in excess of the 500 kN MBL of the twistlocks. Similarly, calculated load on the container corner posts were at 147 per cent of the allowable compressive corner post load of 848 kN.
Figure 19: Bay 52 plan showing calculated force exceedances
Source: Yang Ming, modified and annotated by the ATSB
Lashing calculation check of bay 56
A lashing calculation check of YM Efficiency’s container stowage arrangement showed that calculated forces in at least eight locations in bay 56 exceeded the allowable limits of various forces (Figure 20).
For example, for the container in position 560682, calculated lifting force was at 262 per cent (655 kN) of the allowable lifting force of 250 kN and in excess of the 500 kN MBL of the twistlocks. Similarly, calculated load on the container corner posts were at 152 per cent of the allowable compressive corner post load of 848 kN.
Figure 20: Bay 56 plan showing calculated force exceedances
Source: Yang Ming, modified and annotated by the ATSB
Effect of forces
Significant exceedance of the compressive corner post load would typically be expected to manifest as a collapse of the container’s corner post/s (Figure 21). This can result in the stack becoming unstable and collapsing to either side, thereby placing forces on adjoining stacks or structures. Racking force exceedances typically manifested as a deformation or distortion of the container box structure. There was no safety factor applied to the maximum design corner post load (848 kN) and maximum racking force (150 kN) values for the container structure.
Figure 21: Image showing container corner post collapse
Source: ATSB
Exceedance of the lifting forces could result in excessive and potentially destructive stresses on container corner sockets, twistlocks, turnbuckles and lashing rods (Figure 22). The destructive failure of one or more twistlocks leaves the container and those above it partially or completely unsecured. This can result in the loss or uncontrolled movement of the container leading to a collapse or toppling of the stack. This can also place stresses on adjoining stacks that were not allowed for in the design of the lashing system.
It is important to note that, for the container loss to have occurred, it was not necessary for every single instance of a force exceedance to have manifested as a failure of the container or lashing device. Any one structural failure of a container and/or lashing or, a combination of such failures could have given rise to the sequence of events that resulted in the loss of containers overboard.
Figure 22: Examples of lifting force exceedances
Source: ATSB
Conduct of the lashing forces calculation check
The chief mate stated that he did not perform a lashing forces calculation check of the proposed container stowage plan in Kaohsiung. The master believed that he would be consulted by the chief mate if there were any difficulties or issues with the cargo plan. He also stated that he considered the chief mate to be an experienced and capable officer. The fact that he was not called upon for assistance led to the master assuming that the cargo plan had been approved without any significant unresolved issues.
Training and knowledge
The chief mate and master both stated that they were unfamiliar with the set-up and use of the lashing forces calculation check using TSB Supercargo’s lashing calculation program. The unresolved IMDG segregation conflicts in the cargo plan suggested that there might also have been an inadequate understanding of other aspects of the loading computer system.
There was no evidence of training in the use of TSB Supercargo being provided to ship’s officers prior to the accident (training was provided to the chief mate and master after the accident). Junior officers were usually trained in the use of the system and its checks while on the job, by senior officers. While newly promoted chief mates were usually supervised on board by the master until confident in the conduct of the checks, YM Efficiency’s chief mate was an experienced officer with many years’ experience as a chief mate on container ships.
Cargo-planning process
YM Efficiency berthed at Kaohsiung at 1448 in the afternoon of 31 May and sailed shortly before midnight that same day. During this approximately 9-hour port stay, the ship loaded 881 containers and discharged two containers. This time also included the checks and approval of the proposed cargo plan and checking of container lashings by the ship’s crew.
Container ship operations generally involve certain key phases involving responsible individuals both ashore and on board the ship. Yang Ming’s container planning and operations process could be divided into activities during the following three location-based phases:
stowage planning centre
port container terminal
shipboard.
Stowage planning centre
The Yang Ming stowage planning centre is located in Keelung, Taiwan. The centre was staffed with cargo planners who were trained and employed by Yang Ming. Cargo planners were primarily ex-seafarers or graduates of maritime colleges (with little seagoing experience). The SMS required that cargo stowage, stability and draught calculations be performed ashore in advance of cargo operations on board the ship.
The loading port agency accepted container bookings from shippers and forwarded the forecast cargo details to the stowage planning centre (identified as the ‘centre planning office’ in the shipboard SMS). These planners organised the ship’s final container bookings forecast and prepared a draft stowage plan with loading instructions. The preparation of the draft stowage plan took into account a number of factors, including the cargo to be unloaded, the ship’s expected stability condition, its schedule and order of discharge ports, forecast container bookings and special cargo requirements. This stowage plan did not include final container weights for the containers expected to be loaded nor could it account for any containers that arrived at the terminal late or that did not arrive at all. The stowage plan and associated loading instructions were then sent to the container terminal (in this case, Kaohsiung).
The shore planners used a version of computer automated stowage planning software (commonly known as ‘CASP’) that did not include the lashing forces calculation program. Hence, there was no lashing forces calculation check of the proposed container stowage plan performed at the shore planning stage. As a result, a stowage arrangement with significant weight and distribution irregularities was submitted to the terminal for YM Efficiency’s cargo operations.
As part of the investigation, the ATSB reviewed the current practices of other major container ship operators. This research identified that planning processes have the means of incorporating lashing forces calculation checks into the shore planning process. Further, a number of those operators considered the conduct of these checks ashore as an integral part of the shore planning process. They advised that consideration of lashing forces were taken into account from the very outset in order to reduce the risk of an unsafe stowage plan being presented to the ship.
Port container terminal
As is common in the marine industry, the planners at the Kaohsiung container terminal were employed by the terminal, not by Yang Ming. Their responsibilities were largely restricted to the operational aspects of the ship’s port call including the discharge and loading of containers. The terminal planner finalised the stowage plan by entering the verified weights of containers as they arrived at the load port. The plan was also adjusted for any planned containers that were late or that did not arrive at the load port. The loading and unloading sequence for the ship’s port call was then planned, taking into account Yang Ming’s loading instructions.
Yang Ming stated that a (design) stack weight check was performed before the plan was presented to the ship but not a lashing calculation check. The stowage planning software used at the terminal did not include the lashing forces calculation program and the conduct of a lashing forces check was not part of the terminal planning process.
The stowage plan was then presented to the ship as an electronic file for final checking and approval.
Shipboard
The electronic file containing the proposed stowage plan was presented to the ship upon arrival in port or shortly before. The ship’s responsible officer (the chief mate) was then expected to check the plan against a number of specified criteria such as IMDG compatibility, acceptability of container weight and distribution and stack weight checks, before approving the plan for actioning. Any identified irregularities were to be rectified or were to be referred ashore for assistance.
Yang Ming stated that the electronic file containing the planned stowage arrangement and container details was provided to YM Efficiency for approval by email about 2 hours prior to its arrival at Kaohsiung. The proposed plan was also provided to the chief mate by the terminal planner after the ship berthed.
The ship’s passage from the previous port, Shekou, was estimated to have taken about 18 hours with the ship embarking the harbour pilot for Kaohsiung at about 1400 on 13 May. The chief mate, who was the ship’s responsible cargo officer, also performed the duties of the OOW on the 0400-0800 and 1600-2000 bridge watches. Records of hours of rest for 13 May show that the chief mate was resting between 1200 and 1400 before attending to the port call at Kaohsiung. This meant that there was limited opportunity for him to check the proposed cargo plan received by email before the ship berthed.
The electronic file containing the proposed stowage plan was received from the terminal planner at about 1515 (about 30 minutes after the ship berthed). The SMS required the chief mate to check the proposed plan using the loading computer system and, if there was any irregularity, that the chief mate immediately request a rectification. A rectification could potentially involve re-positioning or cancellation of the containers involved. These checks and any associated amendments had to be conducted after the ship berthed with cargo operations imminent. While the SMS expected the ship’s officers to seek shore assistance if necessary, shore planners did not have the software capability to perform lashing force calculations. This meant that the punctual start, and the efficient conduct, of cargo operations depended on the chief mate’s ability to check, rectify and verify the proposed cargo plan in a timely and effective manner.
Container stowage checklist
A summary of the checks required under the ship’s SMS was provided in the form of a container stowage checklist (Appendix G). The completed checklist for the ship’s call at Kaohsiung on 13 May noted that, among others, the following checks of the proposed stowage arrangement were performed by the chief mate:
dangerous cargo list received and verified
dangerous cargo stowage in compliance with the IMDG Code, local requirements and Yang Ming policy
calculated GM, longitudinal strength and bridge visibility in compliance with safety condition
each stack weight below deck strength limitation (design stack weight)
vertical weight distribution in compliance with lashing system recommendation.
The checklist also recorded the ship’s maximum shear forces (44 per cent), maximum bending moments (69 per cent) and GM (1.09 m).
The chief mate recalled checking that the design stack weight was not exceeded and that planned container locations were suitable for the containers to be loaded including for refrigerated containers and containers carrying dangerous goods. The chief mate also checked that the ship’s stability parameters met the IMO criteria and that bending moments and shear forces were within acceptable limits. However, a check of calculated lashing forces, which would have identified the vertical weight distribution irregularities in the proposed stowage arrangement, was not performed.
The chief mate subsequently approved the stowage and loading plan without requesting any changes. The checklist noted that the final, verified bay plan was received at about 1545 and that cargo operations commenced at 1600.
The absence of a lashing forces check during the planning process ashore meant that an inherently unsafe container stowage arrangement was presented to the ship for approval. The omission of the shipboard lashing forces check removed the last opportunity to identify the safety implications of the proposed stowage arrangement. Consequently, the ship was loaded in accordance with the unsafe stowage arrangement.
Rectification of identified issues
On board YM Efficiency, rectification of issues identified during the shipboard check depended on action by the responsible ship’s officers.
Rectification of calculated lashing force exceedances generally involved relocation of containers such that calculated forces were reduced to acceptable levels. This might involve the redistribution of container (weights) within the stack, within the bay or elsewhere on the ship. If the redistribution of containers failed to address the issue, the implementation of additional mitigating measures might be considered, such as reducing the ship’s GM through ballasting. As a last resort, a container may be cancelled for carriage.
The redistribution of containers would essentially need to be done by the chief mate on a ‘trial and error’ basis until the check showed that calculated forces fell within allowable limits. TSB Supercargo did not have the capability to offer solutions to identified lashing force calculation exceedances. However, an effective starting point would possibly have involved repositioning containers to eliminate situations where significantly heavier containers were loaded over lighter ones.
In bay 52, this would have been relatively straightforward, given that the bay was empty on arrival in Kaohsiung. The order of loading containers could have been changed to ensure that heavier containers were loaded at the bottom, with containers designated for loading in the bay swapped with other bays if necessary.
However, in bay 56, the first five tiers of containers had been loaded in Shanghai and were already on board on arrival at Kaohsiung (Appendix H). The stowage plan proposed the loading of three additional tiers above the Shanghai cargo. With a few exceptions, almost all the Kaohsiung containers were heavier than those from Shanghai in the tiers immediately below them. The rectification of this situation would have involved either relocating the heavy containers to a different bay or the discharge of the relevant Shanghai containers, loading of the heavier Kaohsiung containers and then reloading the Shanghai containers on top. The latter method, involved the undesirable ‘double-handling’ of containers.
Rectification of irregularities related to the weight and distribution of containers in a proposed stow would almost inevitably involve the redistribution of containers within or across the ship’s bays. The redistribution of cargo would also potentially introduce additional conflicts related to lashing forces, stability, IMO visibility rules, IMDG segregation rules and port discharge schedules. These conflicts would have to be resolved and the plan re-checked before execution.
Depending on the planned sequence of operations, this rectification may be able to take place while other cargo operations get underway. However, as operations progress, there would be increasingly limited options available to the chief mate that would allow the redistribution of containers without over-stowing cargo and affecting work already completed or underway. Further, additional shore gantry crane ‘moves’ associated with the redistribution of cargo would incur additional costs.
The alternative was to delay or suspend cargo operations while modifications were made to the plan and those changes re‑checked and approved. Delays to a ship’s operations in port would have knock-on effects on sailing and berthing schedules, waiting times, container storage and warehousing, and potentially introduce delays to the container transport chain ashore. In an environment where speed of operations is of critical concern, any delays would likely attract considerable commercial penalties.
In summary, the costs, disruption and delays to operations associated with making substantial modifications to the cargo plan at the last minute places unrealistic expectations on the ship’s officers. Under such circumstances, it is unlikely that the chief mate would have the necessary influence to delay or suspend operations while pursuing increasingly limited options for the modification of the cargo plan.
Incident reporting and communications
Reporting procedures in the YM Efficiency’s SMS required the master to notify the company’s marine department in the event of an incident. The master informed the company of this incident via satellite telephone at about 0130 on 1 June, about 1 hour after the containers were lost overboard. The procedures also instructed the master to comply with all relevant international requirements in relation to the incident.
AMSA reporting requirements
Australian legislation requires that all foreign and Australian vessels involved in a marine incident in Australian waters report the incident to the Australian Maritime Safety Authority (AMSA). The responsibility to report an incident, including loss of a cargo from a ship, is that of its owner and master.[45] The reporting involves a two-step process, which consisted of an incident alert and a subsequent incident report with more detail.
In the event of an incident in Australian waters, an incident alert needs to be submitted as soon as ‘reasonably practicable’. Marine Order 1[46] clarified this by requiring the incident alert to be submitted within 4 hours of the incident. The incident alert is to be submitted by completing an incident alert form[47] online or by downloading the form, completing it and emailing it to AMSA. Following the submission of the incident alert, vessels are required to submit a more detailed incident report[48] within 72 hours.
YM Efficiency was in coastal waters, about 14 miles from land when the loss of containers occurred. The main engine shutdown and prevailing weather meant that the disabled ship, as well as the lost containers, subsequently drifted into territorial waters. YM Efficiency’s incident alert, in the form of an AMSA form 18 sent by email using satellite services, was not submitted until about 1153 on 1 June, nearly 12 hours after the incident. The incident alert was submitted to the ship’s local agent who notified port authorities. Subsequently, AMSA’s Joint Rescue Coordination Centre and state authorities (Roads and Maritime Services) were notified of the incident.
By 1330, the Joint Rescue Coordination Centre had begun deploying air surveillance assets. Shortly after, AMSA began drift modelling[49] to predict where the containers were likely to be washed ashore. Maritime safety information broadcasts to warn shipping of the lost containers were also initiated by about 1500. By the late afternoon, there were reports of two containers drifting off Port Stephens. The State authorities implemented state spill contingency plans and liaised with local fire and rescue services to respond to reports of containers that washed ashore.
In the days following the accident, coast radio stations including Newcastle VTIC and Marine Rescue NSW bases assisted with the dissemination of maritime safety information concerning the lost containers.
Safety communications
Safety communications are those communications used to convey important navigational or meteorological warnings. Safety communications have priority over all communications except distress and urgency communications.
Safety communications can be transmitted either using terrestrial systems such as very high frequency radio (VHF) or using satellite-based systems. In a terrestrial system, safety communications consist of a safety announcement using digital selective calling (DSC) followed by a safety call and safety message using radiotelephony or other means.
The safety call comprises the initial voice or text procedure, including the safety signal, prior to the transmission the safety message. The safety message indicates that the calling station has an important navigational or meteorological warning to transmit. International and Australian regulations placed a responsibility on the ship’s master to inform all vessels in the vicinity of any serious danger to navigation by transmitting a safety signal and message.[50]
When a safety message is transmitted via radiotelephony, the preceding safety signal comprises the word ‘SECURITE’ spoken three times. This is followed by the identity of stations to whom the message is addressed and the transmitting station’s identity. Safety messages from ships to other stations in the vicinity are usually addressed to all stations.
YM Efficiency’s safety message transmissions
At about 0229 and 0231, the YM Efficiency’s second mate (the OOW) broadcast two radiotelephony calls on VHF channel 16. These calls were not preceded by a digital selective calling safety announcement or by a safety call with the spoken word ‘SECURITE’. Further, the ship’s broadcasts did not follow the form required of emergency radiotelephony voice procedures. The two radiotelephony calls, however, were broadcast addressed to all stations, stated the ship’s name, that containers were lost overboard and the position where the containers were lost.
As the calls were broadcast on VHF radio, they had a limited range (generally, within line of sight). Stations within range of the broadcast and capable of receiving the message would have included other ships in the vicinity (there were several), Newcastle VTIC, volunteer marine rescue bases, and any other stations monitoring channel 16. Of these, some stations had a responsibility to listen for distress and emergency communications.
National Coast Radio Network
As part of its SOLAS obligations, Australia provides a satellite and high frequency (HF) radio communications service that forms part of the global maritime distress safety system (GMDSS).[51] The Australian GMDSS‑network does not provide voice watchkeeping on the distress radiotelephony frequencies.
The National Coast Radio Network was established in July 2002 to replace the Commonwealth Coastal Radio Network. Each jurisdiction monitored the relevant VHF and HF distress and calling frequencies and broadcast relevant navigation warnings and maritime safety information.
In NSW, marine radio services were provided by Kordia (a specialist telecommunications company), the port corporations of three NSW ports[52] and Marine Rescue NSW.
Newcastle VTIC
Newcastle Port Corporation was one of the three port corporations that formed part of the National Coast Radio Network. The primary role of Newcastle VTIC was the planning, booking and coordination of ship movements for the port of Newcastle. However, as part of the National Coast Radio Network, Newcastle VTIC provided part of the VHF component of the network and monitored VHF channel 16 for distress and emergency communications at all times (primarily from domestic and recreational vessels rather than from seagoing merchant ships).
A review of Newcastle VTIC’s archived audio data for 1 June confirmed that YM Efficiency’s broadcasts on channel 16 were recorded. However, there was no evidence to indicate that the VTIC operator/s heard, documented, acknowledged or took any action in response to the broadcasts. The earliest awareness of the accident was shortly after 0700, when reports of a container loss from YM Efficiency were heard on local public radio broadcasts by the Australian Broadcasting Corporation (ABC).
Marine Rescue NSW
Volunteer rescue organisations are located throughout Australia with a focus primarily on promoting safety and carrying out local rescues. As such, volunteer marine rescue radio operators normally only responded to calls directly addressed to them. Nevertheless, in NSW, part of the State’s marine radio services were provided by volunteer marine rescue bases.
Archived electronic audio recordings obtained from the Port Stephens marine rescue base confirmed that YM Efficiency’s VHF broadcasts were recorded there. However, as with Newcastle VTIC, there were no documented log entries either in the Port Stephens base log or in the Marine Rescue NSW state-wide log, and there was no awareness of the accident. The earliest that Marine Rescue NSW personnel gained an awareness of the container loss was at about 0647, when contacted by the ABC.
Similar occurrences
Over the past few decades, flag administrations and agencies with a responsibility to investigate safety occurrences have investigated several container loss and container damage events. Some common recurring, contributory factors identified in these investigations include stack weight exceedances, excessive compression and racking forces, and shortcomings in the shore planning process. Another factor that was common to a number of these investigations was the difficulty encountered in conclusively determining an external cause for the ship’s motion or movement that contributed to the incident.
Svendborg Maersk
On 14 February 2014, the 8,160 TEU, 347 m Denmark-registered container ship Svendborg Maersk lost 517 containers overboard with a further 250 containers damaged. The incident occurred when the ship suddenly rolled to extreme angles on two occasions while the ship was on passage in the Atlantic Ocean off Ushant, France.
Denmark’s Maritime Accident Investigation Board investigation report—Svendborg Maersk – Heavy weather damage on 14 February 2014, identified that, on two separate occasions, Svendborg Maersk encountered extremities in an adverse weather situation, causing heavy rolling. The investigation was unable to establish whether the extreme rolling motions of the ship were caused by parametric resonance or single waves that were different from the predominant wave pattern.
Pacific Adventurer
On 11 March 2009, the 1,123 TEU, 185 m Hong Kong-registered multi-purpose container ship Pacific Adventurer lost 31 containers overboard off Cape Moreton, Queensland, Australia. The containers were lost when the ship rolled violently while on passage to Brisbane. At the time, the ship was being subjected to the effects of tropical cyclone Hamish. Two of the ship’s fuel oil tanks were holed as the containers went overboard, resulting in 270 t of fuel oil leaking into the sea, polluting 38 miles of the coastline.
The ATSB transport safety investigation report MO-2009-002 identified that Pacific Adventurer probably experienced synchronous or resonant rolling in the time leading up to the loss of containers, brought about by the ship’s natural roll period matching the encounter period of the waves.
Annabella
In February 2007, the 868 TEU, 134.4 m-long, United Kingdom (UK)-registered container ship Annabella sustained a collapse of cargo containers stowed in a cargo hold. The incident occurred in the Baltic Sea in adverse weather, while the ship was on passage from Antwerp, Belgium to Helsinki, Finland. Three of the collapsed containers contained hazardous cargo and the ship was redirected to port of Kotka where emergency services and specialist contractors attended and safely unloaded the hazardous containers.
The UK’s Marine Accident Investigation Branch (MAIB) investigation Report No. 21/2007 concluded that the collapse of cargo containers occurred as a result of compression and racking forces acting on the lower containers of the stack. Maximum allowable stack weights had been exceeded and lashing bars had not been applied to the containers as required. Class approval of the loading computer system did not include the container and lashing modules, which contributed to a programming error not being detected. In addition, the report identified that the master did not report the accident to the coastal state authorities as soon as possible, potentially delaying timely and effective support from shore authorities.
The MAIB also found that the pace of modern container operations is such that it is very difficult for ship’s staff to maintain control of the loading plan.
P&O Nedlloyd Genoa
On 27 January 2006, the 2,902 TEU, 210.1 m-long, UK-registered container ship P&O Nedlloyd Genoa lost 27 containers overboard in the Atlantic Ocean while on passage from Le Havre, France to Newark, United States. The incident occurred when the ship was struck by a steep-sided swell wave during a series of large rolls initiated by large swell waves. In addition to the loss of containers overboard, the ship also sustained a collapse of 28 containers.
The UK’s MAIB investigated the incident and published Report No. 20/2006. The investigation could not determine the cause of the accident with any certainty. Sea conditions did not appear to have been steady enough to induce parametric rolling and the ship’s natural roll period appeared to have been just outside the limits for parametric rolling.
The report concluded that the stowage plan in the affected bay exceeded the maximum stack weight limit in the outboard row and disregarded the principle of ‘no heavy over lights’ loading. Errors in the stowage plan were not identified by the company’s planning staff, the terminal or the ship’s chief mate.
Dutch Navigator
In April 2001, the 99 m-long, Netherlands-registered general cargo ship Dutch Navigator encountered poor weather that resulted in a shift of nine cargo container units in the foremost bay of cargo hold. The incident occurred while on passage from Bilbao, Spain to Avonmouth, UK. Two of the nine units were tank containers containing incompatible dangerous goods, with one of these tank containers significantly damaged with a leak.
The UK’s MAIB investigated the incident and published Report No. 37/2002. The investigation concluded that container stack masses in bay 01 of the hold were substantially in excess of the recommendations of the ship’s CSM and that the stowage of tank containers in the hold did not comply with the IMDG Code. Calculated racking loads on the container frames in the lower tier of bay 01 were substantially in excess of design limits and were considered to be a major factor in the failure of the stow.
At about 0035 on 1 June 2018, YM Efficiency was en route to Sydney, steaming at about 3–4 knots into strong gale force winds and very rough seas off Newcastle when it suddenly rolled heavily (nearly 30° to either side). As a result, a number of container stacks on deck collapsed or toppled with 81 containers lost overboard and 62 others damaged. Soon after the container stacks began collapsing, the ship’s main engine shut down.
As the ship drifted without propulsion, no further containers were lost overboard. After some delays, the main engine was restarted and the passage resumed. The ship arrived off Sydney later that day but no berth in the port was made available. Consequently, the ship remained at sea in persisting bad weather until it berthed at the Port Botany container terminal in Sydney on 6 June. Fortuitously, none of the damaged containers on board were lost during that extended period. Meanwhile, debris from the lost containers that had not sunk continued washing up ashore.
Early in the ATSB investigation, it became evident that the sudden, heavy rolling directly resulted in the collapse of the container stacks, and the loss of propulsion immediately afterwards. Therefore, all potential causes for the rolling were explored. While the possibility of an abnormal wave could not be ruled out, there was insufficient evidence to conclude that this was the case. Similarly, the rolling could not be attributed to parametric rolling because there was insufficient evidence to definitively conclude that the conditions conducive to allow this behaviour were present. YM Efficiency had not been in beam seas, the ship’s calculated roll period was outside the range expected for synchronous rolling and other relevant stability parameters were not abnormal or unusual. Therefore, no definitive reason/s for the sudden rolling could be established.
However, the investigation identified a number of contributing and other safety factors under the following broad areas:
container stowage and securing
cargo planning and checking
navigation in adverse weather
incident reporting and communications.
Container stowage and securing
As with most container ships, YM Efficiency had a Cargo Securing Manual (CSM) and a loading computer system to assist its master and crew with the safe carriage of containers. These tools provided all that was necessary from a mandatory and practical standpoint to plan and safely carry cargo. Together, they were a primary risk control – a control that was easier to manage, and much more predictable, than the weather.
Cargo Securing Manual
The CSM mandates how containers are stowed and secured to ensure that forces acting on the containers and their lashings do not exceed defined safe limits for carriage. A number of factors influence these forces, including container weight and location, stack height, and stability characteristics, such as metacentric height (GM) and roll period. The weight of containers and their vertical distribution in a stack are critical factors. The CSM provided mass-distribution arrangements to avoid stowage arrangements exceeding safe force limits.
YM Efficiency’s stowage arrangements in bays 52 and 56 (to which the collapsing container stacks were confined) did not conform to the applicable mass-distribution requirements. There were significant deviations, particularly with respect to container weights and stack weights, tier heights, and other inconsistencies, as summarised below:
the stowage arrangement exceeded the 7-tier limit specified (loaded to a height of 8 tiers)
many stacks of 40-foot ‘high cube’ containers exceeded the maximum stack weights specified
many container weights exceeded the weights specified for individual slots
there were many instances of heavy containers above lighter ones, contrary to principles of vertical distribution.
The type and extent of these deviations introduced a high level of risk, which was realised when the ship rolled heavily. While the stowage arrangements were not planned by direct reference to the mass-distribution arrangements, the exceedances of weights and tier heights directly influenced the lashing forces acting on the container stacks and lashings.
In practice, lashing forces in the proposed stowage arrangements were to be calculated and assessed for compliance with the requirements of the CSM using the loading computer system. Use of the loading computer system offered a flexible and efficient way to ensure compliance with the CSM.
Loading computer system
YM Efficiency’s loading computer system included a lashing calculation program that allowed for a direct check of the forces acting on containers and lashings. Analysis of the stowage arrangement (based on default values similar to those in YM Efficiency’s CSM) showed that calculated forces exceeded maximum allowable values at several locations in bays 52 and 56. Specifically, calculated values for lifting force, compressive force on corner post loads and racking forces exceeded allowable limits as follows:
In bay 52, there were;
10 instances of lifting force exceeding the maximum (including four exceeding 200 per cent)
four instances of corner post load exceeding the maximum (including two exceeding 140 per cent)
two instances of racking forces exceeding the maximum.
In bay 56, there were;
eight instances of lifting force exceeding the maximum (including four exceeding 200 per cent)
four instances of corner post load exceeding the maximum (including two exceeding 150 per cent)
two instances of racking forces exceeding the maximum.
The lashing force exceedances determined by the ship’s lashing calculation program were a direct result of the weights and distribution of containers in the bays. By contrast, calculated lashing forces in other bays were generally compliant with the CSM (with minor exceptions in bay 48) and almost no container damage or loss occurred there.
Resultant forces were calculated in the CSM for the most severe combination of forces expected, based on certain theoretical extreme values for aspects of the ship’s motion such as roll, pitch and heave. This meant that when the ship encountered conditions that approached or exceeded those theoretical values, it became increasingly likely that the calculated resultant forces would be physically realised. For example, the angle to which the ship rolled (nearly 30°) exceeded the theoretical angle of roll (25.1°) used in the calculations. Therefore, it was almost certain that forces generated during the rolling approached or exceeded the forces determined by the lashing calculation program.
The heavy rolling gave rise to accelerations, which in turn generated excessive forces in the container stacks. This placed stresses and loads on containers and lashings that were in excess of the strengths and minimum breaking loads for which they were designed, resulting in their structural failure. It was not necessary for every identified calculated force exceedance to be realised – any single exceedance or combination of exceedances could have initiated the failure sequence. The ensuing collapse and toppling of container stacks led directly to the loss of containers overboard.
Use of the loading computer system
The lashing forces calculation check was an important risk control measure to ensure that proposed container stowage arrangements complied with the requirements of the CSM. Yang Ming’s cargo planning process ashore did not incorporate a lashing forces check (see the section titled Cargo planning). Therefore, the shipboard check was the final, and only, opportunity to check the proposed stowage plan before it was implemented on the ship.
Yang Ming procedures required that proposed container stowage plans be checked on board the ship for safety and compliance with the CSM. Any irregularities identified in the stowage arrangement were to be rectified to the master’s satisfaction before the ship sailed. In practice, proposed container stowage plans should have been checked using the loading computer system and its built-in lashing calculation program.
The checklist for cargo operations at Kaohsiung indicated that a number of checks required by the ship’s procedures were performed and found satisfactory. However, YM Efficiency’s proposed container stowage plan was not checked using the lashing calculation program at Kaohsiung.
The checklist also noted that the proposed stowage plan was checked for compliance with the IMDG Code. However, the ten unresolved dangerous goods segregation conflicts identified during the investigation indicated that some checks might have been omitted or incorrectly performed.
YM Efficiency’s chief mate and master stated that they were not familiar with the set-up or use of the lashing calculation program. Evidence of other omitted or improperly performed checks suggested that this might have extended to broader aspects of the loading computer system as well. The lashing calculation program formed part of the functionality of the loading computer system (although the carriage of a loading computer system was not a requirement for the ship). The safe stowage and loading of the ship depended on the responsible officers being able to effectively operate the system, run the required checks, interpret the outcome of those checks and take the necessary action. Apart from on-the-job training and mentoring, there was no evidence to indicate that the officers had been trained in the use of the loading computer system or the lashing calculation program.
In summary, the ship’s master and chief mate did not check the proposed container stowage plan using the lashing calculation program because they probably did not have an adequate understanding of the system and its checks. This meant that a stowage arrangement with significant weight and distribution irregularities was approved for execution. When eventually subject to the sudden, heavy rolling, these irregularities gave rise to excessive forces, which culminated in the loss of containers overboard.
Cargo planning and checking
The cargo planning process ashore offered a realistic and ideal opportunity to ensure that proposed container stowage plans complied with YM Efficiency’s CSM. However, the organisation and structure of Yang Ming’s shore operations did not include certain important safety checks. In particular, the lashing forces check was not part of any stage of the shore planning process. According to Yang Ming, it was impossible to perform the lashing forces check ashore as they could not account for container weights, containers that arrived late or that did not arrive at the terminal. Further, the version of computer automated stowage planning software used by the shore planners did not have the software required to perform these checks.
However, current industry practice indicates that the importance of conducting CSM-related checks at an early stage is well understood and the ability to perform these checks ashore during the shore planning stage exists. In fact, integration of the lashing forces checks into the shore planning process is standard practice for a number of major container ship managers.
The absence of the lashing forces calculation check in Yang Ming’s shore planning process meant that weight and distribution irregularities in the proposed stowage plan were not identified during that stage of the planning. Consequently, an inherently unsafe stowage arrangement was presented to YM Efficiency, and compliance with the CSM requirements relied entirely on shipboard checks of the stowage arrangement at an unnecessarily late stage. While the ship’s loading computer system had the software to perform the lashing forces calculation and other checks, such as compliance with the IMDG Code, its master and crew faced other limitations.
Shipboard checks in practice occur at a late stage in the planning process when the ship is berthed with cargo operations imminent. Loading and discharge operations at container terminals are expected to be conducted quickly, efficiently and with minimum disruption to the planned sequence. The identification of multiple, serious irregularities in a proposed stowage plan would require the suspension or delay of cargo operations until the deficiencies are rectified. These delays will almost certainly have flow-on effects to the ship’s schedule, berthing schedules of other ships and port operations, which all incur a commercial cost. Such practical considerations place unrealistic expectations on ship’s officers in terms of identifying and resolving irregularities in the stowage plan, at the last minute, without unduly affecting cargo operations.
These impediments, together with a lack of loading system knowledge detailed previously, affected the ability of YM Efficiency’s master and chief mate to perform the necessary checks, interpret their outcome, understand the implications and then decide on appropriate action to address the matter.
Therefore, while shipboard checks are a necessary step in cargo planning and stowage and serve to assure the master that the proposed plan is safe and compliant, they should not be the only checks as was the case with Yang Ming’s cargo planning process. In YM Efficiency’s case, this resulted in the chief mate approving the non-compliant and unsafe proposed container stowage plan without properly checking it.
Navigation in adverse weather
A ship that is stopped generally tends to lie beam-on to the wind and seas. In a rough sea, the ship is likely to roll and, depending on the severity of the weather and the ship’s stability, may roll heavily. This can impose stresses on cargo and ship’s structures resulting in damage. The shifting of cargo can also lead to a sudden adverse change in the ship’s stability with the potential for capsizing. Drifting beam-on in rough seas also leaves the ship vulnerable to synchronous rolling.
On the afternoon of 31 May, YM Efficiency’s master decided to drift without propulsion in increasingly adverse weather conditions. The ship was subject to the effects of gale force winds between force 8 (between 34 and 40 knots) and force 9 winds (between 41 and 47 knots), 6 m seas and a 5 m swell. Analysis showed that YM Efficiency generally settled beam-on to the prevailing weather when drifting.
After the loss of containers, the ship was disabled as its main engine had shut down. In these circumstances, it was unavoidable that the ship would drift in the prevailing weather. The loss of propulsion and disablement of the ship, especially in adverse weather, is generally considered a serious situation with potential for grave danger. However, once the main engine was returned to service at about 0200, no attempt was made to start the engine to restore propulsion and regain control of the ship. The master decided to continue drifting until 0252 when the main engine was started and passage resumed, probably prompted by advice of the requirement for ships to remain 10 miles offshore.
The decision to drift on 31 May left the ship open to the possibility of synchronous rolling. Heavy rolling on a container ship can impose severe compression, racking and lifting forces. This can loosen lashings and place stresses on containers, weakening components of the system. After the accident, with collapsed stacks and loose containers on deck, it was even more imperative that control of the ship was regained to avoid any further damage and container loss.
The initial decision to drift in adverse weather by the master was in response to a delay in the ship’s required time off arrival at Sydney. He assessed that the ship’s GM afforded adequate stability and recalled that the ship’s motion while drifting during the afternoon was comfortable with little pitching or rolling. After the accident, the master once again described conditions on board as being comfortable with little need for concern. The second mate’s recollections concurred with the master’s account.
There was insufficient evidence to establish if the decision to drift on 31 May contributed to the loss of containers overboard. There was also no evidence that the decision to continue drifting after the main engine was returned to service resulted in any adverse consequences. Nevertheless, the decision to drift in what was unarguably adverse weather increased the risk of damage to the ship and cargo, and was inconsistent with the accepted practice of good seamanship.
Incident reporting and communications
The loss of containers overboard from YM Efficiency was a marine incident that required reporting to the coast state authorities, in this case the Australian Maritime Safety Authority (AMSA). An incident alert was required within four hours of the incident and a subsequent incident report within 72 hours.
The requirement for an incident alert was primarily to enable authorities to mobilise resources to:
respond to the incident
implement contingency plans
notify relevant personnel and organisations
manage risk from potential consequences.
AMSA also had a responsibility to initiate promulgation of maritime safety information to those who might be affected by the lost containers.
While the master reported the incident to the ship’s managers soon after the incident, the incident alert notification to AMSA was not made until about 11 hours after the containers were lost overboard. This delayed the authorities’ response to the incident. Specifically, response actions such as drift modelling and aerial surveillance of the ship and lost containers were not initiated until more than 12 hours after the incident. Promulgation of maritime safety information for affected waters was also delayed until about 1500 (over 14 hours after the incident).
About 2 hours after the incident, YM Efficiency broadcast two messages to warn nearby vessels of the loss of containers overboard. The messages were broadcast in English, on the appropriate distress and calling frequency (VHF channel 16). The messages were addressed to all stations and contained the necessary information required to convey the details and seriousness of the incident to any listening station. However, these broadcasts did not follow the form required of emergency radiotelephony voice procedures, were not announced by a digital selective calling announcement and the calls did not include the appropriate safety message designator ‘SECURITE’.
Coast radio stations on the Australian coast received the messages broadcast by YM Efficiency. However, operators at these stations remained unaware of the incident until several hours later when they were alerted to it by a news broadcast. It is acknowledged that the primary purpose of these coast radio stations was the localised provision of services relating to port operations or the rendering of safety services to small recreational and domestic commercial vessels. In addition, the absence of appropriate message designators and the greater amount of general radio traffic off major ports may have affected the coast radio station operators’ ability to discern YM Efficiency’s message. The use of the appropriate ‘SECURITE’ message designator and digital selective calling announcements may have better alerted operators to the broadcast.
Therefore, while the ship did make two broadcasts intended to alert radio stations in the area to the accident, they were not picked up by coast radio stations and an early opportunity to alert authorities was lost. Such early awareness would have allowed the appropriate State and Commonwealth authorities to respond to the incident in a timely manner, regardless of the delay in the master reporting the incident to AMSA via the agent.
Findings
From the evidence available, the following findings are made with respect to the loss of 81 containers overboard from YM Efficiency, 16 NM east‑south‑east of Newcastle, New South Wales on 1 June 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
YM Efficiency suddenly rolled heavily while steaming slowly in adverse weather. That movement generated forces which placed excessive stresses on the container stows in bays 52 and 56, resulting in the structural failure of a number of containers and components of their securing systems, and the subsequent loss of containers overboard.
The weights and distribution of containers in bays 52 and 56 were such that calculated resultant forces on containers and securing systems exceeded the allowable force limits specified in the ship’s Cargo Securing Manual.
The ship's master and chief mate did not check that the proposed container stowage plan complied with the requirements of the Cargo Securing Manual probably because neither had an adequate understanding of the loading computer system.
The ship’s manager’s (Yang Ming)cargo-planning process ashore did not ensure that the proposed container stowage plan complied with the stowage and lashing forces requirements of the ship's Cargo Securing Manual. Consequently, compliance with these requirements relied entirely on shipboard checks, made at a late stage, with limited options available for amendments without unduly impacting commercial operations. [Safety issue]
Other factors that increased risk
The decision to drift in severe weather despite the main engine being available, was inconsistent with the practice of good seamanship, and increased the risk of damage to the ship and cargo.
The ship’s radio broadcasts, intended to alert stations to the loss of containers, were transmitted on the distress and calling frequency but did not include the appropriate message designator, ‘SECURITE’ and were not preceded by a digital selective calling announcement. Coast radio stations that received the broadcasts did not acknowledge or respond to them, which meant that an early opportunity to alert Australian authorities to the incident was lost.
The loss of containers overboard was not reported to Australian authorities within the required 4 hours following the incident, significantly delaying the response to ensure the safety of navigation and the environment.
Other findings
YM Efficiency's main engine shut down soon after the container loss started, and therefore was not a contributing factor.
Safety issues and actions
The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the marine industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are provided separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Safety issue description: The ship’s manager’s (Yang Ming) cargo-planning process ashore did not ensure that the proposed container stowage plan complied with the stowage and lashing forces requirements of the ship's Cargo Securing Manual. Consequently, compliance with these requirements relied entirely on shipboard checks, made at a late stage, with limited options available for amendments without unduly impacting commercial operations.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Yang Ming
Yang Ming advised the ATSB of the following safety action taken following the loss of containers overboard from YM Efficiency:
a review of cargo operations procedures to ensure that verification of compliance with vertical weight distribution arrangements is performed
cargo operations procedures have been updated to reflect the requirement for ship’s officers to verify lashing forces
periodic familiarisation and shore-based training for all officers on compliance with the Cargo Securing Manual
review and amendment to navigation procedures which now require the master to report and seek advice from shore management when the ship is expected to encounter waves greater than 4 m
an emergency procedure for containers lost at sea has been included in the emergency procedures manual and includes a requirement for such incidents to be reported to the relevant parties using the standard reporting format
a directive issued to the Yang Ming fleet reminding that all deck officers need to be familiar with the on board container stowage planning and lashing software, and the cargo securing manual.
Ship details – YM Efficiency
Name:
YM Efficiency
IMO number:
9353280
Call sign:
A8OS5
Flag:
Liberia
Classification society:
American Bureau of Shipping
Departure:
Kaohsiung, Taiwan
Destination:
Sydney, Australia
Ship type:
Container ship
Builder:
Taiwan Shipbuilding Corporation
Year built:
2009
Owner(s):
All Oceans Transportation
Manager:
Yang Ming Marine Transport Corporation
Gross tonnage:
42,741
Deadweight (summer):
52,773 t
Summer draught:
12.535 m
Length overall:
268.80 m
Moulded breadth:
32.20 m
Moulded depth:
19.10 m
Main engine(s):
Sulzer 7RT-flex96C
Total power:
54,460 BHP
Speed:
24.8 knots
Damage:
Eighty-one containers lost overboard, 62 containers damaged, significant damage to ship’s accommodation ladder, superstructure and cargo structures
Appendices
Appendix A – Navigation in heavy weather or in tropical storm areas checklist
Source: Yang Ming, modified by the ATSB
Appendix B – Description of container positions on board
The position of a container on board a ship was given by means of a six-digit number (Figure 23). The first two digits indicated the bay number where the container was located. An odd number indicated that the bay was suitable for 20-foot containers while an even number meant that it was suitable for 40-foot containers.
Figure 23: Bay/Row/Tier container location numbering system
Source: Yang Ming, modified and annotated by the ATSB
The next two digits gave the container’s athwartships position by means of a row number. YM Efficiency’s bays varied between 9 and 13 rows each. The middle row in each bay was designated as row ‘00’. Rows to starboard were designated odd numbers beginning with row ‘01’ immediately to starboard of the middle row and progressing outboard. Similarly, rows to port were designated even numbers beginning with row ‘02’ immediately to port of the middle row and progressing outboard.
The last two digits denoted the container’s tier number indicating its vertical position. The first tier on deck was designated ‘tier 82’, the next higher one ‘tier 84’ and so on.
Appendix C – Bay 52 container stowage arrangement
Source: Yang Ming, modified and annotated by the ATSB
Appendix D – Bay 56 container stowage arrangement
Source: Yang Ming, modified and annotated by the ATSB
Appendix E – Results of lashing force calculations (Force)
Source: Yang Ming, modified and annotated by the ATSB
Appendix F – Results of lashing force calculations (Percentage)
Source: Yang Ming, modified and annotated by the ATSB
Appendix G – Checklist of container stowage operation
Checklist for cargo operations during YM Efficiency’s port call at Kaohsiung on 13 May 2018. Source: Yang Ming, modified by the ATSB
Appendix H – Bay 56 cargo disposition by port of loading
Source: Yang Ming, modified and annotated by the ATSB
Sources and submissions
Sources of information
The sources of information during the investigation included:
American Bureau of Shipping (ABS)
Anangel Destiny
Attikos
Australian Maritime Safety Authority (AMSA)
MacGregor
Manly Hydraulics Laboratory
Marine Rescue New South Wales
the Port Authority of New South Wales
Roads and Maritime Services (RMS)
Total Soft Bank (TSB)
Weather News Incorporated (WNI)
the ship’s manager—Yang Ming Marine Transport Corporation
YM Efficiency’s master and crew.
References
Graham Danton, 1996, The theory and practice of seamanship, 11th Edition, Routledge, London.
International Maritime Organization, 2007, MSC.1/Circ.1228—Revised guidance to the Master for avoiding dangerous situations in adverse weather and sea conditions, IMO, London.
International Maritime Organization, 2014, Code of Safe Practice for Cargo Stowage and Securing, IMO, London.
International Maritime Organization, 2014, MSC.1/Circ.1353/Rev.1—Revised guidelines for the preparation of the Cargo Securing Manual, IMO, London.
International Maritime Organization, 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London.
Lloyd’s Register and The Standard P&I Club, A master’s guide to container securing, 2nd Edition.
National Geospatial Intelligence Agency, 2018, Sailing Directions, East Africa and the Sothern Indian Ocean (Pub. 171), NGA, Springfield.
UK P&I Club, 2004, Container lashing and stowage.
United Kingdom Hydrographic Office, 2016, The Mariner’s Handbook (NP 100), UKHO, Taunton.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Yang Ming, the ship’s master, chief mate, second mate and chief engineer, AMSA, MacGregor, ABS, Marine Rescue NSW, Port Authority NSW, RMS, TSB and the Liberian Registry.
Submissions were received from Yang Ming, AMSA, MacGregor, MR NSW and PA NSW. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 24/07/2018
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Sequence of events
On 1 June 2018, at about 0035 Eastern Standard Time,[1] the Liberian-flagged container ship YM Efficiency (Figure 1) lost 81 containers overboard in gale-force weather conditions. At the time of the container loss, the ship was about 16 NM east-south-east of Newcastle, New South Wales (NSW). The occurrence also resulted in damage to a further 62 containers and structural damage to the ship’s gangway, superstructure and lashing bridges. The ship was on a regular service, calling at ports in China, Taiwan and Australia.
Figure 1: YM Efficiency entering Port Botany, NSW on 6 June 2018
Source: ATSB
YM Efficiency
YMEfficiency is a 268.8 m-long, 4,250 TEU[2] container ship, registered in Monrovia, Liberia. The ship was owned by All Oceans Transportation, Liberia and operated by Yang Ming Marine Transport, Taiwan. At the time of the incident, the ship was classed with the American Bureau of Shipping.
Loading in Taiwan
On the afternoon of 13 May 2018, YM Efficiency berthed at the port of Kaohsiung, Taiwan. About an hour after berthing, the loading of containers on board the ship commenced and just before midnight, cargo operations were completed. Shortly after, YM Efficiency departed Kaohsiung for Port Botany, NSW, Australia, with a maximum draft of about 12.6 m aft. On departure, the ship’s passage was executed to achieve an expected time of arrival at the pilot station off Port Botany at midday on 1 June 2018.
Passage to Australia
During the passage south, the ship’s crew received regular weather forecasts and advice to assist voyage planning, as part of a commercial weather routing service. By the afternoon of 29 May, the ship was off the coast of Brisbane, Queensland making good an average speed of about 9 knots. By this time, the ship’s crew had also begun to receive weather data broadcast by Australia’s Bureau of Meteorology (BoM).
By 0930 on 30 May, YM Efficiency was off the coast of NSW, about 32 NM to the north-east of Coffs Harbour. Weather forecast information received on board predicted steadily increasing winds and seas into the next day. Between 0930 and 1130 that morning, in preparation for the expected heavy weather, the chief officer was charged with carrying out checks in accordance with the ship’s heavy weather checklist. This included a check to ensure that container lashings on deck were secure, which was subsequently completed. By 1200, the ship was off Coffs Harbour with the weather recorded in the ship’s logbook as being west-south-westerly winds at force four[3] (between 11 and 16 knots) with 3 m seas and 2 m swells.
At 1605 on 30 May, BoM issued coastal waters forecasts for the Macquarie and Hunter coasts of NSW. Both forecasts included gale warnings for the next day, 31 May, caused by a low-pressure system moving east over the Tasman Sea for the next few days.
By 1900 on 30 May, YM Efficiency was off Port Macquarie and the weather had deteriorated. The weather was recorded as being cloudy with west-south-westerly winds at force eight (between 34 and 40 knots) with 6 m seas and 5 m swells.
By 0800 the next morning, 31 May, the ship was about 32 NM east-north-east of Port Stephens. The weather was recorded as being cloudy with west-south-westerly winds at force eight (between 34 and 40 knots) with 7 m seas and 5 m swells. The ship’s main engine speed was set at 35 revolutions per minute (rpm), the equivalent of ‘slow ahead’. At about 0830, a second heavy weather checklist was completed, with the container lashings checked once again.
The incident
At about 1300 on 31 May, the ship received information that the pilot boarding time for the ship’s call at Port Botany had been delayed by 8 hours to 2000 on 1 June. At about 1400, the ship’s main engine was stopped and the ship commenced drifting off the NSW coast, about 30 NM east of Newcastle (Figure 2). The weather at the time was recorded as being overcast with west-south-westerly winds at force eight (between 34 and 40 knots) with 6 m seas and 5 m swells.
Figure 2: Section of navigational chart Aus 489 showing YM Efficiency's track
Source: Australian Hydrographic Service, annotated by the ATSB
The ship’s main engine was re-started for brief periods over the next few hours to maintain some control over the ship’s drift. The rough weather continued into the evening with the wind recorded as having increased to force nine (between 41 and 47 knots) at 2200.
At about 2330, the ship’s main engine was started with the engine speed set to 35 rpm and the ship’s head was slowly brought around to the south-west to resume the passage to Port Botany. At midnight, the third officer handed over the navigation watch to the second officer. By this time, the ship was on a heading of about 210° with a speed of about 4.3 knots. The weather at midnight was recorded as being overcast with west-south-westerly winds at force nine (between 41 and 47 knots) with 6 m seas and 5 m swells.
At about 0034 on 1 June, in a position about 16 NM east-south-east of Newcastle, the ship experienced a period of quick, heavy rolling for about 60 to 90 seconds. The rolling was estimated by the ship’s master as having reached angles of up to 30º to port and starboard. Shortly after the start of the rolling, several engineering alarms sounded and the main engine shut down with the rpm reducing to zero. The second officer reported hearing loud noises on deck and suspected that there had been some cargo damage. He turned on the ship’s deck lights and observed that containers had been damaged and possibly lost overboard from the bays aft of the accommodation.
By about 0036, the rolling had reduced and the ship’s motion had calmed. By this time, the master had arrived on the bridge and the chief engineer and second engineer had proceeded down to the engine room to assist the duty engineer with the main engine shutdown.
The master took over the navigation of the vessel and instructed the chief officer to conduct a damage assessment. At about 0040, the chief officer reported several containers damaged or lost overboard from bays 52 and 56, just aft of the accommodation (Figure 3).
Figure 3: Damaged containers on bay 52 and bay 56 on board YM Efficiency
Source: ATSB
At about 0045, the main engine was successfully re-started and the engine telegraph[4] on the bridge was placed at ‘dead slow ahead’ and then, almost immediately, placed at ‘stop’ again. The ship continued to drift in the gale force winds and seas until about 0252, when the main engine was started and the ship resumed passage for Port Botany.
In the morning, the ship’s crew conducted more detailed damage assessments and attempted to stabilise the damaged and collapsed containers on deck. The container loss and damage was found to be limited to bays 52 and 56. The container loss was reported to the Australian Maritime Safety Authority (AMSA) who coordinated notifications to other involved stakeholders. AMSA also commenced modelling the drift of the lost containers and initiated safety broadcasts to warn shipping in the area of the hazard posed by the lost containers.
Over the next few days, AMSA, along with Roads and Maritime Services, NSW, continued to work with the ship’s owners and insurers to detect, identify and track containers and their contents on the NSW coast. Although there were a considerable number of damaged containers still on board the ship, no further containers were lost overboard after the container loss event on 1 June. The ship sustained damage to the gangway, superstructure and lashing bridges.
YM Efficiency eventually berthed in Port Botany at about 0936 on 6 June. Over the course of the following days, personnel representing several different stakeholders attended the ship including investigators from the ATSB, AMSA surveyors and the ship’s flag state - Liberia.
On 11 June, the first damaged container was discharged from the ship and by 21 June, all remaining damaged containers had been discharged. YM Efficiency departed Port Botany for Melbourne at about 2130 on 22 June.
Ongoing investigation
The investigation is continuing. The ATSB will follow any location and salvage efforts to identify any further evidence should it become available.
The investigation will include the following:
analysis of the ship’s container stow and lashing arrangement
analysis of the ship’s stability condition
actions of the ship’s officers and crew following the incident
analysis of weather conditions at the time of the incident.
The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this report. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 18 May 2018, an Airbus A320 aircraft, registered VH-VQK, was being operated on a regular public transport flight by Jetstar Airways. The flight departed from Sydney, New South Wales for Ballina/Byron Gateway Airport, New South Wales.
The flight crew conducted a go-around on the first approach at Ballina because the aircraft’s flight path did not meet the operator’s stabilised approach criteria. On the second approach, at about 700 ft radio altitude, a master warning was triggered because the landing gear had not been selected DOWN. The flight crew conducted a second go-around and landed without further incident on the third approach.
What the ATSB found
The flight crew did not follow the operator’s standard procedures during the first go-around and subsequent visual circuit at 1,500 ft. In particular, the flaps remained at Flaps 3 rather than Flaps 1 during the visual circuit. This created a series of distractions leading to a non-standard aircraft configuration for a visual circuit. Limited use of available aircraft automation added to the flight crew’s workload.
During the downwind leg following the first go-around, the flight crew did not select the landing gear DOWN as they had commenced the configuration sequence for landing at the Flaps 3 setting. Furthermore, the flight crew incorrectly actioned the landing checklist, which prevented the incorrect configuration for landing being identified and corrected.
Safety message
Unexpected events during approach and landing phases can substantially increase what is often a high workload period. Adherence to standard operating procedures and correctly monitoring the aircraft and approach parameters provides assurance that a visual approach can be safely completed. The selection of inappropriate auto-flight modes, unexpected developments, or any confusion about roles or procedures can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry. Handling of approach to land is one of these priorities.
The occurrence
First approach
On the morning of 18 May 2018, an Airbus A320 aircraft, registered VH-VQK, was being operated on a regular public transport flight by Jetstar Airways. The flight departed from Sydney, New South Wales for Ballina/Byron Gateway Airport, New South Wales. The captain was the pilot monitoring (PM) and the first officer (FO) was the pilot flying (PF).[1]
During the flight, the flight crew discussed and planned their arrival into Ballina. The forecast weather conditions were good with clear visibility and light winds. The FO suggested that they conduct a visual approach. Given that the conditions were good and the captain could see the airport from 50 NM the captain agreed. The FO then programmed the Flight Management Guidance System for the descent and arrival and carried out an approach briefing for a visual approach to runway 24. The FO recalled that he briefed the initial actions for a go-around, however, the flight crew did not discuss subsequent actions including the visual circuit[2] procedure.
At 1042 Eastern Standard Time,[3] the flight crew commenced descent during which they broadcast the required radio calls for their arrival on the common traffic advisory frequency (CTAF). During this period they became aware of a helicopter conducting right circuits at the airport.
Descending through about 2,100 ft the FO disconnected the autopilot and manually flew the aircraft. During manoeuvring to join a left base, the aircraft’s airspeed and altitude were both higher than a normal approach profile. The captain recognised the problem and recalled thinking that a go-around would be required, but due to the circuit traffic he wanted the aircraft established on final approach before commencing the go-around procedure.
The FO continued the approach and targeted a vertical speed of 1,000 ft/min descent and commenced a turn onto the final approach. Recorded flight data showed a peak vertical speed of about 1,300 ft/min at about 730 ft, and the aircraft still well above the desired vertical profile. Still turning onto the final approach the FO observed three white fly-down lights on the visual approach slope indicator system (VASIS).[4]
First go-around
At 500 ft above ground level (AGL) the aircraft automatically generated a callout of ‘five hundred’ and the captain commanded a go-around by calling out ‘not stable’. The FO commenced the go-around procedure (Figure 1).
Recorded flight data showed the aircraft was about 450 ft AGL when the go-around commenced. With take-off/go-around (TOGA) thrust set and Flaps 3 selected, the aircraft approached the circuit altitude of 1,500 ft about 10 seconds later.
As the FO levelled the aircraft it accelerated quickly toward the Flaps 3 limit speed (185 kt). The FO called for the approach phase[5] to be activated, which would have reduced the autothrust’s target speed from green dot speed[6] to 139 kt, and the captain went to action this request.
However, due to the aircraft’s acceleration, the FO believed the autothrust system would not prevent a flap overspeed prior to the approach phase becoming active. Consequently, he retarded both thrust levers to IDLE. This action disengaged the autothrust and generated an Electronic Centralised Aircraft Monitoring (ECAM) caution message (AUTO FLT A/THR OFF).
The captain heard the associated aural master caution chime, scanned the instruments and observed the aircraft’s pitch attitude being 10° nose up with Flaps 3 and idle thrust. He immediately commanded the FO to place both thrust levers back into the climb detent and re-engage the autothrust system. The FO subsequently reported that he had already commenced these actions at that time.
Figure 1: Flight path of VH-VQK during incident flight
Source: Google Earth annotated by ATSB.
Circuit for second approach
The FO commenced a left turn to conduct a standard left circuit for runway 24, however, the captain instructed the FO to conduct a right circuit. The captain later recalled his decision to conduct a non-standard right circuit was predicated on a number of reasons, but mainly due to the helicopter conducting right circuits and the noise sensitive area over the Ballina township to the south-east of runway 24 (Figure 1).
During the turn onto the downwind leg of the circuit, the FO offered the PF duties to the captain. The captain took control of the aircraft and the FO reverted to PM duties. The captain continued to fly the aircraft manually with the autopilot off and the autothrust engaged.
During the downwind leg, the captain recalled observing on his navigation display that the aircraft was positioned too close to the runway. Recorded flight data indicated the aircraft was about 1.2 NM abeam the runway rather than the captain’s desired 2.0 NM spacing. The captain turned left to widen the circuit spacing.
The flight crew completed the after take-off checklist. The captain noted that the flaps were set to Flaps 3 rather than the normal Flaps 1 configuration for a visual circuit, and he instructed the FO to let the flaps remain at that setting as he wanted to prioritise safely flying the aircraft in the circuit area.
As the captain commenced the turn onto the base leg, he scanned the ECAM upper display and observed the flaps were still set at Flaps 3. He commanded Flaps FULL, which the FO selected.
Both the captain and the FO stated they completed the landing checklist at about 950 ft AGL, which included the ECAM landing memo, and continued the approach.
At about 700 ft radio altitude (RA), a master warning for L/G GEAR NOT DOWN was triggered because the landing gear had not been selected DOWN. Recorded flight data showed that about 4 seconds after the master warning, the landing gear was selected DOWN. A further 2 seconds later the captain selected the thrust levers to TOGA and commenced a second go-around. The aircraft’s lowest recorded height was about 670 ft AGL.
Second go-around
The flight crew reconfigured the aircraft to gear UP and Flaps 1, as per the go-around procedure. The captain elected to continue manually flying the aircraft and conducted a second non-standard right circuit.
At about this time, the pilot of a Cessna 172 inbound from the north made radio calls advising aircraft at Ballina of his intention to join the (left) circuit for landing. The captain of the A320 provided instructions to the Cessna 172 pilot over the radio to confirm separation between the two aircraft.
On the downwind circuit leg for the third approach, the A320’s traffic collision avoidance system (TCAS) generated a traffic advisory (TA). The flight crew had remained in visual contact with the Cessna 172 and estimated its position to be about 2.0 NM to the north and about 800 ft above them. No further actions were required from either flight crew in relation to the TCAS TA.
On the third approach the flight crew configured the aircraft in accordance with the operator’s visual circuit procedures and actioned the landing checklist, including the landing memo items from the checklist. The aircraft landed on runway 24 without further incident.
The captain held an Air Transport Pilot (Aeroplane) Licence, a multi-engine command instrument rating and a Class 1 Aviation Medical Certificate. He had over 11,000 hours flying experience, of which over 3,000 hours were on the A320/A321. The captain was a check pilot for the operator; however, this flight was rostered as a normal line flight, with no check or training functions scheduled.
The first officer (FO) held a Commercial Pilot (Aeroplane) Licence and was appropriately qualified for the flight. He had about 1,600 hours flying experience, of which about 1,400 hours were on the A320/A321.
Both flight crew signed on for duty at Sydney Airport at 0510 and operated a flight from Sydney to the Gold Coast then return to Sydney. The flight to Ballina/Byron Gateway was their third flight of the day. Both flight crew reported that they had a reasonable amount and quality of sleep the night before and did not feel tired at the time of the occurrence. The captain had conducted flights the previous day and the FO had conducted flights on the two previous days, and neither reported any problems with their sleep prior to those days’ flights.
Both the captain and the FO had operated into Ballina on many previous occasions. The FO advised that this was only the third or fourth time he had operated into Ballina as pilot flying.
Go-around procedure
The operator’s procedures stated the pilot flying (PF) must conduct an immediate go-around if the pilot monitoring (PM) called ‘500 not stable’. The operator’s go-around procedure (based on the aircraft manufacturer’s procedure) detailed a sequence of actions that the PF and PM were required to perform, as summarised in Figure 2.
For most go-arounds, once the aircraft reached the nominated thrust reduction altitude, the procedure required the thrust levers to be placed into the climb detent by the PF. This action would activate the autothrust system.
In SPEED mode, the autothrust adjusts the thrust in order to acquire and hold a speed target and does not allow speed excursions beyond the maximum speed for each flap configuration. The flaps are not automatically retracted from the Flaps 3 configuration.[7] As the aircraft accelerates, the flight crew would need to retract flaps to the required position. The operator’s procedure when conducting a visual circuit following a go-around was normally to re-configure the aircraft to the Flaps 1 position.
Figure 2: Airbus A320 go-around profile
Source: Airbus.
Visual circuit procedure
The operator’s Flight Crew Operating Manual contained procedures for flying a visual circuit. The procedure detailed a visual circuit be flown at 1,500 ft AGL with Flaps 1. Prior to turning onto the base leg of the circuit, the flight crew should normally select Flaps 2, select landing gear DOWN and arm the spoilers. On the base leg, the flight crew should normally select Flaps 3 followed by Flaps FULL (if required). Flight crews would then perform the landing checklist.
ECAM landing memo
The Airbus A320 Electronic Centralised Aircraft Monitor (ECAM) presents data to flight crew on two displays: the Engine/Warning Display (E/WD) and the System Display (SD). Data presented includes:
primary engine indications, fuel quantity, landing gear, flap and slat position
warning and caution alerts, or memos
synoptic diagrams of aircraft systems, and status messages.
Memos are displayed on the lower section of the E/WD, and they list functions or systems that are temporarily used for normal operations. The display uses colour codes, which indicate to flight crew the importance of the indication. Green indicates the item is operating normally, and blue indicates there are actions to be carried out.
The landing memo is displayed when the aircraft is in the approach phase below 2,000 ft. However, after a go-around the system logic requires the aircraft climb above 2,200 ft radio altitude (RA) in order for the landing memo to reset. If the aircraft conducts a circuit lower than 2,200 ft the landing memo will not be displayed on the E/WD until 800 ft RA on the next approach.
Figure 3: Airbus A320 flight deck and E/WD landing memo
Source: Airbus modified by ATSB.
Landing checklist
As part of the operator’s stabilised approach criteria the landing checklist was required to be completed prior to 1,000 ft AGL. The checklist included an item for ECAM MEMO. When actioning that item the captain and FO were required to independently look at the ECAM MEMO on the E/WD, confirm that there was no blue text and, on observing that, announce ‘landing, no blue’ in response to the checklist item.
In the case of the landing memo not being displayed on the E/WD (as in the event of a go-around and visual circuit below 2,200 ft), the flight crew were required to read, check and announce the landing memo items listed on the checklist below the item ECAM MEMO.
Incidents such as the incorrect configuration of an air transport aircraft for landing are rarely the result of a single action or identifiable event. Instead, a number of factors combine to result in an unintended outcome; which in this case was the conduct of the second approach to Ballina/Byron Gateway Airport without the landing gear selected DOWN.
Although the incident was highly undesirable, it should be noted that the aircraft’s warning system effectively alerted the flight crew to the problem, and the crew responded promptly to the warning and initiated a second go-around.
Conduct of the first go-around
Due to the unstable approach on the first attempt to land, the flight crew appropriately performed a go-around.
An all engines go-around is a very dynamic procedure with high accelerations created by the application of take-off/go-around (TOGA) thrust. When performed at a low aircraft weight with low altitude level off, such as a 1,500 ft circuit height, it can be a demanding manoeuvre. It requires flight crews to perform a significant number of actions in a short period of time with all of them related to important changes of attitude, thrust, flight path, landing gear and flap configuration and flight modes. The actions need to be performed in the correct order, with a high level of coordination between the crew.[8]
The initial actions of the first go-around manoeuvre, up until reaching the thrust reduction altitude, were performed correctly. However, instead of retracting the flaps on schedule to Flaps 1, the first officer (FO) called for the approach mode to be activated first in an attempt to reduce the aircraft’s acceleration. Concerned about a potential flap overspeed, the FO then retarded the thrust levers past the climb detent to IDLE. This action de-activated the autothrust system and its protections, which limit thrust to help prevent overspeeds. With Flaps 3 still set and about 10° nose-up pitch attitude, the aircraft performance deteriorated, requiring intervention by the captain.
Visual circuit
In this incident, several distractions caused the flight crew to deviate from the operator’s normal visual circuit procedures at Ballina. The FO was anticipating a left circuit to be flown in accordance with the published procedure for runway 24. However, the captain commanded a non-standard right circuit for various reasons, which he had not previously advised the FO during the approach briefing or the subsequent approach.
As the aircraft was being turned onto downwind the flight crew were presented with further distractions including the handover of flying duties to the captain and then correcting the lateral flight path spacing in the circuit. The captain continued to manually fly the aircraft, which added to his workload. Accordingly, the captain elected to concentrate on flying the aircraft and have the FO conduct the required checklists and radio calls. As the captain prioritised tasks he chose to remain at Flaps 3, which was permissible and safe, but not the operator’s standard configuration for a visual circuit which was Flaps 1.
Landing configuration
Linking an aircraft’s normal procedures with an identifiable phase of flight is designed to assist a flight crew’s procedural recall. During most approaches, a flight crew will follow the same sequence for configuring flaps, landing gear and spoilers and conducting the landing checklist.
The operator’s sequence of configuring the aircraft for landing required the landing gear to be selected DOWN prior to the selection of Flaps 3. As the captain turned on to the final approach during the second approach, he scanned the flight instruments, observed Flaps 3 already set and instinctively commanded Flaps FULL, which was the normal sequence from Flaps 3. The FO selected Flaps FULL but then also turned his attention to monitoring the aircraft’s flight path. As such, neither of the flight crew were aware that the landing gear had not been selected DOWN.
Landing checklist
The flight crew flew the second visual circuit at about 1,500 ft. Therefore, the Electronic Centralised Aircraft Monitor (ECAM) landing memo logic was not reset after the go-around. When the flight crew performed the landing checklist on the second approach, with the aircraft at about 950 ft, the landing memo would not have been displayed on the Engine/Warning Display.
The absence of the landing memo should have prompted the flight crew to perform the items of the landing checklist as a ‘read-and-do’ checklist. Had they read the required actions from the checklist, both the captain and FO would have been required to independently check and announce that the landing gear was down. This method should have effectively ‘trapped’ their error.
When the landing memo did appear at 800 ft, both of the flight crew were situationally focused on intercepting the final approach path and performing radio calls. Neither the captain nor the FO recalled seeing the landing memo appear on the E/WD; which would have had the landing gear item in blue text. Both the captain and FO were subsequently alerted to the incorrect configuration for landing by a master warning message triggered at about 700 ft.
It would be ideal if the aircraft’s systems were designed such that the landing memo became available during the 1,500 ft visual circuit. However, system design is often a matter of compromise and there is also a need to minimise unnecessary complexity. Airbus set a minimum height of 2,200 ft to prevent spurious display of the landing memo during take-off and to prevent display flickering during an approach.
The exact reasons why both crew did not notice the absence of the landing memo when completing the landing checklist are unclear. However, a combination of workload and expectancy are often involved in such errors (Wickens and McCarley, 2008).[9] In this case, the flight crew probably expected the memo to be there, given that it is normally present at that phase of flight. In addition, the absence of something that should be present is often more difficult to detect than the presence of something that should not be there (for example, Thomas and Wickens, 2006).[10]
Overall, this occurrence reinforces the importance of using normal procedures, and minimising and managing the effects of workload during critical phases of flight.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
During the first go-around, the flight crew did not fully complete the standard go-around procedure, resulting in the aircraft’s flaps remaining at Flaps 3 rather than Flaps 1 during the subsequent visual circuit at 1,500 ft.
During the downwind leg following the first go-around, the flight crew did not select the landing gear DOWN, as they had commenced the configuration sequence for landing at the Flaps 3 setting.
The flight crew did not identify that, because the aircraft had not climbed through 2,200 ft, the landing memo had not been reset and was not displayed.
Following both go-arounds, the captain elected to conduct non-standard right circuits. This increased the potential for traffic conflicts with other aircraft, and flight crew workload managing such conflicts.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Jetstar Airways
As a result of this occurrence, Jetstar Airways has advised the ATSB that both flight crew members attended debriefings with flight operations management and were provided with specific simulator and line flying training related to the occurrence.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At 2000 Central Standard Time on 13 May 2018, the crew of a Leonardo Helicopters AW139, registered VH-YHF, departed Darwin, Northern Territory, to search for an active emergency position-indicating radio beacon (EPIRB). The crew flew under night visual flight rules with support of a night vision imaging system.
During an approach to a potential EPIRB target, smoke from nearby bushfires affected visibility and the helicopter developed an uncommanded high rate of descent. The Aircrew Officer, in the rear of the helicopter, called ‘Climb! Climb! Climb!’, and the pilot regained control with a rehearsed recovery drill. During the recovery procedure, the power demand exceeded airframe limitations. This exceedance went undetected, and the helicopter was flown on a second sortie that same evening.
What the ATSB found
The pilot entered instrument meteorological conditions during approach, and lost control of vertical speed. The helicopter descended to 31 ft above ground level during the event. Reversion to standard patter and practiced drills allowed the crew to recover the situation and avert an accident.
Two layers of protection available to the crew of the helicopter were not used. Flight instruments were not referred to in the incident approach, and a crewmember trained to support the pilot in monitoring the approach was required to be in the rear of the aircraft.
A main gearbox over-torque of 159.5 per cent occurred during the recovery. The crew could not determine the magnitude of the potential over-torque after the event. Subsequently the aircraft remained in service in a condition of uncertain airworthiness.
What has been done as a result
CareFlight has established three main controls aiming to prevent reoccurrence:
Stabilised Approach Criteria was written into standard operating procedures, requiring an immediate go-around if the aircraft leaves a prescribed range of approach parameters.
Controlled flight into terrain (CFIT) avoidance training was incorporated into the ground-based training syllabus.
Improved advice on use of auto hover functions was written into aircraft handling standard operating procedures. This included a requirement that the function was not to be engaged while the helicopter was descending.
Safety message
Pilots must be aware of the human factors hazards associated with loss of visual references. Pilots can protect themselves by maintaining the use of instrument scans in approaches at night, and making use of monitoring by trained and available crewmembers.
Flight planning should include assessment of the risk of a degraded visual environment. Operators should document their minimum acceptable levels of illumination and levels of tolerable risk. Where the risk exists, predetermined responses should be readily available.
Instrument flight rules (IFR) pilots in IFR-rated aircraft should prioritise use of inadvertent instrument meteorological conditions drills and pre-planned exit routes over recovery of visual meteorological conditions.
Flight crew and engineering teams should not rely solely on indicators, or absence of indicators, to determine airworthiness. If there is any reason to suspect exceedance of aircraft limits, operators should run diagnostics to determine the airworthiness of the aircraft beyond doubt.
People have a responsibility to aid their own rescue. Up-to-date registration of an EPRIB, and correct use of an EBIRB and other signalling equipment, simplifies a rescue of people in need. Australian Maritime Safety Authority guidelines exist to help people prepare for onshore and offshore remote area travel.
The occurrence
Incident flight
On the evening of 13 May 2018 at 1943 Central Standard Time,[1] the Rescue Coordination Centre (RCC) tasked the crew of a Leonardo Helicopters AW139, registered VH-YHF, to locate an active emergency position-indicating radio beacon[2] (EPIRB) 38 km north-east of Darwin Airport, Northern Territory. The EPIRB had been activated within the vicinity of a waterway called Salt Water Arm (Figure 1).
Figure 1: Map showing Darwin take-off point, search area, and location of incident event
Source: Google Earth annotated by the ATSB
The area was popular with recreational anglers, so the crew of VH-YHF anticipated responding to a boating event. They also determined that such a response would likely require use of the aircraft’s winch.
The crew configured the aircraft with the pilot on night vision goggles[3] (NVG) in the front right seat, the aircrew officer (ACO) with NVG in the rear cabin by the right hand door, and the flight nurse in the rear cabin without NVG. Lighting within the cockpit and cabin was NVG-compatible. Two steerable searchlights mounted to the front, one steerable searchlight mounted to the right side of the aircraft, a handheld light operated by the ACO, and LED light bars at the front and rear of the helicopter supported the Night Vision Imaging System[4] (NVIS).
At about 2000, the crew departed Darwin Airport with good visibility. At that time, a five-metre tide was receding from Salt Water Arm. There was little illumination as the moon had set at 1653, and the sun had set at 1830. There was limited celestial light available through the gaps in the clouds which were forecast as scattered[5] cumulus and stratocumulus clouds at 2,000 ft, with cloud tops to 10,000 ft. Smoke from outlying grass fires drifted across the search area below 7,000 ft, reducing visibility to 4 km in places. The crew could not easily detect the smoke due to low illumination.
As the crew descended into the search area and commenced the search, smoke became evident as the task progressed. The ACO described visibility as 5 km but dropping in and out due to large amounts of smoke. These conditions are common for the region, and recent check flights for the crew had been conducted in similar conditions.
During the flight, the beam of the search light would reflect off smoke and ash. Backscatter from the beam was affecting visibility, reducing NVG image quality, and reducing peripheral vision. As a result, the beam required frequent adjustment. The ACO contacted the RCC and advised that limited visibility may hamper the operation.
The helicopter was fitted with direction-finding equipment (DF) which enabled the crew to locate the source of a 121.5 MHz beacon signal, such as the EPIRB. The crew found that readings from the DF were erratic and unreliable. This added a level of complexity to the operation, making it difficult to locate the beacon. As a result, the crew conducted a visual search for potential targets from a safe working height of above 800 ft above ground level (AGL).
While the use of NVG allowed the crew to detect targets, the image quality was not high enough to verify the targets from this safe working height. The crew had to fly the aircraft down to 400 ft AGL to verify whether their target was one requiring rescue. The crew flew the descent to the target visually, using searchlights to ensure the approach and departure paths were clear of obstacles. The intent was to decrease rate of descent and airspeed before activating auto-hover (HOV) mode at 400 ft AGL.
At 2110:30, the crew commenced an approach from the north to a point of interest in Salt Water Arm. The pilot reported visibility on approach to the target as good to the north-west, and dark to the north and east. During this approach, the pilot lost visual references. At 2110:40, the pilot activated HOV mode. At this time, the helicopter had already developed an undesired high rate of descent (Figure 2).
Figure 2: Flight path of VH-YHF during the event
Source: Leonardo interpretation of data from the Flight Data Recorder, annotated by ATSB
At the point of activation of HOV mode, the aircraft was at 430 ft, pitched 19.7 degrees nose-up, and descending at over 1,300 ft/min with a ground speed of 14 kt. The autopilot increased collective[6] pitch to 48 per cent to arrest the rate of descent.
Due to the lighting installed on the aircraft, and prioritisation of peripheral vision, the ACO could see the ground below and advised the pilot of a high rate of descent. The ACO provided advice twice more to the pilot before transitioning to an emergency call of ‘Climb! Climb! Climb!’ The pilot was by now receiving clear visual cues and detected a rapid rate of closure with the ground.
At 2140:46, at a height of 280 ft with a rate of descent of 1,630 ft/min, in a reversion to drilled emergency procedures, the pilot overrode aircraft automatics and used forward cyclic[7] and collective to reverse the rate of descent. The pilot directed his attention to the attitude indicator and the picture outside. The pilot increased collective pitch to 77 per cent. At this point, the rate of descent increased to 1,952 ft/min, indicative of onset of vortex ring state[8].
Maintaining forward cyclic, the pilot was aware of engine temperature limits and made a small reduction in collective to avoid exceeding the limits, before increasing collective again to 84 per cent.
At 2140:50, a yellow caution light illuminated and a crew alert system (CAS) message appeared on the display. Occupied with the recovery procedure, the pilot flew solely through the outside picture and the attitude indicator. The aircraft descended to a height of 31 ft AGL before attaining a positive rate of climb. As the pilot’s recovery manoeuvre ceased and control inputs returned to normal, the warning self-extinguished at 2140:57. The pilot noticed the warning, but could not read it before it extinguished.
It is likely that any further delay in conduct of the recovery drill would have led to an impact with terrain.
Return to base
The crew advised the RCC that they would end the flight and return to base. The crew landed the helicopter back at base at 2158. The pilot found that ash had accumulated on the fuselage of the helicopter, confirming flight through streams of smoke. During the flight through smoke, visibility was reduced below the visual minima.
A crew debrief took place and it was thought that a main gearbox overtorque could have occurred. There is no capacity in the aircraft for the crew to check for overtorque without the presence of an aircraft maintenance engineer (engineer). As a precaution, and as per Operations Manual requirements, the crew called a duty engineer to explain the situation and seek advice.
The duty engineer asked the crew to check the CAS system for messages. If an overtorque occurred, a white status message saying ‘maintenance’ would be present. This would signal a requirement to download and analyse data from the aircraft’s central maintenance computer (CMC).
The pilot estimated the extent of a potential overtorque to be within operational limits. The crew did not detect a maintenance message. With this information, the duty engineer advised that no maintenance activity was required.
Subsequent mission flight
Prior to the mission’s second flight, the crew thoroughly discussed the event. They developed a different strategy for the search to prevent reoccurrence, including the use of topography over the DF.
At 2254, the crew departed for the second flight to locate the source of the EPIRB transmission. The crew flew the arms of the river system at 1,000 ft using the autopilot, with the pilot flying with reference to instruments, and the ACO visually searching from the back.
The EPIRB was successfully located and noted to be in the bottom of a 14 ft metal-hulled recreational fishing boat. The boat carried two people and was in total darkness. As the vessel was unlit, the ACO could see the EPIRB flashing in the bottom of the boat. The position of the EPIRB had most likely resulted in the sporadic readout of the DF.
The helicopter crew directed a nearby Northern Territory Water Police vessel to the scene. The Water Police were then able to assist.
Detection of main gearbox overtorque
The following day, the crew related the experience to an engineer in the hangar and requested a download of the CMC data to check for potential issues. An overtorque of the main gearbox is recorded when a torque limit is exceeded. The limits for all engines operative are 110 per cent for five minutes, or 121 per cent for 5 seconds.
The engineer downloaded and analysed the data. An overtorque in excess of 125 per cent requires grounding of the aircraft, and analysis of the data by the engine and airframe manufacturers. He found that a main gearbox overtorque to 159.5 per cent had occurred during the first flight. The extent of the overtorque was such that the helicopter should not have been flown until the engine and airframe manufacturers declared the helicopter serviceable.
The engineer grounded the helicopter and sent data to the manufacturers of the engines and airframe for analysis. This meant that the crew had departed for their second flight of the previous evening in an aircraft of uncertain airworthiness.
Five days later, the engine manufacturer confirmed that the engines were undamaged and suitable for service. The helicopter manufacturer advised that the helicopter’s main gearbox was serviceable and required inspection of oil for metal contamination at 50 flight-hour intervals. The engineers carried out the necessary actions, and subsequently returned the helicopter to service.
The pilot had over thirty-seven years’ experience in flying helicopters. He held an Airline Transport Pilot Licence (Helicopter) and instrument rating (Helicopter), authorising him to conduct night visual flight rules[9] (NVFR) and instrument flight rules[10] (IFR) operations as pilot. The pilot had gained experience around the world in military helicopter operations, onshore and offshore resource support, mountain flying, search and rescue, and ambulance helicopter operations. He held a current Class 1 Aviation Medical Certificate.
Table 1: Pilot’s rotary-wing hours accumulated
Total Time Rotary Wing
9,800
Instrument Flight
327.5
Night Flight
833.0
AW139
724.9
Source: Pilot
The pilot had more than 100 hours’ experience in command with night vision imaging systems (NVIS) and held a grade 1 NVIS rating. The operator’s training and checking system evaluated the pilot as level 2 night vision goggles (NVG).
The pilot achieved currency with an NVIS proficiency check on 9 May 2018. Notes on file advised the pilot to seek practice opportunities in order to consolidate skills for future upgrade to a level 1 NVG pilot. The report also noted that a lack of opportunity to practice was preventing the pilot from making best use of the aircraft’s automated systems.
The pilot’s roster pattern was week-on, week-off, performing 24-hour standby while rostered on. The most recent pattern started on 09 May 2018. In the 4 days prior to the incident, the pilot had accumulated 27.3 hours of duty and 5.8 hours of flight time. Within the Operator’s Fatigue Risk Management System[11] (FRMS), scores of 75 or less were considered consistent with safe working practices. The pilot’s score was 51. He reported feeling well and alert.
Aircrew Officer
The Aircrew Officer (ACO) had 23 years’ experience in crewing Search and Rescue (SAR) and Emergency Medical Services (EMS) helicopters as winch operator and down the wire rescue crewmember. He also held a Commercial Pilot Licence (Helicopter). His total experience in crewing helicopters was over 3,500 hours.
The ACO was NVIS and winch current, having undergone currency and proficiency flights on 10 and 12 May 2018. The Operator’s AW139 crewmembers all completed a pilot’s ground school course for the AW139. The ACO was trained and competent in front seat support and rear cabin activities. The ACO was rated as a Level 1 NVG crewmember within the operator’s system. He had over ten years’ NVIS experience, and he was part of a team that first integrated NVIS into company operations.
The ACO worked on a week-on, week-off, 24-hour standby roster. The ACO reported feeling well and rested at the time of the incident. The ACO’s score of 32 in the Operator’s FRMS supported this.
Flight Nurse
The Flight Nurse (FN) was a medical crewmember responsible for patient care, and not expected to be involved in the operation of the aircraft in flight.
Flight crew configuration
Exemption to operate with crewmember in rear cabin
The Civil Aviation Safety Authority (CASA) provided the Operator with an exemption to Supplement 60 of the AW139 rotorcraft flight manual. The exemption allowed the ACO to operate from the rear cabin of the aircraft during flight below 300ft and for landing at unimproved sites.
The Operator provided a risk analysis for landing at unprepared helicopter landing sites (HLS) under NVG to CASA in support of the exemption. For the descent and final approach phases, the identified risks were concerned with unintentional interference from the ground, obstacles, and loose objects. The helicopter manufacturer had no technical objection to the exemption on the provision that, amongst other things, the crewmember focussed on ensuring identification of obstacles.
Focussing on flight below 300 ft, the risk analysis provided for the initial exemption did not consider risks in the approach phase of flight relating to monitoring and the need for a single pilot to transition from outside goggle vision to instruments to supported peripheral vision. This exemption was later rendered unnecessary by an amendment to Supplement 60 in revision 22 of the AW139 rotorcraft flight manual on 19 October 2017. The manufacturer stated that they addressed risks during transition phase in the initial NVIS certification of the aircraft.
Climb-through
The Operator listed the responsibilities of an ACO in their operations manual as:
Under direction of the pilot assist with the operation of all aircraft equipment and systems during the conduct of VFR, NVG and IFR operations;
and
… operate the winch, dispatch, and recovery of personnel and assist the pilot in maintaining clearance from obstacles by lookout and reporting over the intercom.
Company ACOs could not carry out all of their duties from one location in the aircraft. The ACO had to climb between the front and back as operational requirements demanded. CASA’s position was that they supported the role of the ACO in the front left seat and did not support the transfer of the ACO from the front to rear of the cabin and vice versa in flight. CASA preferred operators to land for the ACO transfer through the aircraft to take place.
When responding to an emergency, the ACO would ordinarily begin the flight in the front and assist the pilot, then climb through to the rear to operate the winch as required. When an ACO used the climb-through, the company required the crew to file a report for data collection and analysis of the procedure.
On this flight, with no available landing sites on scene, and a short flight to the search area with anticipated use of the winch, the ACO began the flight in the back of the helicopter.
Aircraft information
General
Leonardo Helicopter’s AW139 is a medium-sized twin-engine helicopter powered by two Pratt & Whitney PT6C-67C engines (Figure 3). Each engine is capable of producing take-off power of 1,252 kW. Each engine produces enough power for the aircraft to climb in the event of one of the engines failing. The main gearbox’s maximum limit for power from both engines is 1,641 kW. Therefore, overtorque of the transmission can occur when a pilot demands excessive engine power with both engines operative.
VH-YHF
AW139 serial number 31108 was registered in Australia on 18 February 2008 as VH-YHF, and at the time of the occurrence had flown 3,423 hours. The helicopter was certified and maintained for IFR and NVIS operations.
The helicopter’s autopilot was a 4-axis system with enhanced 3-cue flight director (FD). The FD is capable of controlling the helicopter’s movement in the pitch, roll, yaw, and vertical axis. The installed version of the FD had auto-hover functionality (HOV) mode, yet did not offer SAR modes that can mark, return, and transition down to a selected target.
Figure 3: AW139 helicopter VH-YHF
Source: Careflight
Auto-hover
HOV mode incorporates two systems to hold the aircraft at a point in space selected by the pilot. The first system controls the pitch and roll of the aircraft to maintain a zero ground speed in all directions. The second uses the barometric altitude or the radio altimeter[12] (RADALT) information and control of height to maintain the altitude selected by the pilot.
Aside from the panel-mounted autopilot controller, the pilot can activate both systems with the centre of the pitch/roll beep trim selector switch on the cyclic (Figure 4). With the airspeed below 75 kt, ground speed below 60 kt and altitude between 15 ft and 2,000 ft above ground level the system can be engaged. Engaging the system instructs the autopilot to make control inputs to bring the aircraft to a hover at the height showing on the RADALT at the time the pilot presses the switch. There was no vertical speed limit to engage HOV mode. The manufacturer did not intend for HOV mode to be engaged with a high vertical speed, though it did not preclude a pilot from doing so.
If engaged with a high vertical speed, the system would show as engaged and the autopilot would make adjustments necessary to attain the height designated by the pilot. This would induce a magnitude of overshoot relative to the vertical speed at time of engagement. A difference between the reference height and actual height would trigger a warning once large enough. For example, at a reference height of 500 ft, a message ‘HTLM’ appears on the PFD and ‘ALTITUDE, ALTITUDE’ sounds when the actual height passes below 430 ft.
Source: Leonardo Helicopters, annotated by the ATSB
Crew Alert System
The primary flight display (PFD) and the multi-function flight display (MFD) present instrumentation to the pilot (Figure 5). The PFD displays FD modes selected, and their status. The MFD displays engine and aircraft system data and the crew alert system (CAS). The CAS displays messages pertaining to the operation and condition of the aircraft to the crew for information and action.
Figure 5: Exemplar AW139 cockpit displays
Source: Leonardo Helicopters file photo, annotated by the ATSB
The CAS messages appear in order of priority. Red warnings appear at the top of the list, next are yellow caution messages, third are green advisory messages, and fourth are white status messages. The final line in the list is white text stating ‘END.’ Each page shows twelve lines and crew can scroll through pages. When scrolling, red warnings cannot be hidden and remain at the top of the list on each page.
A warning or caution message will show with a coloured background until acknowledged. Once acknowledged, it appears as coloured text on a black background. Some messages such as “XMSN OVTQ” (main transmission overtorque) will disappear when the condition causing them has passed. White status messages will only show on the ground with weight on wheels (Figure 6).
The “MAINTENANCE” message is significant because following exceedance of a limit such as torque, it will illuminate after landing. The presence of the “MAINTENANCE” message is a cue to an aircraft maintenance engineer (engineer) to investigate and rectify the cause of the message before cancelling the message.
Figure 6: Exemplar caution light and maintenance message on CAS
Source: Leonardo Helicopters, annotated by the ATSB.
Night vision imaging system
To improve vision during night operations, the helicopter crew utilised an NVIS. The operator was experienced in application of these technologies. They trained their own crews and offered NVIS training to other operators.
The operator’s NVIS comprises:
AN/AVS-9 green phosphor Night Vision Goggles (NVG)
NVG-compatible cockpit lighting
NVG-compatible cabin lighting
2 x 450 W incandescent forward facing steerable search lights
1 x 450 W incandescent steerable search light by winch
White flood lights at the front and back of the aircraft.
The operator mandated the use of NVIS for all visual flight rules (VFR) flights at night.
Goggle position
The human eye carries two sets of light-sensitive receptors: rods and cones. The cones are packed into the fovea, the central part of the retina responsible for focal vision. The rods populate the area of the retina used for peripheral vision. The way in which information from the focal regions and information from the peripheral regions is processed differs significantly (Miller & Tredici, 1992).
Peripheral vision is processed automatically and quickly. Humans utilise peripheral information to orientate themselves within their environment without even noticing. Focal vision requires conscious processing, which happens slowly and takes up cognitive resources (RTCA, 2001). The information delivered to the user through NVG is largely within the focal region. The cognitive resources required take away from other tasks requiring focal vision, such as interpretation of instruments (Salazar et al, 2003).
NVG offer a field of view (FOV) of 40° vertically and horizontally, much narrower than the 200° horizontally and 120° vertically most humans experience (Morawiec and others, 2007). Goggles are normally adjusted to a point where the central image is sharp, and the edge of the picture is slightly blurred yet becomes sharp when focussed upon. This puts the eyepiece approximately 25 mm from the eye.
This operator advised that they extend the NVG further away from the eye again. This reduces the FOV by a couple of degrees and increases the amount of peripheral vision available. This, in combination with copious white light, provides for increased peripheral vision when looking around the goggles below 400 ft in the obstacle environment.
This provides benefit in spatial orientation in low-level hover operations. The effect will be lost if peripheral cues become unreliable and obscure the target, such as happens with backscatter from obscurants like smoke.
White light
The use of white light is fundamental to this operator’s NVIS usage strategy. NVG-friendly[13] searchlights do not help in obstacle clearance as the NVG do not detect the light reflected by obstacles in the vicinity. White light (detectable by NVG) is amplified by the goggles and provides a clear image of where obstacles are. The crew moves the lights in a ‘scan and pause’ pattern with a wide swath either side of the planned approach and departure paths looking for obstacles.
The combination of peripheral vision and white light likely aided the ACO in his assessment of rate of closure and enabled his timely use of emergency phase Crew Resource Management (CRM).
NVIS approach procedure
Overhead the HLS or point of interest, the pilot marks the target on the GPS. The pilot then flies a circuit at 1,000 ft to set up an approach to the spot. Since the visual acuity afforded by the goggles does not provide ground cover detail until a height of 400 ft, the pilot must use instruments to monitor the progress of the aircraft, as per normal night flight procedures. The company operations manual highlights three critical instruments for the initial stage of the approach:
attitude indicator, to avoid incorrect attitude adversely affecting airspeed and rate of descent
vertical speed indicator, to make up for the reduced visual cues for rate of descent
radio altimeter, to incorporate a visual and audible warning that is set at 400 ft as a defence against unexpected rates of terrain closure
The pilot manually flies to a datum point of 400 ft above ground level (AGL) to attain the visual acuity required to identify the target. It is common to come to a hover at 400 ft to complete the reconnaissance and crew brief. The pilot can select HOV mode to pause. If there is a need to descend to winching height, the crew scans the approach and departure paths with searchlights using a ‘stop, scan, move’ process.
Once clear, the crew agrees to continue and the pilot eases the aircraft forward and down with the autopilot. ACO and pilot will work together to bring the aircraft to the best hover reference.
Meteorological information
During the shift, the pilot monitored weather reports and weather forecasts from sources at Darwin and surrounding airports, and the Bureau of Meteorology (BoM). The Aerodrome Forecast (TAF) for Darwin airport, valid for the duration of the flight, forecast wind as 6 kt from the south‑east, visibility of 10 km or greater, nil significant weather, and nil significant cloud below 5,000 ft. The aerodrome report matched the forecast precisely with the exception of showing wind to be 5 kt.
The BoM issued a Graphical Area Forecast (GAF) at 1332 Central Standard Time (CST), which carried a validity from 2030 CST for six hours. The planned operation was within area B2, and the operations were close to the boundary with B1. The GAF forecast scattered cloud with base 2,000 ft and tops to 10,000 ft in the area of B1. The forecast for the area B2 was visibility over 10 km reducing to 5,000 m with isolated areas of smoke below 7,000 ft. The crew reported that some of the conditions associated with B1 existed in their area of operation.
At 1923 CST, BoM published a new GAF. The new GAF showed visibility of 10 km reducing to 4,000 m with isolated areas of smoke below 7,000 ft in B2. Pilots utilising NVG must maintain visibility of 5,000 m at or above 500 ft above terrain or obstacles (Civil Aviation Order 82.6). In areas of smoke, visibility could be expected to be below that required for VFR flight at night.
Environmental conditions
On the night of the incident, there was very little celestial illumination. The moon had set at 1653 CST, and the sun had set at 1830 CST. The only light was starlight. Clouds obscured much of the starlight available.
Grass fires had been burning to the southeast of the region for several days. Smoke from the outlying grass fires drifted across the search area below 7,000 ft, reducing visibility in places. The operations manual mentioned smoke as a common cause of loss of visual reference, and pilots were required to memorise loss of visual reference drills.
The crew reported that these conditions had prevailed for a week. Training notes from a flight three days prior described similar conditions. The report stated:
…this flight was conducted on an especially difficult NT typical night – no moon, very low illumination, and smoke contamination.
Where operationally viable, the crew flew the helicopter above the smoke inversion, which they reported to be at around 1,000 ft.
Risk management of deteriorating weather and loss of visual references
The operator’s risk management profile recognised the risk of deteriorating weather and loss of visual references during a SAR operation. Among the potential consequences was loss of control leading to an aircraft accident. The management of the risk included controls for prevention of an occurrence, and for recovery should the event occur.
Prevention controls
Documented controls for the prevention of loss of visual references were:
Training and checking, to ensure that crews have relevant experience of similar conditions, all crew know how to assist in the approach and landing phase, and that procedures are being correctly followed.
Maintenance of good CRM, to ensure effective mission management and decision making aboard the aircraft.
Keeping the ACO current to assist the pilot with management of the flight.
Recovery controls
Recovery controls covered four aspects of operation:
Equipment fit, ensuring that the aircraft is appropriately equipped and has a functioning RADALT and Attitude Indicator.
Sound knowledge of procedures and limits for visual illusions and inadvertent instrument meteorological conditions (IIMC).
Crew preparedness: Use of simulator training to ensure crews have exposure to implementing correct technique in recovery procedures.
Crew Resource Management: Ensuring unambiguous and timely communication in situations requiring urgent action.
Beacon activation
Activating an emergency position-indicating radio beacon (EPIRB) begins a distress signal transmission on the 406 MHz frequency, which is detected by satellites. The transmission contains a code that identifies the registered owner of the EPIRB in a database. The Rescue Coordination Centre (RCC) can use the registration details to source information on the activation of the beacon, and contact the owner or a nominated emergency contact.
In this case, the EPIRB belonged to a Queensland-registered vessel, which was sold some time before without re-registration of the EPIRB. As a result, the RCC had no current contact details or information for the current owner of the EPIRB.
EPIRBs in Australia also transmit on the 121.5 MHz frequency. Search and Rescue Assets carry direction-finding (DF) equipment to home in on 121.5 MHz signals. When the beacon is correctly deployed, the DF shows the crew the direction the signal is coming from.
On 22 July 2007, the crew of a Bell 412 were searching for the source of an EPIRB transmission. The pilot was IFR-rated and the aircraft IFR-equipped. The crew were operating on a dark night with searchlights without NVG. There was smoke from active bushfires in the area.
During the approach, the pilot lost visual references due to the haze from smoke and dust in the atmosphere. The helicopter entered a high rate of descent. The aircrew officer called ‘zero airspeed.’ The pilot initiated recovery actions and the main gearbox was over-torqued in the recovery.
There was a landing site available and the pilot continued the approach from 200 ft AGL and inspected the helicopter after landing. The Bell 412 had a physical indicator that clearly indicated to the crew that overtorque had occurred.
In December 2009, the crew of a Bell 206L was conducting aerial work on a fire ground. The pilot was not IFR-rated and helicopter was not IFR-equipped. On take-off, the helicopter entered low cloud. The pilot lost control and the aircraft collided with the ground; the pilot was seriously injured and the passenger was fatally injured. There was no option for the pilot to conduct an IIMC drill to stabilise the aircraft and attain a safe profile.
On 21 October 2016, the crew of a BK 117-C2 were returning to base from carrying out an EMS mission. The pilot was IFR-rated and the aircraft was IFR-equipped. The flight was conducted under NVFR with NVIS. Conditions were marginal, and on departure, the helicopter entered low cloud.
The ACO declared loss of visibility on take-off. The pilot had poor visibility ahead yet could see well to the right. The pilot thought visibility would improve as they passed ground lighting that was reflecting in raindrops on the canopy.
The visibility did not improve, and the pilot slowed the aircraft to maintain visual meteorological conditions. The low-speed manoeuvre resulted in an undesired aircraft state and a terrain awareness warning activated. The pilot conducted an IIMC drill, restabilised control, and continued the flight before landing safely.
Aeromedical flights in the United States
In an analysis of aeromedical flights in the US, Aherne and others (2016) found that between 1995 and 2013, the US aeromedical industry had 32 fatal accidents resulting in 100 deaths. These flights were all single-pilot operations at night. All flights were operated under VFR, and two thirds of the fatal accidents occurred in instrument meteorological conditions (IMC).
During an approach to a potential search and rescue target, smoke from nearby bushfires affected the visibility for the flight crew. The helicopter developed an uncommanded high rate of descent, and the aircrew officer in the rear alerted the pilot, at which point a recovery was enacted. The recovery manoeuvre resulted in an airframe limitation exceedance, which went undetected for the subsequent flight.
This analysis will examine the operator’s risk management, degraded visual environments, single pilot operations, and airframe limitation exceedance management.
Operator’s risk controls
On this occasion, prevention controls failed and recovery controls worked to save the aircraft and crew. There were, however, gaps in the implementation of all of the documented controls:
Training and checking achieved the aim of creating relevant experience, yet an identified limited practice opportunity reduced efficacy.
Crew resource management (CRM) lapsed in a missed announcement of loss of visual references. CRM was, however, restored to good effect in recovery.
The aircrew officer (ACO) was trained yet not positioned to assist the pilot in managing the approach.
There were no preventative controls that helped crews to define limits of visibility beyond the description of visual flight rules (VFR) minima.
The operations manual stated:
Illumination levels are significantly affected by moon position and strength, cloud presence, and cultural lighting and during NVG operations; illumination levels have a profound effect on the ability of the NVG to clearly discern terrain at distance. Visibility is also affected by the usual day time issues of dust, snow, moisture, bushfire smoke and other atmospheric obscurants.
However, the operations manual offered no guidelines on interpretation of factors affecting visibility or definition of acceptable limits. This meant the crew had to interpret marginal conditions during operations and decide if the minima were sufficient. This meant that the organisation did not set its own tolerance for risk in this regard.
During the event, CRM, the well-rehearsed recovery drill, and use of the attitude indicator were all vital in recovering control of the aircraft. The documented and implemented recovery controls worked as intended.
Contribution of night vision imaging system
Studies have shown that night vision goggles’ (NVG) performance can lead pilots to revert to a daytime model of operation (Rash, 2010), leading them to overlook the threats and complexities of operating with NVG. The operator’s operations manual clearly reminded crew that NVG does not turn night into day, and that the use of NVG carries limitations and risk.
Low-contrast Terrain
The search area was an area of low-contrast terrain for night vision imaging systems (NVIS) operations. This meant that elements of the terrain reflected similar amounts of celestial light, creating a low-quality image in the NVG. This lack of detail reduced visual cues. The reduction in visual cues most likely led to difficulty in perceiving the aircraft’s attitude and estimation of terrain clearance (Parush et al., 2011).
Obscurants
Airborne particles affect the image that NVG produce. The cues that would normally be relied upon for loss of visual meteorological conditions (VMC)[14] may not be present. Operating unaided, light sources begin to disappear as obscurants increase. Under NVG, as obscurants reduce the light energy reaching the goggles, NVG will continue to amplify the light signal, disguising the worsening visibility (see CAAP 174-01 11). There will be steady reduction in image quality outside of the bright spots as signal to noise ratio reduces. Scintillation[15] in the image will occur.
Sighting pinpoints of bright light over long distances does not mean that visibility is in excess of 5 km. Visibility must be measured by the distance detail can be seen on the ground. If a pilot using NVG can see lights but no ground detail, they may be in or very close to instrument meteorological conditions (IMC).[16] An early decision to use a recovery drill if visual references are lost is also vital to ensure entry into IMC does not develop into a loss of control or controlled flight into terrain.
Degraded visual environment
Conditions of degrading visibility create ambiguity. This ambiguity can stall decision-making, as two contextually different situations are faced (Orasanu and others, 2001). Either the approach continues and the target is assessed, or the approach is aborted and the mission is delayed.
Pilots rely on appropriate visual cues to assess quickly and accurately the aircraft’s current and future situation. Darkness, even while utilising a NVIS, reduces availability of these cues. No one is immune to these phenomena and strict adherence to an instrument scan on night approach is the primary protection available.
Pilots tend to underestimate the likelihood of loss of control and overestimate their ability to continue to control the aircraft if visual references are lost (Wiggins and others, 2012). The cues for IMC are an absence of those for VMC. The search area for cues to resolve the ambiguity is external to the aircraft, and as such, attention can be drawn outside (Summerfield & Egner, 2009).
Humans also often incorrectly believe that changes will be easy to detect in their environment. Unless someone observes a change while it is taking place, there is a good chance it will not be picked up (Wickens & McCarley, 2008). While searching outside for cues, changes on instruments can be missed. These missed changes can lead a pilot to believe that their knowledge of their position and trajectory in space is accurate. This belief leads to a reduction in the search for new information or information to the contrary (Wickens & McCarley, 2008).
Above 400 ft, the approach should be predominantly made with reference to instruments (see CAAP 174-01 D.3). The pilot was primarily using goggle vision and looking outside. The narrow field of view of the NVG’s requires a demanding and deliberate scan pattern to integrate the outside with instruments. As the pilot slowed to below 45 kt with reducing visual cues, the picture outside was not giving enough information to manage the closure rate of the aircraft. This resulted in a loss of the ability to recognise, with any accuracy, the aircraft’s position and trajectory.
Single-pilot operation
Monitoring is a fundamental tool to boost threat and error management (Flight Safety Foundation, 2014). Furthermore, inadequate monitoring is related to a high number of approach and landing accidents. While there is a clear benefit to multi-crew operations, there is no requirement for multi-crew in Australian search and rescue (SAR), and emergency medical services (EMS). SAR/EMS Operators in Australia tend to perform reduced crew flight operations, whereby extra crewmembers are called upon only for periods of vulnerability.
Crew in the back of an AW139 cannot hear alarms from the cockpit. The 400 ft warning from the Radio Altimeter (RADALT) and the 150 ft warning from the aircraft are only available to front seat crew. The aircraft descended through 400 ft at 1,430 ft/min. The pilot resumed manual control at the time of the emergency climb call as the aircraft passed through 280 ft, 3.5 seconds later.
Had there been a second person in the cockpit monitoring the approach, their first indication of a loss of visual reference, if not announced by the pilot, would most likely be an unusual combination of attitude and vertical speed. The aircraft had developed an unusually high 900 ft/min rate of descent 12 seconds before passing through 400 ft. This information may take a monitoring Aircrew Officer (ACO) a second or two to process. Once processed, however, the aircrew officer (ACO) is in a position to call for a go-around, and to provide accurate information to the pilot regarding the aircraft state much sooner in the sequence.
While facing a high risk of encountering a degraded visual environment, the requirement to have the ACO in the rear cabin for winch operations degraded the crew’s defences against loss of control. The addition of another trained crewmember would be an ideal risk control for operations in potentially degraded visual environments.
Caution and maintenance messages
There is no option for the crew to review caution messages once the message has self‑cleared, or to interrogate the system to discover the extent of any exceedance. As the main transmission torque limit exceedance message (XMSN OVTQ) was missed because it appeared during a time of high workload in flight, the crew could not know of the nature and extent of the exceedance without the support of an aircraft maintenance engineer (engineer).
The crew and the engineer who downloaded the data the following day reported that no maintenance message was detected on the crew alert system (CAS). Analysis of the central maintenance computer (CMC) log showed that eight minutes before the incident flight, a maintenance message activated for 41 seconds. A maintenance message again illuminated four minutes after landing for 31 seconds until shutdown.
The crew reported that the maintenance message was overly generic and related to a host of issues, ranging from critical to inconsequential. The only way to determine the meaning of the message was for an engineer to access the CMC through a laptop. Given the remote locations and 24‑hour nature of operations, engineer access was often impractical, and some telephone diagnosis had to take place.
Additionally, a software update had previously caused issues by instructing the aircraft that equipment it did not have was fitted. As a result, numerous maintenance messages related to the failure of the non-existent equipment were seen. This nuisance message issue was resolved 6 months prior to the event.
These nuisance alerts and generic nature of the message could combine to dilute the significance of the maintenance message and reduce the likelihood that crews would seek out and respond to genuine alerts.
Automatic hover mode use
The autopilot’s automatic hover (HOV) mode fitted to the helicopter could be engaged while the helicopter had a high rate of descent. If this system was not explicitly understood, the pilot may believe that HOV mode had adequate control of the aircraft upon activation. It would display as engaged even though it could be subject to a considerable overshoot, outside of the system’s capacity to recover before impact with terrain. At the height engaged, the mismatch between reference height and actual radar height would have triggered a PFD message ‘HTLM’ and an aural callout of ‘ALTITUDE, ALTITUDE’ after about 2.5 s, as the aircraft passed through a point between 39 ft and 70 ft below the reference height. The pilot input came 4.2 s after engagement of automatic hover. Without the correct mental model of HOV mode operation, time taken to interpret autopilot performance may have delayed manual recovery actions.
Beacon registration and placement
When the vessel was located, the crew saw the emergency position-indicating radio beacon (EPIRB) laying in the bottom of the boat and not deployed as per Australian Maritime Safety Authority guidance. This resulted in a scattered signal and created inaccuracies in the operation of the Direction Finder (DF). The crew could not resolve the direction of the beacon.
The lack of accurate registration details and sporadic output of the DF caused distraction to the crew and increased their time to find the target. The result for the crew was that they were required to identify a number of targets and make approaches to them for visual identification. This increased the complexity and time taken to complete the operation.
Figure 7: Correct EPIRB placement following activation
Source: Australian Maritime Safety Authority __________
From the evidence available, the following findings are made with respect to the loss of control of a Leonardo Helicopters AW139, registered VH-YHF, on 13 May 2018, and the subsequent release of the aircraft without a required inspection. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
During the search for a transmitting beacon, the helicopter crew planned to approach to a hover near a target. However, low celestial illumination and drifting smoke created a high risk of encountering a degraded visual environment. This resulted in a loss of visual references on approach.
During the approach to hover in a degraded visual environment, searching outside for visual cues drew the pilot’s attention away from the flight instruments. This resulted in flight instruments not being referenced when they were needed.
The required position of the aircrew officer in the rear of the helicopter prior to descent negated the benefit of having a trained and competent crewmember to assist the pilot, resulting in a degraded monitoring capability in the approach to hover.
While on approach in a degraded visual environment, without the protections of flight instrument use or monitoring, the helicopter entered an uncommanded, undetected high rate of descent, resulting in a transmission overtorque during recovery.
Other factors that increased risk
Auto hover had no design limit on vertical speed for engagement, which permitted overshoot following engagement with high rate of descent.
As the aircrew could not confirm the existence of an exceedance, and a maintenance message was not detected on the Crew Alert System, the aircraft was operated despite requiring an inspection.
Other findings
Application of good Crew Resource Management and practiced recovery techniques supported the crew in restoring control.
The emergency position-indicating radio beacon was not registered to the current owner, and was incorrectly placed in the boat. The placement scattered the beacon's signal, leading to loss of accuracy in direction-finding equipment. As a result, mission complexity and time taken to rescue were increased.
Sources and submissions
Sources of information
The sources of information during the investigation included:
the pilot and crew
Careflight
Aviation Specialities Unlimited
the Bureau of Meteorology
Airservices Australia
Leonardo Helicopters
the Civil Aviation Safety Authority.
References
Aherne BB and others, 2016, Pilot Domain Task Experience in Night Fatal Helicopter Emergency Medical Service Accidents, Aerospace Medicine and Human Performance. 87(6). 550-556.
Arthur W and others, 1998, Factors That Influence Skill Decay and Retention: A Quantitative Review and Analysis, Human Performance. 11(1), 57-101.
Australian Transport Safety Bureau, 2004, ASR B2004/0152, Night Vision Goggles in Civil Helicopter Operations
Bailey RE and others, 2017, An Assessment of Reduced Crew and Single Pilot Operations in Commercial Transport Aircraft Operations, 2017 IEE/AIAA 36th Digital Avionics Systems Conference, St Petersburg
Biggs AT and others, 2015, Examining perceptual and conceptual set biases in multiple-target visual search, Atten Percept Psychophys. 77. 844-855.
Civil Aviation Authority, 2013, CAP 739, Flight Data Monitoring
Dismukes RK & Berman B, 2010, Checklists and Monitoring in the Cockpit: Why Crucial Defenses Sometimes Fail, National Aeronautics and Space Administration, Moffett Field
Flight Safety Foundation, 2014, A Practical Guide for Improving Flight Path Monitoring, Washington.
Flight Safety Foundation, 2018, Position Paper: Pilot training and competency, Alexandria.
Miller RE & Tredici TJ, 1992, Night Vision Manual for the Flight Surgeon, Armstrong Laboratory, AL-SR-1991-0002
Morawiec G, Niall KK & Scullion K, 2007, Distance estimation to flashes in a simulated night vision environment, Defence R&D Canada, TR 2007-143
Orasanu J & Martin L, (1998). Errors in aviation decision making: A factor in accidents and incidents. In Proceedings of the Workshop on Human Error, Safety, and Systems Development. 100-107.
Orasanu J, Martin L & Davison J, (2001). Cognitive and contextual factors in aviation accidents, in Salas E and Klein G (Eds.) Linking expertise and naturalistic decision making, Lawrence Erlbaum Mahwah NJ. 209–226.
Parush A, Gauthier M, Arseneau L & Tang D, (2011). ‘The Human Factors of Night Vision Goggles Perceptual, Cognitive, and Physical Factors’, Reviews of Human Factors and Ergonomics. 7. 238-279.
Previc FH & Ercoline WR, 2004, Spatial Disorientation in Aviation, American Institute of Aeronautics and Astronautics, Inc., Reston.
Rash CE, 2010, ‘Lighting Up the Night’, Aero Safety World. August 2010. 14-18.
Robson D, Night Flight, 2008, Aviation Theory Centre, Cheltenham.
RTCA 2001, Concept of Operations: Night vision imaging systems for civil operators, RCTA/DO-268, RTCA, Washington, D.C.
Salazar G and others, 2003, Civilian use of night vision goggles, Aviation Space and Environmental Medicine. 74. 79-84.
Summerfield C & Enger T, 2009, Expectation (and attention) in visual cognition, Trends in Cognitive Sciences. 13(9). 403-409.
Wiggins MW and others, 2012, ‘Characteristics of pilots who report deliberate versus inadvertent visual flight into instrument meteorological conditions’, Safety Science. 50(3). 472-477.
Wiggins MW and others, 2014, ‘Cue-utilisation typologies and pilots’ pre-flight and in-flight weather decision-making’, Safety Science. 65. 118-124.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Civil Aviation Safety Authority, the Bureau of Meteorology, Leonardo Helicopters, the crew of VH-YHF, engineers for VH-VHF, and Careflight.
Submissions were received from the Civil Aviation Safety Authority, the Bureau of Meteorology, Leonardo Helicopters, the crew of VH-YHF and Careflight. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Appendix A: Flight data
Figure 8: Incident flight data
Source: Operator / Leonardo Helicopters, annotated by the ATSB
Figure 9: Incident flight data
Source: Operator / Leonardo Helicopters, annotated by the ATSB
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 15 May 2018, at 1903 Eastern Standard Time, a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.
What the ATSB found
The ATSB found that the pilot, who was conducting his first night training flight, likely became spatially disorientated during a go-around manoeuvre, which resulted in a loss of control at low level and collision with terrain.
The flight instructor did not intervene to take control of the aircraft during the go-around manoeuvre, because she was not aware the pilot had become spatially disorientated and was accustomed to directing the pilot to correct control problems. Inconsistent with Civil Aviation Safety Authority guidance, the instructor, who had previously instructed the pilot for his private instrument rating, did not provide a night flying demonstration before directing the pilot around the circuit.
Safety message
It is important for flight instructors to provide a demonstration when introducing a pilot to a new flight sequence or new flight environment. Time spent demonstrating the key points of a new sequence or environment will usually improve the learning process by ensuring that the development of a new skill is supported and preceded by knowledge and understanding from experience.
The flight instructor reported that for the delivery of future initial night flying training, she would conduct either a separate session of daytime flying training circuits prior to night, or deliver the training as day-into-night circuit training. She also commented that, prior to teaching night flying, flying training organisations should consider conducting refresher training in unusual attitude recoveries, irrespective of a pilot’s level of experience and qualifications.
The occurrence
On 15 May 2018, at 1903 Eastern Standard Time,[1] a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one flight instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.
The pilot held a private instrument rating and the accident flight was the pilot’s first training flight for a night endorsement to be added to his rating.[2] The instructor arrived at the hangar in the evening, just as the pilot was completing his pre-flight inspection of the aircraft. They completed the inspection together and then the instructor delivered a night flying brief to the pilot. The briefing included the physiological effects of the night environment, procedural differences for the night circuit, and the instrument and visual sections of the night circuit, which included the need to transition onto instruments on rotation during take-off.
The pilot and instructor boarded the aircraft and completed all the checklist items on the multi‑function display (MFD). The wind appeared to be light and variable and they selected runway 11 for the circuits. The pilot activated the runway lighting while taxiing,[3] which also provided precision approach path indicator (PAPI) lighting.[4]
The instructor directed[5] the pilot throughout the first touch-and-go[6] circuit to runway 11, which she considered was flown to a good standard with the pilot responding to her direction. On the second circuit, at about 500 ft above ground level on approach to land, the pilot and instructor noted the approach was too steep. The pilot, with direction from the instructor, corrected the approach and they both observed two‑white and two-red PAPI lights on short final approach, which indicated they were on the correct approach path. The pilot flared the aircraft a ‘little high’ for the touchdown, and the aircraft bounced twice. The pilot elected to go-around and applied full power before touching down again.
When full power was applied, the aircraft pitched[7] up. As the pilot was attempting to transition his scan onto the instruments, the instructor, whose attention was on the attitude indicator,[8] directed him repeatedly to level the wings—‘wings level’. The pilot observed the runway lights disappear off to the right and felt the aircraft was in a roll[9] as he was trying to focus his attention on the attitude indicator.[10] Following a review of the ATSB’s draft investigation report, the pilot also reported that he manipulated the flight controls in an attempt to recover the aircraft. Shortly after, the aircraft collided with the ground, struck a fence and came to rest inverted.
The pilot reported that he ‘kicked the pilot’s door window out’ to exit the aircraft, at which stage the wings were alight and a grass fire had started.[11] He then pulled the instructor out of the wreckage, who had lost consciousness after becoming disorientated while looking for the emergency egress hammer.[12] Emergency services located at the airport immediately responded to the accident. Figure 1 shows the wreckage site with reference to runway 11. Weather conditions were not considered a contributing factor to the accident.
The flight instructor held a valid Commercial Pilot Licence (Aeroplane), a Grade 1 flight instructor rating, an instrument rating and a night visual flight rules rating. She had a total flying experience of about 4,200 hours and last completed a flight review on 3 December 2017.
The pilot held a valid Private Pilot Licence (Aeroplane) and a private instrument flight rules rating. He last completed a flight review on 11 March 2017 (private instrument rating), had accrued about 500 hours on Cirrus aircraft, and about 50 hours of instrument flight time. The pilot had conducted the majority of his training and subsequent flying from Orange Airport, where his aircraft had been hangered.
Closed-circuit television footage
Closed-circuit television footage from Orange Airport depicted the aircraft rolling left at a low height above runway 11 before impacting the ground on the north-east side of the runway at 1903. A small fire ensued after impact, followed by deflagration of the fuel vapour about 7 seconds later. About 9 minutes later, the CAPS[13] rocket fired. Figures 2, 3 and 4 depict the initial roll of the aircraft, deflagration of the aircraft fuel vapour and firing of the CAPS rocket.
Figure 2: VH-PDC in left roll
Source: Orange City Council, annotated by the ATSB
Figure 3: Deflagration of fuel vapour
Source: Orange City Council
Figure 4: CAPS rocket
Source: Orange City Council, annotated by the ATSB
Aircraft information
Electronic stability and protection
Before take-off, the pilot checked the aircraft’s autopilot and then switched it off. When the autopilot is switched off, the aircraft’s electronic stability and protection (ESP) system is operational. The ESP system automatically activates the autopilot servos to recover the aircraft from excessive roll and pitch attitudes.
The ESP roll protection activates at 45° roll angle, reaches a maximum stick force at 50°, and disengages when the roll angle reduces to 30°. The ESP pitch protection engages at 17.5° nose up, reaches a maximum stick force at 22.5° and disengages at 12.5°. Although the ESP uses the autopilot servos to drive the controls, the pilot retains the ability to override the system.
Recorded data
VH-PDC carried a Garmin G1000 avionics package, and a Recoverable Data Module (RDM). The G1000 is capable of recording various parameters to a secure digital (SD) card, installed on the upper slot of the MFD. The same information is recorded to the RDM, which is an impact and fire resistant unit,[14] installed on the vertical fin spar. The RDM and MFD modules were removed from the aircraft for examination by the ATSB.
The RDM was recovered from the severely fire damaged fin. The rear portion of the module was exposed to a high temperature and showed external heat damage. Disassembly of the crash hardened enclosure to access the data storage components revealed extensive fire damage to the memory devices. No data was recovered from this device.
Initial observations of the MFD SD card slots revealed they were substantially fire damaged and retained two SD cards; the top slot contained the data logging card, the bottom slot contained the Garmin database card. To access the cards, the MFD was disassembled, and the circuit board holding the two cards was removed. The data logging card was found to be substantially damaged (Figure 5). The encapsulated memory device was removed from the data logging card and cleaned. The data logs were then extracted with a modified SD card reader. A total of 241 flight logs were recovered, including the accident flight (Figure 6).
Figure 5: Data logging SD card
Left: Removed MFD slot with data logging SD card. Right: removed data logging card with card memory identified. Source: ATSB
Figure 6: Recovered accident flight data
Source: ATSB
The recovered flight data indicated that after touchdown, power was initially increased to about 45 per cent (19:02:15) and a slight left roll initiated. Power was then advanced to about 90 per cent (19:02:18) and the left roll developed to a peak value of -52° (19:02:23) with a pitch attitude of +20° (nose-up)[15] and airspeed varying from 56–69 kt.[16] The pitch attitude then increased to a peak value of +29° before lowering to +7° as the aircraft rolled right to a peak value of +27° at a height of about 100 ft above the runway (19:02:25).
The aircraft collided with the ground followed by the airport boundary fence and came to rest inverted during the period 19:02:26–30.[17] The final track at initial impact was about 60° left of the runway centreline. During the accident sequence, the rate of heading change to the left developed commensurate with the angle of left roll, and the recorded normal and lateral G‑accelerations[18] were minimal.[19]
Wreckage information
With the exception of the right rudder cable, no mechanical defect was found that could have prevented the normal operation of the aircraft. The right rudder cable was found attached to the rudder, but the forward end was found with a failure near the connection to the rudder pedals. The cable was removed from the wreckage for examination by the ATSB. A preliminary examination determined it did not fail from fatigue. The aircraft’s flight data demonstrated the rudder was operational during the accident sequence. On that basis, it was concluded that the rudder failure observed was a result of the impact, and no further examinations were conducted on the rudder cable assembly.
Survival factors
The aircraft was fitted with a composite roll cage within the fuselage structure to provide roll protection for the occupants. The front seats were each fitted with a four-point inflatable restraint system with an inertia reel lock. Despite coming to rest inverted after striking the ground at about 60–70 kt, the pilot and instructor reported that they found themselves uninjured, but could not open the doors with the aircraft inverted.[20] The inflatable restraints (air bag style system) did not activate, but this was considered likely to be due to the gradual level of deceleration.
The iBrace Survivor Questionnaire[21] was completed for the pilot and instructor with the following results:
The pilot was able to evacuate unassisted from the aircraft while it was filling with smoke by kicking out a window. He then pulled the instructor out of the burning wreckage after seeing her collapsed inside. He suffered from third-degree burns to 7 per cent of his body.
The instructor was unable to evacuate unassisted from the aircraft after she became disorientated in the dark, smoke filled environment, which led to a loss of consciousness. She suffered from first and second-degree burns and smoke inhalation injuries, which required her to be intubated.
Closed-circuit television footage identified an ambulance crossing the runway towards the accident site about 3 minutes after impact. In addition, an emergency medical service helicopter was located at the airport with the crew on duty at the time of the accident. They transported the pilot and instructor to Sydney for treatment.
Additional information
Spatial disorientation
The pilot reported that the aircraft pitched up when he applied power for the go-around and that he observed the runway lights disappear off to the right. He felt that the aircraft was in a roll while he was trying to focus his eyes on the attitude indicator as the instructor was directing him to level the wings. He commented that without enough right rudder the aircraft will ‘pull to the left’ [when applying additional power] and that it is normal to apply right rudder, but that ‘it was pitch black’.
There is a small village, Spring Hill, located upwind of runway 11, but the instructor reported that it was not large enough to produce an illuminated horizon below about 200 ft above ground level. She reported that on the night of the accident, at low level with the runway lights obscured, it was ‘pitch black’, and that [for a pilot looking outside] the environment would have been ‘totally disorientating’.[22]
Benson (1988; as cited in Gibb et al., 2011) defined spatial disorientation as:
The pilot fails to sense correctly the position, motion, or attitude of his [or her] aircraft or of himself [or herself] within the fixed coordinate system provided by the surface of the earth and the gravitational vertical.
The three sensory systems for determining orientation of the human body in space are the visual, vestibular,[23] and somatosensory[24] systems. Newman (2007) and others have reported that the visual system provides 80 per cent of the orientation information in normal conditions. However, in the absence of visual cues, orientation and motion information are divided between the vestibular and somatosensory systems. These systems can easily produce false information for a pilot due to local accelerations of the aircraft about the pitch, roll and yaw axes.
The vestibular system responds to head position and movement, which may lead to an incorrect perception of body motion if not supported by a visual reference. For example, an upward pitch (head backward) may be detected as a forward acceleration, and a roll as a lateral (sideways) acceleration. The somatosensory system detects local accelerations on the body, but if the pitching and rolling motions occur at close to +1G flight, such as during the accident sequence, the somatosensory system may not be able to resolve ambiguities generated by the vestibular system.
It was noted by Newman (2007) and Gibb et al. (2011) that spatial disorientation is likely an under‑reported phenomena in aviation. They suggested that this may be due to it resulting in one of two likely outcomes; either the pilot recovers the aircraft with no harm or damage done, and therefore does not perceive the need to report; or it results in a fatal accident and the investigation cannot verify from the evidence available that spatial disorientation contributed to the event.
Flight instruction
Instrument flying proficiency
The Civil Aviation Safety Authority’s (2007) Flight Instructor Manual: Aeroplane, chapter 18: Night Flying, states the following:
Before students undertake night solo circuit operations they must have received sufficient instrument flight training to enable them [to] carry out the following manoeuvres solely by reference to instruments: a) climb and climbing turns, b) straight and level flight and level turns, c) descent and descending turns, d) unusual attitude recovery full panel.
As the pilot already held a private instrument rating, the above training exercises were not required to be conducted as lead-in to his night flying training.
Demonstration
The Flight Instructor Manual stated that ‘airborne sequences must follow an acceptable method of teaching like: demonstrate, direct then monitor. However, the pilot acted as flying pilot for his first night flying training flight without a prior demonstration.[25] The instructor explained that there were several reasons for this as follows:
When the pilot first approached the instructor for his private instrument rating training, he was already a qualified pilot [private pilot licence] who owned his own aircraft and was capable of flying it competently. The instructor considered him an advanced student for the instrument training as he had already accumulated several hundred flying hours experience.
The instructor used the direct method to deliver the pilot’s instrument training. This was about 40 hours of dedicated instrument flying training.
At the time of the accident flight, the instructor and pilot had accumulated about 50 hours flying together without the need for the instructor to demonstrate a flying sequence or intervene to correct an improperly flown sequence. The pilot’s instrument flying training ensured he had accumulated sufficient minimum instrument flying prior to his first night flying training flight.
Benefit of demonstration
The benefit of demonstration as an instructional technique is that it permits the student to focus their attentional resources on key learning points for new sequences, without the diversion of those resources to managing the flight path. Studies have noted that observational experience, in addition to physical practice, can provide a more effective learning experience than physical practice alone.
In 2000, Shea et al. compared the performance of a physical practice group with a combined observation and physical practice group on a motor learning test. The physical practice group outperformed the combined practice group under the practice test conditions, but when the test conditions were varied from the practice conditions, the combined practice group ‘performed significantly better’ than the physical practice group.
Intervention
After the go-around was commenced, the instructor reported that the aircraft entered an unusual attitude. Both the instructor and pilot reported that the instructor was repeatedly directing the pilot to level the wings. The instructor commented that at the time, she was thinking ‘get that left wing up’, but directing ‘wings level’. At the time, her eyes were focused on the pilot’s attitude indicator[26] and she was expecting the pilot to recover the aircraft. However, the pilot had become spatially disorientated, which she was not aware of. It was only a matter of seconds between the instructor’s comprehension that the aircraft was not responding and the impact with the ground. The instructor considered that it ‘happened very fast’, and that as she was not in the habit of taking over the controls from the pilot, her natural reaction was to direct what was needed. The pilot also reported that it ‘happened very quickly’, with ‘no height to recover’.
The Cirrus SR22 is fitted with two single-handed side control yokes mounted beneath the instrument panel on the left and right side of the cockpit, and the instructor reported that it is not an easy aircraft for an instructor to take over control from a student. She commented that the single-handed yokes are sensitive in their response, which can lead to ‘fighting over the controls’ if the instructor attempts to follow-through on the controls[27] while a student is flying. Therefore, she was not following through on the controls during the touch-and-go sequence.
Previous similar accidents
Spatial disorientation
Spatial disorientation presents a danger to pilots as the resulting confusion can often lead to incorrect control inputs and resultant loss of aircraft control. Gibb and others (2010) state that spatial disorientation accidents have a fatality rate of about 90 per cent, indicating how compelling the misperceptions can be. A search of contributing safety factors in the ATSB aviation occurrence database revealed that of the investigated accidents where spatial disorientation was found to be a factor (about one per year), nearly all resulted in fatal injuries.
The United States National Transportation Safety Board’s database was searched for previous accidents involving spatial disorientation. A search of all aircraft categories returned 710 results. Cirrus SR20 and SR22 aircraft returned 18 results for spatial disorientation as a finding between 2003 and 2017, 13 of which were fatal accidents (four of the non-fatal accidents involved use of the Cirrus Airframe Parachute System for recovery). The conditions for all of the accidents were instrument meteorological or night, or combination of both. Of the 18 accidents for Cirrus aircraft, 10 were for instrument-rated pilots and four occurred during take-off.
The ATSB education booklet Avoidable Accidents No. 7, Visual flight at night accidents: What you can’t see can still hurt you (AR-2012-122) outlines a number of night-time accidents that have been a result of spatial disorientation due to dark night conditions.
Loss of control during go-around
A search of the ATSB database for previous SR22 accidents involving a loss of control during a go-around manoeuvre found one result of interest:[28]
During a touch-and-go training exercise, the aircraft veered off the runway to the left while under full power for take-off. The pilot reported that his attention may have been diverted to the flap control lever at the time (ATSB reference number 201006782).
The United States National Transportation Safety Board’s database was searched for previous similar accidents. The search criteria were Cirrus SR22, instructional flight, and accident. The search results were then filtered for loss of control events during an attempted go-around. The following results of interest were reviewed:
Report ERA12FA540: Loss of control in-flight. ‘During the final approach, witnesses saw the airplane drifting to the left while descending at a relatively high sink rate. Witnesses heard the power being adjusted, and, close to the ground, the engine went to high power. The airplane’s nose rose, and the airplane veered to the left. The airplane touched down left wing down off the runway in grass, heading about 40 degrees left of the runway centreline. It then entered woods, where it hit numerous trees and came to rest upside down and on fire…Examination of the wreckage revealed no pre-existing mechanical anomalies that would have precluded normal operation’.
Report ERA13CA222: Landing area overshoot. ‘According to the instructor, he and the student pilot were practicing short field landings. When the airplane was about 20 feet above the ground on approach to the runway, the airspeed suddenly decreased. The student pilot applied full engine power, the airplane yawed to the left, and the airplane impacted the ground before it reached the runway. The flight instructor reported no pre-impact mechanical malfunctions or failures with the airplane that would have precluded normal operation’.
Report NYC07CA010. ‘As the pilot of the SR-22 was performing a flare for landing, the airplane’s airspeed “became too slow,” and the pilot applied full power and announced “go-around.” The airplane veered left, and continued approximately 100 yards, before it struck a tree and came to rest upright. The pilot reported no mechanical anomalies with the airplane’.
During a night training flight, a go-around from runway 11 at Orange Airport, New South Wales was commenced. Shortly after, the Cirrus SR22 aircraft, registered VH-PDC, collided with the ground. The flight instructor and pilot received serious injuries and the aircraft was destroyed.
As mentioned above, the presence of a fractured rudder cable in the wreckage was not considered a contributing factor. This was because the rate of heading change during the accident sequence followed the angle of roll, rather than the application of power, and there was no significant lateral acceleration associated with the application of power.
The data logging card did not record pilot control inputs or movement of the autopilot servos. Therefore, it could not be determined if the reversal of the initial rolling and pitching motion was the result of the actions of the pilot, or flight instructor, or the aircraft’s electronic stability and protection system. However, the thresholds for activation of the aircraft’s pitch and roll protection were reached during the accident sequence, and the reversal of the pitch and roll were consistent with the operation of the system. While the system was designed to mitigate an unusual attitude from developing, the act of recovering from a high pitch angle at slow speed will inevitably result in a loss of height.
The final approach on the accident flight was steep at 500 ft. While this was corrected before the landing, it would have increased the pilot’s workload during the approach. Using this as a trigger to conduct a go‑around would have provided the pilot with the opportunity to set up for a more stable approach on the next circuit.
This analysis will examine the conduct of flight demonstrations, and the pilot experiencing spatial disorientation and the flight instructor’s awareness of such.
Flight demonstration
The pilot was undergoing his first night flying training flight for the addition of a night endorsement to his private instrument rating. The flight instructor had previously instructed the pilot for his instrument rating, and considered him an advanced student. His instrument flying training was delivered by the instructor using the instructional method of direct, without the need to demonstrate any sequence or intervene to correct an incorrectly flown sequence. Because of this earlier experience, the instructor elected to use the instructional method of direct without first demonstrating any of the key learning points for the night flying environment.
Night circuits involve a unique runway environment for assessing the approach path and landing, and require a unique procedure for combining visual and instrument flying sequences. The Civil Aviation Safety Authority’s flight instructor manual emphasised that the ‘acceptable delivery rate of new information to the student [pilot] needs to be combined with good demonstrations and adequate student practice’. Consistent with this guidance, best practice is to ensure that the student [pilot] is introduced to a new environment in a gradual way. The lack of demonstration for the pilot’s introduction to night flying likely increased the risk of the pilot not having an adequate opportunity to attend to, and absorb, the key learning points before attempting to practice the sequences as the pilot flying.
Spatial disorientation
The flight instructor reported that the pilot’s first night circuit was flown to a reasonable standard with the pilot responding to her direction. At the end of the second circuit, the aircraft bounced twice during the attempted touchdown and the pilot applied full power to perform a go-around. In response to the application of full power, the aircraft pitched nose-up and started to roll to the left. The pilot reported that he lost all external visual references as the runway lighting disappeared from view underneath the aircraft, and was attempting to focus his attention on the attitude indicator as the aircraft continued to pitch up and roll left.
The pitching and rolling motion of the aircraft, in addition to the pilot and instructor reports that the external environment was ‘pitch black’, were all consistent with the pilot experiencing spatial disorientation. The nose up pitching motion and left rolling motion were consistent with the natural response of the aircraft without corrective pilot control input.
Flight instructor awareness
During the accident sequence, the flight instructor repeatedly directed the pilot ‘wings level’, but her attention was focused on the primary flight display and she was not aware the pilot had become spatially disorientated. Therefore, she did not immediately intervene to recover control of the aircraft during the accident sequence, which only lasted about 7 seconds from the decision to go-around to initial impact.
Findings
From the evidence available, the following findings are made with respect to the spatial disorientation and collision with terrain involving Cirrus SR22, registered VH-PDC, at Orange Airport, New South Wales, on 15 May 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
While attempting a go-around manoeuvre from an aborted touch-and-go, the pilot did not immediately transition his scan onto the attitude indicator and became spatially disorientated, which resulted in loss of control of the aircraft and collision with terrain.
The flight instructor was not aware the pilot had become spatially disorientated, which resulted in her providing direction rather than intervention during the loss of control.
Other factors that increased risk
Contrary to best practice, the flight instructor elected to direct the pilot for his first night flight without a demonstration. This decision was influenced by the pilots' experience, private instrument rating, and previous instructional method.
General details
Flight Instructor details
Licence details:
Commercial Pilot Licence (Aeroplane), issued 11 February 2015
Gibb R, Ercoline B & Scharff L 2011, ‘Spatial disorientation: decades of pilot fatalities’, Aviation, space, and environmental medicine, vol. 82, no. 7.
Newman DG 2007, An overview of spatial disorientation as a factor in aviation accidents and incidents, Australian Transport Safety Bureau, Canberra. Aviation research and analysis report – B2007/0063.
Shea C, Wright D, Wulf G & Whitacre C 2000, ‘Physical and observational practice afford unique learning opportunities’, Journal of motor behavior, vol. 32, pp. 27–36
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Cirrus Aircraft, Civil Aviation Safety Authority, flight instructor, pilot and United States National Transportation Safety Board.
The submissions from those parties were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Terminology used in this report
Occurrence: accident or incident.
Safety factor: an event or condition that increases safety risk. In other words, it is something that, if it occurred in the future, would increase the likelihood of an occurrence, and/or the severity of the adverse consequences associated with an occurrence. Safety factors include the occurrence events (e.g. engine failure, signal passed at danger, grounding), individual actions (e.g. errors and violations), local conditions, current risk controls and organisational influences.
Contributing factor: a safety factor that, had it not occurred or existed at the time of an occurrence, then either: (a) the occurrence would probably not have occurred; or (b) the adverse consequences associated with the occurrence would probably not have occurred or have been as serious, or (c) another contributing factor would probably not have occurred or existed.
Other factors that increased risk: a safety factor identified during an occurrence investigation, which did not meet the definition of contributing factor but was still considered to be important to communicate in an investigation report in the interests of improved transport safety.
Other findings: any finding, other than that associated with safety factors, considered important to include in an investigation report. Such findings may resolve ambiguity or controversy, describe possible scenarios or safety factors when firm safety factor findings were not able to be made, or note events or conditions which ‘saved the day’ or played an important role in reducing the risk associated with an occurrence.
Safety issue: a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operational environment at a specific point in time.
Safety action: the steps taken or proposed to be taken by a person, organisation or agency in response to a safety issue.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
Preliminary report
Report release date: 28/06/2018
This preliminary report details factual information established in the investigation’s early evidence collection phase and has been prepared to provide timely information to the industry and public. Preliminary reports contain no analysis or findings, which will be detailed in the investigation’s final report. The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003.
Sequence of events
On 15 May 2018, at 1903 Eastern Standard Time,[1] a Cirrus SR22 aircraft, registered VH‑PDC, collided with terrain at Orange Airport, New South Wales. The accident was a night training flight with one pilot (aircraft owner) and one instructor on board. The pilot and instructor were seriously injured and the aircraft destroyed.
The pilot had a private instrument rating and the accident flight was the pilot’s first training flight for a night endorsement.[2] The pilot performed a pre-flight inspection of the aircraft in a hangar under lights and then moved the aircraft out of the hangar onto the apron. After the instructor arrived, a pre-flight briefing was held in the hangar, which included the effects of the night environment on depth perception and the procedural differences from daytime flying.
The pilot and instructor boarded the aircraft and completed all the checklist items on the multi‑function display. The aircraft was taxied for a departure from runway 11 and the pilot activated the runway lighting while taxiing. In addition to the runway lighting, precision approach path indicator (PAPI) lighting was also available.[3]
One touch-and-go[4] circuit was completed to runway 11 without incident. On the second circuit, when at about 500 ft above ground level on approach to land, the pilot noted the PAPI was displaying four-white lights. In response, the pilot steepened the approach and then observed two‑white and two-red lights. When the runway surface came into view in the aircraft landing lights, the pilot flared for the landing. The aircraft bounced and the pilot elected to apply full power and go-around, rather than attempt to continue with the landing.
When full power was applied, with full flap selected, the aircraft pitched up. As the pilot was transitioning his scan onto the instruments, the instructor repeatedly directed him to maintain wings level. The pilot felt the aircraft was rolling to the left and the runway lights appeared to the right.[5] Shortly after, the aircraft collided with the ground and came to rest inverted (Figure 1).
Figure 1: Cirrus SR22 registered VH-PDC wreckage
Source: ATSB
The pilot exited the aircraft after kicking out a window, at which stage the wings were alight and a grass fire had started. He then assisted the instructor with exiting. While moving the instructor clear, the pilot heard a canister discharge from inside the wreckage and about 1 minute later he heard what sounded like the aircraft parachute pyrotechnic activate.[6] Emergency services located at the airport immediately responded to the accident.
Closed-circuit television footage
Closed-circuit television footage from Orange Airport showed the aircraft rolling left at a low height above runway 11 and impact the ground on the north-east side of runway 11 at 1903. A fire ensued about 5 seconds after impact and about 9 minutes after impact a pyrotechnic device activated.
Ongoing investigation
The investigation is continuing and will include the following:
interviews with the pilot, instructor and any witnesses (preliminary interview with pilot completed and a preliminary statement has been provided by the instructor)
examination of aircraft recorded data
examination of the aircraft flight controls.
_________ The information contained in this preliminary report is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this preliminary report. As such, no analysis or findings are included in this update.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 9 May 2018, there were five controllers on duty in the Air Traffic Control (ATC) tower operated by Airservices Australia (Airservices) at Perth Airport, Western Australia (WA). One controller was acting as the surface movement controller (SMC)[1]. One controller, who was being trained in air traffic control, was acting as the aerodrome controller (ADC)[2] under the supervision of another controller. The other controllers on duty were in airways clearance delivery and tower supervisor roles.
At 0841 local time, the crew of a Regional Express SAAB 340 aircraft operating a passenger service, call-sign RXA2113, were at their departure bay. The crew contacted the airways clearance delivery controller who issued an airways clearance for the planned flight from Perth to Albany, WA. This clearance authorised the crew to track to Albany via SOLUS and flight-planned route. The crew was cleared to depart Perth in accordance with the SOLUS THREE standard instrument departure (SID) and climb to 5,000 ft. Figure 1 shows SOLUS THREE SIDs from runway 03 and runway 06.
Figure 1: Perth Airport SOLUS THREE SIDs from runway 03 (red highlight) and runway 06 (blue highlight)
Source: Adapted from Airservices Australia
The Automated Terminal Information Service (ATIS) that was available to pilots between 0852 and 0908 included the following information:
Runway 03 for all arrivals and for departures via [various waypoints including] SOLUS. Runway 06 for all other departures.
Based on the airways clearance and ATIS, the RXA2113 crew programmed the aircraft flight management system (FMS) for a departure from runway 03 direct to MIDLA followed by a left turn to track as specified by the SID to SOLUS, followed by the flight-planned route (Figure 1: red highlight).
The controller acting as SMC took control of this position at 0830. Between 0847 and 0901, the SMC had managed the taxi transit of five aircraft that all departed from runway 06.
At 0905, the RXA2113 crew contacted the SMC to request taxi clearance. The SMC recalled that he referred to the flight data record on his display and perceived that the aircraft was departing off runway 06. Accordingly, the SMC issued instructions for RXA2113 to taxi via taxiway ‘Charlie Six’ (C6) and hold short of runway 03 (Figure 2). At the same time, the SMC selected the intermediate hold point as the clearance limit on the ATS graphical display.
Figure 2: Perth Airport taxiway map with RXA2113 route highlighted in blue
Source: Adapted from Airservices Australia, annotated by ATSB
As required to ensure there was no conflicting traffic, the SMC coordinated a runway crossing for RXA2113 with the ADC. The SMC then issued onwards clearance for RXA2113 to ‘cross runway 03, taxi hold point Victor (V), runway 06’ and selected the hold point on the graphical display. Once the SMC was satisfied that the crew was complying with the instruction, he transferred the flight data record to the ADC screen as per standard procedure.
By now it was apparent to the RXA2113 crew that ATC intended for them to depart from runway 06 rather than runway 03 as nominated on the ATIS for SOLUS departures. At the time, the captain considered this and determined that they would still be compliant with the airways clearance as the runway was not part of the clearance and the SID was applicable to both runways. Given that key aspect and crew member experience of similar departures, the crew did not query ATC about the variation to the expected departure runway.
At hold point V the RXA2113 crew reprogrammed the FMS for the SOLUS THREE SID for runway 06. The captain recalled that this process did not present any problems to the crew and they were not aware of any safety implications.
In the tower, the trainee ADC was in the controlling position and the supervising ADC was seated behind and adjacent to the trainee. The trainee had full vision and control of the monitors and controls. The supervising ADC reported that although his view of the display was incomplete he remained vigilant of arriving and departing aircraft.
When the opportunity arose, the supervisor was asking the trainee questions about ATS policy and procedure as an ad hoc training activity. This was taking place while the RXA2113 crew prepared for take-off at the hold point. Although the flight data record for RXA2113 was displayed on the ADC display after the SMC had transferred it, there was no requirement for the ADC to pay attention to RXA2113 until the crew was ready for take-off.
At 0910, the RXA2113 crew contacted the ADC to advise they were ready to depart.
The supervising ADC recalled that the trainee ADC followed standard procedure to ensure that the runways and initial departure track were free of conflicting traffic. The supervisor did not have a clear view of the flight data record on the ATS display and it was unclear if the trainee ADC referred to it. Departures[3] were being conducted in accordance with auto-release procedures so no coordination was required with the departures controller.
The supervising ADC related that during departures, the focus of both his and the trainee ADC’s attention was on monitoring for incoming and outgoing traffic, and checking that the runways were clear. At Perth Airport, the ADC controls arrivals and departures off all runways. This means that when an ADC issues a take-off clearance from one runway, he or she will also be aware of any aircraft arriving or departing from other runways.
The presence of the aircraft at hold point V indicated to the ADC that RXA2113 was scheduled to depart from runway 06, and the ADC issued a take-off clearance from that runway. The trainee ADC instructed the RXA2113 crew to line up, then at 0911 cleared the crew to take-off from runway 06 with instructions to contact ‘departures’ when airborne.
From the perspective of the crew and controllers in the tower, the take-off and departure was uneventful. However, the departures controller was expecting the aircraft to be on a northward track to MIDLA rather than tracking initially to the north-east before turning left to MIDLA (runway 03 departure, Figure 1). The aircraft was soon on the flight planned track and there was no reported loss of separation with any other aircraft.
The controllers in the tower were unaware of the discrepancy between the clearances issued to the crew of RXA2113 and the flight data record until advised by the departure controller.
Contextual information
The controllers described the traffic situation as quiet by 0840 because the number of aircraft movements had decreased from the earlier morning period. The weather at Perth Airport was not operationally significant, the visibility was good, and the wind was light and variable.
Personnel information
Surface movement controller
The controller who was performing the role of SMC held ATC certification and had about three years’ experience with Airservices. Prior to that, the controller had been trained by, and operated for, another ATC agency.
Prior to the day of the occurrence, the controller had three rostered days off. He reported having slept well the night before. Although the controller was concerned about the health of a close family member, he did not consider that his performance would be affected. There was no evidence to indicate that stress affected the actions of the SMC on the day of the occurrence.
Aerodrome controllers
The trainee controller who was performing the role of ADC under supervision had previous experience with another ATC agency. It was reported that the trainee controller had demonstrated competence at the console but needed further familiarity with Airservices’ policy and procedures.
On the day of the occurrence, both controllers in the ADC position started work at 0530, and had been working for approximately three and a half hours. They were in the second shift of their rotation, having come off rostered days off the day prior to the occurrence. It is not known what sleep either controller had prior to the occurrence.
Consideration of controller rostering and fatigue
The ATSB reviewed the actual hours worked and known sleep history of the SMC and ADCs for indications of fatigue on the day of the occurrence. Based on the available evidence, there is no indication that fatigue contributed to this occurrence.
ATC systems
Flight Data Record
The air traffic system automatically generated the departure runway for RXA2113 into the flight data record. This displayed the departure runway as 03 in the fourth column of the top row (Figure 3). The ATC system allowed the controllers to change the departure runway recorded for each flight. The system would notify other users that this change had occurred.
Figure 3: The Flight Data Record for RXA2113
Source: Adapted from Airservices Australia
Hold point selection panel
Immediately after the SMC instructed the RXA2113 crew to taxi to hold point V, he recorded that hold point in the ATC system. The SMC called up the ‘RWY03 Hold Points’ selection panel within the ATC system. The SMC used this panel to record the taxi clearance for RXA2113 to hold point V (Figure 4).
This panel presented all valid hold points for runway 03 departures. Although the hold point options on the graphical display were delimited to those associated with the system-assigned runway, hold point V was available to facilitate traffic flow from terminals 3 and 4.
Figure 4: Hold point selection panel in ATC system for runway 03 departures (Hold point V highlighted by ATSB)
Source: Adapted from Airservices Australia, annotated by ATSB
The ATSB noted that the ATS system did not provide any specific inhibitions to prevent or alert the controllers to the taxi of aircraft to non-conforming hold-points.
Safety analysis
Taxi clearance RXA2113
The surface movement controller issued taxi instructions to the crew of RXA2113 which directed them to runway 06. This was contrary to the departure runway (runway 03) recorded by the air traffic system and shown on the ATC flight data record.
When an aircraft crew requests a taxi clearance, the SMC would normally provide instructions based on the flight data record.
The ATSB considered the factors that might have adversely influenced the SMC’s attention and perception at the time. Based on the available information, there were no indications that fatigue, workload, expectancy, or stress from personal circumstances were contributory.
The ATSB also considered the presentation of the departure runway information on the flight data record. That information was presented clearly and saliently and there was a high level of contrast between the text and the background. No one reported that the flight data record was difficult to read or interpret. Therefore the runway information was readily accessible.
Therefore, as the SMC issued taxi instructions that were inconsistent with the flight data record, it is likely that he did not attend to the flight data record.
After the SMC issued the taxi instructions to hold point V, runway 06, there were no prompts for a reassessment of those instructions. Although they were not required to, if the crew of RXA2113 had requested confirmation that the departure runway was different to that expected, this would have prompted the SMC to check the flight data record. In this occurrence, the flight crew had identified the instructions were inconsistent with the information provided by the ATIS, as such this was a missed opportunity to identify and resolve this inconsistency. Although the ATC system limited the taxiway selections to those associated with the assigned departure runway, hold point V was necessarily available for use in conjunction with both runways 03 and 06.
Although the SMC instructed the crew of RXA2113 to taxi to a runway contrary to the flight data record, the ATSB did not identify any broader risk to safety posed by this action. There is no evidence that the taxi instructions issued to the crew reduced the safety of the aircraft or other traffic while it was taxiing and holding. The arrival of the aircraft at the hold point of runway 06 did have an effect on the ADC function.
Take-off clearance RXA2113
The trainee ADC issued a take-off clearance to the crew of RXA2113, which cleared them to depart from runway 06. Like the taxi clearance, this was also contrary to the departure runway recorded by the air traffic system and displayed on the flight data record.
The ATSB considered whether the training activity the ADCs were engaged in prior to issuing the take-off clearance affected their attention to and perception of the departure runway on the flight data record. The ADC supervisor related that the focus of attention of both ADCs during the take-off clearance was on monitoring incoming and outgoing traffic, and checking that the runway was clear and that in these circumstances the ADC would not normally focus on the flight strip of a taxiing or departing aircraft.
The ATSB also identified that the position of RXA2113, at hold point V, was a strong indicator to the ADC that aircraft was scheduled to depart from runway 06. Given the position of the aircraft at the hold point to runway 06 and crew report that RXA2113 was ready at that position, it is likely that both controllers engaged in the ADC function had an expectation that RXA2113 should depart from runway 06.
In this context it is unlikely that the training activity affected the likelihood of the ADC detecting the departure. The focus of the ADCs on traffic, and the expectation associated with the presence of the aircraft at runway 06, meant that the controller was unlikely to detect that the aircraft had been taxied to the incorrect runway, whether they were engaged in training or not. This expectation likely resulted in the two ADCs either not attending to the flight data record or misperceiving the runway information on the record.
Safety considerations
The departure of RXA2113 from runway 06 meant that the initial track of the aircraft was different to that expected by the departures controller. The departures controller used the air traffic system to identify which runway aircraft would depart from, in order to predict their track after departure.
Based on the information current in the air traffic system, the departures controller had expected RXA2113 to depart from runway 03 and commence on a northward track to MIDLA. Because RXA2113 departed from runway 06 and initially tracked to the north-east, this may have affected the departures controller’s understanding and awareness of the position of the aircraft.
The departure of RXA2113 from runway 06 was primarily the result of the taxi instructions provided by the SMC. After the SMC had issued these instructions, there were limited opportunities to identify the deviation in departure runway, or to update this information within the air traffic system.
The ATC system contains limited defences to prevent or identify deviations from the operational detail of the departure runway. The departure runway is recorded on the flight data record, and the system primarily relies on each controller attending to that record to ensure departures accord with the planned runway. In addition, aircraft separation relies on both controller and flight crew, and there is a role for flight crew to identify any perceived inconsistencies or errors to ATC.
The ATC system has comprehensive defences to ensure the separation of aircraft while taxiing, and during and after take-off. The ATSB did not identify any evidence that separation was affected at any stage during this occurrence.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The Perth SMC issued taxi instructions to the flight crew of a departing aircraft that directed them to the holding point of runway 06 rather than runway 03, which was assigned by the air traffic system and shown in the flight strip details.
The aerodrome controllers cleared the crew of the departing aircraft to take-off from runway 06, which was contrary to the runway assigned by the air traffic system and shown in the flight strip details. As a result, the initial track of the aircraft was different to that expected by the departures controller.
There was no broader safety risk identified as a result of either the taxi or take-off clearances. The taxi clearance provided to the crew of the departing aircraft did not reduce the safety of the aircraft while it was taxiing and holding. The take-off clearance did not reduce the separation of the aircraft during take-off or departure from the airport.
Safety action
Airservices reported that as a result of this incident, they have conducted a check assessment with the SMC. Airservices have developed a training and performance improvement plan for the SMC, to address several performance issues identified in their review.
Safety message
This occurrence highlights how deviations from flight details, as presented in the air traffic system, affect the ability of controllers and flight crews to understand and predict the behaviour of aircraft. Furthermore, limited defences exist to identify when instructions have deviated from the information recorded in the system. Although in this occasion the ATSB has not identified any significant risk to the safety of taxiing or departing aircraft, controllers are reminded that they play an important role in remaining vigilant to the content of displayed data, and updating the system when deviations do occur.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the evening of 9 May 2018, an Airbus A320, registration VH-VQL, was being operated on a regular public transport flight by Jetstar Airways Pty. Ltd. The flight departed Avalon Airport, Victoria, at about 1800 Eastern Standard Time,[1] for Sydney, New South Wales.
Approaching Sydney Airport, air traffic control (ATC) cleared the aircraft for a high-speed descent from flight level FL 250[2] for the RIVET TWO Standard Instrument Arrival (STAR).[3] At about 1846, the first officer (FO), who was the pilot flying, commenced the descent via the published waypoints for the STAR (Figure 1).
Figure 1: Departure and approach chart – Sydney Airport
Source: Airservices Australia, modified by ATSB.
After passing DUDOK, ATC provided clearance to conduct the runway 34L[4] Independent Visual Approach (IVA) and provided radar vectors for a final approach intercept (Figure 2 and red line on Figure 1). Crossing the coast, the aircraft was about 2,000 ft high on profile compared with other similar approaches (see the section titled Approach profiles) Figure 1.
After passing BOOGI on descent, the captain commented to the FO on the possibility of track shortening[5] due to the only preceding traffic being on final approach for runway 34L.
Observing the aircraft was high, the flight crew selected ‘open descent mode’[6] in order to increase the aircraft’s rate of descent. They then deployed speed brakes in an attempt to intercept the runway 34L glideslope.
After intercepting the final approach course, the flight crew selected landing gear down and disengaged the autopilot. The FO reported manually flying the aircraft to intercept the glideslope from above. At about 2,850 ft, which was 300 ft above glideslope, the flight crew selected the first flap setting for landing.
Figure 2: VH-VQL approach path to runway 34L Sydney
Source: Google earth, modified by ATSB
Prior to configuring for ‘flaps 2’, the flight crew selected the missed approach altitude of 3,000 ft in the altitude window of the flight control unit (FCU). The recorded data indicated that the altitude selector was also pulled, which changed the aircraft’s vertical flight mode from open descent to open climb. In response to the mode change, the auto-thrust system, which was active at the time, increased thrust to climb the aircraft to 3,000 ft. Unaware of the thrust increase, the flight crew continued configuring for the approach by selecting ‘flaps 2’.
The increase in thrust increased the aircraft’s airspeed. This led to the FO reducing the aircraft’s descent rate in an attempt to manage the acceleration and prevent flap overspeed. Despite this, the aircraft’s airspeed continued to increase, leading to a 2 kt flap overspeed. Reducing the rate of descent also resulted in the aircraft diverging further from the approach glide path.
The recorded data showed that a thrust lever reduction to idle occurred just prior to exceeding the ‘flaps 2’ extension speed. A few seconds later, the airspeed decreased back below the maximum ‘flaps 2’ extension speed. Observing that the approach was not stable, the captain commanded the FO to go around.[7]
In response, the FO increased the thrust levers to the take-off/go-around setting (TOGA) however, recorded data showed that the aircraft was not pitched to the required 15° nose-up attitude. Consequently, the aircraft continued to accelerate. The captain reported that he announced ‘pitch’ and ‘speed’ to draw the FO’s attention to the under rotation. However, the aircraft’s airspeed exceeded the maximum ‘flaps 2’ extension speed by 8 kt. The FO reported identifying that as the aircraft was going to exceed the ‘flaps 2’ speed, he selected ‘flaps 1’, which was not in accordance with the standard operating procedures. However, the aircraft also accelerated through the maximum ‘flaps 1’ extension speed of 230 kt by about 8 kt and by the time the flap had fully retracted, the exceedance had increased to 24 kt.
Due to the aircraft’s acceleration the FO also ordered the retraction of the landing gear. By the time the landing gear had retracted fully, the aircraft had exceeded the maximum landing gear transition speed by 13 kt.
As the ‘flaps 1’ extension speed was exceeded, the captain advised the FO that he was taking control of the aircraft. Recorded data showed that the captain reduced the thrust, pitched the aircraft to 15° nose-up, and climbed to the missed approach altitude. The captain assumed the pilot flying role for the remainder of the flight, and an approach and landing was made on runway 34L.
Approach profile
A number of ATSB investigations have identified the importance of the management of the aircraft energy state and profile during the approach and landing phases of flight. They are known to be high workload periods for flight crew, especially during high-speed descents. This requires a high level of attention to ensure the aircraft meets the stabilised approach criteria prior to the required altitude.
The approach profile for VH-VQL, between DUDOK and final approach to runway 34L, was comparably higher and faster than previous flights (Table 1 and Figure 3).
Table 1: Comparative descent profiles for VH-VQL on the RIVET 2 STAR, Sydney
Source: ATSB
Despite being cleared for a high-speed descent during the initial phase of the arrival, the aircraft was recorded to have arrived at BOOGI slightly high on profile, with an airspeed reduced to 250 kt, which was required by the standard operating procedures (SOP). However, between DUDOK and NASHO the aircraft’s descent shallowed until crossing the coast prior to NASHO. This positioned the aircraft about 2,000 ft high on profile in comparison to other flights that were flown in the same aircraft type by different flight crews.
Figure 3: VH-VQL comparative approach to Sydney Airport, RIVET TWO STAR 34L
Source: Google earth, modified by ATSB
Recorded data indicated that the descent rate of the aircraft increased after crossing the coast, which corresponded to the ATC clearance for the commencement of the IVA. Further, the data showed the aircraft’s selected speed target remained set at 250 kt prior to intercepting the final approach track. The flight crew continued to use various speed targets for the remainder of the approach in an attempt to slow/configure the aircraft and capture the glideslope profile.
The data also indicated that the aircraft turned onto final approach at about 9.8 NM from the runway threshold, at about 3,400 ft. The aircraft’s speed turning final was about 223 kt. This resulted in delays with aircraft configuration and achieving a stabilised approach.
Stabilised approach criteria
The company Operations Manual detailed that an approach to land is stabilised when all of the following criteria are met by no later than 1,000 ft height above the aerodrome (HAA):
1. The aircraft is on the correct nominated flight path and only small changes to required bank angle and pitch are needed to maintain the correct flight path
2. The aircraft speed is not more than speed target +10 kt and not less than speed target -5 kt (refer Note immediately below);
Note: Reference (2) above: In VMC ONLY the approach may be continued below 1000 ftHAA provided the PIC is confident thespeed target will be achieved by no later than 500 ft HAA.
3. The aircraft is in the correct landing configuration
4. Sink rate is no greater than 1000 ft per minute below 1000 ft above the aerodrome
5. Thrust setting is appropriate for the aircraft configuration and is not below the minimum power for the approach as defined in the aircraft’s operating manual
6. All briefings are completed.
Go-around procedure
In the event of an unstable approach, the company procedure detailed that the pilot flying (PF) should apply three initial actions simultaneously;
Advance thrust levers to take‑off/go‑around (TOGA) thrust
Rotate the aircraft to 15° of pitch, if all engines are operating
Announce go‑around to the pilot monitoring (PM).
Subsequent assistance is then provided by the pilot monitoring (PM) to retract one setting on the flaps and the PF announces the flight mode readout. The PM then checks the modes on the flight mode annunciator and announces positive climb. The PF then commands landing gear up, the PM would then select the landing gear up and the rest of the procedure is actioned.
Flight Crew
The Jetstar operations manual required a minimum of two flight crew for the operation of the A320. Additionally, pilots must also meet the minimum experience and qualification requirements outlined in the company SOPs. To ensure that each member of the flight crew can demonstrate sufficient role competency, newly‑appointed captains and FOs operated on a restricted basis, after clearance to line, for a period of six and three months respectively. Jetstar also requires that no more than one pilot may operate under restriction on the flight deck of the A320 at any one time. The captain had just completed his initial command restriction period and all flight crew met the company requirements prior to the flight. Both flight crew were appropriately licenced, qualified and experienced on the aircraft type and held valid Class 1 medicals.
The captain had a total of about 20,000 hours flying experience, of which about 2,600 hours was on A320 aircraft. He had logged over 600 hours and over six months as captain on the A320 prior to the incident. His last flight check was conducted in an A320, on 22 February 2018, and he was familiar with runway 34L as he had been based in Sydney since 2012. He did not have any health issues and advised being well rested prior to the flight.
The FO joined the company in 2011 with significant civil and foreign military flying experience, and had logged over 8,700 flight hours total time, of which over 3,300 hours were on the A320. His last flight check was conducted in an A320 on 9 January 2018 and was familiar with runway 34L as he had been based in Sydney since 2016. The FO reported feeling well rested prior to the flight, and in good health.
Except for the previous sector, both pilots had not flown together in their respective roles on the A320. However, they had flown briefly together about five years prior on the A330 and were aware of each other’s experience and aviation background. In reflecting on the occurrence, the captain reported that his knowledge of the FO’s background created a performance expectation that reduced the cockpit gradient[8] during the flight and delayed his intervention during the occurrence. The FO reported that his relationship with the captain was good.
Safety analysis
Management of the approach
The arrival to DUDOK was comparatively similar to other flights. However, after DUDOK, insufficient descent rate resulted in the aircraft being high on profile. Additionally, the flight crew maintained a selected speed of 250 kt prior to turning onto final, which positioned the aircraft in a high-energy state and led to delays configuring the aircraft. The high speed and profile required an irregular intercept of the glideslope from above, on final approach. It was likely that, at this time, the flight crew’s focus of attention was primarily on configuring the aircraft, reducing its speed and capturing the glideslope. In addition, the flight crew elected to descend manually using the flight directors, increasing their workload as they approached 1,800 ft.
Prior to 1,800 ft, the missed approach altitude of 3,000 ft was selected in the altitude window of the flight control unit (FCU). At this time, the altitude selector was also pulled which initiated a mode change to open climb. This change had the effect of increasing thrust, as the auto-thrust system was still active. This went unnoticed by the crew despite the annunciation and resulted in increasing airspeed.
Without the automated thrust increase the crew may have been able to stabilise the approach in accordance with the operator’s required criteria. However, the undetected thrust further destabilised the approach and subsequently led to the initial flap overspeed. Had the flight crew identified the flight mode annunciator (FMA) change, appropriate and timely action may have prevented the flap overspeed and prompted an earlier go-around.
The go-around
Having assessed that the aircraft was unlikely to meet the stable approach criteria, the captain appropriately initiated the go‑around.
A go-around requires a methodical sequence of many actions by both the pilot flying and the pilot monitoring. During a go-around, the aircraft transitions quickly from descending at relatively low thrust, to climbing at high thrust with a changing configuration. The tempo of the sequence is relatively rapid compared to other normal in-flight manoeuvres.
At the initiation of the go-around, the flight crew did not conduct the sequence in accordance with the required standard operating procedures. This led to the normal go-around flight crew actions being delayed, omitted, and out of sequence. Further, the nature of the two-engine, high-energy go-around is such that there is a rapid acceleration of the aircraft. When the FO did not increase the pitch to the expected nose up attitude, the aircraft accelerated more quickly than the flight crew expected. This limited the time available to complete the required actions of retracting flap and landing gear before exceeding the operational limitations of the aircraft.
As the pilot monitoring, the captain had good opportunity to observe the rapidly accelerating aircraft, and that the FO had not pitched the aircraft as expected. This, combined with the non‑standard flap selection made by the FO, were cues to the captain to formally intervene and reduce the risk of the flap and landing gear overspeed.
Cockpit gradient
The captain reported that he had high regard for the FO’s experience and that influenced the performance he expected from him. Consideration of the FO’s background also influenced the point at which the captain felt it necessary to intervene during the flight. In hindsight, the captain felt that the cockpit gradient contributed to the occurrence by delaying the required intervention.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
While descending through 1,800 ft, the crew inadvertently activated open climb mode with the selection of the assigned altitude selector to 3,000 ft. This resulted in an undetected increase in thrust, which destabilised the approach, and led to the flap overspeed.
The use of a non-standard go-around procedure, including a lower than required pitch attitude, resulted in increased acceleration and exceedance of the flap and gear limitations.
The captain's perception of the first officer's level of experience likely led to a shallow cockpit gradient. This influenced the captain's level of intervention during the approach and go-around.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The operator conducted an internal investigation which highlighted the importance of situational awareness of flight crews and reiterated the operational guidelines in the ‘Airbus ‘Golden Rules for Pilots’, which included rule 3 ‘Understand the FMA at all times’ and included expectations for the crew to monitor, announce, confirm, and understand FMA changes and annunciations.
Safety message
Handling of approach to land is one of the ATSB’s SafetyWatch priorities. Unexpected events during the approach and landing can substantially increase what is often a high workload period. Adherence to standard operating procedures and correctly monitoring the aircraft and approach parameters provides assurance that an independent visual approach can be safely completed. The selection of inappropriate auto-flight modes, unexpected developments, or any confusion about roles or procedures can contribute to decisions and actions that increase the safety risk to the aircraft and its passengers.
A go-around should be immediately carried out if the approach becomes unstable or the landing runway cannot be identified from the minimum descent altitude or missed approach point.
The ATSB SafetyWatch highlights the broad safety concerns that come out of our investigation findings and from the occurrence data reported to us by industry.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 14 May 2018, a Gippsland Aeronautics GA-8 Airvan (Airvan) aircraft, registered VH‑BFL, departed Kununurra, Western Australia (WA) on a scenic charter flight. The pilot and three passengers were on board.
After about one hour and fifteen minutes, the aircraft landed at Bellburn Airstrip (Bellburn), 202 km SSW from Kununurra, and picked up four more passengers. The aircraft departed at about 1600 Western Standard Time[1], to continue the scenic flight. A second company aircraft was utilised to carry the passengers’ baggage.
About 12 minutes after departure, the pilot commenced a planned climb from 2,500 ft to 3,500 ft above mean sea level, during which he felt the aircraft performance was a bit ‘sluggish’. The pilot reported that the climb rate was lower than expected with the aircraft’s speed between 85–100 kt. The pilot also observed the fuel flow was about 55–60 litres per hour (l/hr), which was less than expected for the full rich mixture setting selected.
The pilot reported that he then completed a check of the engine settings and physically confirmed, through touching the controls, that the mixture was full rich, the throttle control was set to 25 inches of manifold pressure, and the propeller lever was set to 2,500 revolutions per minute. The pilot turned the fuel pump on, which made no difference to the aircraft performance. He then notified the company chief pilot, who was flying the other aircraft.
The pilot decided to divert and commenced a turn back to Bellburn maintaining 3,500 ft. The pilot left climb power set and briefed the passengers that they were diverting to Bellburn. The fuel flow had now reduced to about 50–55 l/hr, however, airspeed and height were maintained. The pilot checked if there were any other abnormal indications but all gauges were indicating normally, with both fuel tanks indicating three quarters full and no warning lights illuminated.
During the transit back to Bellburn, the pilot performed some troubleshooting by gently moving the throttle back and forward. There was a noticeable deceleration when the throttle was moved back so the pilot returned it, to its original position for the transit back to Bellburn.
The pilot reported that about 18 km from Bellburn, without further pilot intervention, the power slowly started to decrease. To maintain height, the pilot increased the aircraft’s pitch, resulting in a decrease in airspeed. When the airspeed reached 80 kt, the best glide speed for the aircraft, the pilot commenced a shallow descent, maintaining 80 kt. The pilot reported fuel flow was reading approximately 45 l/hr in the turn. The pilot contacted the chief pilot to advise him of the descent and asked for further assistance. On suggestion from the chief pilot, the pilot moved the mixture control a few millimetres back and then forward again. Immediately the engine started to run very roughly. The fuel flow then dropped to 35 l/hr and the engine started to cough and splutter. The pilot estimated that they lost about 90 per cent of the power that had been available prior to adjusting the mixture setting.
At this point, the pilot determined that a forced landing was required and turned into wind. The pilot maintained 80 kt, and confirmed the fuel pump was on, the mixture control was set to full rich, the ignition was on both magnetos, and the throttle was pushed forward. The pilot advised the passengers that he was performing a forced landing and briefed them on the process for evacuating the aircraft after landing. During the descent, the pilot tried pushing the manual prime button, which produced no increase in engine performance.
The pilot selected a forced landing area and turned towards it. During the descent, at approximately 150 ft above ground level, the pilot secured the engine and turned off the aircraft’s electrical system. During the landing roll, the wings hit some small trees. Towards the end of the landing roll, the aircraft went into a ditch and tore off the nose landing gear.
The chief pilot reported that he notified air traffic control of VH‑BFL’s situation and position as the aircraft landed.
After the aircraft came to rest, the pilot directed the passengers out and away from the wreckage. The pilot checked everyone for injuries and provided assistance where required. The pilot returned to the aircraft, activated the emergency locator transmitter, and contacted the chief pilot in the company aircraft, which was circling overhead.
The pilot visually checked the fuel level in the left wing, and found it was close to full. There was a noticeable fuel leak from the right wing where a small tree had struck the wing, so the pilot turned off the master and avionics switches and went back to wait with the passengers.
After about ten minutes, two helicopters from Bellburn arrived and transferred the passengers and pilot back to Bellburn. The operator then utilised other aircraft in its fleet to ferry the pilot and passengers back to Kununurra where the pilot and three passengers attended the local hospital with minor injuries.
Figure 1: VH-BFL forced landing site
Source: Operator
The operator carried out a visual inspection of the aircraft at the accident site and noted that the number six cylinder air intake pipe was missing from the engine. Due to difficulties accessing the remote site, there was a delay in recovery and further examination of the wreckage by the operator.
The aircraft’s records indicated that a 110 hourly inspection was carried out three weeks prior to the accident. This included an inspection of the induction system and no defects were noted. The last engine overhaul was performed in April 2016, and no scheduled or unscheduled maintenance requiring the removal of the engine’s number six cylinder air intake pipe had been recorded since.
Records obtained from the fuel supplier indicated that checks were performed when the fuel was received, in addition to the subsequent daily inspections and a post-occurrence check following this occurrence. These checks all indicated the fuel was clear, bright, and contaminate-free.
Operator comments
The chief pilot provided the following comments:
When visiting the forced landing site, several days after the event, a search of the forced landing site was performed however, the missing intake pipe was not found (Figures 2 and 3).
The pilot had recently completed the company induction training package, which included several practice forced landings.
The chief engineer provided the following comments:
A ’spanner check’ was carried out immediately after the accident on all Lycoming engines in the operator’s fleet. The same check was also carried out on engines from other manufacturers that had been recently overhauled and fitted. No deficiencies were found.
Engineering staff were reminded to remain vigilant when refitting engine components.
Figure 2: Image of engine with number six cylinder air intake pipe missing
Figure 3: Lower (left image) and upper (right image) air intake pipe attachments points highlighted in red. Air intake pipe, bolts and flange are missing.
Source: Operator
Pilot comment
The pilot provided the following comments:
On the day of the incident, the pilot had flown VH‑BFL from Kununurra to Bellburn and taken off again without any issues.
The aircraft had sufficient fuel for the flight and was within weight and balance limits.
Prior to the flight, the pilot conducted fuel drains on VH-BFL. No water or other contaminants were found in the fuel.
Recent forced landing practice in the Airvan helped the pilot to feel more comfortable with the emergency. In particular, the recent practice gave the pilot a good appreciation for the Airvan’s glide ratio, which helped when selecting a suitable landing site.
Engine manufacturer comment
The engine manufacturer advised that detachment of an induction pipe will cause a loss of power and likely engine flame out. They further stated that:
The fuel injector measures the total induction airflow and meters fuel to the correct mixture ratio. An induction leak reduces the airflow through the injector, so there is less fuel metered, however the actual airflow to the cylinders is increased due to the leak, which results in an overall Lean mixture for all cylinders.
Previous occurrence
A review of the ATSB database identified a similar occurrence, involving the same aircraft type, which occurred on 21 October 2015, AO-2015-123. On that occasion the aircraft experienced a power loss shortly after take‑off however, sufficient power remained to permit a return to the departure airport. Prior to commencing operations that day a pre‑flight inspection of the aircraft had been conducted, with no defects found.
Examination of the aircraft after landing identified that the intake tube on the number four cylinder was loose. Maintenance, involving removal of the intake tube, had been conducted on 10 October 2019, however it was reported that the tube was securely re-fitted and that all other similar securing bolts were also checked. The circumstances that led to the fasteners loosening could not be established.
Safety analysis
During the flight from Kununurra to Bellburn and the subsequent departure from Bellburn, the pilot reported the aircraft was performing normally. From the start of the emergency, there was a gradual degradation in performance until a forced landing was required. The pilot noted that throughout the emergency, the fuel flow was indicating below normal and that all other engine indications were normal.
The reported performance of the aircraft was consistent with the likely symptoms resulting from the air intake pipe to number six engine cylinder becoming lose and then detaching in flight. Consequently, the ATSB concluded that the missing intake pipe was the cause of the loss of power however, consistent with the previous occurrence in 2015, the reason for the air intake pipe coming loose could not be determined.
The pilot made the decision to turn back to Bellburn Airfield early in this emergency and when the situation developed, he quickly recognised the need for a forced landing. By turning into wind and using the best glide speed for the aircraft, the pilot maximised the time available to deal with the emergency and his landing options. In addition, the pilot made good use of the supporting aircraft with the chief pilot on board for troubleshooting advice.
Although it could not be determined as to what extent the pilot’s recent forced landing practice influenced the accident sequence, it is likely that the practice reduced the risk of mishandling the emergency and may have prevented further injury to the occupants of the aircraft.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The air intake pipe to engine cylinder number six probably detached in flight, leading to the loss of engine performance. There was insufficient evidence to determine why the intake pipe detached from the engine.
Recent forced landing practice performed by the pilot as part of the operator’s joining procedures likely reduced the risk of mishandling the emergency and may have prevented more serious injuries being received by the pilot and passengers during the forced landing.
Safety message
This accident highlights the importance of frequent emergency procedures training. The pilot’s handling of the forced landing contributed positively to the survivability of this accident in difficult terrain. Although, as a minimum, flight reviews are required every two years, pilots and operators are reminded of the benefits of more frequent practice of emergency procedures.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
